On February 12, 2016, the Department of Health and Human Services, Centers for Medicare and Medicaid Services (“CMS”) promulgated the final rule on the requirement that providers and suppliers receiving funds under the Medicare program report and return overpayments by the later of sixty (60) days after the date on which the overpayment was identified or the date any corresponding cost report is due, if applicable. The report and return provisions in this final rule apply only to Medicare Part A and Part B providers and suppliers. CMS will address Medicare Part C managed care plans, Medicare Part D plan sponsors, and Medicaid under separate rule making. Even so, CMS pointed out that the Affordable Care Act (the “Act”), Section 1129J(d) already requires providers and suppliers who identify overpayments received from Medicare and/or Medicaid to report and return those overpayments to the appropriate payor. The failure to report and return an overpayment can give rise to False Claims Act liability.
CMS’s examples of overpayments include Medicare payments for non-covered services, payments in excess of the allowable amount for the services, errors and non-reimbursable expenditures in costs reports, duplicate payments, and payments made when another payor had the primary responsibility for the payment. The overpayments must be reported and returned, regardless of whether there was human or system error, fraudulent behavior, or any other reason for the overpayment. CMS clarified that in circumstances where the amount paid exceeds the appropriate payment amount to which the provider or supplier is entitled, only the difference between the amount paid and the appropriate payment amount must be returned. However, where payment is made for an item or service that is not payable (e.g., claims resulting from violations of the Anti-Kickback Statute, Stark laws or claims generated for items or services provided by an excluded person or where payment is secured through fraud), the overpayment would be the entire amount paid. CMS would not adopt a minimum monetary threshold for reporting and returning overpayments. Any overpayment, no matter how small, must be reported and returned. However, CMS stated it was considering adopting a minimum threshold amount for cost-report related overpayments.
In response to questions about underpayments of claims that providers and suppliers may uncover through their monitoring for overpayment, CMS said this final rule did not address underpayments and refused to adopt suggestions that the look back period for re-billing underpaid claims be modified to match the look back period for reporting and returning overpayments.
The final rule provides that a person has identified an overpayment when the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and has quantified the amount of the overpayment. CMS stated that reasonable diligence includes both proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments and reactive compliance through investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment. Credible information of a potential overpayment is a factual determination. Illustrative examples that would prompt a provider or supplier of the need to exercise reasonable diligence to investigate whether there has been an overpayment include: 1) compliance hotline complaints about overpayments (even if anonymous if the information is credible); 2) incorrectly coding services resulting in increased reimbursement; 3) claims submitted for payment where a patient death occurred after the service date; 4) services provided by an unlicensed or excluded individual; 5) internal audit by provider or supplier that reveals overpayments exist; 6) a provider or supplier experiences a significant increase in Medicare revenue with no apparent reason; and 7) a provider or supplier is notified by a government agency that an audit revealed a potential overpayment.
CMS also encouraged providers and suppliers to review additional resources, such as the OIG’s annual work plan and CMS notices to structure their proactive compliance monitoring activities and retroactive reviews. CMS would not provide compliance guidance to small providers and suppliers regarding resources or measures to ensure compliance with the rule but referred to the Medicare Learning Network and OIG compliance materials.
Providers and suppliers who fail to investigate whether an overpayment occurred when there is a duty to make a reasonable inquiry, including the failure to conduct such inquiry with all deliberate speed after obtaining the information, could result in the provider or supplier knowingly retaining an overpayment because it acted in deliberate ignorance or careless disregard of whether it received the overpayment. The final rule makes it clear that the 60 days to report and return the overpayment begins to run when the reasonable diligence inquiry is completed or on the day the person received the credible information of a potential overpayment but failed to conduct reasonable diligence to investigate and, in fact, received an overpayment (as receipt and retention of an actual overpayment is required). Identification of an overpayment includes quantifying the amount of the overpayment.
The final rule significantly shortened the ten-year look back period in the proposed rule. The final rule now provides that overpayments must be reported and returned only if a person identifies the overpayment within six (6) years of the date the overpayment was received.
CMS clarified that where the contractor identifies a payment error by the contractor and notifies the provider or supplier that it will adjust the claims to correct the error, there is no need for the provider or supplier to report and return the overpayment separately. Providers and suppliers will be able to use an applicable claims adjustment, credit balance, self-reported refund, or another appropriate process to return the overpayment. Providers would be able to request a voluntary offset from the contractor to return the overpayment or may submit a check in payment. CMS acknowledged the variances in reporting of overpayments currently required by contractors and stated it planned to develop a uniform reporting form that would enable all payments to be reported and returned in a consistent manner across all Medicare contractors.
Providers and suppliers may also use the OIG Self-Disclosure Protocol or the CMS Self-Referral Disclosure Protocol to report and return overpayments. Using either protocol would satisfy the duty to report the overpayment and would suspend the repayment deadline. The sixty-day time period is suspended on the date CMS or OIG acknowledges receiving the protocol submission and remains suspended until a settlement is reached in the protocol process. If a settlement ultimately is not reached, providers and suppliers have whatever balance of the time in the sixty-day period remains after the time period was suspended to report and return the overpayment.
CMS also amended the reopening rules to provide for a reopening period consistent with the six year look back period to report and return overpayments. CMS also clarified that providers and suppliers could use scanned or electronic records to validate claims for purposes of identifying overpayments, in response to commenters’ complaints that it was burdensome and expensive to maintain paper records for six to ten years.
In the situation where a government audit reveals an overpayment, CMS agreed that the scope of the reasonable diligence in investigating is defined by the issues that the contractor or government audited. However, the government audit may be for a limited time period. If the provider or supplier confirms the government audit findings, he may have credible information of receiving a potential overpayment that extends beyond the audited timeframe. In that case, the provider or supplier should conduct due diligence within the six year look back period set forth in the final rule. In the situation where the provider or supplier appeals the determinations of the government audit, CMS agreed that it would be premature for the provider or supplier to initiate a reasonably diligent investigation into the same issues in an additional time period, until such time that government audit claims had worked their way through the administrative appeals process. In response to concerns by commenters that they may repay money that is later determined to not be an overpayment, CMS said there is no appeal process for repayment of self-identified overpayments, unless the return results in a revised initial determination of specific claim(s), which would then trigger appeal rights. Thus, providers and suppliers will be held to their determination regarding the existence of an overpayment and their reporting and returning the money. Additionally, it is important that providers and suppliers maintain documentation regarding claims for which overpayments were reported and returned, in case those refunded claims become the subject of an audit by a Medicare contractor or the OIG.
The final rule adopts a standard of at most six months from receipt of the credible information for reasonable diligence to conduct the timely, good faith investigation of credible information, unless there are extraordinary circumstances. Therefore CMS has determined that a total of eight months (six months for timely investigation and two months for reporting and returning) is a reasonable amount of time, absent extraordinary circumstances. Extraordinary circumstances that may increase the due diligence time allowance would include unusually complex investigations, physician self-referral laws violations that are referred to the CMS Voluntary Self-Referral Disclosure Protocol, natural disasters, or states of emergency. Providers and suppliers are advised to maintain records that accurately demonstrate their reasonable diligence efforts to demonstrate timely compliance with the rule.
In quantifying the amount of an overpayment, CMS stated that statistical sampling and extrapolation are an appropriate component of exercising reasonable diligence in investigating an overpayment. Providers and suppliers are required to conduct an appropriate audit to determine whether an overpayment exists and to quantify the overpayment. If a single overpaid claim is identified, CMS stated it was appropriate for the provider or supplier to inquire further to determine whether there were more overpayments on the same issue before reporting and returning the single overpayment. CMS recognized that a common way to conduct an audit is to use a probe sample and incorporate the results into a larger full sample as the basis for determining an extrapolated overpayment amount. If that methodology is employed, the provider or supplier should not report and return overpayments on single or probe sample claims until the full overpayment has been identified. CMS cautioned that statistical sampling should be conducted in a manner that conforms to sound and accepted principles. Providers and suppliers must be able to explain how the overpayment amount was calculated.
The final rule stresses the importance of both proactive compliance and reactive measures to assure that all overpayments are identified and returned within sixty days of identification. Although this final rule applies only to Medicare Part A and Part B payments, healthcare providers and suppliers who receive payments from Medicare and Medicaid are advised to implement due diligence practices to detect and investigate possible overpayments to avoid potential False Claims Act liability.