The Centers for Medicare and Medicaid Services (“CMS”) has clarified the reporting requirements and lookback period for overpayments from Medicare Parts A and B in Final Rule 6037 (“Final Rule”), issued by CMS on February 12, 2016. The regulations set forth in the Final Rule took effect March 14, 2016.
The Patient Protection and Affordable Care Act established a new section of the Social Security Act requiring a person who has received an overpayment from Medicare or Medicaid programs to “report and return the overpayment the later of: (a) the date which is 60 days after the date on which the overpayment was identified; or (b) the date any corresponding cost report is due.” 42 U.S.C. § 1128J(d). Failure to comply with the 60-day reporting and repayment requirement subjects providers to possible False Claims Act liability. See 31 U.S.C. 3729(b).
Prior to the Final Rule, there was much confusion regarding what it means to have “identified” an overpayment, and when the 60-day reporting period began. In September, we wrote about the lack of CMS guidance and how courts were creating their own standard for “identified” to fill the gap. For example, in United States ex rel. Kane v. HealthFirst Inc., Civil Action No. 11-cv-02325 (S.D.N.Y. June 27, 2014), the Court defined “identified” to mean “when a provider is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained.” See HealthFirst Order Denying Mot. to Dismiss, at 6.
The Final Rule clarifies that a person has identified an overpayment “when the person has or should have, through reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” 81 F.R. 7654. The language “quantified the amount of the overpayment” was not part of CMS’s 2012 proposed rule and was added to the Final Rule. See 77 F.R. 9182. CMS has now clarified through its Final Rule that the determination of the amount of an overpayment, whether through statistical sampling and extrapolation or some other means, factors into whether the overpayment is, in fact, “identified.”
The standard for “identified” in the 2012 proposed rule tied the threshold obligations for compliance to identifying the overpayment. The same is true of the Final Rule, but the standard for compliance is conclusively established. The proposed rule stated that a person has identified an overpayment if the person has “actual knowledge” of the existence of the overpayment or “acts in reckless disregard or deliberate ignorance” of the overpayment. 42 C.F.R. § 401.305(a). This prior definition purposefully tied the standard for “identified” to the “knowing” standard under the False Claims Act and was included to incentivize providers to determine whether an overpayment exists. See 31 U.S.C. § 3729(b)(1). After receiving comments arguing against such an expansive standard, the Final Rule simply uses the term “reasonable diligence” for a provider’s duty to investigate. CMS explains that “reasonable diligence” still acts to incentivize providers to determine whether an overpayment was received, as it covers both proactive compliance activities to monitor claims and reactive investigative activities undertaken in response to credible information about a potential overpayment. 81 F.R. 7661. According to CMS, the concept of “reasonableness” is “fact-dependent,” and “is demonstrated through the timely, good faith investigation of credible information which is at most six months from receipt of the credible information, except in extraordinary circumstances.” 81 F.R. 7662.
Commencement of 60 Day Timeline.
CMS further clarified the reporting requirement by developing a bright-line standard regarding the starting point for the 60-day timeline. In the preamble to the Final Rule, CMS states:
The 60-day time period begins either when the reasonable diligence is completed and the overpayment is identified or on the day the person received credible information of a potential overpayment if the person fails to conduct reasonable diligence and the person in fact received an overpayment.
In other words, providers have 60 days to report and return an overpayment only after reasonable diligence has been completed and the amount of the overpayment is determined. See 81 F.R. 7664. The 60-day reporting period does not begin to run until the conclusion of reasonable diligence, which is at most six months from receipt of credible information that an overpayment exists. This clarification is a relief to providers who were concerned about their inability to identify, report and return an overpayment within the previous 60-day timeline.
Six Year Lookback.
The Final Rule also specifically requires that overpayments be reported and returned only if a person identifies the overpayment within six years from the date the overpayment was received. See 42 C.F.R. § 401.305(f). The six-year lookback period is a change from the 2012 proposed rule, which established a lookback period of 10 years. However, six years is the more commonly-used statute of limitations under the False Claims Act and is consistent with the medical record retention requirements for Medicare Part B providers as well as the HIPAA requirements for maintaining documentation of compliance policies. See 81 F.R. 7671; 45 C.F.R. 164.316(b)(2). The six-year lookback period is measured from the date the person identifies the overpayment.
Method of Repayment.
Regarding the final step of how to actually report and return an overpayment, the Final Rule allows providers to use claims adjustment, credit balance, self-reported refund process or another appropriate process to report and return overpayments. The 13 elements to be reported from the 2012 proposed rule are no longer required. See 42 C.F.R. § 401.305(d). Instead, CMS suggests using the most applicable process set forth by a provider’s Medicare contractor. If the overpayment amount is based on an extrapolation, the Final Rule requires that the report explain how the overpayment amount was calculated by statistical sampling methodology.
The Final Rule adds some objectivity to the 60-day reporting and repayment standard and is less onerous to providers and suppliers than earlier direction. The Williams Mullen Health Care Group will continue to monitor the issue.
 In May, 2014, CMS issued a final rule addressing overpayments from Medicare Parts C & D. See 42 C.F.R. §§ 422.326(c) & 360(c).
 Ruth A. Levy & Patrick C. Devine, Jr.; “The Definition of Identify: The 60-Day Rule,” September 2, 2015.
 Six months was chosen as the timeframe for investigation because CMS believes it is short enough to cause providers to prioritize such investigations, but long enough to allow the devotion of resources and time to complete the investigation. See 81 F.R. 7662.