The U.S. District Court for the District of Columbia handed down a major victory to Medicare Advantage issuers on September 7, 2018, vacating a 2014 CMS regulation relating to Medicare Advantage overpayments. While the holding rested on several grounds, perhaps most importantly, the court held that the regulation improperly expanded the scope of liability under the False Claims Act (FCA). In the court’s words: “Not being Congress, CMS has no legislative authority to apply more stringent standards to impose FCA consequences through regulation.” Op., at 28.

The regulation was issued in connection with the Affordable Care Act’s (ACA) requirement that Medicare Advantage issuers must report and return any overpayments received from CMS within a 60-day period following the “identification” of such overpayments. Id. at 10. The failure to do so subjects issuers to liability under the FCA.

While the ACA established a basic statutory framework, it left “several crucial terms undefined.” Id. at 11. Against this backdrop, CMS promulgated the Overpayment Rule, attempting to fill the holes in the statutory scheme.

The Overpayment Rule elaborated on two key elements: (1) what constitutes an “overpayment;” and (2) the point at which an issuer is deemed to have “identified” an overpayment, triggering the 60-day reporting period (and ultimate FCA liability for the failure to do so).

Under the final rule, an “overpayment” occurs when an issuer receives a risk-adjusted payment from CMS for an enrollee, even though the enrollee’s medical diagnosis was inadequately documented. An issuer is deemed to have “identified” an overpayment “when it has determined, or should have determined through the exercise of reasonable diligence” that it received an overpayment. 79 Fed. Reg. 29,844, 29,923. Reasonable diligence would require “at a minimum . . . proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments.” Id.

Plaintiff United Healthcare, a large national Medicare Advantage plan issuer, commenced an action under the Administrative Procedure Act (APA) challenging the Overpayment Rule and its definitions of “overpayment” and the “identification” of them.

Among other arguments, United asserted that the Overpayment Rule’s definition of “identification,” which requires reasonable diligence and proactive compliance activities, improperly created a new, lower negligence standard to liability under the FCA. As United explained in its briefing: “Under CMS’s new definition, MA plans potentially are subject to this punitive liability based on merely negligent inaction (i.e., failing to proactively search for and find overpayments) – a stark departure from the normal rule that the False Claims Act does not allow liability based only on negligence.” United Br., at 44. The court agreed with United and struck down the Overpayment Rule on this ground (among others).

In holding that the Overpayment Rule improperly expanded FCA liability, the court explained that FCA liability is limited to false claims that are submitted to the government “knowingly.” “‘Knowingly’ is a term of art defined in the FCA to include false information about which a person ‘has actual knowledge,’ ‘acts in deliberate ignorance of the truth or falsity of the information,’ or ‘acts in reckless disregard of the truth or falsity of the information.’ . . . Congress clearly had no intention to turn the FCA, a law designed to punish and deter fraud, into a vehicle for either punishing honest mistakes or incorrect claims submitted through mere negligence or imposing a burdensome obligation rather than a limited duty to inquire. With those proscriptions in mind, the 2014 Overpayment Rule extends far beyond the False Claims Act and, by extension the Affordable Care Act.” Op., at 27-28.

The court also took issue with CMS’s attempt to sidestep the APA’s procedural requirements by significantly altering the definition of “identification” between the proposed and final versions of the Overpayment Rule. In the proposed rule, CMS defined “identified” in a way that more closely mirrored the FCA, requiring actual knowledge, reckless disregard or deliberate ignorance. Notably absent from the proposed rule were the requirements of “reasonable diligence” or “proactive compliance” requirements imposed by the final Overpayment Rule.

The court held that the final rule’s stark departure from the proposed rule by imposing reasonable diligence requirements violated the APA. As the court explained, a regulation “violates the APA if it is not a logical outgrowth of the agency’s proposed regulations.” Id. at 29. The imposition of reasonable diligence was not a “logical outgrowth” of the proposed rule, and thus invalid under the APA. The court explained that CMS effectively “pull[ed] a surprise switcheroo on regulated entities by adopting an interpretation that significantly departs from the one proposed.” Id.

The ruling, while a victory for issuers regarding the Overpayment Rule, is also a victory for issuers in a broader sense, in that it serves as a strong reminder that agencies cannot enlarge the FCA’s scope through regulation.