Knowledge Base Article

Before the era of most moms working outside the home and pre-school daycare, the school playground was the first place for serious socialization outside of family for many American children. All over the nation, the school playground foretold of the inevitable societal cliques – there were city kids, country kids, in-crowd, outsiders, do-gooders, trouble makers, and even bullies. One scene that played out during numerous recesses was the bully taking lunch money from a less rambunctious playmate. If the victim wasn’t the pushover the bully thought, he or she might raise their clenched fist and yell, “Give it back now!” Hopefully this outburst attracted the attention of teachers or classmates, a fight was averted, and the wrong righted.

The Centers for Medicare and Medicaid Services (CMS) may seem more like the bully than the victim to many in healthcare, but sometimes providers and suppliers receive monies from CMS to which they are not entitled. In a recent Final Rule, CMS clarified the requirements of their version of “give it back now” or at least within 60 days.

The requirement for refund of overpayments within 60 days of identification has been a law since enactment of the Affordable Care Act (ACA) on March 23, 2010. The sub-regulatory guidance explaining and defining the requirements was finalized in a Final Rule published in the Federal Register on February 12, 2016. According to CMS, this rule provides needed clarity and consistency in the reporting and returning of self-identified overpayments.

Even without this rule, providers and suppliers are subject to the statutory requirements of the Act and could face potential False Claims Act (FCA) liability, Civil Monetary Penalties Law (CMPL) liability, and exclusion from federal health care programs for failure to report and return an overpayment. The ACA requires a person (defined as a provider or supplier) who has received an overpayment to report and return the overpayment by the date which is 60 days after the date on which the overpayment was identified (for claims-based overpayments) or the date any corresponding cost report is due (for cost reporting issues) and to notify Medicare in writing of the reason for the overpayment. Any overpayment retained by a person after the deadline for reporting and returning the overpayment is an obligation that has the potential to trigger FCA liability.

Meaning of Identification

The rule clarified that a provider/supplier has identified an overpayment when they have or should have, through the exercise of reasonable diligence, determined they received an overpayment and quantified the amount of the overpayment. This definition of “identified” allows time for an investigation and quantification of the overpayment amount before the 60 day clock begins. CMS expects a period of six months is sufficient for most investigations unless there are extraordinary circumstances which would be rare. Not all inquires should take six months – providers should prioritize these inquires and complete as soon as possible.

Reasonable Diligence

The definition of “identified” includes an expectation of “reasonable diligence” on the part of providers. CMS discusses two aspects of reasonable diligence - investigations in response to credible information of a potential overpayment and proactive compliance activities.

If a provider obtains credible information concerning a potential overpayment, they should investigate to determine whether an overpayment has been received and to quantify the amount. Credible information supports a reasonable belief that an overpayment may have been received. Examples of information that may be credible and support an investigation to determine if an overpayment occurred include but are not limited to:

• Hotline complaints
• A significant increase in Medicare revenue
• Knowledge of violation of the anti-kickback statute
• RAC audit findings, as well as other Medicare contractor and OIG audit findings

According to CMS, “failure to make a reasonable inquiry, including failure to conduct such inquiry with all deliberate speed after obtaining the information, could result in the provider or supplier knowingly retaining an overpayment because it acted in reckless disregard or deliberate ignorance of whether it received such an overpayment….The 60-day time period begins when either the reasonable diligence is completed or on the day the person received credible information of a potential overpayment if the person failed to conduct reasonable diligence and the person in fact received an overpayment.”

CMS advises providers to maintain documentation of their reasonable diligence efforts to demonstrate their compliance.

The second aspect of reasonable diligence is proactive compliance activities. CMS states that “providers and suppliers have a clear duty to undertake proactive activities to determine if they have received an overpayment or risk potential liability for retaining such overpayment.” A robust and active Compliance Program would include this in the form of an annual compliance risk assessment and compliance work plan. CMS encourages providers to use publicly available information to assist in planning their compliance monitoring activities and reviews, such as the OIG’s annual work plan and CMS notices.

Overpayment

Overpayment is defined as any funds that a person has received or retained under Title XVIII of the Act to which the person, after applicable reconciliation, is not entitled under such title. These funds might be received or retained due to fraud or due to more inadvertent reasons. An overpayment must be reported and returned regardless of the reason it happened – be it a human or system error, fraudulent behavior or otherwise. Overpayment examples given in the rule include:

• Medicare payments for non-covered services
• Medicare payments in excess of the allowable amount for an identified covered service (for example, providers must report and return overpayments resulting from up-coding, whether the inappropriate coding was intentional or not)
• Increases in reimbursement from errors and non-reimbursable expenditures in cost reports
• Duplicate payments
• Receipt of Medicare payment when another payer had the primary responsibility for payment

Overpayment may be the difference between what was paid and the amount that should have been paid or in the case of non-covered services the entire amount. Rules and regulations in effect at the time of the original payment apply, therefore payments that were proper at the time the payment was made do not become overpayments at a later time due to changes in law or regulation, unless otherwise required by law.

Providers may use statistical sampling and extrapolation to calculate an overpayment amount. Where the overpayment amount is extrapolated based on a statistical sampling methodology, the overpayment report must explain how the overpayment amount was calculated.

CMS declined to adopt a minimum monetary threshold related to this rule. They are considering establishing a minimum monetary threshold for cost report-related overpayments that would be published in program guidance or future rulemaking.

Lookback Period

The rule sets the lookback period for self-identified overpayments to six years from the date the overpayment was made. This is a relief from the ten years suggested in the proposed rule, but longer than the lookback period for Recovery Auditors (3 years) or for Medicare contractors (48 months or 4 years). This means that if an overpayment issue is discovered by one of these contractors or through an internal review that could potentially have affected prior claims, providers and suppliers need to determine whether they have received overpayments going back 6 years as stated in this rule.

Reporting and Returning Overpayments

Providers and suppliers may use existing processes, such as an applicable claims adjustment, credit balance, self-reported refund, or another appropriate process to satisfy the obligation to report and return overpayments. Refunds must be sent to the appropriate Medicare contractor according to the applicable administrative process. Overpayment cannot be reported and returned directly to the Department. The reason for the overpayment will likely affect the provider’s decision on which method to use to return the overpayment.

CMS also amended the reopening rules to provide for a reopening period that accommodates the 6-year lookback period for reporting and returning overpayments, and to ensure that the reopening rules do not present an obstacle or unintended loophole to compliance and enforcement of this Act. Providers may request that contractors reopen initial determinations for the purpose of reporting and returning an overpayment.

Medicare contractors are required to process all voluntary refunds and should not return voluntary refund checks. According to CMS there is no reason for a contractor to refuse a refund because a different company was the contractor during the period covered by the refund. CMS may consider a processing deadline for contractors in the future.

CMS accepts the CMS Voluntary Self-Referral Disclosure Protocol (SRDP) and the OIG Self-Disclosure Protocol (SDP) as an appropriate means for returning an overpayment. As indicated in the final rule, “providers and suppliers need to decide who is the most appropriate recipient of the overpayment report and refund as provided in § 401.305(d) – the applicable Medicare contractor, the SDP, or the SRDP. Providers and suppliers should review the SDP and SRDP to determine whether either of those avenues is available.”

In the event that a SDP settlement is not reached, the provider or supplier has the balance of the 60-day time period remaining, from identification to the suspension of that 60-day period when OIG acknowledged receiving the SDP submission, to report and return any overpayment to the contractor.

Cost Reporting, PIP, Outliers, and Overpayments

Below are excerpts from the Final Rule concerning cost reporting and other related overpayment issues.

In the context of cost reporting, the “applicable reconciliation” is the provider's year-end reconciliation of payments and costs to create the cost report. The cost report must be filed within 5 months of the end of the provider's fiscal year end, which allows time to reconcile payments and costs and identify any funds to which the provider is not entitled. This overpayment should be returned at the time the cost report is filed.

If the provider self-identifies an overpayment after the submission and applicable reconciliation of the Medicare cost report, it is their responsibility to follow the procedures in this rule, and report and return the overpayment within 60 days of identification. The provider must use the applicable reporting process for cost report overpayments (submit an amended cost report) along with the overpayment refund. The amended cost report must include sufficient documentation and data to identify the issue in order for the MAC to adjust the cost report.

If the overpayment is identified by the MAC during the cost report audit, the MAC will determine and demand the exact amount of the overpayment at final settlement of the cost report. If the MAC notifies a provider of an improper cost report payment, the provider has received credible information of a potential overpayment and must conduct reasonable diligence on other cost reports within the lookback period to determine if it has received an overpayment.

Overpayments as a result of PIP payments would be reported and returned at the time the initial cost report is due. There is no applicable reconciliation until the PIP payments are dealt with in the cost report process. However, if a provider is aware that their PIP payment may not be accurate, they should continue with normal business practices and inform its MAC of the issue.

An overpayment as a result of an outlier reconciliation would be identified once the provider receives that information from its MAC as part of the cost report settlement process. The provider is not responsible for attempting to identify the cost report outlier reconciliation overpayment in advance of the MAC's reconciliation calculation. However, for claims, if the provider identifies an inaccurate outlier claim payment, the provider must follow the overpayment payment reporting process for claims, as noted in this final rule.

Provider Liability

The Final Rule makes it clear that an overpayment refund does not negate any potential liability the provider or supplier may have for the overpayment issue. Although CMS will not recover an overpayment twice, they do not exempt claims that form the basis for a returned overpayment from subsequent audit by CMS, a CMS contractor or the OIG. In addition Medicare contractors may refer potential fraudulent conduct to law enforcement.

This is certainly a lot of information to simply say “give it back now” but that is the government for you. I have tried to relay some important aspects of the Reporting and Returning Overpayments Final Rule, but encourage financial, compliance and legal personnel of providers and suppliers to read the entire rule for the best understanding.