,
Salvatore G. Rotella, Jr. and
Melanie K. Martin 
By linking the retention of program overpayments and potential liability under the False Claims Act (FCA), the Patient Protection and Affordable Care Act of 2010 (PPACA) has dramatically expanded the scope of exposure for health care providers under the FCA. Potential overpayments to providers—including but not limited to such things as garden variety duplicate payments to discoveries of Medicare payments for designated health services (DHS) provided on referrals from physicians absent a valid Stark law exception—create new FCA exposure and the need for heightened compliance efforts by providers and health plans.
The government has long taken the position that federal health care program overpayments, once identified, must be refunded. Prior to enactment of the Fraud Enforcement and Recovery Act (FERA) in 2009, the FCA included only a fairly narrow, so-called "reverse false claims" provision. A failure to refund an overpayment constituted a FCA violation under that provision only if a person or entity used a "false record" or "statement" to conceal, avoid, or decrease an obligation to pay money to the government. FERA, however, established FCA liability for "knowingly concealing, or knowingly and improperly avoiding or decreasing, an obligation to pay" funds owed the government. Under FERA, an individual or entity is potentially liable under the FCA for failing to refund money it is "obligated" to pay to the government, even if the funds were obtained or retained without a predicate "false record or statement." FERA "obligations" may arise from express or implied contracts, grantor-grantee and licensor-licensee relations, or statutes or regulations.
Section 6402(a) of the PPACA added a new Section 1128J(d) to the Social Security Act, which now expressly requires providers, suppliers, and health plans to "report and refund" to "the Secretary, State, intermediary, carrier, or contractor" an "overpayment" by the later of "60 days after the date on which the overpayment was identified" or "the date any corresponding cost report is due." As part of the process, a provider must give notice of "the reason for the overpayment." An "overpayment" is newly defined under the PPACA amendment as any funds received or retained under Medicare or Medicaid to which the provider, supplier, or plan is not entitled after an "applicable reconciliation.
Significantly, the PPACA makes reporting and repaying any overpayment an "obligation" under the FCA, so that failure to report and return an overpayment within the applicable deadline may in itself result in FCA liability. Criminal liability aside, FCA violations may result in monetary penalties of $5,500 to $11,000 per claim, plus treble damages. Additionally, Section 6402(d) of the PPACA amends the Civil Monetary Penalty (CMP) statute, which may be invoked by the HHS Office of Inspector General (OIG) and without a referral to the Justice Department, to establish CMPs for failures to report and repay overpayments. Under Section 6502 of the PPACA, "unpaid overpayments" also are grounds for Medicaid program exclusion. The new laws will apply even to overpayments received prior to their effective date, but which are later discovered and for which an "obligation" to repay occurs today.
There are a host of areas in which overpayments trigger reporting and repayment obligations under the PPACA, which can become the grist of reverse false claims actions under the FERA. These range from discoveries of duplicate payments, payments for ineligible beneficiaries, third party liability, and determinations that services were not medically necessary, to more subtle discoveries of confirmed Stark law violations. The latter may occur where, for example, hospitals or other DHS providers have service agreements with referring physicians that have expired, fail to fully and comprehensively describe the scope of services covered by the agreement, are not based on fair market value, or are not for a commercially reasonable purpose.
Particular vigilance should be applied to credit balance reporting. There is some tension between the recent FERA amendments, under which Congress indicated it did not intend to treat failures immediately to repay amounts slated to be credited to the government in due course through quarterly credit balance reports as "improper" withholdings, and the 60-day mandatory limit for repayments imposed under the PPACA. It is unclear, for example, whether a quarterly credit balance report comprises a "cost report" for purposes of invoking the "later of" time limits imposed under Section 6402 of the PPACA. In addition, providers often encounter practical difficulties in effecting returns of Medicaid overpayments to states (including Pennsylvania) that may lack protocols for receiving refunds other than the withdrawing of claims for payment within narrow time windows. Credit balances and overpayments involving Medicare Advantage or Medicaid managed care plans also take on added significance under another FERA amendment that subjects false claims against government contractors (now including knowing failures to repay under the PPACA) to the FCA.
Several issues remain unsettled. The PPACA, for example, does not specify when an "overpayment" is considered "identified," thereby triggering the running of the repayment deadline. The OIG historically has taken the position in the self-disclosure context that an overpayment is not identified until a provider has completed an internal investigation of an apparent overpayment. But the treatment of this issue under the PPACA is not yet clear. Nor does the FERA amendment define the term "improperly."
Similarly, in 2009, the OIG announced that it would no longer accept self-disclosures of Stark violations that did not also implicate FCA violations. Section 6409 of the PPACA obligates HHS to establish a self-disclosure protocol for "pure" Stark law violations (or potential violations) within six (6) months of the effective date of the PPACA. But—pending further clarification—that mandate does not appear to suspend the obligation to report and repay within the prescribed sixty (60) day limits upon the enactment of the PPACA.
Notwithstanding these open questions, prudent providers, suppliers, and plans should take immediate steps to minimize potential liability under these new provisions of law. They should, for example, review their existing compliance programs, which are made mandatory under the PPACA, to ensure policies and procedures are in place regarding reporting and refunding overpayments that will satisfy with the requirements of Section 6402. They should also ensure that the workforce is adhering to these policies and procedures. Providers, suppliers, and plans also may wish to establish new policies that "fast track" reporting and refunding of suspected overpayments, once they have been identified, to ensure compliance with the PPACA's mandatory deadlines. Finally, and at the very least, these new laws warrant a careful review of all contracts and contractual relations between DHS providers and referring physicians for purposes of Stark law compliance.
In our next Health Law Alert, we will further explore the expansions and changes to the Stark law effectuated by the PPACA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.