A recent proposed change to the 60-day repayment rule could affect how providers assess their potential liability for overpayments and their choices regarding repayment. On December 27, 2022, the Centers for Medicare & Medicaid Services (CMS) proposed a change to the standard of care required under the 60-day repayment rule (the “Overpayment Rule”) as part of a group of policy and technical changes to the Medicare program. The change would affect traditional Medicare, as well as Medicare Advantage (MA) and Medicare Part D. If adopted, the change will be welcome news for providers as it will raise the standard for liability under the Federal False Claims Act (FCA) for failure to report and repay an identified overpayment from ordinary negligence to “reckless disregard.”
But why is CMS making this change now? And what practical effect will the change have on providers with respect to how they conduct their compliance programs? This article attempts to answer those questions.
The Backstory to the Overpayment Rule Change
The genesis of the proposed change is a case brought by United Healthcare’s Medicare Advantage organizations and supported by the managed care insurance industry’s trade association – “America’s Health Insurance Plans” – in January 2016, challenging the Overpayment Rule adopted by CMS for Medicare Advantage plans in 2014. Most likely the real beef of the Medicare Advantage plans was with CMS’ application of what the insurers viewed as a double standard for determining payment rates, but it seized upon the Overpayment Rule’s “reasonable diligence” requirement (explained below) as a vehicle to challenge the double standard.
The double standard that the industry complained about arose from the differences between traditional (fee for service) Medicare and Medicare Advantage. Under the former, providers are paid on the basis of services rendered. While providers are required to report diagnosis codes, the code selection typically does not affect payment and CMS does not audit them for accuracy. By contrast, Medicare Advantage plans are paid on a pre-determined monthly lump sum basis, with the amounts adjusted per-enrollee based on health status. To determine that health status, CMS requires the plans to report data on the diagnosis codes of its enrollees, which the plans derive from the medical records held by their plan providers. By law, CMS must pay Medicare Advantage plans in a manner that ensures “actuarial equivalence” between traditional Medicare and Medicare Advantage. In other words, the amounts paid to a Medicare Advantage plan in monthly premiums must be actuarily equivalent to what CMS would otherwise pay under traditional Medicare for the same group of beneficiaries.
CMS conducts audits of Medicare Advantage plans to validate the accuracy of the diagnosis codes they reported for their plan members by comparing bills paid to corresponding medical records. Beginning in 2008, CMS used the audit results to extrapolate error rates from the audit sample to the entire population for the affected Medicare Advantage plan and required the plans to return any overpayment to CMS based on the extrapolated error rate. This step is what led to the industry’s complaint about the use of a double standard: CMS did not audit its traditional Medicare claims for accuracy of the diagnosis codes when determining monthly premium rates paid to the plans (potentially understating the payments), but then it used audited records to require plans to return funds to CMS. The insurers argued that this double standard violated the actuarial equivalence requirement. In 2012, in response to these complaints, CMS adopted a “Fee for Service (FFS) Adjuster” (a margin of error) before requiring repayments on the extrapolated audit results.
Fast forward to 2014 and CMS’ adoption of the Overpayment Rule, which includes a provision requiring Medicare Advantage plans to refund “identified” overpayments, and defines “identified” to include not only overpayments for which the provider has actual knowledge but also overpayments that the Medicare Advantage plan “should have determined through the exercise of reasonable diligence.” When CMS did not include a FFS Adjuster in the Overpayment Rule, the Medicare Advantage plans objected, arguing that they should be given a margin of error on their repayment obligations under the Overpayment Rule similar to the FFS Adjuster they had on the CMS diagnosis code audits.
In the litigation, United Healthcare argued that the reasonable diligence standard essentially required them to audit all of the data they submit to CMS because of the potential risk of False Claims Act liability. This obligation, United Healthcare argued, failed to ensure “actuarial equivalence” – because it allowed CMS to set rates based on unaudited data, but then required the plans to perform “a more searching form of scrutiny” in identifying overpayments attributable to the same types of mistakes (inaccurate diagnosis codes). United Healthcare also argued that the obligation imposed FCA liability for ordinary negligence, which was “an unlawful departure from the standard of liability under the False Claims Act.”
The latter argument appears to have struck a nerve with the Federal District Court for the District of Columbia. The court cited to the CMS commentary that accompanied the Overpayment Rule, where CMS stated that reasonable diligence “at a minimum … would include proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments,” as compared to the False Claims Act’s standard of actual knowledge, deliberate ignorance, or reckless disregard.
The district court ruled for the Medicare Advantage plans on both grounds – that the Overpayment Rule violated the actuarial equivalence requirement and that it impermissibly imposed an ordinary negligence standard for liability under the False Claims Act. With respect to the latter, the court held that the Overpayment Rule’s reasonable diligence standard was inconsistent with the False Claims Act’s “knowingly” standard.
CMS appealed the district court’s decision to the U.S. Court of Appeals for the D.C. Circuit but wisely chose not to appeal the court’s ruling on the reasonable diligence standard. This litigation strategy appears to have eliminated the plaintiffs’ best argument, as the court of appeals roundly rejected their other arguments about the necessity for an actuarial equivalence adjustment when applying the Overpayment Rule to the results of extrapolated diagnosis code audits.
The court of appeals noted that CMS was not challenging the lower court’s rulings regarding the reasonable diligence standard being inconsistent with the FCA’s “knowingly” standard of liability. Nevertheless, the court went on to state in dicta that:
Nothing in the Overpayment rule obligates insurers to audit their reported data. As the district court held … the Rule only requires insurers to refund amounts they know were overpayments, i.e., payments they are aware lack support in a beneficiary’s medical records. That limited scope does not impose a self-auditing mandate.
The Proposed Rule’s Change to the Reasonable Diligence Standard
In its December 27, 2022 proposed rule, CMS announced the change to the liability standard under the Overpayment Rule with little fanfare. The commentary is brief. It merely refers to the United Healthcare litigation as the basis for CMS’ decision to amend the Overpayment Rule provisions to remove the reference to “reasonable diligence” and replace it with the False Claims Act’s “knowingly” standard. As amended, the pertinent provision of the Overpayment Rule (for traditional Medicare) will read as follows:
§ 401.305 Requirements for reporting and returning of overpayments.
(a) General
(1) A person that has received an overpayment must report and return the overpayment in the form and manner set forth in this section.
(2) A person has identified an overpayment when the person knowingly receives or retains an overpayment. The term ‘‘knowingly’’ has the meaning set forth in 31 U.S.C. 3729(b)(1)(A).
Practical Effects of the Change
1. An Additional Defense to Liability
Certainly, the change to the Overpayment Rule’s liability standard, if adopted in final form, will benefit those unfortunate providers who become subject to a suit under the False Claims Act for failing to repay an identified overpayment. Depending upon the facts, a provider subject to such a suit may be able to argue that its failure to repay was the result of mere negligence, not reckless disregard. The Government will not be able to argue that the provider “should have known” of the overpayment. Instead, it will have to prove that the provider’s failure to identify the overpayment was at least a form of “gross negligence plus.” Further, a provider-defendant will be able to cite to the DC Circuit Court’s statements to argue that the Overpayment Rule only requires a provider to refund amounts that they know were overpayments; i.e., payments they are aware lack support in the medical record.
Yet the December 7, 2022 proposed amendment does not adopt an actual knowledge test, and in that respect does not reconcile squarely with the DC Circuit’s description of the limited duty imposed on Medicare Advantage plans to refund overpayments only if they “know” or are “aware” of the overpayments. Because these statements were not necessary to the court’s decision (CMS had already dropped the “reasonable diligence” issue on appeal), it is not certain how much weight they will carry in subsequent cases. The DC Circuit’s commentary on the need for insurers to have actual knowledge of an overpayment to retrigger the repayment obligation ignores the “reckless disregard” prong of the definition of “knowingly” under the FCA. Over-reliance on these statements would come with significant risk.
Indeed, before adopting the “reasonable diligence” standard for providers’ duty to identify overpayments, CMS suggested that the FCA’s “knowingly” standard supported a constructive knowledge test, referring to Congress’ use of the “knowing” language in the repayment provision of the Act as support for its position that in some instances a provider or supplier may receive information that creates an obligation to make a “reasonable inquiry” to determine whether an overpayment exists. In the final rule, CMS rejected arguments that the duty to repay was limited to situations of actual knowledge:
If the requirement to report and return overpayments only applied to situations where providers or suppliers had actual knowledge of an overpayment, then these entities could easily avoid returning improperly received payments and the purpose of the section would be defeated.
The proposed rule change might be a case of form over substance, with CMS conceding that it cannot stray from the “knowingly” test for liability under the False Claims Act, but the government (particularly the Office of the Inspector General (OIG), which we assume coordinates closely with CMS on the Overpayment Rule) practically construing the “knowingly” test to mean the same as a reasonable diligence test.
2. A New Factor in Decisions on Where to Make a Disclosure
CMS’ abandonment of the reasonable diligence standard may affect how a provider evaluates whether to make a self-disclosure using the OIG’s Self-Disclosure Protocol or simply a repayment to the Medicare Administrative Contractor. If a provider identifies overpayments after an extended period of time, and those overpayments were not the result of initial false claims but instead were received through innocent mistake or ordinary negligence, or perhaps through no fault of the provider, then the provider may reasonably decide to refund to the Contractor and avoid the claims multiplier that would apply in a self-disclosure to the OIG.
But a recitation of these factors shows just how uncommon such a fact pattern might be; if the initial submission of the claims could be characterized as “reckless” then the False Claims Act (or Civil Monetary Penalties statute) could still apply even if the overpayments are never identified or the delay in identifying the problem was innocent or merely negligent. In the real world, significant overpayments are seldom the result of innocent mistake by the provider or the fault of the contractor. Most often, the overpayments result from provider error, which becomes systemic. At some point in time, the repetition of the error without detection gives rise to the potential for the initial claims submission to be considered “reckless” behavior, as providers are considered responsible for knowing the Medicare program rules, whether or not the overpayments are ever detected. The provider’s primary concern will remain the application of the False Claims Act to the initial submission of the claims, not the application of the 60-day repayment rule.
3. Determining the Time Frame for Investigating and Reporting Overpayments
Another significant consequence of the removal of the “reasonable diligence” standard is uncertainty over how to approach investigations and repayments. When it adopted the “reasonable diligence” standard, CMS described in detail a six-month period (from receipt of credible information of an overpayment) for conducting an investigation and a two-month period for quantifying the results and making repayment. It also described examples of credible information that would trigger a duty to investigate. The change proposed in December 2022 provides no substitute guidance for providers to follow. CMS apparently has decided that providers will need to figure out answers to these questions on their own, and then prosecutors and courts can decide whether they made good choices. Some commentators have even suggested that the change in the rule eliminates the eight-month rule-of-thumb to conduct an investigation, shortening it to 60 days.
In practice, completing an overpayment investigation within 60 days is nearly always an impossibility. Given that the regulatory change from “reasonable diligence” to “knowingly” is a loosening of the standards, the six-month investigation/two-month quantification time period still should be viewed as a useful guideline.
4. The Duty to Conduct Pro-Active Compliance Activities
And finally, the most puzzling question – do providers no longer need to be concerned with conducting “pro-active compliance activities … to monitor for the receipt of overpayments”? Superficially, it could be said that the pressure is off because of the removal of the reasonable diligence standard. The DC Circuit Court’s statement in United Healthcare that insurers need only refund amounts they know are overpayments implies a very limited duty to conduct retrospective audits. But this is exactly the situation that caused CMS to adopt the “reasonable diligence” standard for determining when overpayments have been identified. In 2016, CMS described its “programmatic concern of the ostrich defense – that the plain mandate to report and return overpayments received would be avoided by not taking action to obtain actual knowledge of an overpayment.”
Whether courts will hold to an “actual knowledge” standard for repayment liability remains to be seen. One should expect that the government will argue that “deliberate ignorance” or “reckless disregard,” as evidenced by a failure to investigate suspected overpayments, is sufficient to trigger False Claims Act liability for knowingly and improperly failing to repay an overpayment. Indeed, prosecutors may try to characterize a provider’s decision not to engage in any pro-active compliance activities as being evidence of reckless disregard, and whistle blower attorneys are unlikely to be dissuaded from pursuing cases simply because of this rule change. Most providers will not want to roll the dice on FCA liability by relying upon an actual knowledge standard for repayments as a substitute for proactive compliance activities. In sum, providers should not see the abandonment of the “reasonable diligence” standard as a green light to reduce their compliance budgets.
About the Author:
Mark Fitzgerald is a principal with the Powers Law Firm. He has represented health care providers for many years on a broad array of healthcare regulatory and compliance matters including compliance with the Stark and anti-kickback laws, Medicare billing and reimbursement, and voluntary self-disclosure and repayment matters.
This article is for informational purposes and is not intended as legal advice. No legal or business decision should be based on its content. If you have any questions about the subject of this article please contact Mark Fitzgerald at Mark.Fitzgerald@powerslaw.com
This article was published in the American Health Law Weekly on February 3, 2023.
Copyright 2023, American Health Law Association, Washington, DC. Reprint permission granted.