Overview

After receiving scores of comments over nearly 4 years, the Centers for Medicare and Medicaid Services (CMS) has released its final rule (the “Final Rule”) addressing the reporting and returning of overpayments made to suppliers and providers who receive funds through Medicare. The Final Rule implements Section 6402(a) of the Affordable Care Act, which requires that suppliers and providers report and return overpayments by 60 days after (1) the overpayment is identified or (2) the date on which the corresponding cost report is due, whichever is later. This blog post addresses some of the important provisions contained in the Final Rule, which will be codified at 42 CFR 401.301-305 and 401.607 and is effective March 14, 2016.

The Final Rule goes a long way towards addressing and clarifying several of the important concerns raised by stakeholders, especially those concerning the length of the “lookback” period (now set as 6 years) and the (often thorny) determination of when an overpayment is “identified.” Even with this added guidance, however, questions remain, and compliance with the Final Rule may impose significant administrative burdens on healthcare providers and suppliers. For example, certain statements in CMS’s commentary appear to raise the question of whether the Final Rule effectively imposes an obligation on providers and suppliers to uncover any overpayments received during the 6-year lookback period.

When is an overpayment “identified”?

The 60-day clock on reporting an overpayment begins to run when an overpayment is “identified.” The Final Rule resolves some ambiguity over the “identification” question by making clear that an overpayment has been “identified” when a person “has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount.” A provider will typically be deemed to have acted with “reasonable diligence” where it conducts a “timely, good faith investigation” within “6 months from receipt of the credible information, except in extraordinary circumstances.” In commentary, CMS further clarified that “reasonable diligence” includes both proactive compliance activities “conducted in good faith by qualified individuals to monitor for the receipt of overpayments,” and reactive investigative activities undertaken in response to receiving credible information about a potential overpayment. The Final Rule’s “reasonable diligence” language appears to be a different standard than that contained in the proposed rule, which instructed providers who possess credible information concerning an overpayment to proceed with “all deliberate speed.”

By holding suppliers and providers responsible for claims they “should have” identified “through the exercise of reasonable diligence,” the Final Rule seeks to address CMS’s concern that suppliers and providers “might avoid performing activities to determine whether an overpayment exists, such as self-audits, compliance checks, and other research.” To shed light on when an overpayment occurs, page 7659 of the commentary accompanying the Final Rule lists several possible scenarios in which a provider or supplier will be deemed to have identified an overpayment. These include (among others) where the provider or supplier:

• reviews billing or payment records and learns that it incorrectly coded certain services, resulting in increased reimbursement

• learns that a patient death occurred prior to the service date on a claim that has been submitted for payment

• learns that services were provided by an unlicensed or excluded individual on its behalf; or

• performs an internal audit and determines that overpayments exist.

How far must a provider or supplier “look back?”

An overpayment must be reported if identified “within 6 years of the date [it] was received.” Per CMS, the 6-year limitation period is designed to “avoid imposing unreasonable additional burden or cost on providers and suppliers.” This 6-year lookback period is a notable departure from the 10-year period outlined in the proposed rule, and was issued following comment from several stakeholders that a 10-year period would be “overly burdensome.” CMS explained that a 6-year rule would “appropriately address many of the concerns about burden and cost” raised by commenters, since “many providers and suppliers retain records and claims data for between 6 and 7 years based on various existing federal and state requirements.”

As noted above, the exercise of “reasonable diligence” required under the Final Rule includes implementation of “proactive compliance activities” designed, in part, to uncover overpayments. This would seem to impose an obligation on providers or suppliers to actively investigate whether there exist any overpayments in the provider’s/supplier’s 6-year Medicare payment history, and not just simply respond to information suggesting that an overpayment exists. CMS seems to confirm this in commentary relating to the 6-year lookback, stating “[t]hus providers and suppliers have a clear duty to undertake proactive activities to determine if they have received an overpayment or risk potential liability for retaining such overpayment.” In light of this, the Final Rule’s administrative impact may be significant.

How to report and return overpayments

To report and return overpayments, the Final Rule requires that a provider or supplier use an applicable claims adjustment, credit balance, self-reported refund, or another appropriate process to satisfy its obligation. Along with the fact of the overpayment itself, the provider or supplier must also notify the Secretary, state, intermediary, carrier or contractor —in writing—of the reason for the overpayment. Per CMS, this reporting regime “preserves our existing processes and preserves our ability to modify these processes or create new processes in the future.” CMS estimates that the Final Rule’s requirements on identifying, reporting and returning overpayments will cost suppliers and providers between $120 and $201 million (CMS’s “mid-range” projection splits the difference between these 2 figures, projecting costs of $161.16 million). While the Final Rule’s goals include ensuring compliance with applicable statutes, promoting the furnishing of high quality care, and protecting the Medicare Trust Funds against fraud and improper payments, CMS lacked sufficient data on which to base a monetary estimate of recovered funds.