 Home 5 Lab Industry Advisor 5 Lab Compliance Advisor 5 Compliance Perspectives-lca 5 Compliance Perspectives: How to Comply with the CMS 60-Day Overpayment Repayment Rule

Compliance Perspectives: How to Comply with the CMS 60-Day Overpayment Repayment Rule

by Glenn S. Demby | Sep 1, 2023 | Compliance Perspectives-lca, Essential, Lab Compliance Advisor

While overpayments may not be your fault, they expose your lab to the risk of liability under the Affordable Care Act.

Sometimes, your lab may receive overpayments from a payer. The overpayment may be due to an isolated error affecting only a single claim, or a flaw in the payer’s system resulting in hundreds or even thousands of overpayments over a long period. While these overpayments may not be your fault, they expose your lab to the risk of liability under the Affordable Care Act (ACA) rule requiring providers to report and return all Medicare and Medicaid overpayments within 60 days of identifying them.¹ Failure to report and refund overpayment may also result in liability under the False Claims Act (FCA), exposing your lab to the risk of prosecution, qui tam lawsuits, and fines ranging from $13,508 to $27,018 per claim. Here’s a briefing on the 60-day rule and how to comply with it.²

What Is an “Overpayment”?

The ACA 60-day rule applies to overpayments that a provider identifies within six years of receiving the payment (the “lookback period”). The February 2016 Centers for Medicare & Medicaid Services (CMS) Final Rule defines overpayment as “any funds that a person has received or retained…to which the person, after applicable reconciliation, is not entitled.”³

“It doesn’t matter whether the overpayment was initially the result of clear fraud or an innocent mistake,” notes healthcare attorney Joseph Keillor of Baker Donelson. “Once you’ve identified an overpayment, your duty to report and return is triggered all the same.”

Examples of Identified Overpayments

In its preamble to the Final Rule, the Centers for Medicare & Medicaid Services (CMS) lists the following as examples of situations in which an overpayment has been identified:³

·       A provider finds incorrectly coded services in its review of billing or payment records
·       A patient died before the date of service on a submitted claim
·       Services were provided by an unlicensed or excluded individual
·       Overpayments are discovered during an internal audit
·       A government agency informs a provider that an audit has revealed a potential overpayment and the provider doesn’t make reasonable inquiry
·       A provider “experiences a significant increase in Medicare revenue and there’s no apparent reason” and the provider doesn’t make a reasonable inquiry to determine if overpayment exists
·       A physician group finds that profits for the group or for a particular physician “were unusually high in relation to hours worked or the relative value units associated with the work” and fails to conduct a reasonable inquiry

The amount that must be repaid is the difference between the amount received and the amount that should have been received, Keillor explains. For an overpayment resulting from violations of the Anti-Kickback Statute (AKS), Stark Law, or goods or services provided by an excluded provider, the entire amount received is considered an overpayment.

The ACA regulations include certain exceptions or special rules for cost report claims, formal OIG and CMS self-disclosures, and requests for extended repayment schedules. A payment that was properly received at the time isn’t deemed an overpayment because the law or regulation has since changed. However, Keillor notes that “agency clarifications are a grey-zone and must be carefully evaluated on a case-by-case basis to assess whether they drive an overpayment with respect to a claim that seemed legitimate and appropriate when originally filed.”

CMS also clarifies in the preamble of the Final Rule that labs and other providers may not use overpayments to offset underpayments. Rather than offsets, providers’ recourse for underpayments is to request reopenings.³

What Is “Identification” of an Overpayment?

The duty to report and repay is triggered when an overpayment is “identified.” According to the current ACA regulations (42 CFR 401.305(a)(2)), “A person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment” (emphasis added).⁴

The regulation thus gives providers enough time to look into possible overpayments and determine their amount. Liability becomes a possibility only when providers are negligent regarding the overpayment.

60-Day Rule vs Reverse False Claims Liability

In addition to violating the ACA 60-day rule, failure to report and repay a Medicare or Medicaid overpayment may constitute a “reverse false claim” resulting in liability under the FCA. The difference is that the FCA doesn’t provide for the exercise of reasonable diligence the way the ACA regulation does. For FCA liability to kick in, the provider need only receive the overpayment “knowingly,” which the statute (31 U.S.C. 3729(b)(1)(A)) defines as meaning “that a person, with respect to information:⁵

(i) has actual knowledge of the information[,]
(ii) acts in deliberate ignorance of the truth or falsity of the information[,] or
(iii) acts in reckless disregard of the truth or falsity of the information.”

Thus, the FCA standard for “knowingly” is more stringent than the ACA standard for identifying an overpayment. The ramifications of this distinction became clear in a 2018 FCA lawsuit by CMS against an insurer for failing to report and refund Medicare Part C and D overpayments. The federal court ruled that using the FCA “knowingly” standard as an enforcement tool for failure to report and return overpayments under the ACA was inconsistent with the ACA regulations since the latter imposes a more lenient negligence standard for liability. Accordingly, the court concluded that CMS exceeded its authority by seeking to hold the insurer to the more stringent FCA standard rather than the one provided for in the regulation [UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 191 (D.D.C. 2018), rev’d in part on other grounds sub nom. UnitedHealthcare Ins. Co. v. Becerra, 16 F.4th 867 (D.C. Cir. 2021), cert. denied, 142 S. Ct. 2851 (U.S. June 21, 2022) (No. 21-1140))].

In response to the Azar case, on December 27, 2022, CMS published a proposed rule that would have ended this discrepancy by making the FCA “knowingly” rule the standard for liability under the ACA overpayment regulations. Specifically, an overpayment would be deemed “identified” and thus subject to the 60-day report and refund requirement when the person “knowingly” receives or retains the overpayment. The proposed rule specifies that the term “knowingly” would have the same meaning as in FCA 31 USC 3729(b)(1)(A).⁶

The good news for labs and other providers is that CMS has apparently decided not to proceed with this idea. Significantly, the proposed change to the standard for identifying overpayments for purposes of the ACA 60-day rule was omitted from the final rule that CMS released on April 5, 2023, and which officially took effect on June 5, 2023.⁷

60-Day Rule Compliance Strategy: Seven Steps to Demonstrate Reasonable Diligence

Bottom Line: Reasonable diligence remains the standard for identifying overpayments subject to the ACA 60-day rule. Unfortunately, there’s no official definition of “reasonable diligence.” So, what exactly does the term mean? According to Keillor, labs seeking to live up to the reasonable diligence standard of identifying overpayments should follow these seven rules:

Rule 1. Be Proactive

Although less demanding than the FCA “knowingly” standard, reasonable diligence requires proactive effort. CMS’s preamble to the February 2016 Final Rule recommends that labs and other providers have “effective compliance plans.” Performing no or minimal compliance activity to monitor the accuracy and appropriateness of their Medicare claims creates liability risk “based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment,” CMS adds.³

Rule 2. Act on Credible Information within Six Months

In addition to “proactive compliance activities” such as monitoring receipts and looking for overpayments, labs must also be reactive by performing investigations in response to “obtaining credible information of a potential overpayment,” according to the 2016 Final Rule.³

“The ‘credible information’ standard is fairly broad and boils down to whether the information supports a reasonable belief that an overpayment may have been received,” Keillor says. “A compliance hotline submission, for example, might still implicate the ‘credible information’ standard even if certain details are missing or the submission lacks perfect precision.”

Keillor notes that the 60-day clock generally begins to tick when the reasonable diligence is completed. But if you fail to exercise reasonable diligence, the 60-day time frame for returning an overpayment runs from the time you receive credible information about a potential overpayment, i.e., when it should have started exercising reasonable diligence, to address the potential overpayment.

“Credible information includes information that supports a reasonable belief that an overpayment may have been received,” explains Keillor, citing CMS’s preamble indicating that reasonable diligence is “demonstrated through the timely, good faith investigation of credible information, which is at most six months from receipt of…credible information [of a possible overpayment], except in extraordinary circumstances.”³ However, the six-month deadline isn’t included in the express language of the regulation.

The preamble leaves some wiggle room, with CMS suggesting that extraordinary circumstances may warrant extending the six months for investigation and 60 days for payment. According to CMS, extraordinary circumstances may include “unusually complex investigations” such as those involved in a physician self-referral law violation, or situations delayed by natural disasters or states of emergency.

Rule 3. Treat MAC Determinations as Credible Information

CMS notes that the audit findings of a Medicare Administrative Contractor (MAC) “are credible information of at least a potential overpayment.” CMS adds that a provider’s confirmation of a MAC’s audit findings may constitute “credible information related to a potential overpayment for periods that were not audited, triggering a need to conduct reasonable diligence,” Keillor says. Moreover, if a MAC determines that there’s been an improper payment of a cost report claim, the provider must “conduct reasonable diligence on other cost reports, CMS states.”³

Rule 4. Document Efforts to Comply with Reasonable Diligence

Labs and other providers are used to documenting everything relevant to demonstrating compliance with the law. In the context of overpayments, CMS’s preamble says that “it is certainly advisable for providers and suppliers to maintain records that accurately document their reasonable diligence efforts to be able to demonstrate their compliance with the rule.”³

Rule 5. Consider Medical Necessity

In the preamble, CMS indicates that the principles explained in the final rule apply to medical necessity determinations. Commenters to the proposed rule contended that lack of medical necessity or insufficient documentation “are extremely difficult to define objectively” and suggested that applying the rule in those circumstances would be unfair. However, CMS responded that “[s]ufficient documentation and medical necessity are longstanding and fundamental prerequisites to Medicare coverage and payment.”³

Rule 6. Treat Unexplained Medicare Revenue Increases as a Red Flag

CMS also suggests that a significant increase in Medicare revenue should trigger the need for reasonable diligence. A commenter sought leniency for labs in this regard, noting that labs aren’t “in a position to determine the medical necessity of the services they provide because they do not order the tests,” and thus shouldn’t be expected to “proactively conduct an inquiry into whether an overpayment exists based on the volume of Medicare work [the lab] conducts.” CMS disagreed. “All providers and suppliers have a duty to ensure that the claims they submit to Medicare are accurate and appropriate,” the agency responded. “There may be situations where a significant increase in Medicare revenue should lead a laboratory to conduct reasonable diligence.”³

Rule 7. Extrapolate to Determine Existence of Similar Overpayments

“A lab—just like any other provider or supplier—can’t act like an ostrich when it uncovers specific problematic claims as part of an audit sample, and bury its head in the sand in regards to similar claims beyond the audit sample,” Keillor cautions. CMS echoes the sentiment, saying that it believes “it is appropriate to inquire further to determine whether there are more overpayments on the same issue before reporting and returning the single overpaid claim.”³

CMS says providers should be able to conduct a probe sample and incorporate it into a larger full sample to extrapolate overpayments “in a timely manner.”³ According to Keillor, as compared to other provider and supplier types, clinical labs will more frequently have claim sets that are materially similar and don’t require extensive individualized analyses to determine which particular claims were overpaid. Although this won’t always be the case, when it is, lab leaders should be able to address the issue more quickly.

Editor’s Note: This is an updated version of a G2 Intelligence article on the 60-day rule that was originally published in April 2016.⁸