By: Harry Silver
The Centers for Medicare & Medicaid Services (CMS) has issued its Final Regulations interpreting the Affordable Care Act (ACA)-imposed 60-Day Rule which requires healthcare providers and suppliers to return overpayments received from Medicare within 60 days of their "identification." As discussed in a previous Client Bulletin, the ACA does not specify what constitutes the “identification” of an overpayment, leaving providers and suppliers to make an educated guess as to when the 60-day clock starts. There are serious consequences for a wrong guess because failure to comply with the 60-Day Rule constitutes a violation of the False Claims Act. The Final Regulations are intended to provide "needed clarity and consistency." 81 Fed. Reg. 7654 (Feb. 12, 2016).
The Final Regulations essentially adopt the Proposed Regulations, with modifications that address concerns raised by providers and suppliers in rulemaking comments.
- CMS modified its proposed definition of “identified” to give providers more flexibility as well as a degree of certainty. While the Proposed Regulations simply repeated the statutory language verbatim, the Final Regulations provide that an overpayment has been identified only after one (a) "has, or should have through the exercise of reasonable diligence, determined" that an overpayment has been received; and (b) "has quantified the amount of the overpayment.”
- CMS declined to limit the duty to conduct self-audits to instances in which a provider or supplier has received information about a possible overpayment. Rather, CMS stated that the “the exercise of reasonable diligence” includes a duty to proactively monitor claims submitted to Medicare to prevent overpayments or to catch them early.
- The Proposed Regulations would have required an overpayment to be reported and returned if it was identified within 10 years of its receipt (the “lookback period”). The Final Regulations reduced the “lookback period” to 6 years.
Definition of “Identified”
CMS’s Proposed Regulations provided that an overpayment has been “identified” when a person has “actual knowledge of the existence of an overpayment, or acts in reckless disregard or deliberate ignorance of the overpayment.” Because this definition merely repeats the language used in the ACA, it would have done little to provide the guidance needed by providers and suppliers. As a result, CMS modified its proposed definition to provide that an overpayment has been “identified” when a provider or supplier “has, or should have through the exercise of reasonable diligence, determined” that an overpayment has been received and has “quantified the amount of the overpayment.” “Reasonable diligence” requires a self-audit to determine whether an overpayment exists and, if so, the amount of the overpayment. In addition, providers and suppliers are required to determine whether there are additional overpayments resulting from the same issue.
The Proposed Regulations would have required providers and suppliers to conduct a reasonable inquiry “with all deliberate speed" after receiving information about a possible overcharge. In issuing the Final Regulations, CMS stated that "all deliberate speed" means that a provider or supplier has up to six months to conduct a reasonable inquiry after receiving credible information about a possible overpayment. The 60-day clock starts after completion of the reasonable inquiry.
The Final Regulations apply only to Medicare Parts A and B, not Parts C and D or Medicaid. CMS has previously issued regulations applicable to Parts C and D. Those regulations provide that an overpayment has been identified when a Medicare Advantage organization or Part D sponsor "has determined, or should have determined through the exercise of reasonable diligence, that [it] has received an overpayment.” A provider or supplier then has 60 days to correct the incorrect data that caused the overpayment to be made.
It is worth noting that the only court to interpret the word “identified,” as used in the 60-Day Rule, Kane v. Healthfirst, Inc, 2015 WL 4619686 (SDNY Aug. 3, 2015), concluded that an overpayment has been "identified" once a provider or supplier receives information indicating that there is the possibility of an overpayment. Because the case involved Medicaid managed care, the Final Regulations are not directly applicable. Nevertheless, the validity of the court’s ruling is questionable, at best, because neither the regulations applicable to Parts A and B, nor those applicable to Parts C and D, start the 60-day clock on the day a provider or supplier receives information about a possible overpayment. An in depth analysis of the Kane decision can be found in the January 2016 issue of Compliance Today.
Clear Duty to Undertake Proactive Activities to Ensure Accuracy of Claims
In adopting the Final Regulations, CMS expressly declined to limit the standard for an “identified” overpayment to instances in which the provider or supplier has simply received information concerning a possible overpayment. CMS did not want to create a disincentive to undertaking “proactive compliance activities” to ensure that providers and suppliers “have properly received Medicare payments." Thus, in response to comments objecting to the suggestion in the Proposed Regulations that there is a "perpetual duty" to "proactively search for overpayments without a reason to believe that a specific overpayment exists," CMS unequivocally stated that "providers and suppliers have a clear duty to undertake proactive activities to determine if they have received an overpayment or risk potential liability for retaining such overpayment." Indeed, while smaller providers and suppliers stated that they that they lack the resources to conduct the required investigations, CMS stated that all providers and suppliers, regardless of size, "have a duty to ensure their claims to Medicare are accurate and appropriate and to report and return overpayments they have received."
CMS stressed that compliance programs should do both “proactive and reactive reviews of Medicare billing.” This is a clear warning to providers and suppliers that there is a duty to monitor Medicare billings for accuracy in order to prevent overpayments, or at least catch them early. Regular self-audits are the best way to detect possible overpayments allowing them to be addressed promptly.
In adopting the Final Regulations, CMS expressly declined to adopt a rule that would bar liability for whistleblower actions under the False Claims Act after a provider or supplier has submitted a valid report of an overpayment. This means that it would be prudent to conduct self-audits, if possible, in a way that minimizes employee involvement in order to reduce the chances of an employee initiating a whistleblower action, under the False Claims Act, before the issue can be addressed.
The "Lookback Period"
The Final Regulations require overpayments to be reported and returned if it was identified within 6 years of its receipt. CMS had proposed a lookback period of 10 years but comments pointed out that many providers and suppliers only retain records and claims data for 6-7 years, and that requiring a longer lookback period would be burdensome and costly. These comments persuaded CMS to reduce the lookback period to 6 years.
Conclusion
In the event a provider does receive information suggesting possible overpayments, there are self-protective steps that can — and should — be taken to avoid liability. Medicare providers and suppliers should, obviously, follow the applicable Final Regulations (Parts A & B or C & D).
There are no applicable rules for Medicaid. Medicaid providers and suppliers that, in good faith, follow the rules applicable to Medicare would not appear to be violating the False Claims Act, which requires actual knowledge, reckless disregard or deliberate ignorance of a false claim. In any event, providers and suppliers under both Medicare and Medicaid should take protective measures upon learning of a possible overpayment. Such protective measures include the following:
- Immediately undertake an investigation, or self-audit. This investigation can involve legal counsel and/or accountants.
- Prepare a memo to file specifying the date on which the information was initially received, the nature of the information, the steps undertaken to initiate an investigation, and the date on which the steps were taken.
- State in the memo that these actions have been taken in reliance on the Medicare Final Regulations.
- Prepare a monthly updated memo to file documenting the progress that has been made, and the status of the investigation.
For questions about this Bulletin, please contact the author, Harry Silver, a Counsel at Potomac Law and developer of CleanClaim--a thorough, cost-effective self-audit program--whose practice concentrates in healthcare compliance and enforcement matters.
______________________________________
Note: This Bulletin is not intended as legal advice. Readers should seek professional legal counseling before acting on the information it contains.
