On Thursday, the Centers for Medicare and Medicaid Services (CMS) published a long awaited final rule that fleshes out the requirement for health care providers and suppliers that participate in Medicare Parts A and B to report and return overpayments within 60 days or by the due date of any corresponding cost report. Going forward, an overpayment must be reported and returned if it is identified within six years of the date that the overpayment was received. Providers and suppliers will be deemed to have "identified" an overpayment when the entity has determined, or should have determined through the exercise of reasonable diligence, that it has received an overpayment and quantified the amount of the overpayment.
Although this rule relaxes some of the most concerning language from CMS's previous proposals, questions remain about the degree of "reasonable diligence" that must be exercised to identify an overpayment and how government agencies and auditors will exercise their discretion when enforcing these requirements. Accordingly, Medicare providers and suppliers should continue to support robust compliance activities as these requirements are implemented.
Background
The origins of this final rule reach back to the Affordable Care Act. Specifically, Section 6402(a) of the ACA established a new requirement for a person who has received an overpayment to report and return the overpayment to CMS, the state, an intermediary, a carrier, or a contractor, as appropriate. This provision also requires that an overpayment be reported and returned by the later of 60 days after the overpayment was identified or the date on which any corresponding cost report is due. The failure to meet this "obligation" can lead to significant financial exposure under the False Claims Act (FCA).
CMS published a proposed rule to implement these new requirements in February 2012. However, the agency's proposals were met with widespread concern across the health care industry due to the possibility of an ambiguous "reckless disregard or deliberate ignorance" standard for "identifying" a potential overpayment and a 10 year "lookback period" for such overpayments. In its final rule, CMS elaborated on the nature of the obligation in an attempt to provide greater clarity and consistency for the industry.
Meaning of "Identification"
In a departure from its proposed "reckless disregard or deliberate ignorance" standard for the identification of an overpayment, the final rule states that a person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. This change from the language of the proposed rule is significant because it clarifies that an overpayment is not identified (and the 60 day clock to report and return does not start running) until the amount of the overpayment is calculated.
Under the final rule, when an entity obtains credible information concerning a potential overpayment, the entity needs to undertake "reasonable diligence" to determine whether an overpayment has been received and to quantify the amount of any overpayment. Although the term "reasonable diligence" is not defined in the final regulations, CMS makes clear throughout the preamble that it includes proactive compliance activities to monitor for the receipt of overpayments as well as reactive investigations in response to credible information of a potential overpayment. Because providers and suppliers have a "clear duty" to undertake proactive compliance activities according to CMS, undertaking no or minimal efforts to monitor the accuracy and appropriateness of claims will expose those entities to liability under the new "report and return" standard.
The final rule also provides important context about the period of time that CMS believes to be "reasonable" for investigation of credible information about an overpayment. Notably, CMS states that "reasonable diligence" is demonstrated through the timely, good faith investigation of credible information, which is at most six months from receipt of the information, absent extraordinary circumstances.
Lookback Period
Under this final rule, overpayments must be reported and returned only if an entity identifies the overpayment within six years of the date on which the overpayment was received. This final lookback period is a significant improvement over the 10 year period in the proposed rule and should give some relief to providers and suppliers. It is important to note, however, that even a six year lookback period will create significant challenges for the investigation of a potential overpayment due to document retention policies, changes in coding protocols, revisions to coverage guidelines, and the loss of institutional memory through staff turnover. Accordingly, providers and suppliers will need to re-focus efforts on maintaining a paper trail to document their "reasonable diligence" to investigate and quantify potential overpayments.
How to Report and Return Overpayments
Finally, CMS's new rule establishes that providers and suppliers must use an applicable claims adjustment, credit balance, self-reported refund or other appropriate process to satisfy the "report and return" requirements. The rule also provides that a provider or supplier is considered to be in compliance with the 60 day requirement if the entity has reported an overpayment through the self-disclosure protocols managed by either CMS or the Office of the Inspector General.
Baker Donelson will continue to monitor the implementation and enforcement of this final rule. If you have any questions regarding CMS's expectations for the identification and refunding of overpayments, please contact the authors of this alert or a member of Baker Donelson's Health Law team.