Medicare and Medicaid Overpayment Requirements and Disclosure Programs
Medicare and Medicaid Overpayment Requirements and Disclosure Programs
The Centers for Medicare and Medicaid Services (CMS) processes electronic claims for providers and providers may receive overpayment for duplicate claims or for claims submitted in error. In an effort to conserve these public trust funds, Congress has passed repayment statutes requiring overpayment made to providers. The repayment statute, also known as the 60 Day Rule, has been on the books since 2010 and it is shrouded with multiple uncertainties. The statute allows for self-disclosure of overpayments received but does not answer the question as to when to disclose. I will be discussing the option of disclosure, the process involved, and the risks and benefits of disclosure.
There are three sources of law to consider regarding the obligation to refund Medicare and/or Medicaid overpayments. The first is the overpayment liability under the 42 USC sec 1320a-7k(d) , provided under the 2010 ACA (“Obamacare”), defining what constitutes an “overpayment” and establishing the required repayments of overpayment. The 2009 addition of FERA[1] to the False Claims Act (FCA) speaks generally about the requirements of returning government overpayments from any source, even beyond payments received from Medicare and/or Medicaid. This would include other government healthcare programs such as Tricare as well as non-healthcare government programs that might apply to the Department of Defense or the Department of Agriculture, etc. Finally, a 2010 change to the Civil Monetary Penalty and Exclusion Act (Federal CMP or CMP) under 42 USC sec 1320a-7a(a)(10) was implemented under the ACA.
As of 2009, there was no clear requirement under the Medicare/Medicaid statutes that providers make overpayment refunds. Therefore, in that year, Congress amended the FCA, under FERA, to impose liability against persons who conceals an obligation to return money to the government or, under 31 USC sec 3729(a)(1)(G) or one who “knowingly and improperly avoids or decreases an obligation to pay or transmit money or property to the Government….” Under the Act, the person has to act knowingly—the person has to be aware of what has happened, and with respect to the refund, also has to act improperly and to avoid an obligation.
In 2009, the concept of “obligation” (31 USC sec 3729(b)(3) was defined as
“an established duty, whether or not fixed, arising from an express or implied contractual, grantor-grantee, or licensor-licensee relationship, from a fee-based or similar relationship, from statute or regulation, or from the retention of any overpayment…”
FERA (the modified version of the FCA) was also changed with respect to the definition of a “claim”[2]:
“(A) means any request or demand, whether under a contract or otherwise, for money or property and whether or not the US has title to the money or property, that---
(i) is presented to an officer, employee, or agent of the US; or is to be spent or used on the Government’s behalf or to advance a Government program or interest, and if the US Government
(I) provides or has provided any portion of the money or property requested or demanded; or
(II) will reimburse such contractor, grantee, or other recipient for any portion of the money or property which is requested or demanded; and
(B) does not include requests or demands for money or property that the Government has paid to an individual as compensation for Federal employment or as an income subsidy with no restrictions on that individual’s use of the money or property.”
This definition is important for the breadth that it has relating to liability under the FCA for providers who receive payments from Medicare and Medicaid managed care plans.
Under the 2009 FCA expansion, FERA, it remained unclear what was meant by acting “improperly”. FCA liability was not intended to apply to the simple retention of an overpayment that was not based on a willful act or unintended increase in payment from the Government to which the recipient was not entitled. Furthermore, the definition of what was meant by “established duty” or even the term “overpayment” was not established under FERA and did not exist under Medicare or Medicaid statutes. However, this all changed in 2010 under PPACA sec 6402(a)(42 USC sec 1320a-7k(d)) with establishment of explicit of these terms. This section of Obamacare says that if a person has received an overpayment, that person has the duty to report and return the overpayment. Therefore, the provider must not only return the overpayment, but must report to the government entity making the payment, stating why the overpayment is being returned. Furthermore, the provider is given a deadline of 60 days after the overpayment was identified to report and return. The statute does not define what it means for an overpayment to be identified. It does, however, define an overpayment.
“The term ‘overpayment’ means any funds that a person receives or retrains under subchapter XVIII (Medicare) or XIX (Medicaid) of this chapter to which the person, after applicable reconciliation, is not entitled under such subchapter.”
The statute includes an explicit cross reference back to the FCA because it says that any overpayment retained by a person after the 60-day deadline to report and return, is an obligation under the FCA. Therefore, while the FERA portion of the FCA created an obligation for a recipient to return overpayments received from any government program, the 60-Day Rule applies specifically to overpayment made by the Medicare/Medicaid healthcare programs, mandating returns of overpayment within 60 days. Note that the 60-Day Rule does not apply to Tricare or other government programs.
As the definition of what is meant by “identified” was not defined by statute, this could be left to a rule making agency or enforcement agency as to how it will be applied. However, as the level of factual specificity increases as to a possible overpayment, what become reasonable under the circumstances becomes less equivocable. Therefore, if a provider receives a report from a disgruntled patient who claims that every charge the provider has ever submitted in his professional life is fraudulent, the provider likely does not have the duty to review every charge he has submitted for the past 30 years. However, if a patient claims that he did not receive a specific service on a date he was seen in the provider’s office, that claim needs to be investigated to see if an overpayment can be identified. Thus, the require duty as to how far to go to idenfity a potential overpayment made to a provider will be very fact specific. Thus, as long as the provider is engaged in reasonable steps to investigate an overpayment claim, the 60-Day Clock does not begin to run. However, if the provider fails to investigate when he reasonably should have, the Clock does run. Just how diligent an investigation the provider must perform to investigate an overpayment charge remains unclear but is also likely to be fact specfic and will require application of common sense.
PPACCA sec 6402(d) amends the Federal CMP statute as well. Therefore, failure to report and return an overpayment not only triggers the FCA but also triggers a separate penalty under the CMP of up to $10,000/claim and treble (triple) damages and the potential exclusion from federal health care programs including Medicare/Medicaid.
On February 16, 2012, CMS published a notice of proposed rulemaking (NPRM) regarding the obligation to report and return Medicare and Medicaid overpayments (77 Fed. Reg. 9179) in which CMS would implement the 60-Day Rule only for purposes of Medicare Parts A and B. CMS has not yet issued its final rule on this matter. CMS has three years, or until February of 2015, to issue its final rule or propose a new rule after this date.
The next question is whether the 60-Day Rule should be obeyed as CMS has not issued its final rule as to how it would implement the statute? The answer is yes. The statute can be enforced even without a final rule from CMS as the statute does not require any interpretation by CMS to implement. The definition of overpayment and the requirement to act within a 60-day deadline are clear in the statute. So, the statute must be obeyed even though CMS has not yet decided how it will implement it. The key provision that CMS will define through the rule making process is how it will define “identify”. The proposed CMS rule considers the matter of “identify” in the context of reckless disregard or deliberate ignorance occurring when a provider actually identifies an overpayment made to it. In this context, the provider would have to have some knowledge that he is in receipt of an overpayment from the government. When the provider is believed to have such knowledge, the 60-Day click begins.
If an overpayment is received and is paid back, what should the provider do with any co-payment received from the patient? This has to be paid back to the patient. It may cost the provider far more in administrative time to calculate likely small amounts that must be paid back to the patient in the form of copayment. However, the statute requires repayment by the provider, even if it costs the provider more in determing such copayment repayment calculations than the copayment amount to be returned.
At the time of this writing, CMS NPRM 60-Day Rule intends to apply a ten (10) year look back provision to Part A and B overpayments. This is peculiar as currently, after 4 years, medical claims made to CMS are determined to be adminstratively final. Additionally, the look back period which applies to Medicare Advantage or Medicaid Managed Care plans has already been finalized and is limited to a 6 years look back. Why CMS is considering applying a 10-year look back period against medical providers is unclear.
If there is an overpayment, does the failure to report and refund timely, which is an “obligation under 1320a-7k(d)(3), automatically result in FCA liability? Not necessarily. The provider must have acted knowingly and improperly.
What if a provider is paid for certifying compliance with meaningless use for implementation of electronic medical records and the provider did not, in fact meet all the elements to fulfill certification requirements? This would be trigger a FCA violation directly under the FCA as the certification was fraudulent. It would also independently constitute an overpayment for which he was not eligible and this overpayment would trigger the 60-Day Rule and secondarily the FCA under FERA.
How about this hypothetical. A hospital system finds and fixes a computer glitch in its non-hospital services affiliate. The hospital engages in data collection and repayment is made within 60-Days of identifying the overpayment. How far should it go back to calculate the repayment? Should it go back 4 years from when it makes the payment to CMS under the concept of the 4-year administrative finality standard? Or, should it go back to the time it identifies that the computer glitch occurred? Or, should it go back 6 years? The current administrative regulation calling for a 4-year look back is still in place as the look back has not thus far been finalized to either a 6-year or a 10-year look back.
First Enforcement of 60-Day Rule: US ex rel. Kane v. Healthfirst, Inc., No. 11-2325 (SDNY).
This is the first government case enforcing the 60-Day Rule. This alleged false claim action was a result of failure to report and return a Medicaid overpayment within 60-Days of identifying them. In this case, Healthfirst, Inc., a Medicaid managed care company, erroneously directed hospitals to submit claims to Medicaid. Medicaid paid the hospital claims when it should not have as the Medicaid managed care company should have paid them instead. NY state put the hospitals on notice that incorrect payments were being made to them. Kane, a hospital employee for the hospital system was directed to investigate the matter and he identified >$1 million in Medicaid overpayment. Kane was terminated and Kane filed a qui tam claim 60 days after he notified the hospital system. The government alleged that the hospital system did not act on Kane’s analysis. The hospital system moves to dismiss the case on the grounds that Kane’s report to the hospital system did not identify the overpayment with specificity. The hospital system is arguing there was no identification on the claim that Kane’s work was incomplete. This case is still ongoing.
SELF-DISCLOSURE OPTIONS:
The self-disclosure process under the 60-Day Rule requires (1) investigation and (2) corrective action. But, what are the disclosure options?
The most benign option is to disclosre and refund to Medicare Adminstrative Contractor or the local Medicaid Agency that handles provider claims. Sometimes, however, they will refer the matter to law enforcement upon reviewing the explanation for return of the overpayment. If there is a matter of wrong doing involved, one should consider disclosing to the OIG under the OIG Self-Disclosure Protocol (“SDP”). If a criminal act is involved, self disclosure can be to the US Attorney’s Office. If the matter involves only Stark Law violation, the report can be to CMS under the Self-Referral Disclosure Protocol (“SRDP”). Matters that “may also raise liability risks” under Anti-Kickback Statute should be disclosed, according to CMS, to the OIG and not to CMS. The Medicare payment look back period under SRDP is 4-years. If you identify a Stark Law violation and fail to refund the associated Medicare payment under SRDP, you are subject to the 60-Day Rule penalities and qui tam actions and the liabilities are grave.
The OIG Self-Disclosure Protocol is also an option for disclosure. This option allows self-disclosure and the ability to settle matters that could involve liability under the Civil Money Penalties Law or which could serve as a basis for exclusion form the Medicare and Medicaid programs. Stark Law only violations should not be disclosed through this route. The benefit of using this form of self-disclosure is a release of Civil Money Penalties and the risk of exclusion from the Medicare and Medicaid program, lower damage penalties, and a suspension of the 60-Day Rule. FCA violations are not released, unless the disclosing party requests DOJ’s particpation or the DOJ chooses to participate.
Will self-disclosure preclude a qui tam action to be filed against the disclosing party?
Disclosure eliminates the risk of continue FCA violations for failure to refund and disclosure overpayments. However, it may or may not bar a qui tam action relating to the basis for the conduct that led to the disclosure. Under US ex re Rost v. Pfizer (1st Cir.), the court takes the position that a qui tam action cannot be brought after public disclosure of an FCA violation. However, under US ex rel Whipple v. Chattanooga-Hamility Cty. Hosp. Auth. (ED Tenn 2013), the court says that a qui tam action can be brought. Under this case, if the relator is an “original source”, he may still litigate a qui tam action even if the matter has been publically disclosed. However, under 31 USC 3730(e)(3), qui tam actions are barred where a civil money penalties proceeding is pending. Self-reporting through the OIG Self-Disclosure Protocol should trigger this statute providing protection against a qui tam action.
Conclusion:
Overpayments made by CMS now trigger a duty for providers to report and return. They must return the overpayment and report why the overpayment is being returned. The risk of not engaging in self-disclosure are grave, including criminal sanctions, money penalties, and potential exclusion from the Medicare and Medicaid programs.
[1] FERA is the 2009 Fraud Enforcement and Recovery Act
[2] 31 USC sec3729(b)(2)
--------------------------------------------------------------------------------------------------
Leslie Tar, Esq., LLM*
*Florida Health Law Attorneys, Florida Medical Board Defense Attorneys, Florida Medical License Defense Attorneys.
* Office location in Port Charlotte, Florida with service to Sarasota, Ft Myers, Naples, Tampa, Orlando, Vero Beach, West Palm Beach, Boca Raton, Ft Lauderdale, Miami, Gainesville, Tallahassee, Pensacola and throughout Florida and nationally.