The 60-day overpayment report and return statute imposes requirements on providers to identify, report, and return Medicare and Medicaid overpayments.[3] (Note: For ease of reference, this chapter refers to both providers and suppliers as “providers.”) Enacted in 2010, section 6402(a) of the Patient Protection and Affordable Care Act (ACA) included the statute (the 60-day statute).[4] (Note: The statute is sometimes also referenced as the “60-day rule.” For purposes of distinguishing between the statute and the implementing regulations with respect to Medicare Parts A and B in this chapter, the terms “60-day statute” and “60-day final rule” are used.) The statute requires providers, Medicare Advantage organizations, prescription drug plan sponsors, and Medicaid managed care organizations to report and return Medicare and Medicaid overpayments within the later of (a) 60 days after an overpayment is identified or (b) the date that any corresponding cost report is due (if applicable).[5] As specifically noted in the ACA, overpayments held beyond 60 days can be the source of liability under the False Claims Act (FCA).
Implementing regulations established after passage of the statute add significant detail regarding compliance, which providers might not divine from review of the statute alone. For example, in the final rule with respect to Medicare Parts A and B overpayments and corresponding preamble (the 60-day final rule), the Centers for Medicare & Medicaid Services (CMS) imposed requirements of “proactive compliance” and “reasonable diligence.”[6] Introduction of these requirements, with limited guidance regarding their application, can make it challenging for providers to determine what is required of them to reduce compliance risk.
This chapter focuses on applicability to providers of the 60-day statute with respect to overpayments arising under Medicare Parts A and B, providing an overview of the legal requirements along with practical compliance tips in an area where nuanced judgments may need to be made.
Overview of the 60-Day Statute
The 60-day statute defines an overpayment as “any funds that a person receives or retains under [either program] to which the person, after applicable reconciliation, is not entitled.”[7] The overpayment must be returned to the “Secretary [of the Department of Health & Human Services], the state, an intermediary, a carrier, or a contractor, as appropriate,” along with notification in writing of the reason for the return.
The broad language of the statute has been interpreted by CMS as affording significant flexibility when providing more detail in implementing regulations. For example, the statute does not define the crucial concept of when an overpayment is considered “identified.” CMS has issued regulations with respect to the report and return of Medicare Parts A and B payments, which are addressed in the next section of this chapter. CMS also issued overpayment regulations applicable for Medicare Parts C and D; however, those regulations were subsequently vacated by the U.S. District Court for the District of Columbia in UnitedHealthcare Insurance Co. v. Azar (the statutory requirements still apply), which is currently pending before the D.C. Circuit.[8][9][10] CMS has not proposed regulations with respect to the report and return of Medicaid payments and may not do so. Nevertheless, providers must comply with the statutory requirements and should review applicable state law, regulations, and other guidance with respect to potential Medicaid overpayments.
Overview of the 60-Day Statute Applicable to Medicare Parts A and B
The regulations implementing the 60-day statute for Medicare Part A and B provide more detail regarding CMS’s expectations about how the 60-day statute applies to potential overpayments arising under Medicare Parts A and B.[11] While doing so, it introduces some vague concepts, creating uncertainty regarding actions that providers are expected to take to ensure compliance.
The following summarizes the key concepts in the 60-day final rule. Individuals responsible for compliance with the 60-day statute and implementing regulations for Medicare Parts A and B should be sure to read the 60-day final rule preamble in full, which is in the Federal Register.[12] The regulations themselves are less than a page, but CMS provided 29 pages of explanatory commentary. This preamble commentary is a critical resource because little other CMS regulatory guidance exists to date to help providers navigate compliance with the statute and implementing regulations.[13]
On December 3, 2020, the Office of General Counsel for the Department of Health & Human Services (HHS-OGC) issued an advisory opinion to set forth how the agency plans to implement the United States Supreme Court’s decision in Azar v. Allina Health Services. HHS-OGC recognizes that while preambles often contain interpretive statements, they are not by themselves binding rules. However, preamble text published with proposed or final rules that are closely tied to regulatory requirements can be implicated in enforcement actions.[14]
Definition of Overpayment
Under the 60-day final rule, an overpayment includes “any funds that a person has received or retained under title XVIII of the Act to which the person, after applicable reconciliation, is not entitled.”[15] This definition is the same as the definition in the statute, except that it is limited to title XVIII of the Social Security Act (Medicare), whereas the statutory definition includes both title XVIII (Medicare) and XIX (Medicaid).[16]
As explained in the preamble to the 60-day final rule, an overpayment may be found to exist even if not caused by the provider or is otherwise outside of the provider’s control, such as where a Medicare administrative contractor makes a duplicate Medicare payment in error. An overpayment also may exist even if the conduct resulting in the overpayment was unintentional. For example, CMS states that providers “must report and return overpayments identified as a result of upcoding, whether the inappropriate coding was intentional or unintentional.”[17]
Under the 60-day final rule, there is no overpayment that is too small to be captured under the 60-day statute. That is because in the 60-day final rule and otherwise, CMS has not established a “materiality or de minimis exception for small-dollar overpayments from the rule.”[18] In practical terms, this means that providers are required to comply with the report and return requirements even if there is just one claim at issue and/or the total amount of overpayment is so low that the cost of processing the overpayment refund exceeds the amount to be refunded.
In the 60-day final rule, CMS identifies the following examples of overpayments:
-
Medicare payments received for noncovered services
-
Medicare payments in excess of the allowable amount for an identified covered service
-
Errors and nonreimbursable expenditures in cost reports
-
Duplicate payments
-
Receipt of Medicare primary payment when another payer had the primary responsibility for payment
-
Lack of medical necessity
-
Insufficient documentation[19]
However, importantly, whether an overpayment exists is a factually specific determination, and a close review is suggested before making any final determination about whether a provider actually has received an overpayment. For example, with respect to documentation, a close review could reveal that while the documentation may be sloppy or less comprehensive than one would expect as best practice, it may still be sufficient to support the payment. As another example, in the 60-day final rule, CMS expressly acknowledges that services provided by an unlicensed individual “does not automatically imply” an overpayment has occurred, and determining whether an overpayment has occurred in such a situation includes investigating the factual circumstances and a review of the relevant laws, regulations, and billing rules.[20]
Identifying Overpayments
Under the 60-day final rule, an overpayment is considered “identified” when a “person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.”[21][22] If a person fails to exercise reasonable diligence to identify an overpayment, and it is determined that the person should have done so, the person will be deemed to have “in fact” received an overpayment.[23] CMS took this approach because it interprets the statute as showing congressional intent to impose on providers a duty to return overpayments that have been received, “which would necessarily include taking appropriate actions to determine whether the provider or supplier has in fact received an overpayment.”[24] CMS notes its rulemaking authority to interpret the statute in a way that allows it to protect what it sees as the integrity of the statute’s plain mandate, and references concern for the use of the “ostrich defense” (i.e., being excused from failure to identify an overpayment by virtue of not making any effort to find it) if the standard for identification was limited to actual knowledge.[25]
CMS uses the term “reasonable diligence” to “cover both proactive compliance activities to monitor claims and reactive investigative activities undertaken in response to receiving credible information about a potential overpayment.”[26] In other words, compliance with the 60-day final rule involves not only responding to reports or information concerning a possible overpayment, but also taking proactive steps to identify potential overpayments (e.g., through developing and implementing a compliance plan, performing periodic self-audits, encouraging workforce to promptly report concerns, or other proactive measures).
The terms “credible information,” “reasonable diligence,” and “proactive compliance” are further addressed next. Given the vagueness of these terms, it can be challenging for providers to determine whether they are acting in compliance with the 60-day final rule. This uncertainty is exacerbated because CMS has thus far declined to provide prescriptive definitions, noting that the concepts are fact-dependent, and stating that it could not address all factual permutations in the 60-day final rule.[27]
Credible Information of an Overpayment
Credible information about an overpayment “includes information that supports a reasonable belief that an overpayment may have been received.”[28] CMS acknowledges that not all information received will be credible and that determining whether information is sufficiently credible to merit an investigation is a fact-specific determination.[29] For example, CMS states that whether a hotline complaint qualifies as credible information is a factual determination, noting that repeated hotline complaints about the same issue or a single sufficiently detailed hotline complaint could lead a reasonable person to conclude that credible information has been received.[30] Based on this example, it could be inferred that where a provider receives a single anonymous complaint on its hotline that raises a general concern about a lack of a culture of compliance within the organization (e.g., “everyone here is a bunch of crooks”), but provides no detail regarding a specific practice or specific individuals involved, a reasonable person may well conclude the complaint does not rise to the level of credible information regarding a specific overpayment.
Credible information could potentially come from sources external to the provider, such as a contractor audit or reports issued by the U.S. Department of Health & Human Services (HHS), Office of Inspector General (OIG). For example, if a government agency informs a provider about a potential overpayment discovered in an audit, the provider has a duty to engage in reasonable diligence to investigate this potential overpayment—the scope of which is defined by the government’s audit.[31] In addition, if the audit is for a limited time period and the provider confirms the audit’s findings, the provider may need to investigate further, as it also “may have credible information of receiving a potential overpayment beyond the scope of the audit if the practice that resulted in the overpayment also occurred outside of the audited timeframe.”[32] Credible information can also come from internal sources, such as from complaints or concerns submitted via the compliance hotline phone number or otherwise, or the result of a billing self-audit performed under a compliance plan.
In many instances, the question about whether credible information exists may require the exercise of a nuanced judgment by the provider. An example that comes up frequently is where a provider conducts a billing self-audit and identifies discrete overpayments. The provider must determine whether those overpayments constitute credible information of a more systemic issue that creates a duty to broaden the scope of the review, as opposed to isolated incidents arguably not requiring further review.
For example, suppose a physician practice identifies a handful of overpayments where a nurse provided the service and the physician identified as the rendering physician on the claims did not provide the requisite level of supervision to meet the “incident-to” requirements, but the claims in question represent just a small percentage of overall claims and in all other instances the practice determined that the incident-to requirements were met. A more systemic issue might not be indicated if, on inquiry, the physician practice’s billing agent informs the physician practice that the issue was caused by a temporary, inadvertent error related to onboarding and training of a new employee at the time. In contrast, if the provider discovers a large number of overpayments, 100% of which resulted from failure to meet the incident-to requirements, and no operational change has occurred that could indicate a time-limited issue, the provider may reasonably determine credible information exists that it may have been consistently coding for the same services in the same way in other circumstances. These scenarios are intended to serve as examples at either end of the spectrum, and whether credible information exists in any particular circumstance is highly fact dependent.
Reasonable Diligence and Proactive Compliance
In the 60-day final rule, CMS makes clear that providers have a duty to “to exercise reasonable diligence to determine whether an overpayment exists.”[33] However, CMS declined to define with granularity what is considered “reasonable,” noting that “the concept of ‘reasonableness’ is fact-dependent.”[34] CMS advised that providers maintain records accurately documenting their reasonable diligence efforts in order to demonstrate their compliance with the 60-day statute, which is a good idea.[35] For example, when engaging in reactive investigation activities upon receipt of credible information, documentation might include copies of key documents reviewed, names of individuals interviewed and summaries of such interviews, key email correspondence, and a summary of the overall investigation and results. Keeping records of diligence efforts are particularly helpful if a provider is investigating in response to receipt of credible information, but has determined no overpayment exists. If that determination is later challenged, having documentation of the diligence undertaken can help support the provider’s position that the requisite scienter does not exist to establish liability under the FCA.
As stated in the previous section on identifying overpayments, the concept of “reasonable diligence” includes both reactive investigative activities and proactive compliance efforts. A provider that does not engage in any or only minimal compliance activities to “monitor the accuracy and appropriateness” of claims risks exposure if it is later found to have received an overpayment.[36] For example, a provider that has not taken any steps to implement a compliance program, or otherwise periodically assess billing practices, could be subject to an allegation that it failed to meet its proactive compliance requirement pursuant to the 60-day final rule.
CMS acknowledged that compliance programs may differ vastly in size and scope, due to the size and type of the provider.[37] For example, CMS noted that compliance activities in a solo practitioner’s office may look very different than those in larger settings, such as in a multispecialty medical group.[38] A provider’s internal monitoring, practice standards, availability of a compliance officer, training and education, corrective action plans, communication with employees, and disciplinary standards and guidelines will differ based on the type and size of practice and available resources.
However, the small size of a provider does not exempt it from the requirement to engage in proactive compliance.[39] In response to commenters seeking clarifications about the level of resources a small provider is expected to devote, CMS declined to provide specific guidance on “resource levels or other measures to ensure compliance with this rule,” but emphasized that “providers and suppliers, large and small, have a duty to ensure their claims to Medicare are accurate and appropriate,” and directed commenters to CMS and HHS OIG educational materials.[40] The HHS OIG has developed a series of voluntary compliance program guidance documents for different types of providers as references.[41] The same obligation applies to all providers, regardless of type and size, which poses a potential unique risk to small providers that may have less infrastructure or resources to engage in proactive compliance, given the lack of specific guidance regarding what specific measures would be considered sufficient.
Timing Requirements
Generally, under the 60-day final rule, a provider has a “total of 8 months (6 months for timely investigation and 2 months for reporting and returning)” to address potential overpayments, barring “extraordinary circumstances.”[42]
CMS has stated that “reasonable diligence” is demonstrated through the timely, good faith investigation of credible information, including quantification of the overpayment amount (if any), within, at most, six months of receipt of the credible information, except in extraordinary circumstances.[43] (Note: Although CMS had initially proposed that diligence be completed with “all deliberate speed,” CMS did not include that phrase in the 60-day final rule, and instead adopted six months as the benchmark for timely investigation in response to commenter requests for clarification and concerns regarding adoption of an open-ended timeframe.)[44] What constitutes extraordinary circumstances is a fact-specific question that could include an unusually complex investigation, such as physician self-referral law violations that are referred to the CMS Voluntary Self-Referral Disclosure Protocol (SRDP).[45]
Extraordinary circumstances also could arise where a provider is faced with a natural disaster or state of emergency.[46] For example, the nationwide public health emergency related to the COVID-19 pandemic would reasonably appear to fit squarely within what could be considered an extraordinary circumstance, particularly for providers on the frontlines that have had to redirect much of their time and resources to preparing for, preventing, and responding to the coronavirus. Of note, the HHS OIG has expressly acknowledged that “health care organizations and the dedicated professionals providing care to patients are facing extraordinary challenges in managing the coronavirus pandemic,” and “delivery of patient care during this public health emergency must be the primary focus of the health care industry.”[47]
The 60-day time period to report and return begins either (1) when reasonable diligence is completed and an overpayment is identified or (2) the day credible information of a potential overpayment is received if no reasonable diligence is conducted and an overpayment was indeed received.[48][49] This distinction is significant, because if a provider does not engage in reasonable diligence in response to receipt of credible information, the 60-day clock for reporting and returning starts immediately upon receipt of the credible information (i.e., the provider loses the additional six months that would otherwise be available). This scenario not only gives the provider less time, but could also increase risk of a “reverse false claim” as mentioned in Chapter 1, “The History and Purpose of the False Claims Act,” and the “Where to Report” section of this chapter. There are also specific circumstances where the 60-day report and return deadline is suspended—through use of the CMS or HHS OIG self-disclosure protocols, as described further in this chapter.
Significantly, with respect to commencement of the applicable time period for investigation and requirement to report and return, CMS declined to limit an organization’s knowledge of an overpayment only to those situations where senior officials have confirmed the overpayment. Rather, CMS stated that “organizations are responsible for the activities of their employees and agents at all levels.”[50] Should a lower level employee have knowledge of an overpayment, the 60-day clock would not necessarily wait until a senior official confirmed this knowledge.[51] Accordingly, a provider should implement processes to educate all levels of its workforce on the importance of prompt reporting of credible information to the appropriate source, such as an employee’s supervisor or the organization’s compliance department.
Lookback Period
The 60-day final rule establishes a six-year lookback period, meaning that “overpayments must be reported and returned only if a person identifies the overpayment within 6 years of the date the overpayment was received.”[52] (Note: The proposed rule initially set a 10-year lookback period.)[53] The lookback period is specifically measured “back from the date the person identifies the overpayment.”[54]
The 60-day final rule also expanded the claims reopening regulation, which permits Medicare administrative contractors and others to reopen claims after an initial determination “to provide for a reopening period that accommodates the 6-year lookback period.”[55] (Note: This provision previously limited the reopening period to either one or four years depending on the circumstances, except if evidence of fraud or similar fault exists or under other limited circumstances.) Now 42 C.F.R. § 405.980 explicitly allows providers to “request that a contractor reopen an initial determination for the purpose of reporting and returning an overpayment under [ 42 C.F.R. § 401.305 ] of this chapter.”[56] CMS stated that this was an administrative accommodation for providers that is necessary to prevent obstacles and unintended loopholes to compliance with the 60-day final rule (a claim determination is generally not otherwise subject to reopening more than four years after the determination was made, with a few exceptions).[57] However, CMS did not make a parallel change to the cost report reopening regulation: 42 C.F.R. § 405.980. (Note: Inexplicably, CMS did not make a similar addition to the reopening regulation that applies to Medicare cost reports, 42 C.F.R. § 405.1885 , under which a cost report is generally not subject to reopening more than three years after the date the determination was made, unless the determination “was procured by fraud or similar fault.”)[58]
Quantifying the Total Amount of the Overpayment
In complying with the 60-day statute, providers will need to quantify the total amount of the overpayment. Here are a few key concepts from the 60-day final rule regarding calculation of the total overpayment.
Return of total or partial payment on a claim: CMS clarified that where a “paid amount exceeds the appropriate payment amount to which a provider or supplier is entitled, the overpayment is the difference between the amount that was paid and the amount that should have been paid.”[59] For example, if a provider was paid $40 for a claim when it should have received $30, the overpayment amount is $10. There are also instances where CMS asserts that the overpayment is the entire amount paid, such as payment on “claims resulting from Anti-Kickback Statute or physician self-referral law violations…or where the payment was secured through fraud.”[60]
Statistical sampling and extrapolation: CMS recognizes that there are instances where it may not be possible to know with 100% accuracy the amount of an overpayment, and permits providers to use statistical sampling and extrapolation to calculate an overpayment amount.[61] If an overpayment is calculated using a statistical sampling methodology, the provider “must describe the statistically valid sampling and extrapolation methodology” in the report of the overpayment.[62] However, the provider should be aware of its more limited appeal rights before choosing to use statistical sampling (see the section titled “Appeal Rights and Refunds for Self-Identified Overpayments” for more information on appeal rights). Medicare administrative contractor websites provide significant detail regarding the overpayment report and return process, including use of statistical sampling, which may be helpful to providers navigating the process.
Offsetting for underpayments: In response to comments received on the ability to offset the total repayment amount with identified underpayments, CMS stated that the 60-day final rule “concerns overpayments, not underpayments,” and states that providers can separately address underpayments by requesting reopenings under 42 C.F.R. § 405.980 .[63] However, if a provider uses statistical sampling and extrapolation, it may be possible to factor in underpayments under certain circumstances. (Note: For example, the website for Novitas Solutions Inc., one of the Medicare administrative contractors, states that “reducing an overpayment amount by subtracting out an underpayment amount is not permitted on voluntary refunds except in the case where statistical sampling and estimation have been used. Even then it must be done judiciously and by applying all applicable Medicare rules and guidelines. As a general rule of thumb, if a deduction is not permitted on an individual claim adjustment; do not take that deduction in your extrapolated review.”)[64] Providers should review the website of the applicable Medicare administrative contractor for more information regarding the availability of offsets when using statistical sampling and extrapolation. To determine which MAC serves your geographical area, see “Who are the MACs” on the CMS website.[65]
Cost Report Considerations
Overpayments addressed in Medicare cost reports generally must be reported and refunded the later of (1) 60 days after identification or (2) the date the cost report is due (generally five months after the end of the cost reporting period).[66][67]
The term “overpayment” is defined as funds which the person, “after applicable reconciliation,” is not entitled.[68] “Applicable reconciliation” in this context is defined narrowly to refer only to cost report reconciliation, where a cost report must be filed.[69] In other words, it refers to the process where CMS makes interim payments to a provider throughout the cost reporting year and the provider reconciles those payments with covered and reimbursable costs at the time the cost report is due.[70]
Two exceptions apply to the general rule that “applicable reconciliation” occurs on submission of a cost report (as opposed to when a cost report is finally settled): (1) where the provider either receives updated supplemental security income ratio information or (2) knows that an outlier reconciliation will be performed.[71] If one of those exceptions applies, the provider is not required to return any resulting overpayment until the final reconciliation of the applicable cost report, which presumably occurs with the issuance of the Medicare Notice of Program Reimbursement.[72][73]
CMS has stated that providers may rely on the applicable reconciliation cost report deadline, as narrowly defined in the 60-day final rule, only if the cost report reconciliation process would be relevant to the determination of whether an actual overpayment exists.[74][75][76] In other words, for cost report-based overpayments, such as those involving graduate medical education payments, a provider can report and return the overpayment by the date that the cost report is due (unless one of the two exceptions in the preceding paragraph apply). But for claims-based payments, such as upcoding on claims for evaluation and management services, the provider must report and return an overpayment within 60 days of identification.
Appeal Rights and Refunds for Self-Identified Overpayments
Generally, a favorable appeal decision means that the provider is entitled to the payment that has been denied. If a provider is not sure whether it has been paid improperly, it may want to use the appeals process to clarify whether the claim was properly paid. However, the appeals process generally is available only where the claim has been denied or recovered by the Medicare administrative contractor as an overpayment. Thus, where a provider is making a refund sua sponte under the 60-day statute, an appeal is generally not available.
However, an appeal right could be generated if a provider makes a refund that results in the reopening of a claim and the issuance by the Medicare administrative contractor of a revised determination.[77] Stated another way, providers generally will have appeal rights with regard to overpayment refunds only where the overpaid claims are individually adjusted and a new determination is issued.[78]
Thus, there may be circumstances where a provider could use the appeals process to obtain a determination about whether a claim was properly paid. If a provider seeks clarification in this manner, CMS takes the position that the appeal should be made in good faith. According to CMS, it is inconsistent with the intent of the statute and regulations for providers to return self-identified overpayments, such as where the overpayments are a subset of a potentially larger set of overpaid claims, while simultaneously using the appeals process as a means to circumvent (1) the duty for timely investigation of all related potential overpayments or (2) the deadline for reporting and returning of identified overpayments.[79]
Importantly, providers generally will not have appeal rights for claims that were refunded based on statistical sampling. This is because CMS typically does not issue a revised claims determination if the overpayment being returned represents a lump sum determined using sampling and extrapolation.[80] CMS states that “there are no appeal rights associated with the self-identified overpayments that do not involve identification of individual overpaid claims and individual claim adjustments.”[81] Lack of appeal rights is an issue that a provider should consider when deciding whether to use statistical sampling.
On another related note, CMS distinguishes between the appeals process for contractor overpayment determinations and the provider’s separate responsibility to investigate credible information in good faith and in a timely manner.[82] In the 60-day final rule, CMS notes that Medicare contractor overpayment determinations are “always a credible source of information for other potential overpayments,” and the basis for a Medicare contractor identified overpayment for one time period could also serve as a basis for an overpayment for an additional time period that is (1) not covered by the contractor audit, (2) not administratively final, and (3) within the lookback period.[83] However, notably, CMS has stated that “if the provider appeals the contractor identified overpayment, the provider may reasonably assess that it is premature to initiate a reasonably diligent investigation into the nearly identical conduct in an additional time period until such time as the contractor identified overpayment has worked its way through the administrative appeals process.”[84] In other words, if a provider does not agree with the contractor’s determination and challenges the contractor’s determination in good faith through the appeals process, it may reasonably determine that the need to engage in further diligence can wait until the appeal is resolved.
Documentation of Overpayment Refunds
CMS recommends that providers retain their audit and refund documentation in case a Medicare administrative contractor or the HHS OIG reaudits claims showing overpayments that the provider believes have already been refunded. CMS will not recover an overpayment twice.[85]