Section 6402(a) of the Affordable Care Act (“ACA”), which was enacted by Congress in 2010, requires a person who has received an overpayment to report and return the overpayment to the Secretary of Health and Human Services, the state, an intermediary, a carrier, or a contractor, as appropriate, by the later of (i) 60 days after the date on which the overpayment was identified or (ii) the date on which any corresponding cost report is due (if applicable).^[1]

In February 2012, two years after the ACA was enacted, the Centers for Medicare & Medicaid Services (“CMS”) issued a proposed rule, which was subject to significant public comment (“Proposed Rule”).^[2] On February 12, 2016, four years from the issuance of the Proposed Rule (i.e., six years after enactment of the ACA), CMS issued the final rule, which becomes effective on March 14, 2016 (“A and B Final Rule”).^[3]

The A and B Final Rule applies only to providers and suppliers under Medicare Parts A and B. The return of overpayments under Medicare Parts C and D are addressed in a final rule that was published by CMS in May 2014 (“C and D Final Rule”).^[4] To date, no final regulations have been adopted that address Medicaid requirements.

The A and B Final Rule contains notable differences from the Proposed Rule, including a shortened lookback period (from 10 to six years) and a different, somewhat relaxed standard for identification of overpayments that trigger reporting and repayment provisions.

This post addresses a number of the significant provisions of the A and B Final Rule, describes an important difference between the two final rules, and sets forth a list of nine key “takeaways” that we believe all Medicare providers and suppliers should be aware of.

Lookback Period Shortened to Six Years

One of the significant issues that the public commented on in the Proposed Rule was CMS’s proposal that the lookback period be 10 years. In the A and B Final Rule, CMS pulls back from its original proposal stating that overpayments must be reported and returned only if a person identifies the overpayment within six years of the date that the overpayment was received. Further, CMS notes that it is amending the reopening rules to accommodate the six-year lookback period for reporting and returning overpayments.

Interestingly, in the A and B Final Rule, CMS specifically discusses the reporting of overpayments through CMS’s Voluntary Self-Referral Disclosure Protocol (“SRDP”) as a result of potential self-referral violations. Currently, providers and suppliers reporting overpayments through the SRDP must provide a financial analysis of overpayments that occurred during a four-year lookback period. Although providers and suppliers reporting overpayments through the SRDP on or after March 14, 2016 (the effective date of the A and B Final Rule), are subject to a six-year lookback period, CMS acknowledges that it is only authorized to collect financial analysis of overpayments that occurred during the four-year lookback period. As such, it is seeking authorization from the Office of Management and Budget (“OMB”) to collect financial information regarding overpayments using a six-year lookback period. The A and B Final Rule states that “[u]ntil the revised collection is approved by OMB, providers and suppliers reporting overpayments to CMS in accordance with the SRDP have no duty to provide financial information from the fifth and sixth years, that is, the 2 years outside of the currently authorized 4-year lookback period.”^[5] CMS concludes that providers and suppliers may voluntarily provide financial information for the fifth and sixth years or may return overpayments for the fifth and sixth years through other means.

“Identified” Means Exercising Reasonable Diligence

The Proposed Rule had provided that “a person has identified an overpayment if the person has actual knowledge of the existence of an overpayment or acts in reckless disregard or deliberate ignorance of the overpayment.” In the A and B Final Rule, CMS instead imposes a reasonable diligence standard and provides much-needed clarity regarding the actions that providers and suppliers must take when an overpayment has been “identified.” In particular, the A and B Final Rule clarifies that “a person has identified an overpayment when the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” While the A and B Final Rule itself does not use the phrase “credible evidence,” this phrase is used throughout the preamble and reflects that reasonable diligence is demonstrated through the timely, good faith investigation of credible information. CMS sets forth that the time period should be at most six months from the receipt of the credible information, except in extraordinary circumstances. “Extraordinary circumstances” may include unusually complex investigations (e.g., physician self-referral law violations that are referred to the SRDP), natural disasters, or a state of emergency.

Notably, CMS’s inclusion in the A and B Final Rule of the six-month time period to conduct an investigation strays from the Proposed Rule’s ambiguous language regarding conducting an investigation with “all deliberate speed.” Instead, the A and B Final Rule provides that a total of eight months (six months for timely investigation and two months (60 days) for reporting and returning the overpayment) is considered the outside time period for reporting and returning an overpayment absent extraordinary circumstances.

Addition of Quantification to Standard for Identification

It is important to note that the 60-day time frame begins not only from when the overpayment is identified but also after the potential overpayment has been “quantified.” In the A and B Final Rule, CMS specifically recognized that statistical sampling and extrapolation are appropriate components of a provider’s reasonable diligence in investigating an overpayment and can serve as an appropriate way to calculate an overpayment amount, stating that “[p]art of conducting reasonable diligence is conducting an appropriate audit to determine if an overpayment exists and to quantify it.”^[6]

In the A and B Final Rule, CMS specifically declined to adopt a minimum monetary threshold for overpayment refunds. CMS stated that adopting a regulatory “de minimis” standard would be susceptible to abuse, especially in the context of claims-based overpayments. CMS noted particular de minimis examples from commenters, including certain de minimis monetary thresholds related to contractor recovery, incidental medical staff benefits, Medicare Secondary Payer liability recovery, beneficiary inducements, and the 5 percent threshold set forth in corporate integrity agreements. But CMS elected not to create a de minimis threshold, stating these “examples are detailed in subregulatory guidance, program instructions, or a negotiated contract with [the U.S. Department of Health and Human Services’ Office of Inspector General (“OIG”)] that is applicable only to a specific party.”

The inclusion of “quantified” is a significant improvement from the Proposed Rule, which suggested imposing no such requirement. Notably, on August 3, 2015, in United States ex rel. Kane v. Health First, Inc., the U.S. District Court for the Southern District of New York, in issuing the only reported opinion on the False Claims Act’s reversed false claim overpayment provision, determined that the 60-day clock for repaying “identified” overpayments began ticking “when a provider is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained.”^[7] That ruling, which was perceived as a significant victory by government enforcers and qui tam relators, has been tempered by the provision in the A and B Final Rule that quantification be part of “identification.”

Tolling the 60-Day Rule

The A and B Final Rule will allow providers and suppliers reporting overpayments through CMS’s SRDP and the OIG Self-Disclosure Protocol (“SDP”) on or after the March 14, 2016, effective date to toll the 60-day deadline for returning overpayments. The deadline will be tolled while the provider or supplier is negotiating a potential settlement under these protocols. CMS declined, however, to extend this treatment to self-disclosing entities outside the SRDP and SDP. CMS specifically mentions the Department of Justice (“DOJ”), noting that CMS is not aware of any analogous self-disclosure process managed by DOJ and thus eligible for the tolling treatment afforded to entities within the SRDP and SDP.

CMS also addressed the question of tolling related to the submission of cost reports. For cost-reporting purposes, providers and suppliers may receive estimated payments for services during the year, but actual costs will be determined at the time that the cost report is due. Cost reports must be filed within five months of the end of the provider’s fiscal year. Both the statutory and regulatory definitions of “overpayment” consider this process and define “overpayment” as funds that a person improperly receives or retains only after “applicable reconciliation” has taken place. Commenters indicated that the statute recognizes the deadline for submission of the initial cost report as tolling the 60-day time period such that applicable reconciliation should mean a process that occurs subsequent to the submission of the initial cost report, while CMS’s discussion of the applicable reconciliation period seemed to suggest that providers and suppliers will be expected to have identified overpayments at the time that the initial or amended cost report is submitted and not after that time. In response, CMS clarifies that the A and B Final Rule will adopt the definition of “applicable reconciliation” as proposed, where “applicable reconciliation” means a provider’s year-end reconciliation of payments and costs to create the cost report. Practically, this will require providers to return overpayments at the time that the cost report is filed, and submission of the cost report will not toll the 60-day time period.

Significance of the Effective Date—March 14, 2016

CMS addressed a number of comments related to the effective date of the A and B Final Rule. Specifically, CMS clarified that Section 1128J(d) of the Social Security Act is not retroactive, meaning that failure to comply with the statutory requirements prior to March 23, 2010, when it was enacted, is not a violation of the statutory provision. Beginning on that date, however, providers and suppliers that had not already returned a particular overpayment were required to report and return the overpayment, even if the overpayment was received prior to March 23, 2010.

As with the statutory provision, the A and B Final Rule is not retroactive, but beginning on March 14, 2016, providers and suppliers are required to comply with the regulatory overpayment requirements. This obligation will extend to overpayments received before that date, even though the obligation to report and return such overpayments under this rule will not be effective until March 14, 2016. CMS notes that providers and suppliers that attempted to comply with the statutory overpayment requirements in the absence of regulatory interpretation “may rely on their good faith and reasonable interpretation” of the statute.

Important Difference Between the Two Final Rules

CMS has imposed different standards regarding when an overpayment is identified for Medicare Parts A and B as opposed to Medicare Advantage (“MA”) plans and Part D sponsors, by leaving out the “quantified” language in the C and D Final Rule. As stated above, the C and D Final Rule specifies that an overpayment has been “identified” (and, thus, the 60-day clock begins) when the plan has determined or should have determined through the exercise of “reasonable diligence” that the plan received an overpayment. In fact, in the C and D Final Rule, CMS stated that for MA plans and Part D sponsors, “[a]n organization can identify or assess that there is a problem with data submitted to CMS, and determine that it is incorrect data, prior to actually calculating what the payment impact is of that erroneous data. For MA and Part D programs, the relevant factor is identifying that the data is incorrect and will result in an overpayment.”^[8]

Although the A and B Final Rule is applicable only to Medicare Part A and B, it is reflective of the government’s current thinking with respect to overpayments and may be suggested by others to constitute evidence of what a reasonable person should undertake with respect to overpayments.

Key Takeaways

1. Providers and suppliers must have both a proactive compliance program to monitor the receipt of overpayments and a process to investigate potential overpayments in a timely manner. In contrast, providers and suppliers that conduct no or insufficient activities to monitor the accuracy and appropriateness of their Medicare claims will be exposed to potential liability for failure to exercise reasonable diligence.

2. Providers should prioritize overpayment investigations; completing such investigations will require the devotion of resources and time. CMS declined to provide specific guidance on resource levels or other specific measures to ensure compliance with the A and B Final Rule.

3. Providers and suppliers should maintain records that accurately and fully document their investigation efforts to demonstrate that they acted in a diligent and timely manner. At a minimum, these records should set out what steps were taken to determine whether an overpayment existed, including all audits conducted, who was involved in the determination, the outcome of the determination, and any follow-up or corrective actions taken as a result.

4. Providers and suppliers should be able to demonstrate that they have devoted appropriate attention, time, and resources—including both internal and external resources, when appropriate—to resolving whether an overpayment exists. This includes demonstrating that any proactive and investigative overpayment determination activities should be conducted by “qualified individuals.” Although what constitutes a “qualified individual” is not defined in the A and B Final Rule, such individuals will likely include compliance personnel, auditors (internal and external when warranted), billing personnel, coding personnel, and internal or external legal counsel in certain circumstances. Other individuals may also be necessary depending on the facts and circumstances giving rise to why an overpayment may exist.

5. Providers and suppliers should retain their refund documentation in the event that a Medicare contractor or other Medicare authority conducts an audit of such claims at a later time. While CMS stated that it would not recover an overpayment twice, refunded claims are not exempt from subsequent audit. Thus, the burden is on providers and suppliers to prove that the claims were previously refunded in subsequent audit activities.

6. Even if a provider or supplier identifies only a single overpaid claim, CMS sets forth that it is appropriate to inquire further to determine whether there are more overpayments on the same issue. This creates a significant burden on providers and suppliers to conduct reasonable diligence and follow-up audits even in the absence of evidence of widespread reach to confirm that a single identified overpayment is not indicative of a systemic problem.

7. The A and B Final Rule eliminated the specific list of data elements that were required to accompany the overpayment refund under the Proposed Rule and recognized that information related to how the overpayment was discovered and corrective action plans may not be necessary in all overpayment situations. CMS noted, however, that where an overpayment amount is extrapolated based on a statistical sampling methodology, it is necessary for the overpayment report to explain how the overpayment amount was calculated.

8. The A and B Final Rule allows for additional refund processes beyond the voluntary refund process. Providers and suppliers may use a claims adjustment, credit balance, or self-reported refund process, or another appropriate process, to report and return overpayments. Providers and suppliers can either submit a check when reporting the overpayment or request a voluntary offset from the contractor.

9. We expect litigation with regard to the term “reasonable diligence.” Indeed, providers and suppliers should anticipate that in the context of False Claims Act cases, both the government and relator’s counsel will promote a broad definition of this term. Moreover, providers and suppliers can expect to face challenges when they argue that there are “extraordinary circumstances” justifying additional time to determine whether an overpayment exists, and they should be prepared to challenge vigorously, where appropriate, any effort made to limit their own investigations to six months simply because that time frame was identified in the preamble to the A and B Final Rule.

_{[1] Section 6402(a) of the ACA and codified at Section 1128J(d) of the Social Security Act.}

_{[2] 77 Fed. Reg. 9179 (Feb. 16, 2012).}

_{[3] 81 Fed. Reg. 7654 (Feb. 12, 2016), available at https://www.gpo.gov/fdsys/pkg/FR-2016-02-12/pdf/2016-02789.pdf.}

_{[4] 79 Fed. Reg. 29844 (May 23, 2014).}

_{[5] 81 Fed. Reg. 7673.}

_{[6] 81 Fed. Reg. at 7663.}

_{[7] No. 1:11-cv-02325 (S.D.N.Y. Aug. 3, 2015).}

_{[8] 81 Fed. Reg. at 7673.}