Former U.S. Prosecutors & Defense Counsel
About Oberheiden & McMurrey LLP
Oberheiden & McMurrey represents Medicare providers, physicians, clinics, home health and hospice agencies, and other Medicare health care providers in audits and investigations. Among our attorneys are Bill McMurrey and Lynette Byrd. Bill is the former chief federal prosecutor for health care fraud at the U.S. Attorney’s Office and Lynette is a former Assistant United States Attorney who has handled health care investigations with the support of the Office of Inspector General (OIG) and the Department of Health and Human Services (HHS).
The Legal Basis for the Obligations
Health care providers have an obligation to report and refund federal program overpayments. This duty stems from the Affordable Care Act (“ACA”) and the Centers for Medicare & Medicaid Services’ (“CMS”) regulation mandating refund of Medicare overpayments. Both the statute and regulations have been drafted to support compliance with applicable statutes, promote the provision of quality care, and protect the Medicare Trust Funds against improper payments, including fraudulent payment. This article will discuss these duties and relevant compliance considerations and issues regarding the calculation and repayment of such overpayments.
First, under the ACA (42 U.S.C. 1320a-7k(d)), a provider who has received an overpayment must report and return it. The provider must send the overpayment to the correct recipient (the Secretary, the State, an intermediary, a carrier, or a contractor) and include, in writing, the reason for the overpayment. An “overpayment” is any funds received under Title XVIII (Medicare) or XIX (Medicaid), to which, after applicable reconciliation, the provider is not entitled (under these titles). The deadline for these two actions is the later of the date that any corresponding cost report is due or 60 days after the overpayment is identified. Importantly, any overpayment retained is an obligation under the Federal False Claims Act.
Second, in February 2016, CMS published its final rule requiring that Medicare Parts A and B health care providers and suppliers report and refund overpayments. An overpayment is defined as the difference between the amount that CMS actually paid to the provider and the amount that the provider should have been paid, noting that there is no de minimis exception to overpayment’s definition.
Examples of “funds to which the person is not entitled” may include reimbursement for:
- duplicate claims
- wrong billing code
- not covered or medically unnecessary services
- unbundled codes
- wrong site/level of service
- up-coded services
- services not rendered
- services ordered/performed by and excluded or un-licensed person
- failure to comply with the conditions of payment (as contrary to conditions of participation)
- Stark/Anti-Kickback laws violation affiliated tainted claims
- failure to comply with secondary payer rules
- credit balances
- cost reports (non-allowable costs reported)
Similar to the ACA’s overpayment provision, the CMS rule’s deadline is the later of the date that is 60 days after the overpayment’s identification, or the due date of any applicable corresponding cost report (a separate final rule was published in the May 23, 2014 Federal Register (79 FR 29844) that addresses Medicare Parts C and D overpayments). This rule clarifies requirements for the reporting and returning of self- identified overpayments. A failure to report and reimburse means that providers and suppliers remain subject section 1128J(d) of the Social Security Act and could face False Claims Act (FCA) liability, Civil Monetary Penalties Law (CMPL) liability, and exclusion from federal health care programs. Nonetheless, providers and suppliers shall continue to be required to comply with all other current CMS procedures when a determination (by CMS, Medicare Administrative Contractors (MACs), etc.) is made that overpayment exists.
Accordingly, a person who has received a Medicare Part A or Part B overpayment must report and return the overpayment in the form and manner set forth in the Code of Federal Regulations.
Duty to Investigate
First, the reporting requirement’s 60 day clock starts running when a person has identified an overpayment. This means when a person has determined that an overpayment occurred, or if that person should have made such a determination through the exercise of reasonable diligence that he/she (i) received an overpayment, and, (ii) he/she quantified the amount of the overpayment. Importantly, if a provider fails to exercise reasonable diligence in conducting an investigation into a potential overpayment, the 60 day time period will begin on the day that the provider receives “credible information” of a potential overpayment.
The provider’s receipt of “Credible information of a potential overpayment” gives rise to a duty to investigate on the part of the provider. It is important for providers to understand that whether or not information is “credible” is an inherently fact dependent matter. The following constitutes a non-exclusive listing of situations, where, if provider is made aware of them, reasonable due diligence will be required:
- Incorrect coding is revealed through a review of provider’s billing and payment records
- An overpayment is revealed pursuant to an internal audit
- Repeated hotline complaints about the preceding or similar issues
- A detailed hotline complaint
- The provider learns that an unlicensed or excluded individual provided the services
- The government or a government contractor informs a provider that an audit revealed an overpayment
- The provider learns of an unexpected increase in Medicare revenue.
Reasonable diligence on the part of a provider means: (1) proactive and good faith compliance efforts conducted by qualified individuals to identify overpayments and (2) good faith investigations conducted in a timely manner by qualified individual in response to credible information about a possible overpayment. In short, the CMS regulations expressly state that providers have both a clear duty to undertake proactive compliance activities to ensure that their claims are correct and appropriate and to determine if they have received an overpayment. Failure on the part of the provider to perform such actions carries with it the risk of potential liability for retention of such overpayments that would otherwise been detected by following the preceding compliance efforts.
A provider’s timely performance of reasonable diligence means that the investigation of credible information (except in extraordinary circumstances) should be prompt and in good faith, but never more than six months from the receipt of credible information. Extraordinary circumstances include, but are not limited to: (1) extraordinarily complex investigations that may be anticipated to require more than 6 months of investigation (e.g. ones involving Self-Referral Disclosure Protocol program (SRDP)); or (2) situations where there is a state or emergency or natural disasters (e.g. Hurricane Katrina). In any case, providers and suppliers should maintain accurate records documenting all reasonable diligence efforts so that they will be able to demonstrate their compliance with the rule’s requirements.
The 60 day deadline for reporting and returning overpayments begins on one of two dates. First, the day when reasonable diligence is completed. Second, the day the relevant person received credible information if the person failed to conduct reasonable diligence. Generally, providers should allow for, in the appropriate circumstances, 2 months for reporting and returning after the timely 6 month investigation. It is important to note, however, that the refunding deadline will be suspended when: (1) the Provider requests an extended repayment schedule, or (2) CMS or the Department of Health and Human Services’ Office of the Inspector General (OIG) acknowledges receipt of submission to, respectively, the OIG Self-Disclosure Protocol or CMS Self-Referral Disclosure Protocol (noting that self disclosure to the Department of Justice (DOJ) does not suspend a refund obligation under the Overpayment Regulation).
Documenting the Investigation
Providers should maintain records of their overpayment investigations. Examples of important investigative records include:
- Documentation of any alleged violation
- Descriptions of the investigatory process
- Records of review of important documents
- Well-maintained witness interviewed log
- Well-maintained log of documents reviewed
- Descriptions of any sampling methodologies utilized
- Results of any relevant investigations
- Statement of impact cost to the federal program and its beneficiaries
- The provider’s corrective action plan
Sampling and the Medicare Regulation
The CMS final rule establishes that a quantification of the overpayment amount may be determined using extrapolation methodologies, statistical sampling or other appropriate methodologies (such as random selections of claims from a population or extrapolation only from within the time period covered by the population emanating from the relevant sample). Notably, if a provider calculates the overpayment amount pursuant to one particular methodology, the report must contain a description of that methodology’s statistically valid sampling/extrapolation. Importantly, providers should not return only a subset of claims identified for overpayment without extrapolating the overpayment’s full amount. Indeed, until the full overpayment amount is determined, the provider should not report and return overpayment on any individual claims (re the “prove sample”). The idea behind this is that if a provider finds a single overpaid claim, it would then be appropriate to perform further inquiry so as to determine if that provider has more overpayments before that provider reports and returns the singularly identified overpaid claim.
To Whom Should Providers Submit Their Reports and Refunds and Can Providers Appeal?
Providers and suppliers will have to determine the identity of the appropriate recipients of their overpayment reports and refunds. For example, the proper recipient may be a provider’s relevant Medicare contractor or the OIG’s Self Disclosure Protocol (SDP) or SRDP programs. Providers must remember that forwarding the overpayment report and refund to an inappropriate agency will not satisfy their obligations with regard to any applicable process. The provider must correctly identify the relevant Medicare contractor or other recipient. Next, it is the general rule that for self-reported overpayment claims, the provider does not have an automatic right to appeal. The exception to this rule is a provider’s right to appeal a revised determination by a government contractor issued when an overpayment is returned through adjusting specific claims (but only if a new determination is issued). CMS recommends that providers and suppliers retain audit and refund documentation in case a government contractor or OIG audit alleges that the provider or supplier has not adequately refunded an overpayment.
Co-Payment and Deductibles?
Provides are required to refund overpayments of co-payments and deductibles pursuant to Medicare regulations. Specifically, providers must promptly refund to the beneficiary any incorrect collections and notify the MAC of the refund. Failure to refund the overpayment within 60 days results in a requirement that the provider set aside an amount equal to the incorrect collection in a separate account and notify the MAC of such set aside.
Enforcement and Penalties
A provider’s retention of an overpayment after the reporting deadline can give rise to liability under the False Claims Act (31 U.S.C. §§ 3729 et seq.). False Claims Act penalties include damages of three times the amount of the overpayment and civil monetary penalties of $10,957-$21,916 per claim.
How to Report the Overpayment: Cover Letter
Reporting the overpayment will require completing the Overpayment Refund or Recovery Request Form if reporting to a MAC (such as CGS Administrators, LLC) and preparing a Cover Letter. The Cover Letter should identify the following information:
- The provider’s name and address;
- The provider’s number;
- The audit period;
- The services/items (CPT/HCPCS) for which payment is refunded;
- The cause of the overpayment;
- How the provider became aware of the overpayment;
- An explanation of the audit methodology (should beclaim specific);
- An explanation of any statistically valid samples (should identify the population, sample size selection, sample item selection, error rate and extrapolation);
- Where appropriate, inclusion of RATSTATS (SDP identifies 100 claims as minimum);
- The provider’s actions taken to correct the error that caused the overpayment and to prevent reoccurrence;
- The identity, phone number, and email contact information for any contact person regarding further questions or additional necessary information; and
- Enclosure of the check or request for recovery adjustment.
Compliance Considerations for Providers
It is important for providers to be proactive regarding their compliance with health care laws and regulations. Providers should regularly access and review their compliance program documentation and standards, especially regarding such matters as audit and monitoring functions and responses to hotline tips. Moreover, providers should establish defensible policies for: (1) responding to and investigating Credible Information of Overpayments, and (2) Quantification of Overpayments within the 6 month limit. In addition, providers should routinely maintain all relevant documentation of: (1) the nature of any credible information, (2) the timing and nature of investigation processes, including documentation of all important dates (date of receipt of credible information, 6 month deadline for investigation and quantifications, and 60 day deadline to address any relevant identification); (3) quantification, and (4) verification of receipt of reports.
Contact Oberheiden & McMurrey, LLP today for a free and confidential consultation.