Health Law Alert: CMS Finalizes 60-Day Overpayment Rule
On February 12, the Centers for Medicare and Medicaid Services (CMS) published its long-awaited final rule detailing healthcare providers’ obligations under the Affordable Care Act’s (ACA) 60-Day Overpayment Rule. This rule requires Medicare providers and suppliers who identify overpayments to report and return them within 60 days. The new regulations apply only to Parts A and B of the Medicare program; regulations issued in 2014 address Parts C and D overpayments. Notably, while the ACA provision on overpayments applies to the Medicaid program, there have been no regulations issued to date governing the return of overpayments to Medicaid. Organizations that fail to return overpayments face potentially significant liability under the False Claims Act (FCA), making familiarity with the new rule particularly important. The full text of the Final Rule, which takes effect March 14, 2016, can be found here.
History of the Overpayment Rule: A Tortured Odyssey
There have long been provisions scattered throughout the various laws governing the Medicare program that obligate health care providers to return payments to which they are not entitled. For example, the same portion of the Social Security Act in which the federal Anti-kickback Statute is found includes a prohibition that appears to criminalize the retention of overpayments in some circumstances. The Stark Law requires parties to return reimbursement for claims billed in violation of that law. However, these and other provisions were spread about numerous Medicare and Medicaid laws, regulations, and program manuals and were hardly a model of clarity for providers.
The ACA raised the stakes for compliance by creating a new statutory obligation to report and return overpayments within 60 days of identification, as well as treating the failure to do so as an “obligation” actionable under the FCA. Long before the ACA, though, CMS attempted to implement regulations governing the process for reporting and returning overpayments, publishing regulations in 1998 and 2002. However, the earlier rules were not finalized due to objections from the provider community and what appeared to be recognition on the part of the agency that the regulations were too unworkable to be implemented.
In February 2012, CMS proposed a new set of regulations to implement the ACA statutory directive. The agency reportedly received comments from over 200 submitters and ended up issuing a one-year delay in issuing final regulations, presumably due to the complexity of the issue. The product of nearly six years of back-and-forth by CMS and healthcare providers, the Final Rule clarifies several open questions raised by the bare language of the 60-day rule, which requires providers and suppliers receiving funds under Medicare to report and return overpayments by the later of (1) 60 days after the date on which the overpayment was identified, or (2) the date any corresponding cost report (if any) is due. Most notably, provider concern has centered on what it means to have “identified” an overpayment, what standard of diligence is required in pursuing and quantifying overpayments, and how far back in time providers must “look back” as part of their investigations.
Overview of New Regulations: When is an Overpayment Identified?
Under the new Rule, an overpayment is considered to have been “identified” when a provider or supplier “has, or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” This “reasonable diligence” standard is a major improvement from that found in the proposed regulation, which declared an overpayment to be identified when a person either had actual knowledge of the overpayment, or acted in reckless disregard or deliberate ignorance of the overpayment. In making the change, CMS agreed with several commentators who had pointed out that “part of identification is quantifying the amount.” Accordingly, under the new standard, so long as providers diligently investigate and quantify any overpayments, the 60-day clock will not be triggered until those investigations have concluded. This acknowledgement by CMS that the amount needs to be “quantified” as a requisite to an overpayment having been identified is a significant improvement from the proposed rule.
Nonetheless, while the definition of “identified” promulgated by CMS eases some of the concerns of providers and suppliers, the new Rule makes clear that a “reasonably diligent” investigation cannot drag on indefinitely. Absent “extraordinary circumstances” such as “unusually complex investigations,” CMS expects timely investigation of overpayments to take no longer than six months from receipt of credible information. The agency gives a few examples of situations where “extraordinary circumstances” could be present, including Stark Law violations that are self-reported under the Self-Referral Disclosure Protocol as well as “natural disasters or a state of emergency.” Clearly, any organization relying on the extraordinary circumstances option to delay the return of an overpayment should document in detail the specifics of the circumstances that resulted in the delay.
This is a concrete change from the proposed rule, which had merely indicated that investigations should be conducted with “all deliberate speed.” The result is that suppliers and providers will generally have eight months from start to finish in which to meet their obligation to investigate and return any overpayments found (six months for investigation and two months for reporting and returning).
The Importance of Maintaining Robust Compliance Programs
In addition, CMS sent a shot across the bow of organizations that do not have strong compliance programs in place, noting that the agency believes “undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of a provider or supplier’s Medicare claims would expose a provider or supplier to liability under the identified standard … based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment.” The agency pointed out that it interprets “reasonable diligence” to include both responding to the need for an investigation as it arises, as well as “proactive compliance activities conducted in good faith and in a timely manner” by qualified compliance personnel. Comments like these, together with the ACA’s directive that all providers/suppliers ultimately have compliance plans in place, make it clear that organizations that do not take a proactive approach to compliance do so at their great risk.
A Shortened Look Back Period
Finally, CMS responded to concerns raised by several commentators by reducing the “lookback” period from ten years, as originally proposed in 2012, to only six in the Final Rule. In its commentary to the rule, CMS acknowledged that requiring a ten-year lookback was unduly burdensome and that six years more properly aligned with the typical limitations period under the FCA. Accordingly, providers are only required to report and return overpayments identified within six years of when they were received. Perhaps as an incentive to encourage voluntary review, CMS further noted that overpayments reported before March 14, 2016, when the Final Rule takes effect, will only be subject to the four-year lookback window previously provided for in informal guidance.
Other Developments
The Final Rule includes many other important pieces of guidance:
- Providers/suppliers can continue to use existing processes (in place with their Medicare Administrative Contractor), such as claims adjustment, credit balance, self-reported refund process, or another appropriate process to report and return overpayments.
- Additional guidance on who qualifies as a “credible source” of information about overpayments.
- Explanation on overpayment obligations for entities filing cost reports.
- The use of statistical sampling and extrapolation to calculate overpayments.
- CMS refused to say providers/suppliers could offset identified underpayments against identified overpayments when determining the repayment amount.
Next Steps
With the Final Rule set to take effect in less than one month, providers should pause now to consider what procedures they have in place to identify and repay Medicare overpayments before incurring liability under the FCA. Prompt evaluation of credible information regarding an overpayment, careful documentation of any resulting inquiry, and diligent follow-up are essential to prevent potentially stiff consequences. It may also make sense to review compliance plans to determine whether the type of “proactive” monitoring by qualified personnel outlined in the Final Rule is present.
If you have any questions about the 60-Day Overpayment Rule or the new CMS regulation, please contact Jesse Berg at jesse.berg@lathropgpm.com (612.632.3374) or Catie Bitzan Amundsen at catherine.bitzan@lathropgpm.com (612.632.3277).