CMS Sets Standards for Medicare Overpayments

Final rule explains how providers should carry out timely reporting and returning of Medicare overpayments.

In February, the Centers for Medicare & Medicaid Services (CMS) published the long-awaited final rule Medicare Reporting and Returning of Self-identified Overpayments, establishing official policy for timely reporting and returning of Medicare overpayments received by healthcare providers.
Since the enactment of the Affordable Care Act on March 23, 2010, providers* have been subject to a statutory 60-day timeline for reporting and returning Medicare overpayments, and faced liability under the False Claims Act, Civil Monetary Penalties Law, and the Medicare exclusion authorities for failure to meet the statutory deadline. The final rule was preceded by CMS’ proposed rule published on February 16, 2012, and brings some clarity to issues such as when an overpayment is considered to be “identified” for purpose of the 60-day deadline, as well as how far providers must look back when identifying overpayments subject to the reporting and returning requirement.
* In this article, “provider” or “person” refers to both a “provider,” as defined in 42 CFR 400.202 (e.g., a hospital), and a “supplier,” as defined in 42 CFR 400.202 (e.g., a physician).
Basic Standard
Under the final rule, a person who has received an “overpayment” must report and return the overpayment by the later of either:
(i) The date which is 60 days after the date on which the overpayment was “identified;” or
(ii) The date any corresponding cost report is due, if applicable.
In the final rule, “overpayment” means any funds that a person has received or retained under Medicare Part A or B to which the person, after applicable reconciliation, is not entitled. CMS published rules for reporting and returning of overpayments in Medicare Parts C and D in separate rulemaking (79 FR, 29843, May 23, 2014).
Six-month Investigation Benchmark
An overpayment is identified when a person has, or should have through reasonable diligence, determined that the provider has received an overpayment and quantified the amount of the overpayment. With this definition, CMS acknowledges that “identification” of an overpayment involves quantifying the amount, which requires time for a reasonably diligent investigation.
According to CMS, “reasonable diligence” includes:

Proactive compliance activities conducted in good faith by qualified individuals to monitor the receipt of overpayments; and
Investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment.

CMS established a six-month period as the benchmark for what it considers to be a timely investigation, absent extraordinary circumstances. According to CMS, a total of eight months (six months for timely investigation and two months for reporting and returning) is a reasonable time, absent extraordinary circumstances. CMS stated that “extraordinary circumstances” may include unusually complex investigations that the provider reasonably anticipates will require more than six months to investigate, such as Stark Law (the physician self-referral law) violations that are referred to the CMS Voluntary Self-Referral Disclosure Protocol (SRDP). Specific examples of other types of extraordinary circumstances cited by CMS include natural disasters or a state of emergency.
Six-year Look-back Period
Overpayments are subject to a six-year “look-back” period. Meaning, overpayments must be reported and returned if they have been identified within six years of the date the overpayment was received.
Although CMS had originally proposed a 10-year look-back period to be consistent with the outer limit of the False Claims Act statute of limitations, CMS recognized that a 10-year period would be overly burdensome for providers in terms of retaining records and retrieving information from electronic legacy systems.
Reporting and Return Process
Under the final rule, a provider must use the reporting process established by the applicable Medicare administrative contractor (MAC) to report the overpayment. This may include applicable claims adjustment, credit balance, self-reported refund, or other process set forth by the MAC. If the amount of the overpayment was calculated using a statistical sampling methodology, then the provider must describe the statistically valid sampling and extrapolation methodology in the report.
Note: In finalizing this section of the rule, CMS removed a requirement under the proposed rule that would have required providers to include 13 specific data elements when reporting overpayments to a MAC. CMS acknowledged that allowing providers to follow the processes established by each MAC would avoid the administrative burden of reporting information the MAC considers unnecessary.
CMS also allows the deadline for returning an overpayment to be suspended when a provider submits a request for an extended repayment schedule to the MAC. The deadline will remain suspended until CMS or the MAC rejects the suspended repayment schedule request or the provider fails to comply with the terms of the extended repayment schedule.
Relationship to Self-disclosure Protocols
The final rule affords special treatment for overpayments that implicate the fraud and abuse laws enforced by the Office of Inspector General (OIG) or the Stark Law enforced by CMS.
Specifically, a person satisfies the reporting obligations of the final rule by making a disclosure under the OIG Provider Self-Disclosure Protocol or the CMS Voluntary SRDP, resulting in a settlement agreement using the process described in the respective protocol:

OIG Provider Self-Disclosure Protocol: The deadline for returning an overpayment is suspended when the OIG acknowledges receiving the submission to the OIG Provider Self-Disclosure Protocol. The repayment deadline remains suspended until a settlement agreement is entered, the person withdraws from the OIG Provider Self-Disclosure Protocol, or the person is removed from the OIG Provider Self-Disclosure Protocol.
CMS Voluntary SRDP: The deadline for returning an overpayment is suspended when CMS acknowledges receipt of the self-disclosure. The repayment deadline remains suspended until a settlement agreement is entered, the person withdraws from the SRDP, or the person is removed from the SRDP.

Effective Date
Although the final rule just went into effect March 14, 2016, providers have been subject to the Affordable Care Act’s provisions for timely reporting and returning of Medicare overpayments since March 23, 2010.
CMS states that provisions of the final rule are not retroactive. Providers who reported and/or returned overpayments prior to March 14, 2016, and who made a good faith effort to comply with the Affordable Care Act’s “report and return” requirements, are not expected by CMS to have complied with each provision of the final rule. All providers reporting and returning overpayments on or after March 14, 2016 — even overpayments received prior to this date — must comply with the requirements of the final rule.
Implementation for Providers
Although healthcare providers have long been obligated to report and return overpayments, providers should take a number of steps in response to the final rule.
Step 1: Providers should implement or review processes to assure they respond appropriately to receiving credible information regarding a potential overpayment. Credible information may include, for example, the discovery of a single, overpaid claim (which may trigger the need to make further inquiries), or one or more hotline complaints regarding the same or similar payment-related issue.
Step 2: Although CMS allows for identifying and quantifying a potential overpayment to occur after a reasonably diligent investigation, providers should be prepared to take no more than six months to complete the investigative process, absent extraordinary circumstances.
Step 3: Providers should maintain records that accurately document their reasonably diligent efforts to demonstrate their compliance with the final rule.
Step 4: Providers should be prepared to look back six years when identifying potential overpayments.
Disclaimer: This information is provided as an educational resource and is not to be construed as providing legal opinion or creating an attorney-client relationship. Any questions regarding obligations under the final rule should be directed to your healthcare attorney.

Julie Roth, MHSA, JD, RHIA, is a partner in Lathrop & Gage, LLP, and is co-chair of the Healthcare Practice Team. She represents healthcare providers on regulatory compliance, Medicare and Medicaid reimbursement issues, self-disclosure matters, government investigations, HIPAA privacy and security standards, the Stark Law, the Anti-kickback Statute, the False Claims Act, and other federal and state laws.