On Feb. 12, the Department of Health and Human Services’ (“HHS”) Centers for Medicare & Medicaid Services (“CMS”) published its final rule regarding reporting and returning Medicare overpayments. This final rule comes nearly four years after its proposed rule regarding the reporting and return of Medicare overpayments that left the provider community nervous and uncertain about when an overpayment would be considered “overdue” under CMS’s vague 60-day standard.

The final rule takes effect March 14, 2016, and although the final rule is not retroactive, providers and suppliers reporting and returning overpayments on or after March 14, 2016—even overpayments received prior to March 14, 2016—must comply with the final rule’s requirements.

Under Section 1128J(d) of the Social Security Act, which was established on March 23, 2010, with the enactment of the Affordable Care Act, providers and suppliers must report and return an overpayment by the later of (a) the date which is 60 days after the date on which the overpayment was identified; or (b) the date any correspondence cost report is due, if applicable.

For timing purposes, the 60-day time period begins when either: 1) the reasonable diligence is completed; or 2) the day the provider receives credible information of a potential overpayment and fails to exercise reasonable diligence to discover the actual overpayment. The final rule provides long-awaited guidance and clarity around Section 1128J(d)’s statutory language to guide providers and suppliers in their efforts to report and return overpayments in the manner required by CMS. Below is a summary of the key highlights of the final rule.

60-Day Clock Clarified

The final rule is laced with terms of art. Under the final rule, a provider or supplier “identifies” an overpayment when, through “reasonable diligence,” it quantifies the amount of the overpayment. “Reasonable diligence” is interpreted by CMS to require both proactive compliance and responsive investigations to obtain credible information of a potential overpayment, and requires a timely, good faith investigation of credible information, which occurs within six months from receipt of such information, except in extraordinary circumstances that CMS acknowledges could justify an investigation time in excess of six months. CMS selected six months as the benchmark timeframe for an overpayment investigation to suggest that providers should prioritize these investigations while recognizing that such investigations may demand significant time and resources, and allocating 60 days after the six-month investigation period to report and return the overpayments identified.

Notably, the final rule abandons CMS’s “all deliberate speed” language in its 2012 proposed rule, which some federal courts had recently interpreted to mean that providers and suppliers had a 60-day window from the date of learning of any alleged overpayment to return the funds to CMS. Under the final rule, CMS clarifies that the 60-day clock begins after any overpayments have been identified (i.e., after “reasonable diligence,” described above, has been completed and the actual overpayment is quantified) or the date the provider learned of credible information of an alleged overpayment in the event the provider fails to exercise reasonable diligence to investigate the matter. So, CMS indicated that a total of eight months—six months for timely investigation and two months for reporting—is likely a reasonable amount of time to respond to a potential overpayment, absent extraordinary circumstances. Extraordinary circumstances are fact-dependent but can include unusually complex investigations, which the provider reasonably anticipates will span more than six months, and physician self-referral law (commonly referred to as the “Stark Law”) violations referred to CMS via its Self-Disclosure Referral Protocol reporting process.

Extrapolation Acceptable

The final rule also indicates that statistical sampling and extrapolation are appropriate components of reasonable diligence in investigating an overpayment where a claim-by-claim review is impractical. Such statistical methods can serve as an appropriate way to calculate an overpayment amount. Providers and suppliers should also maintain records that accurately document their reasonable diligence efforts to be able to demonstrate compliance with the final rule, including any statistical methodologies employed to calculate an overpayment caused by a systemic issue.

Providers also have an obligation to look beyond a single claim overpayment for issues likely to be systemic in nature. For example, CMS states in the final rule that it is inappropriate for a provider or supplier to only return a subset of claims identified as overpayments and not extrapolate the full amount of the overpayment. Thus, providers and suppliers should not report and return overpayments on specific claims from a probe sample without identifying the full scope of the overpayments. Similarly, where the overpayment amount is extrapolated from a statistical sampling, it is necessary for the overpayment report to explain how the overpayment amount was calculated.

Six-Year Lookback Period and Reopening Rules Forthcoming Amendments

Importantly, the final rule limits the lookback period to six years from the date the provider identifies the overpayment from its proposed rule lookback period of 10 years. CMS noted this six-year limit is necessary to avoid imposing unreasonable burdens on providers and suppliers to exercise reasonable diligence through an auditing process. Similarly, the final rule states that CMS will seek to amend the claims reopening rules (which currently provide for only a four-year reopening period) to provide for a reopening period that accommodates the six-year lookback period for reporting and returning overpayments where the reopenings are requested by providers or suppliers. CMS stressed such amendments are necessary to ensure that the reopening rules do not present an obstacle or unintended loophole to compliance.

CMS noted, however, that it is not authorized to increase the current four-year lookback period for Stark Law SRDP disclosures unless and until the Office of Management and Budget (“OMB”) approves using the six-year lookback period. CMS did state that it will seek authorization from OMB to extend the six-year lookback standard to the SRDP process in connection with this final rule.

Multiple Avenues to Return Overpayments

Regarding return of overpayments, the final rule allows for multiple avenues to return overpayments in addition to the standard voluntary refund process. Providers and suppliers may use the claims adjustment, credit balance, self-reported refund process, or another appropriate process to report and return overpayments to CMS. The ability to use multiple processes to return overpayments should allow providers and suppliers to minimize costs.

Tolling Limited to Formal Self-Disclosure Processes Only

Several commenters requested that CMS clarify whether self-disclosure by providers and suppliers to other government entities, such as the Department of Justice (“DOJ”) and the Medicare Fraud Control Unit (“MFCU”), would toll the 60-day deadline as in the CMS Voluntary Self-Referral Disclosure Protocol (“SRDP”) and the OIG Disclosure Protocol (“SDP”). But, CMS refused to extend this treatment to self-disclosing entities outside of the SRDP and SDP processes. Thus, there is no suspension of the 60-day deadline in the final rule for self-disclosure to DOJ or MFCU.

No De Minimus Overpayment Exception

Although requested by commenters, CMS refused to adopt a de minimus monetary overpayment threshold in the final rule. CMS reasoned that adopting a regulatory de minimus standard would be susceptible to abuse, especially in the context of claims-based overpayments. However, CMS did state that it is considering establishing a minimum monetary threshold for cost report-related overpayments in future rulemaking.

No ICD-10 Grace Period

Likewise, several commenters requested a grace period to accommodate billing errors and overpayments caused by learning the ropes of ICD-10 and its implementation. CMS declined to adopt such a grace period.

Final Rule Limited to Medicare Part A and B Overpayments Only

Note, no final rule has been published that addresses Medicaid overpayment requirements. Furthermore, CMS stated in the final rule that, given the differences that exist between Medicare Parts A and B and Medicare Parts C and D and Medicaid, that a separate rulemaking process would be appropriate to address those differences.