CMS Issues Proposed Regulations to Guide Providers and Suppliers in Complying with Mandate to Report and Return Medicare Overpayments

Mar 05, 2012


Signed into law on March 23, 2010, the Patient Protection and Affordable Care Act (“PPACA”), or federal health care reform act, included a provision (the “Report and Refund Mandate”), broadly requiring health care providers, suppliers and managed care organizations that have received an “overpayment” from the Medicare or Medicaid program to report and return the overpayment within 60 days of the date when the overpayment was “identified.”  See PPACA Section 6402(a).  The penalties for noncompliance provided in Section 6402(a) are severe – subjecting a provider to liability under the False Claims Act, Civil Monetary Penalties Law and possible exclusion from participation in federal health care programs.  Yet in the nearly two years since the Report and Refund Mandate was enacted, the federal government had provided no guidance about exactly what a provider was supposed to do -- how, when, to whom to report and refund an overpayment   -- in order to comply with the Reporting and Refund Mandate. 

CMS Proposed Regulations

Finally, on February 16, 2012, the Centers for Medicare and Medicaid Services (“CMS”) weighed in and announced proposed regulations (the “Proposed Regulations”) outlining the steps that Medicare providers and suppliers are to take when they have “identified” an “overpayment,” and providing some clarity as to what those key terms actually mean.  See 77 Federal Register 32 at 9179-9187.  This memorandum will discuss CMS’ Proposed Regulations and highlight a few apparent differences with the guidance already provided about the Report and Refund Mandate by the New York State Office of the Medicaid Inspector General (“OMIG”), interpreting the same provisions of PPACA.

What Providers and Suppliers Are Subject to the Proposed Regulations?  Despite the broad reach of Section 6402(a) of PPACA, the Proposed Regulations apply only to “providers” -- hospitals, skilled nursing facilities, rehabilitation facilities, home health agencies, and hospices reimbursed under Medicare Part A -- and to “suppliers” -- physicians or other practitioners reimbursed under Part B.  Medicaid overpayments and managed care organizations will be “addressed at a later date.”  CMS nevertheless reminds Medicare Advantage plans, Medicaid managed organizations, and others that they too must still comply with the Report and Refund Mandate in the absence of any regulatory guidance.  77 Fed. Reg. at 9180.

What Constitutes an Overpayment?  In the Proposed Regulations, CMS merely recites the definition of an “overpayment” in Section 6402(a) without further explication.  (An overpayment is defined in the statute as “any funds that a person receives or retains . . . to which the person, after applicable reconciliation, is not entitled.”)  In the preamble to the Proposed Regulations, however, CMS does provide examples of overpayments for illustrative purposes:

  • Medicare payments for noncovered services.
  • Medicare payments in excess of the allowable amount for an identified covered service.
  • Errors and nonreimbursable expenditures in cost reports.
  • Duplicate payments.
  • Receipt of Medicare payment when another payor had the primary responsibility for payment.

In the case of cost-based Medicare reimbursement (e.g., for a hospital’s graduate medical education), CMS makes clear that an “overpayment” does not occur until “after an applicable reconciliation takes place,” when the cost report is due.  

When is an Overpayment “Identified” for Purposes of Triggering the 60-Day Report and Refund Mandate?  Section 6402(a) of PPACA left undefined the operative term -- when an overpayment has been “identified” -- that triggers the 60-day window to report and refund the overpayment.  In its Proposed Regulations, CMS attempts to fill in the statutory void by equating “identified” in Section 6402(a) with the criteria for the term “knowing” under the federal False Claims Act, 31 U.S.C. Section 3729(b).  As CMS notes, Section 6402(a) does define “knowing” as having the same meaning as that term is defined in the federal False Claims Act.  Moreover, tying the Report and Refund Mandate to the federal False Claims Act is consistent with the related provision in PPACA, making the “knowing” retention of an overpayment actionable as a “false claim.” 

Specifically, the Proposed Regulations state that a provider has “identified” an overpayment if the provider has “actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment” -- precisely how the term “knowing” is defined under the federal False Claims Act.  CMS’ logic for adopting this definition is to give providers and suppliers an incentive to exercise reasonable diligence to determine whether an overpayment exists.  In this regard, CMS suggests that the 60-day clock commences once the provider has identified the existence of an overpayment, if not the exact amount.  Such an interpretation would be consistent with OMIG’s guidance.

CMS observes that in some cases, a provider may receive information about a potential overpayment that is insufficient to determine whether the provider was in fact overpaid.  In those cases, the provider must make “reasonable inquiry” to make that determination.  Thus, the 60-day period would not necessarily begin to run unless and until reasonable inquiry reveals that the provider was overpaid.  The Proposed Regulations do not specify how long a provider may take to conduct its reasonable inquiry other than to state that it must be conducted “with all deliberate speed” -- introducing an element of uncertainty to the analysis.

Examples provided by CMS to demonstrate when an overpayment has been “identified” include:

  • A provider that has reviewed its billing records and learns that it incorrectly coded certain services resulting in increased reimbursement.
  • A provider learns that a patient death occurred prior to the service date.
  • A provider learns that services were provided by an unlicensed or excluded individual.
  • A provider performs an internal audit and discovers that an overpayment exists.
  • A provider is informed by a government agency of an audit that discovered a potential overpayment, and the provider fails to make a reasonable inquiry.
  • A provider experiences a significant increase in Medicare revenue and there is no apparent reason for the increase.

Cost-based Provider: The cost-based provider must report and return the overpayment within 60 days of the date it identified the overpayment or on the date the cost report is due, whichever is later.

How Far Back in Time Do Providers Have to Look for an Overpayment?  In the preamble and Proposed Regulations, CMS indicates that an overpayment must be reported and returned if a provider identifies the overpayment within 10 years of the date the overpayment was received.  CMS explained that it selected a 10-year period to coincide with the 10-year statute of limitations in the False Claims Act. 

The expectation of a “look back” of 10 years, when records may not be readily available and staff no longer employed, is far more onerous and presents far greater compliance risks to providers than OMIG's guidance.  OMIG stated that it “will not require or expect providers to look back more than six years from the date of disclosure unless the disclosure involves a base year cost report, or OMIG determines that there is a basis to suspect fraud.”  As OMIG explained, “[t]he test is when the problem is identified. It can go back up to six years so that there is a point where the provider can explain when and how the problem started.”

How is the Overpayment to be Reported and Returned?  Consistent with Section 6402(a) of PPACA, CMS proposed that (absent evidence of fraud) overpayments should be voluntarily reported and returned to either CMS, a fiscal intermediary, a Part B carrier, or a Medicare contractor.  To do so, a provider is to use the existing voluntary refund process that is described in Publication 100-06, Chapter 4 of the Medicare Financial Management Manual.  Pursuant to this process, a provider is to report and refund overpayments using a form that each Medicare contractor makes available on its web site until CMS makes available a uniform reporting form, now being developed. 

The voluntary refund process requires providers to explain why the refund is being made and include other detail about the circumstances of the overpayment:

  • How the error was discovered;
  • A description of the corrective action plan implemented to ensure the error does not occur again;
  • The reason for the refund;
  • Whether the provider or supplier has a corporate integrity agreement with the OIG or is under the OIG Self-Disclosure Protocol;
  • The timeframe and the total amount of refund;
  • Medicare claim control number and Medicare National Provider Identification number;
  • A refund of the overpayment1; and
  • If a statistical sample was used to determine the overpayment amount, a description of the statistically valid methodology.

Note that OMIG has created its own form that providers can use when making the required disclosures to OMIG.  Additionally, unlike the voluntary refund process described above, OMIG advises that in the OMIG’s Self-Disclosure Protocol, providers are not required or expected to refund the overpayment until the amount has been verified by OMIG.

When are Self-Disclosures Made Directly to the OIG?  There are also existing procedures for reporting self-discovered overpayments that are the result of potential fraud, or that involve violations of Federal criminal, civil or administrative laws -- to the OIG through the OIG Self-Disclosure Protocol.  CMS explains that providers and suppliers should ensure that they are using the most appropriate process to report and return overpayments, and notes that disclosing overpayments that do not suggest violations of law are not appropriately disclosed through the OIG Self-Disclosure Protocol.  (OMIG’s Self-Disclosure Protocol covers not only potential instances of fraud, but also intentional or unintentional substantial routine errors, systemic errors, or patterns of errors.)  According to CMS, once a provider does self-disclose to the OIG, that self-disclosure would satisfy the reporting requirements set forth in its Proposed Regulations.  However, CMS does not indicate whether it would ever be appropriate to disclose overpayments associated with a violation of law through the voluntary refund process in Pub. 100-06, as opposed to the OIG Protocol. 

In any event, if an overpayment involving a violation of law is disclosed to the OIG, CMS explains that it would suspend the obligation to return the overpayment under Section 6402(a) of PPACA once OIG acknowledges receipt of the submission.2

Cost of Compliance With CMS Proposed Regulations:  Throughout the Federal Register, CMS underscores the importance of timely compliance with the Report and Refund Mandate, through, among other things, repeated reference to the high-stakes penalties that providers face for noncompliance.  Moreover, as CMS has proposed, in order to make a report that comports with the Proposed Regulations, providers must first conduct an investigation to find out about a host of particulars about the overpayment, including the timeframe and scope of the overpayment as well as the reason for the overpayment.  Given the substantial risk posed by noncompliance and the level of detail needed to satisfy the Report and Refund Mandate as proposed by CMS, a provider would likely need to invest considerable personnel hours and resources before it can even begin to fill out the self-disclosure form.  This would be especially true if a provider were required, as CMS has proposed, to look back 10 years to identify and report -- with the requisite level of information   -- on overpayments that are a decade old.

Yet, in what appears to be a stark departure from “real world” compliance, CMS estimates that it will only take on average approximately 2.5 hours, utilizing accountants and auditors and in-house administrative personnel only, and cost a mere $92.75.  77 Fed. Reg. at 9184-9185.  In the case of many identified overpayments, however, a provider will need to marshal much more resources to be in a position to complete the report called for under the Proposed Regulations.  Likewise, in those cases, the actual time and associated cost of compliance will likely exceed the 2.5-hour/$92.75 estimate by several-fold.  Indeed, spending only 2.5 hours and relying on in-house staff alone on a given self-disclosure could put a provider at risk of noncompliance with the very regulations that CMS is now proposing.  In this regard, OMIG suggests that “[b]ecause of the complexity of some issues surrounding self-disclosures, providers may want to consider obtaining the advice of experienced healthcare legal counsel or consultants.”  Moreover, communicating to the provider community that, generally speaking, 2.5 hours should be enough time to satisfy the Report and Refund Mandate, could be misconstrued to mean in effect that the organization need not commit much time and effort to comply with this important provision of law.

When Will CMS’ Proposed Regulations be Finalized?  The Proposed Regulations are subject to a 60-day comment period, which remains open until April 16, 2012.  Although CMS will accept comments with respect to any issue contained in its Proposed Regulations, it has specifically invited comments to the following provisions:

  • Whether the proposed 10-year lookback period is appropriate;
  • Whether CMS’ economic assessment of the costs of providers for complying with the reporting and returning requirements is accurate; and
  • With respect to the CMS Medicare Self-Referral Disclosure Protocol, whether there are any alternative approaches that would allow providers to avoid making multiple reports of identified overpayments.

While the Proposed Regulations will not be finalized until after the comment period, the Proposed Regulations provide CMS’ first formal occasion to offer guidance on many of the issues that have challenged providers as they try to understand their responsibilities under PPACA’s Report and Refund Mandate. In light of this guidance, providers may wish to revisit their current policies and procedures for reporting and returning overpayments. In any event, providers should look forward to the finalized regulations as well as any new regulations affecting other government-funded programs besides Medicare Parts A and B for more definitive guidance.

1   CMS explains that if a provider requires additional time to make the repayment, the provider must use the existing Extended Repayment Schedule outlined in Publication 100-06, Chapter 4 of the Financial Management Manual to request such additional time.

2   Overpayments that have resulted from actual or potential violations of the physician self-referral statute are to be reported and returned to CMS through the Medicare Self-Referral Disclosure Protocol.  CMS proposes to suspend the obligation to return overpayments under Section 6402(a) of PPACA when it acknowledges receipt of a disclosure made pursuant to the Self-Referral Disclosure Protocol.  However, a provider must also still report the overpayment in the manner set forth in CMS’ Proposed Regulations.



June 27: SFIG Legal Counsel Forum 2018

Partners Scott Cammarn and Neil Weidner will be speaking at this event in New York City.

Cadwalader's research and intelligence platform provides analysis on changes in U.S. financial regulation. Subscribers receive a daily newsletter interpreting new laws, rules and enforcement actions that impact financial institutions.