CMS Issues Proposed Rule Implementing Requirements for Healthcare Providers and Suppliers to Report and Return Medicare Overpayments

02.17.2012

Updates

On February 16, 2012, the Centers for Medicare & Medicaid Services (“CMS”) published its long-awaited Proposed Rule implementing Section 6402(a) of the Patient Protection and Affordable Care Act (“ACA”). 77 Fed. Reg. 9179 (Feb. 16, 2012), available at http://www.gpo.gov/fdsys/pkg/FR-2012-02-16/pdf/2012-3642.pdf. This Section of the ACA, entitled “Reporting and Returning of Overpayments,” requires health care providers and suppliers[1] to report and return Medicare and Medicaid overpayments no later than 60 days after the overpayment was “identified,” or the date any corresponding cost report is due, as applicable. See 42 U.S.C. § 1320a-7k(d). Providers and suppliers who fail to comply with these requirements risk liability under the federal False Claims Act,[2] administrative penalties under the Civil Monetary Penalties Law, and exclusion from Federal health program participation.[3]

Comments on the Proposed Rule must be submitted to CMS and received no later than 5 p.m. on April 16, 2012.

What is an “overpayment”?

Under the ACA, an overpayment exists when a person receives or retains Medicare or Medicaid funds to which the person is not entitled. The Proposed Rule provides the following non-exhaustive list of potential “overpayments”:

Medicare payments for noncovered services.
Medicare payments in excess of the allowable amount for an identified covered service.
Errors and nonreimbursable expenditures in cost reports.
Duplicate payments.
Receipt of Medicare payment when another payor was primary.

When is an overpayment “identified”?

Of particular significance is CMS’s proposal that an overpayment is “identified” if a person has “actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the existence of the overpayment.” In other words, CMS proposes that under some circumstances, an overpayment is “identified” even when the person does not actually know of it. CMS justifies its expansive definition as follows:

We believe defining ‘identification’ in this way gives providers and suppliers an incentive to exercise reasonable diligence to determine whether an overpayment exists. Without such a definition, some providers and suppliers might avoid performing activities to determine whether an overpayment exists, such as self-audits, compliance checks, and other additional research.

CMS leaves unanswered what factors might trigger an obligation to conduct internal audits, “compliance checks” and unspecified “additional research” in order to avoid the specter of recklessness in failing to discover an overpayment.

The Proposed Rule provides the following non-exhaustive examples of when an overpayment is “identified”:

A provider or supplier reviews billing or payment records and learns that it incorrectly coded certain services, resulting in increased reimbursement.
A provider or supplier learns that a patient death occurred prior to the service date on a claim that has been submitted for payment.
A provider or supplier learns that services were provided by an unlicensed or excluded individual on its behalf.
A provider or supplier performs an internal audit and discovers that overpayments exist.
A government agency informs a provider or supplier of an audit that discovered a potential overpayment, and the provider or supplier fails to make a reasonable inquiry. CMS goes on to note that “failure to conduct such inquiry with all deliberate speed after obtaining the information, could result in the provider or supplier knowingly retaining an overpayment because it acted in reckless disregard or deliberate ignorance of whether it received such an overpayment.”
A provider or supplier experiences a significant increase in Medicare revenue and there is no apparent reason for the increase, and the provider or supplier fails to make a reasonable inquiry into whether an overpayment exists.

The obvious and troubling import of these examples is that CMS is attempting to convert a statutory repayment obligation into a much broader auditing and monitoring obligation. We expect health care providers and suppliers to challenge this significant expansion of the law during the notice-and-comment period.

When does the 60-day period begin to run?

The Proposed Rule clarifies that if an overpayment is claims-related (e.g., involves issues such as upcoding or duplicate billing), it must be reported and returned within 60 days of identification. For overpayments that would generally be reconciled on a cost report (e.g., overpayments related to graduate medical education payments), a provider may report and return the overpayment within 60 days of identification or on the date the cost report is due, whichever is later.

While CMS clarifies that the 60-day clock begins to run “on the date on which the person has identified the overpayment,” it does not clearly address when “identification” occurs in the case of suspected, but unconfirmed, overpayments. For example, if a provider receives an “anonymous compliance hotline telephone complaint about a potential overpayment,” CMS notes that the provider or supplier “has an obligation to timely investigate the matter.” The 60-day requirement will be satisfied “[i]f the provider diligently conducts the investigation and reports and returns any resulting overpayment within the 60-day reporting and repayment period.”

CMS leaves unanswered whether a provider must conduct and complete its investigation and make a report and refund within 60 days in order to comply with the law, or whether the 60-day period is tolled during the investigation until such time as an overpayment is confirmed. While the latter reading appears to be the more reasonable view (and comports with the plain meaning of the term “identified”), the Proposed Rule could be clearer on this point. We are aware of situations where government auditors have taken the position that a provider must conduct an internal review and analysis of claims and report and refund all billing errors within 60 days of the government’s request, regardless of whether the government auditor identified specific billing mistakes or overpayments. Providers may want to request more clarity from CMS on this issue so they do not find themselves pressured to conduct hasty audits in order to beat the 60-day clock.

What is the report and return process?

CMS proposes to use the existing voluntary refund process (renamed the “self-reported overpayment refund process”), which requires providers and suppliers to report overpayments using a form that each individual Medicare contractor makes available on its public website. CMS plans to develop a uniform reporting form in the future. CMS also provides examples of what a person may report as the reason for an overpayment (e.g., incorrect service date, duplicate payment, incorrect CPT code), and warns that contractors will scrutinize those overpayments and make referrals to the Office of the Inspector General (“OIG”) whenever circumstances warrant such a referral. The Proposed Rule does not address what reporting process a provider or supplier should use for Medicaid or Tricare overpayments, or whether a provider or supplier can comply with the statutory repayment obligation through electronic billing adjustments made in the ordinary course. As drafted, the Proposed Rule contemplates that providers and suppliers complete a detailed contractor-specific overpayment refund process form each and every time it corrects a paid claim.

The Proposed Rule also requires duplicative reports of overpayments where providers have self-disclosed conduct through the Medicare Self-Referral Disclosure Protocol (“SRDP”), which is used to report known or probable violations of the federal Stark Law. CMS clarified that when CMS acknowledges receipt of a SRDP report, the SRDP suspends the running of the 60-day deadline to return the physician self-referral related overpayment, but the provider is not relieved of its obligation to report the overpayment to its Medicare contractor using the self-reported overpayment refund process. CMS is soliciting comments, however, on “alternative approaches that would allow providers and suppliers to avoid making multiple reports of identified overpayments.” CMS proposes that a voluntary self-disclosure through the OIG’s Self-Disclosure Protocol (“SDP”) (where providers self-disclose instances of potential fraud) will suspend refund obligations under the ACA as well as reporting obligations, provided that the SDP report is made within the 60-day period mandated by the ACA.

Where a provider or supplier is unable to repay an identified overpayment in the 60-day time period because of the magnitude of that overpayment, CMS proposes that the provider or supplier use the existing Extended Repayment Schedule process. This process requires providers and suppliers to submit significant documentation demonstrating that repayment would create a true financial hardship.

How long is the lookback period?

CMS proposes an extremely long, ten-year lookback period for the report and return requirement, based on the outer limit of the False Claims Act statute of limitations. CMS does not address how the lookback period applies in the case of suspected overpayments. For example, if a provider identifies an issue with a number of claims paid in 2009, must the provider perform a ten-year retrospective audit to be considered to have conducted a “reasonable inquiry” into the existence of additional overpayments? The length of the proposed lookback period further highlights the troubling implications of CMS’s attempt to convert a statutory repayment obligation into a much broader and infinitely more burdensome audit obligation.

[1] The Proposed Rule is limited to providers and suppliers of services under Medicare Parts A and B. CMS indicated that it would address other stakeholders (e.g., Medicare and Medicaid managed care organizations and prescription drug plans) at a later date.

[2] Section 1128J(d) of the ACA provides that any overpayment retained by a person after the deadline for reporting and returning the overpayment is an “obligation” for purposes of the False Claims Act, 31 U.S.C. § 3729. Any person who “knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money or property to the Government” may be found liable under the False Claims Act. Penalties include treble damages and significant per-claim penalties ($5,500 – $11,000 per claim).

[3] Section 1128A of the ACA provides that any person who “knows of an overpayment . . . and does not report and return the overpayment” as required by the ACA may be found liable under the Civil Monetary Penalties Law and accordingly could be excluded from participation in Federal health care programs.