Health Law Alert: Keeping Ten Years’ Worth of Records on Hand: CMS Proposes 60 Days to Repay Overpayments


The Centers for Medicare and Medicaid (CMS) has released proposed regulations to implement a key Affordable Care Act (ACA) initiative requiring reporting and returning “overpayments.”  Once finalized, the regulations will fill in much of the detail about how providers must disclose and return overpayments within 60 days of the date an overpayment is identified. The proposed rule takes an aggressive interpretation of the ACA mandate, while only touching on the complexities of coding, billing, and other reimbursement requirements. It also creates a 10-year look back period for identifying and repaying overpayments. Without substantial changes, the regulations will impose heavy burdens on providers. Overpayments retained beyond the 60-day period are actionable under the False Claims Act (FCA), and thus may expose providers to significant financial liability as well as exclusion from participating in federal health care programs. Providers are encouraged to review and comment on the proposed rule by April 16, 2012.

The Proposed Rule

Who is affected?
The proposed regulations are limited to Medicare Part A and Part B providers and suppliers (referred to collectively herein as “providers”). Other stakeholders, such as managed care organizations and prescription drug plans, will be addressed at a later date. CMS cautioned, though, that all parties remain subject to the statutory requirements under the ACA (on which the regulation is based) and could face potential liability under the FCA and Civil Monetary Penalties Law, as well as exclusion from federal health care programs, for failure to report and return overpayments. Thus, the existing statutory requirements continue to apply regardless of any delays in finalizing the proposed rule.

What is an “overpayment”?
An overpayment is any Medicare funds a person receives or retains to which, after applicable reconciliation, the person is not entitled. CMS offers a few examples of what this means, including payment for non-covered services, duplicate payments, payments that exceed the allowable amount for a covered service, receipt of Medicare payments when another payer is primary on the claim, and cost reporting errors.

When is an overpayment “identified”?
CMS interprets “identification” of the overpayment to be when a provider “knows” that an overpayment may exist, using the knowledge standard found in the FCA. Thus, identification begins when a person acts with actual knowledge of, in deliberate ignorance of, or with reckless disregard to the overpayment's existence. When a provider receives information about a potential overpayment, a duty arises to investigate the claim. Providers are expected to make a “reasonable” inquiry into whether an overpayment exists. This inquiry needs to occur with “all deliberate speed.” If during the discovery process an overpayment is found, the repayment process is triggered.

CMS offers several examples of when an overpayment has been “identified.”  For instance, an overpayment has been identified when a review of billing or payment records discloses incorrect coding. CMS also notes that an overpayment is identified where a provider “experiences a significant increase in Medicare revenue and there is no apparent reason for the increase,” but nonetheless fails to make a reasonable inquiry. This is because a provider who experiences a large revenue increase, but fails to explore why, may be found to have acted in reckless disregard or with deliberate ignorance. Likewise, a provider who receives an anonymous tip on a compliance hotline about a potential overpayment, but fails to timely investigate the matter, could be found to have acted with reckless disregard or deliberate ignorance.

When does the 60-day clock start?
The 60-day reporting and repayment period begins on the date an overpayment is identified. CMS conditions the start of the 60 days on provider identification in order to place the onus on the provider and incentivize the proactive identification of potential overpayments by self-auditing and robust compliance efforts. It seems unlikely that 60 days will always be a sufficient period of time for a provider to identify an overpayment. CMS appeared to recognize the complexity of uncovering a potential overpayment by allowing the provider flexibility during the “reasonable inquiry” phase to determine the validity of an overpayment claim. However, little concrete guidance is offered in terms of when an inquiry would be determined to meet the reasonableness standard.

Reporting Overpayments
To report overpayments, CMS will use the existing voluntary refund process defined in the Medicare Financial Management Manual. Providers will need to identify a range of information about the overpayment including how the error was discovered, a description of the corrective action, the timeframe and the total amount of refund, and the method used to determine the overpayment. Additionally, reporting and repayment would be required for all overpayments identified within ten years of receipt. Until uniform reporting forms are available, CMS wants providers to use the forms available on their Medicare Contractor’s website.

Anti-Kickback Statute and Stark Law Self-Disclosures

CMS recognizes that overpayments may arise from violations of the Anti-Kickback Statute that are not apparent to the provider submitting the claim. CMS gives the example of a hospital that bills for services, unaware that a device manufacturer has paid kickbacks to a physician on the medical staff to induce that physician to implant the manufacturer’s device at the hospital. CMS states that in instances where providers are not a party to an illegal kickback arrangement, they are unlikely to have “identified” an overpayment and no resulting obligations will follow. However, the duty does arise if the provider possesses sufficient knowledge of the Anti-Kickback arrangement that would trigger one of the “knowledge” standards noted above.

For overpayments that are the subject of a disclosure through the CMS Self-Referral Disclosure Protocol, the 60-day deadline for returning overpayments related to physician self-referrals would be suspended. The proposed rule clarifies that a self-disclosure under the SRDP only suspends the 60-day deadline for repayment and does not affect the provider’s obligation to report the overpayment through the self-reported overpayment refund process.

Prepare for the Final Rule

The proposed rule is yet another powerful weapon in CMS’ arsenal of fraud fighting tools. Given the scope of penalties available for not reporting overpayments within the short time frame allowed, providers should evaluate their ability to identify, understand, report, and return overpayments within the 60-day period. Providers are strongly encouraged to submit comments to CMS so that the agency understands the impact the proposed rule may have on provider operations.

If you have questions about the proposed regulations, please contact Jesse Berg at or 612.632.3374.

Don’t forget to register for Gray Plant Mooty’s upcoming Health Law Roundtable, "Crisis Management for the Health Care Provider: Successfully Navigating the Law and Public Relations," to be held this Thursday, March 8, at 7:30 a.m. RSVP by email to or by phone to 612.632.3170.


This article is provided for general informational purposes only and should not be construed as legal advice or legal opinion on any specific facts or circumstances. You are urged to consult a lawyer concerning any specific legal questions you may have.