United States: "Mea Culpa" – CMS Issues Proposed Rule On Reporting And Identifying Overpayments

Last week, the Centers for Medicare and Medicaid Services (CMS) issued its proposed rule to implement section 6402(a) of the Affordable Care Act. Section 6402(a) of the Affordable Care Act established a new section 1128J(d) entitled ''Reporting and Returning of Overpayments.'' This section requires a person who has received an overpayment to report and return the overpayment to the government or a contractor within 60 days of identifying the overpayment.

To help our clients and friends analyze the proposed rule, we have drafted a list of likely questions about the rule, and provided our answers below.

Questions and Answers

1. What does the new rule require providers to do?

Providers have to return any overpayments within 60 days of identifying the overpayment. The new rule sets forth policies and procedures for reporting and returning overpayments to the Medicare program under Parts A and B.

2. When is this requirement effective?

It is effective now even without a final regulation because the statutory requirement has been in effect since March 23, 2010, when Congress enacted the health care reform law provision.

Section 6402(a) of the Affordable Care Act established a new section 1128J(d) of the Social Security Act (the "Act") entitled ''Reporting and Returning of Overpayments.'' Section 1128J(d) (1) of the Act requires a person who has received an overpayment to report and return the overpayment to the secretary, the state, an intermediary, a carrier, or a contractor—as appropriate and to the correct address—and to notify the party to whom the overpayment was returned in writing of the reason for the overpayment. Section 1128J(d)(2) of the Act requires that an overpayment be reported and returned by the later of— (1) the date which is 60 days after the date on which the overpayment was identified, or (2) the date any corresponding cost report is due, if applicable. Section 1128J(d)(3) of the Act specifies that any overpayment retained by a person after the deadline for reporting and returning an overpayment is an obligation (as defined in 31 U.S.C. 3729(b)(3)) for purposes of federal False Claims Act liability.

3. Who does this new rule cover?

CMS proposes in the rule to cover only Medicare Part A and B providers and suppliers at this time. All providers are subject to the statutory requirements, however. The statutory requirement applies to all providers and includes Medicaid, Medicare Advantage, and Medicare Part D organizations within its scope.

4. What is an "overpayment"?

Section 1128J(d) of the Act provides that an overpayment means ''any funds that a person receives or retains under title XVII [Medicare] . . . to which the person, after applicable reconciliation, is not entitled under such title.'' CMS adopts the same definition in the rule. Examples of Medicare overpayments under the definition proposed in the rule could include all of the following:

• Medicare payments for noncovered services,
• Medicare payments in excess of the allowable amount for an identified covered service,
• Errors and nonreimbursable expenditures in cost reports,
• Duplicate payments,
• Receipt of Medicare payment when another payor had the primary responsibility for payment,
• Incorrectly coded services resulting in increased reimbursement,
• Death of a patient prior to a service date on a claim submitted for payment,
• Services provided by an unlicensed or excluded individual,
• Violations of the Stark physician self-referral statute, and
• Overpayments that arise due to a violation of the anti-kickback statute.

5. How quickly do I have to report an "overpayment"?

60 days. Under the proposed rule and the Act, the 60-day requirement to report and return any overpayment would run from the date on which the person had identified the overpayment.

6. How do I know if I have "identified" an "overpayment"?

CMS explains in the proposed rule that the repayment obligation arises from an overpayment when a person "has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment." This standard is essentially the same knowledge standard for a violation of the federal False Claims Act.

CMS says in its commentary that by defining ''identification'' in this way, providers and suppliers have an incentive to exercise reasonable diligence to determine whether an overpayment exists. Without such a definition, some providers and suppliers might avoid performing activities to determine whether an overpayment exists, such as self-audits, compliance checks, and other additional research.

In a positive interpretation for providers, CMS clearly states that the 60-day reporting period does not begin until the overpayment is identified. So a provider can likely gather facts or review with counsel the underlying laws during the period of reasonable inquiry before starting the 60 days to report.

7. What is a "reasonable inquiry"?

CMS provides some flexibility in the proposed rule for providers. CMS does not define what meets the test for a "reasonable" inquiry, but a provider is obligated to make an inquiry that is reasonable when concerns of overpayments arise. The Act itself speaks to an overpayment arising only after "applicable reconciliation," so time for investigation appears to be contemplated by both the Act and CMS's regulatory guidance. There is a strong message in the commentary that CMS (and the Office of Inspector General) expect providers to take allegations of overpayments seriously, and investigate them diligently and with deliberate speed. CMS states that:

8. Does a letter from an RAC auditor or ZPIC start the 60 days?

The letter itself probably does not start the 60 days, but the proposed rule would obligate the provider or supplier to make a reasonable inquiry, and likely conduct its own audit of the issues identified. CMS discussed this scenario on page 9182 of the proposed rule. If the self-audit verifies the issues noted by the governmental audit contractor, then an overpayment is presumably identified and needs to be reported and repaid.

9. Does a self-disclosure meet these reporting requirements?

Yes. CMS will suspend the obligation to return Medicare overpayments under section 6402(a) of the Affordable Care Act when the provider reports an overpayment and CMS acknowledges receipt of that disclosure made pursuant to the process established by the Medicare (Stark) Self-Referral Disclosure Protocol (SRDP). The suspension of obligation also will occur when a provider uses the OIG Self-Disclosure Protocol (OIG SDP) for reporting evidence of potential fraud.

10. Will this increase a provider's exposure under the False Claims Act?

It may. The process of reporting and returning overpayments pursuant to this rule and Section 1128J of the Act cannot resolve any potential False Claims Act or OIG administrative liability associated with the overpayment (although there may be a benefit to doing so). CMS clearly states that providers and suppliers should be aware that the Medicare Administrative Contractors (MACs – formerly known as Fiscal Intermediaries) will scrutinize Medicare overpayments received through this process and may make referrals to OIG whenever the MACs believe circumstances warrant such a referral.

Moreover, when evaluating the diligence of a provider in identifying overpayments, CMS has chosen to use the same standards that are under the federal False Claims Act ("knowing" and "reckless disregard"). What meets these tests is very factspecific, and there have been many False Claims Act cases applying these standards, but providers can certainly expect federal enforcement officials to expand the basis for investigating the timeliness of an overpayment refund.

11. Is a provider liable for someone else's overpayment?

Probably not, if it had no knowledge of the overpayment or arrangement causing the overpayment. In the commentary, CMS describes the example of a kickback arrangement between a device manufacturer and a surgeon on a hospital's medical staff in the context of a hospital repayment obligation. It says that providers who are not a party to a kickback arrangement are unlikely in most instances to have ''identified'' the overpayment that has resulted from the kickback arrangement and would therefore have no duty to report it or repay it.

12. How do I report and repay the overpayment?

CMS will use the existing voluntary refund process, which will be renamed the ''self-reported overpayment refund process.'' Each MAC has mechanisms in place for accepting Medicare overpayments, but CMS will begin work on standardizing the reporting form across all MACs. The ''self-reported overpayment refund process'' is described in Publication 100–06, Chapter 4 of the Medicare Financial Management Manual. Under the existing voluntary refund process, providers and suppliers report overpayments from Medicare using a form that each MAC makes available on its website.

Depending on the circumstances, clients may want to consult with counsel to determine if an overpayment exists and how to proceed in reporting it. The MAC forms require, in addition to claim information, that the providers or suppliers summarize why the refund is being made and including the following information: (1) How the error was discovered; (2) a description of the corrective action plan implemented to ensure the error does not occur again; (3) the reason for the refund; (4) whether the provider or supplier has a corporate integrity agreement (CIA) with the OIG; (5) the time frame and the total amount of refund for the period during which the problem existed that caused the refund; (6) Medicare claim control numbers, as appropriate; (7) Medicare National Provider Identification (NPI) number; (8) a refund in the amount of the overpayment; and (9) if a statistical sample was used to determine the overpayment amount, a description of the statistically valid methodology used to determine the overpayment.

13. What is this "look-back period" I've heard about?

CMS proposes in the rule at 42 C.F.R. §401.305(g) that a person must report any Medicare overpayments identified within 10 years of the date the overpayment was received. CMS also proposes to amend its ability to "re-open" closed claims through post-payment auditing process for 10 years (from the current 3-4 years absent fraud or other issues). CMS explains that it chose 10 years because that is consistent with the outer limits of the federal False Claims Act statute of limitations.

The health care provider and legal communities have much discussed this radical change by CMS. We would expect there to be many parties opposing this extended look-back period because it does not appear to be supported by the statutory provisions. The proposed rule also presents legal challenges in sorting out liability and auditing for claims received prior to the law being enacted and identifying successor liability subsequent to a change of ownership.

14. What happens if I keep an overpayment?

The person or organization can be pursued under the False Claims Act or excluded from the government program by the OIG—any person who ''knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money or property to the Government." The Act and the proposed rule provide that any overpayment retained by a person after the deadline for reporting and returning the overpayment is an obligation for purposes of the federal False Claims Act. 31 U.S.C. Therefore, anyone who does not timely report and return the overpayment that has been identified may be found liable under the False Claims Act, the Civil Monetary Penalties Law, or excluded from participation in federal health care programs (section 1128A of the Act).

Conclusion

Comments to CMS on the proposed rule are due no later than April 16, 2012, and a final rule is likely months away. Until a final rule is published, providers are advised to quickly begin a reasonable inquiry once a suspected overpayment has been identified and to conduct the inquiry with all deliberate speed. Please let us know if we can assist your organization with any comments on the proposed rule or the analysis of any Medicare overpayment reporting obligations.

The complete proposed rule is available at http://www.gpo.gov/fdsys/pkg/FR-2012-02-16/pdf/2012-3642.pdf

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.