On February 11, 2016, the Centers for Medicare and Medicaid Services (“CMS”) released for publication its final rule for the Reporting and Returning of Overpayments under Medicare Part A and Part B (the “Final Rule”). The Final Rule was published today in the Federal Register and can be found here. CMS’ proposed rule regarding the reporting and return of overpayments under Medicare Part A and Part B was published on February 16, 2012 (the “Proposed Rule”).

CMS made significant revisions in the Final Rule to when a provider or supplier has “identified” an overpayment and how far back the provider or supplier must look when determining the overpayment (i.e, the “lookback” period) that should alleviate some of the burden placed on Medicare providers and suppliers.

The Affordable Care Act established 42 U.S.C. § 1320a-7k(d) which requires a provider or supplier who has received an overpayment to report and return the overpayment to the Secretary, the state, an intermediary, a carrier, or a contractor, as appropriate, at the correct address, and to notify the Secretary, the state, an intermediary, a carrier, or a contractor to whom the overpayment was returned in writing of the reason for the overpayment (the “Overpayment Reporting and Return Statute”). The overpayment must be reported and returned within 60 days of the provider or supplier identifying the overpayment.

The Final Rule sets forth, among other items, when an overpayment has been identified, the “lookback” period for reporting an overpayment, and the method to report and return overpayments.

Identification of an Overpayment

The determination of when a provider or supplier has “identified” an overpayment is critical. The 60 day window for a provider or supplier to report and return the overpayment under the Overpayment Reporting and Return Statute begins on the date the provider or supplier identifies an “overpayment,” not when the overpayment was received by the provider or supplier.

As the primary purpose of the statute was to codify a provider or supplier’s obligation to report and return an overpayment, CMS’ primary focus in defining when a provider or supplier identifies overpayment was addressing the “ostrich defense” – i.e., avoiding the reporting and repayment obligation by not taking action to obtain actual knowledge of the overpayment.

The standard under the Proposed Rule was that a provider or supplier identified an overpayment when it had “actual knowledge” of the overpayment or acted in “reckless disregard or deliberate ignorance” of a potential overpayment. However, commenters expressed concern that “reckless disregard” and “deliberate ignorance” standards were too ambiguous and did not provide sufficient guidance as to what steps were necessary to avoid overpayment liability.

Under the Final Rule, a provider or supplier has identified an overpayment when the provider or supplier has or should have, through the exercise of reasonable diligence, determined that the provider or supplier has received an overpayment and quantified the amount of the overpayment. According to CMS, “reasonable diligence” include proactive compliance activities (i.e., monitoring of payments) and good faith and timely investigations in response to credible information of a potential overpayment. CMS emphasized that all suppliers and providers have a clear duty to undertake proactive compliance activities to determine if they have received overpayments, including retroactive reviews.

With respect to “actual knowledge,” commentators also suggested that a senior official must confirm an overpayment before an organization has “knowledge” of an overpayment. However, CMS rejected these concerns because, as a general matter, organizations are responsible for the activities of their employees and agents at all levels.

The 60 day period to report and return an overpayment begins after the “reasonable diligence” has been completed (or on the day the provider or supplier received credible information of a potential overpayment if the provider or supplier does not conduct reasonable diligence). Furthermore, an overpayment is not identified until the provider or supplier completes, with reasonable diligence, the auditing work necessary to calculate and quantify the amount of the overpayment.

Consequently, a provider or supplier’s obligation to report and return an overpayment does not begin until it has completed a good faith, timely investigation and calculated and quantified the overpayment.

Lookback Period

If a provider or supplier identifies a pattern of overpayments that occurred over time, one of the first issues to be addressed is how far back does a provider or supplier have to look to identify overpayments?

Under the Proposed Rule, if a provider or supplier identified an overpayment within 10 years of receipt, then a provider or supplier would have had an obligation to report and return the overpayment. CMS based its proposed lookback period on the outer limits of the lookback period under the False Claims Act. Additionally, CMS proposed to amend the reopening regulations to provide for a look back period of 10 years for consistency.

However, commenters objected that the Overpayment Reporting and Return Statute did not provide a basis to establish a new lookback period for reopenings. Furthermore, they felt it was inappropriate to apply the lookback period under the False Claims Act to all overpayments because the False Claims Act was a fraud enforcement statute and many overpayments are caused by errors or mistakes that do not rise to the level of fraud.

Under the Final Rule, a provider or supplier must report and return an overpayment only if it is identified within 6 years of the date the overpayment was received. Additionally, the rules governing reopenings have been amended to include a 6 year lookback period.

How to Report and Return Overpayments

Under the Final Rule, in order to preserve existing processes (and CMS’ ability to modify or create new processes), providers and suppliers must use an applicable claims adjustment, credit balance, self-reported refund, or another appropriate process to satisfy the obligation to report and return overpayments.

Medicare Parts C and D, Medicaid

The Final Rule only applies to overpayments identified with respect to Medicare Parts A and B. CMS previously finalized the rules under Medicare Part C and D on May 23, 2014 (link). Although CMS has not issued rules with respect to Medicaid, CMS emphasized that the Overpayment Reporting and Return Statute still applies to Medicaid, and that any overpayments identified with respect to Medicaid must be reported and returned in accordance with the Overpayment Reporting and Return Statute.

Overpayments Due to Anti-kickback, Stark or Other Violations Subject to Self-Disclosure Protocols

Under the Final Rule, if a provider or supplier makes a disclosure under the OIG Self-Disclosure Protocol (e.g., anti-kickback violations, unlicensed individuals, excluded persons) or the CMS Self-Disclosure Protocol (e.g., Stark Violations), CMS will suspend the 60 day period for the provider or supplier to return the associated overpayments until a settlement agreement is entered, or the supplier or provider withdraws or is removed from the self-disclosure protocol.

Further, CMS reemphasized its belief that only parties to a kickback scheme would be required to repay any overpayment. CMS stated that it recognizes that an innocent provider or supplier is often not a party to, and is unaware of the existence of, a kickback arrangement between third parties that causes the provider or supplier to submit claims that are subject to a kickback. For example, a hospital may not be aware that a device manufacturer has paid a kickback to a surgeon to induce the surgeon to select a medical device used during a procedure at the hospital.

To the extent that an innocent provider or supplier has sufficient knowledge of a kickback arrangement to have identified an overpayment, however, CMS emphasized that the innocent provider or supplier must still report the overpayment. If the overpayment was not reported under the OIG Self-Disclosure Protocol, CMS would forward the matter to the OIG and suspend the repayment obligations until the government had resolved the kickback matter. CMS believes that any enforcement efforts would most likely focus on the perpetrators of the kickback arrangement and expects that only parties to a kickback scheme would be required to repay any overpayments.

Conclusion

The Final Rule becomes effective on March14, 2016. However, the Final Rule represents CMS’ interpretation of the Overpayment Reporting and Return Statute with respect to Medicare Parts A and B. Since CMS emphasized that the Overpayment Reporting and Return Statute is in effect and that providers and suppliers have an obligation to report and return any overpayments (even when the regulations were not final), providers and suppliers need to begin to take steps to prepare to comply with the Final Rule.

Providers and Suppliers should revisit compliance and claims processing activities. CMS’ comments in the Final Rule make it clear that CMS believes that providers and suppliers have a clear obligation to have a proactive compliance function to identify overpayments, including retroactive review if appropriate.