CMS’s Long-Awaited Final 60-Day Repayment Rule Provides Guidance and Eases Some Requirements for Health Care Providers and Suppliers

On Friday, February 12, 2016, the Centers for Medicare and Medicaid Services (CMS) released the long-awaited Final Rule and regulations,[1] providing much needed guidance to providers and suppliers on how to meet the Affordable Care Act’s (ACA’s) 60-day overpayment mandate.[2]

Specifically, a provision enacted as part of the ACA in 2010 requires that all Medicare and Medicaid overpayments be reported and returned by the later of (i) 60 days after the date on which the overpayment was identified; or (ii) the date any corresponding cost report is due (if applicable).[3] However, since its enactment, there has been a great deal of confusion about various aspects of the law; most notably, about what it means to “identify” an overpayment and the length of the required lookback period (i.e., how far back in time providers and suppliers must investigate the receipt of potential overpayments). The proposed regulations issued in 2012 did not clearly resolve the first issue and would have imposed a burdensome and controversial 10 year lookback period. The Final Rule, which applies only to Medicare Parts A and B, clarifies that the identification of an overpayment occurs when the provider or supplier has or should have, through the exercise of reasonable diligence, determined that it has received an overpayment and quantified the amount of the overpayment due to be returned. The Final Rule also establishes that Medicare providers and suppliers are subject to a six year lookback period. Finally, the regulations set forth the process for reporting and returning the identified overpayments. Many of the key provisions of the Final Rule are described in greater detail below.

Providers and suppliers will welcome several provisions of the Final Rule that provide greater clarity and/or are less stringent than the proposed rule.[4] Moreover, the Final Rule appears to reject the 2015 ruling by a New York federal district court judge in the Continuum case, which placed many health care providers and suppliers on “high alert” after the court held that a provider “identifies” an overpayment when it is “put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained … .” In simple terms, the court’s holding stood for the proposition that providers had no more than 60 days to investigate, quantify, report and return all overpayments; an unrealistic mandate, particularly for providers and suppliers investigating complicated compliance issues. With this Final Rule, CMS seemingly has both rejected the Continuum court’s inflexible approach and responded to many of the concerns expressed by the health care industry in reaction to the proposed rule.

CMS also repeatedly emphasizes that all providers and suppliers must take reasonable proactive, as well as reactive, steps to identify overpayments in order to satisfy the law’s requirement to report and return overpayments. As a result, providers and suppliers should closely review the new regulations, update their compliance programs to ensure they are well-positioned to identify and return overpayments, and be on the lookout for increased enforcement of the 60-day rule.

When is an Overpayment “Identified?”

Under the Final Rule, a provider or supplier has identified an overpayment “when the person has, or should have through the exercise of reasonable diligence, determined that the [provider or supplier] has received an overpayment and quantified the amount of the overpayment.”^{^[5]} The fact that the Final Rule recognizes that an overpayment cannot be “identified” until quantification is complete is particularly significant, since quantifying the amount of an overpayment can be extremely time-consuming and resource-intensive. CMS acknowledges that the investigation and quantification may take up to six months, and that complex investigations, such as those involving violations of the Stark Law that have been referred to the CMS Self-Referral Disclosure Protocol, may take even longer. In short, after they have credible evidence of the receipt of a potential overpayment, providers and suppliers generally will have up to eight months to return the money to the government.

What is Reasonable Diligence?

Under the Final Rule, providers must use “reasonable diligence” to identify overpayments. There is considerable discussion in the preamble noting that “reasonable diligence” includes both proactive compliance activities conducted by qualified individuals to monitor claims for overpayments, as well as reactive investigations conducted in response to credible information of a potential overpayment. CMS further states, “Thus providers and suppliers have a clear duty to undertake proactive activities to determine if they have received an overpayment or risk potential liability for retaining such overpayment.”^{^[6]}

The preamble to the regulations also indicates that if the provider or supplier finds a single overpaid claim, “it is appropriate to inquire further to determine whether there are more overpayments on the same issue before reporting and returning the single overpaid claim.” Specifically, if a provider or supplier conducts an audit using a probe sample, the provider or supplier should not report and return overpayments on the specific claims from the probe sample until the full extrapolated overpayment (looking back up to six years if appropriate) is identified. Similarly, in the discussion about government audits, the preamble notes that audits by the government or a contractor may be for a limited time period. If the provider or supplier confirms the audit’s findings, they may have the credible information that triggers an obligation to investigate beyond the scope of the initial audit, i.e., beyond the audited time frame within the six year lookback period as described below.

How Far Back Do Providers and Suppliers Need to Lookback for Overpayments?

Under the Final Rule, an overpayment must be reported and returned within six years of the date the overpayment was received. While this lookback period is considerably shorter than the 10-year period in the proposed rule, it is significantly longer than the four-year time period that many providers and suppliers had been using based on the reopening rules at 42 C.F.R. § 405.980. While not described as such, this appears to be the primary trade off in the final regulations. Providers and suppliers are given a longer time to investigate, but have to return any overpayments that may have been incurred over a longer period of time (albeit not as long as the ten-year period originally proposed).

It is important to note that the six year time frame is the maximum lookback period under the Final Rule. Each overpayment should be reviewed in light of the particular facts at issue since it often is possible to reduce the length of the lookback period - for example, if a coding error was caused by one particular coder who only worked at the facility for a limited period of time.

How Should Overpayments Be Reported and Returned?

The Final Rule states that providers and suppliers should report and return overpayments using applicable claims adjustment, credit balance, self-reported refund, or other reporting processes set forth by the applicable Medicare contractor. The detailed list of required data elements set forth in the proposed rule has been eliminated. The overpayment reporting requirement also can be satisfied by making a disclosure and reaching a settlement under the OIG’s Self-Disclosure Protocol or under the CMS Voluntary Self-Referral Disclosure Protocol. In addition, the regulations require the provider or supplier to describe any statistically valid sampling and extrapolation methodology used to calculate the overpayment.

Receipt of a self-disclosure submission to either the OIG or CMS protocol will suspend the deadline for returning an overpayment until a settlement agreement is entered, or the person withdraws or is removed from the applicable protocol. However, the deadline is not suspended if a self-disclosure is made to any other agency, such as the Department of Justice, an Assistant US Attorney or a Medicaid Fraud Control Unit.

Do Small Dollar Amounts Need to be Reported And Returned?

CMS declined to adopt a minimum monetary threshold for overpayments. As a result, overpayments of even de minimis value must be identified, reported, and returned.

Other Issues Addressed

The Final Rule also:

describes the applicable reconciliation period for providers submitting cost reports, noting that with limited exceptions, the applicable reconciliation for most overpayments occurs when the cost report is filed and any overpayments identified should be returned at the time the cost report is filed;
clarifies that providers who are not a party to a kickback arrangement, but who may have received payments as a result of a kickback arrangement, are unlikely (in most instances) to have “identified” an overpayment. (To the extent such a provider does identify and report an overpayment, CMS indicates that they are unlikely to be required to repay the overpayment, except in extraordinary circumstances);
allows for suspending of the deadline for returning overpayments when a provider requests an Extended Repayment Schedule; and
does not create any new appeal rights, but, to the extent the return of an overpayment results in a revised initial determination for individual claims, providers are afforded any appeal rights that currently exist.

What The Final Rule Means For Providers and Suppliers

With the publication of this Final Rule, Medicare providers and suppliers now are on notice that the government expects them to proactively monitor for, and investigate credible information about, any potential overpayments. Providers and suppliers who identify an overpayment must assess the scope of liability during a six year lookback period, and must report and return any overpayment in a timely manner or face potential Civil Monetary Penalties, exclusion and/or False Claims Act penalties.

To help reduce the risk of exposure, providers and suppliers will want to review their compliance programs to ensure that they contain policies and procedures to monitor for overpayments, and promptly return them once they are identified. Periodic audits to ensure that these policies and procedures are being implemented appropriately also are advisable. In addition, working with legal counsel may help establish whether a particular set of facts actually constitutes an overpayment and if so, can help determine the applicable lookback period.

^{^[1]} 81 Fed. Reg. 7,654 (Feb. 12, 2016).

^{^[2]} The Final Rule applies only to Medicare Parts A and B. Previously issued regulations address overpayment returns in the context of Medicare Parts C and D at 79 Fed. Reg. 29,844 (May 23, 2014). No federal regulations currently address the requirements for returning overpayments to Medicaid, although the law requiring the return of overpayments applies to Medicaid as well as Medicare, and the Final Rule specifically notes the potential liability that exists for failure to report and return an overpayment in accordance with the law, despite the absence of regulations in some cases. 81 Fed. Reg. 7656.

^{^[3]} Affordable Care Act (ACA), § 6402(a); codified at 42 U.S.C. § 1320a-7k(d). The ACA defines an “overpayment” as any funds that a person receives or retains from Medicare or Medicaid to which the person, after any applicable reconciliation, is not entitled. Id.

^{^[4]} 77 Fed. Reg. 9,179 (Feb. 16, 2012).

^{^[5]} 42 C.F.R. § 401.305(a)(2)(emphasis added).

^{^[6]} 81 Fed. Reg. 7664.