CMS publishes final rule regarding obligation to report and refund overpayments


March 2016

On February 12, 2016, the Centers for Medicare and Medicaid Services (CMS) published the Final Rule regarding the obligation of health care providers to report and return overpayments received from Medicare Part A and Part B. This much anticipated Final Rule was published almost two years after CMS sought comments on proposals for the rule.

The Final Rule sets forth regulations designed to implement Section 6402(a) of the Affordable Care Act, which was enacted on March 23, 2010. Section 6402(a) requires a provider to report and return an overpayment to the applicable governmental agency or contractor “by the later of – (A) the date which is 60 days after the date on which the overpayment was identified; or (B) the date any corresponding cost report is due, if applicable.” Failure to comply with the refund obligation may result in liability under the False Claims Act (FCA), civil monetary penalties, and exclusion from federal health care programs.

In the Final Rule, CMS clarifies when an overpayment is “identified” and when the 60-day time period is triggered. According to the Final Rule, an overpayment is identified when a “person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” The exercise of reasonable diligence includes both proactive and reactive compliance activities, according to CMS.

CMS expects providers to conduct internal audits and other proactive compliance efforts to monitor the accuracy of claims submitted to Medicare. Additionally, CMS expects providers to review payments received from Medicare to ensure that such payments are appropriate. According to CMS, the fact that an overpayment results from an error made by a Medicare contractor does not relieve the provider of the duty to report and refund the overpayment. Therefore, CMS indicates that providers should take proactive steps to ensure that payments received from Medicare are appropriate.

In addition to proactive compliance efforts, CMS expects a provider to respond in good faith when the provider receives “credible information” indicating that the provider may have received an overpayment. Upon receipt of such information, a provider should conduct an investigation to determine whether an overpayment was received.

In the preamble to the Final Rule, CMS indicates that, except in extraordinary circumstances, investigations should be concluded within six months after receipt of “information that supports a reasonable belief that an overpayment may have been received.” In the preamble to the Final Rule, CMS explains that the result from an audit conducted by a governmental contractor qualifies as credible information indicating that the provider may have received an overpayment. Thus, the provider is obligated to investigate the conduct uncovered in the audit. For example, if the audit focused on a limited time period, then the provider may need to look beyond that time period for additional overpayments. CMS indicates that in some circumstances providers may undertake such an investigation after the conclusion of any appeal related to the audit results: “If the provider appeals the contractor identified overpayment, the provider may reasonably assess that it is premature to initiate a reasonably diligent investigation into the nearly identical conduct in an additional time period until such time as the contractor identified overpayment has worked its way through the administrative appeals process.”

When conducting an investigation into a potential overpayment, the lookback period is six years. Initially, CMS proposed a tenyear lookback period. However, after receipt of several objections to this proposal, CMS adopted a six-year lookback period in the Final Rule. Additionally, CMS amended the reopening rules so that a provider may request the reopening of an initial determination in order to report and refund an overpayment.

Once a provider determines that an overpayment has been received and quantifies the amount of the overpayment, the 60-day time period set forth in the law begins. However, in the event a provider fails to act upon credible information regarding a potential overpayment, the 60-day time period begins on the date the information was received. Under the law, overpayments must be reported and returned when the applicable cost report is due or 60 days after the overpayment is quantified.

Certain processes will toll the deadline for refunding the overpayment. According to the Final Rule, the refund deadline is tolled when the provider reports the overpayment through CMS’s Voluntary Self-Disclosure Protocol or the Office of Inspector General’s (OIG’s) Self Disclosure Protocol, or when the provider requests an Extended Repayment Schedule.

Initially, CMS proposed that refunds should be initiated through the Medicare contractors’ existing voluntary refund processes or through the OIG’s Self Disclosure Protocol. CMS also proposed that the refund include a report which addressed 13 data elements, such as the reason for the overpayment and an explanation of the provider’s corrective action plan.

In the Final Rule, CMS expanded the options for initiating a refund and provided that refunds could be made through “an applicable claims adjustment, credit balance, self-reported refund, or other reporting process set forth by the applicable Medicare contractor.” To enable the use of these various refund processes, CMS eliminated the proposed requirement to include a detailed report concerning the refund. However, in the event a provider calculates the refund through statistical sampling, the provider must include a report detailing the sampling methodology.

The regulations set forth in the Final Rule become effective on March 14, 2016. Hospitals and other health care providers should evaluate their compliance plans in light of the Final Rule. Compliance plans should include policies to proactively monitor submitted claims and payments received from Medicare.

Furthermore, compliance plans should include steps for internally reporting and investigating credible information of potential overpayments. Failure to implement proactive and reactive compliance activities will expose providers to potential liability under the FCA.