CMS Issues the Final Rule on Providers’ Obligation to Report and Return Overpayments

Written By Nate Trexler

On February 12, 2016, the Centers for Medicare and Medicaid Service (“CMS”) published a final rule regarding the Affordable Care Act’s requirement that providers report and return overpayments.  It has been a long road to this point.  Back in 2012, we wrote about CMS’ proposed rule, which introduced quite a bit of uncertainty in the process of investigating overpayments and ultimately reporting and returning those overpayments.  After nearly four years, and after considering approximately 200 pieces of commentary from interested parties, CMS has finalized the rule, further outlining provider responsibilities under the Affordable Care Act’s requirement.

The Affordable Care Act was enacted on March 23, 2010 and established a requirement that a person who has received an overpayment must report and return the overpayment to the appropriate party and to notify that party of the reason for the overpayment.  The Act requires that an overpayment be reported and returned by the latter of 60 days from the date on which the overpayment was identified or the day any corresponding cost report is due, if applicable.  Importantly, the Act specified that any overpayment that was retained by a person after the deadline for reporting and returning an overpayment constituted an obligation under the Federal False Claims Act, which could lead to significant liability.  This requirement became effective immediately on March 23, 2010, and for almost six years, providers have been under an obligation to report and return overpayments.  Still, for those six years, a number of questions remained.

In this multi-part blog, we will discuss broad highlights from the Final Rule and some more in-depth takeaways.  In this blog post, we discuss how the Final Rule defines when an overpayment is “identified” and the lookback period for reporting and returning overpayments.

Two Highlights of the Final Rule

At the outset, the Final Rule applies only to Medicare Parts A and B. A separate rule applies to Medicare Parts C and D, but there is no rule with respect to Medicaid overpayments.

The Final Rule defines an “overpayment” to be any funds that a person has received or retained under Medicare Parts A and B to which the person, after applicable reconciliation, is not entitled. It does not matter how the overpayment occurred, even if by honest mistake.

One major highlight from the Final Rule is that providers have the ability to investigate whether an overpayment exists without starting the 60-day clock.  As described above, the Act requires a person to report and return an overpayment by the latter of 60 days from the date on which the overpayment was identified or the date any corresponding cost report is due.  The Final Rule has defined “identified” as when a person “has, or should have through the exercise of reasonable diligence,” determined and quantified the amount of the overpayment.  A person “should have determined” that the person received an overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.  This definition clarified confusion as to whether time spent investigating and quantifying a known (or suspected) overpayment would essentially toll the 60-day deadline.  However, CMS makes clear the providers must still exercise “reasonable diligence,” which requires both proactive and reactive compliance measures.  Reactive investigations must occur in a “timely manner,” which CMS considers to be “at most 6 months from receipt of credible information, except in extraordinary circumstances.”  CMS’s commentary on proactive compliance measures will be discussed in a subsequent blog post.

The second major highlight of the Final Rule is the six-year lookback period.  Under the rule, providers must report and return an overpayment if the provider identifies the overpayment within six years of the date the overpayment was received.  The impact of this lookback period is that if a provider obtains credible information of a potential overpayment, the provider needs to conduct reasonable diligence to determine whether they have received an overpayment, which may extend back six years from the date the provider received the credible information.  CMS even commented on the fact that various Medicare audits, including RAC audits, may be time limited (e.g., only the last 3 years), but they serve as credible information of a potential overpayment going back further.  As part of reasonable diligence, providers need to determine whether they have received overpayments, based on the same issues identified in the Medicare audit, going back 6 years.  This lookback period effectively expands the sometimes shorter audit authority of Medicare contractors, putting the onus on providers to complete the entire six year audit.

The text of the Final Rule may be viewed here.

 
In the next blog post, we will discuss some broader takeaways from the Final Rule and how providers can ensure they have appropriate and robust compliance programs in place to address the overarching concerns of these requirements.