On February 16, 2012,[1] almost two years after the passage of the Patient Protection and Affordable Care Act[2] (the "ACA"), the Centers for Medicare & Medicaid Services ("CMS") issued a proposed rule ("Proposed Rule") regarding overpayments to providers and suppliers, as provided for under Section 6402(a) of the ACA and codified at Section 1128J(d) of the Social Security Act (the "Act"). Specifically, Section 6402(a) states that "[i]f a person has received an overpayment, the person shall (A) report and return the overpayment to the Secretary, the State, an intermediary, a carrier, or a contractor, as appropriate, at the correct address; and (B) notify the Secretary, the State, intermediary, carrier, or contractor to whom the overpayment was returned in writing of the reason for the overpayment."

Until now, regulators, courts, clients, and members of the bar have taken different positions on Section 6402(a). The Proposed Rule provides CMS's view on this matter, and, given that CMS is proposing a number of potentially onerous requirements with regard to investigating, reporting, and returning overpayments, stakeholders should consider submitting comments to the Proposed Rule, which are due no later than 5 p.m. on April 16, 2012.

What Is an Overpayment, and What Is the Lookback Period?

CMS proposes to include the same definition of "overpayment" as was provided in the ACA, which is "any funds that a person receives or retains under title XVIII or XIX to which the person, after applicable reconciliation, is not entitled ...."[3] However, to further this definition, CMS now has provided examples of what constitutes an overpayment, which include:

  • Medicare payments for noncovered services;
  • Medicare payments in excess of the allowable amount for an identified covered service;
  • Errors and nonreimbursable expenditures in cost reports;
  • Duplicate payments; and
  • Receipt of Medicare payment when another payor had the primary responsibility for payment.

CMS is proposing that overpayments must be reported and returned if a person[4] identifies the overpayment within 10 years of the date the overpayment was received. According to CMS, 10 years was selected because it is the outer limit of the False Claims Act ("FCA") statute of limitations. CMS also justified this period as providing (1) "a reasonable period for providers to close their books" and (2) a length of time that is sufficient to further CMS's interest in ensuring that overpayments are timely returned to the Medicare Trust Funds.[5]

CMS similarly is proposing to modify the reopening rules in 42 C.F.R. § 405.980(b) to provide that overpayments reported in accordance with these regulations may be reopened for a period of 10 years (i.e., currently, the reopening rules provide for a four-year timeframe). CMS is specifically requesting comments regarding this proposed 10-year lookback period.

CMS acknowledged that "[t]his proposed rule would impose a new deadline on the return of any overpayment that has been identified."[6] Significantly, not only is the Proposed Rule calling for the repayment of overpayments for 10 years, but it is also requiring providers and suppliers to audit and review their claims back 10 years. As such, the Proposed Rule could be read as amending the FCA statute of limitations, at least with regard to overpayments, by setting a 10-year lookback period as the standard, as opposed to an outer limit for certain claims. The Proposed Rule likewise imposes additional timeframes on overpayment repayments. Currently, the only statutory proscribed timeframe for overpayments limits the government's ability to determine that an overpayment occurred to three years.[7] Therefore, this Proposed Rule could set a new standard with regard to a lookback period and does set a new standard regarding the reopening rules.

When Is an Overpayment "Identified"?

The Proposed Rule discusses the term "identified" in the context of when a person has identified an overpayment. CMS proposes that "a person has identified an overpayment if the person has actual knowledge of the existence of an overpayment or acts in reckless disregard or deliberate ignorance of the overpayment." CMS states that it believes that this definition of "identified" incentivizes providers and suppliers to exercise reasonable diligence to determine if an overpayment actually exists. Further, CMS provides these examples of when an overpayment has been identified:

  • A provider of services or supplier reviews billing or payment records and learns that it incorrectly coded certain services, resulting in increased reimbursement;
  • A provider of services or supplier learns that a patient death occurred prior to the service date on a claim that has been submitted for payment;
  • A provider of services or supplier learns that services were provided by an unlicensed or excluded individual on its behalf;
  • A provider of services or supplier performs an internal audit and discovers that an overpayment exists;
  • A provider of services or supplier is informed by a government agency of an audit that discovered a potential overpayment, and the provider or supplier fails to make a reasonable inquiry; and
  • A provider of services or supplier experiences a significant increase in Medicare revenue and there is no apparent reason — such as a new partner added to a group practice or a new focus on a particular area of medicine — for the increase.

The Proposed Rule also discusses instances in which a provider or supplier has received information or identified a potential overpayment. According to the rule, this information creates an obligation to make a reasonable inquiry. "[I]f the reasonable inquiry reveals an overpayment, the provider then has 60 days to report and return the overpayment."[8] CMS further states that the failure to conduct a reasonable inquiry, "including failure to conduct such inquiry with all deliberate speed,"[9] under such circumstances could result in the provider knowingly retaining an overpayment because it acted with reckless disregard or deliberate ignorance as to whether it had received an overpayment. Significantly, this standard could further raise the bar in terms of how compliance programs must respond to potential overpayments.

What Are the Reporting and Returning Deadlines?

The Proposed Rule discusses the provisions of the Act that require that an overpayment be reported and returned by the later of 60 days after the date the overpayment was identified or the date any corresponding cost report is due. In its discussion, CMS stresses that if an overpayment is claims related, it must be reported and returned within 60 days of identification. However, if an overpayment is such that it would be normally reconciled on a cost report, the provider is permitted to report and return the overpayment either 60 days from identification or on the date the cost report is due, whichever is later. By way of example, if an overpayment is related to upcoding or the lack of documentation, it must be reported and returned within 60 days of identification because these types of claims for payment are not submitted to Medicare in the form of cost reports. Conversely, if the overpayment is related to graduate medical education payments, which are normally reconciled on a cost report, the provider or supplier may report and return the overpayment within 60 days or on the date the cost report is due. CMS emphasizes that it is including this discussion to prevent a "loophole" that would allow providers to delay reporting and returning an identified overpayment until a cost report is due, even if the overpayment would not be reconciled on a cost report.

When interim payments are made by CMS to the provider throughout the cost year, CMS proposes that "applicable reconciliation" should occur with the provider's submission of the cost report, and expects providers to return identified overpayments either in an initial or amended cost report. CMS recognizes two exceptions to the "applicable reconciliation" processes. The first exception relates to Supplemental Security Income ("SSI") ratios used to calculate disproportionate share hospital ("DSH") payment adjustments. CMS proposes that, when a provider receives updated information regarding its SSI ratios, the provider is not required to return the potential overpayment until the final reconciliation of the provider's cost report occurs. The second exception applies to outlier reconciliation. CMS proposes that a provider that is aware that it has exceeded the established thresholds is not required to estimate the change in reimbursement and return the estimated overpayment until there is a final settlement of the cost report.

A discussion of self-disclosures and the staying of the 60-day overpayment requirement is discussed below.

How Do Providers and Suppliers Report Overpayments?

CMS proposes that providers and suppliers should return overpayments through the existing voluntary refund process, which will be renamed the "self-reported overpayment refund process." Although CMS acknowledges that the current voluntary refund process is unique to each Medicare Contractor (and available on each Medicare Contractor website), it is planning to develop a uniform reporting form. Appreciating that providers and suppliers have varying relationships and experiences with these existing refund processes, the Proposed Rule presents an opportunity to solidify or potentially change such processes.

If a provider finds that it needs additional time to repay an overpayment, CMS proposes that the provider must use the existing Extended Repayment Schedule ("ERS") process. CMS notes that requests for the ERS are not automatically granted and that the requestor must provide significant documentation to support the contention that the timely repayment of the overpayment represents a true financial hardship. To that end, CMS proposes to amend the definition of "hardship" in 42 C.F.R. § 401.607 to ensure that the ERS is available to return identified overpayments.

To provide clarification, the Proposed Rule includes examples of potential reasons for why an overpayment occurred, such as (1) an incorrect service date; (2) duplicate payments; (3) an incorrect CPT code; (4) insufficient documentation; and (5) a lack of medical necessity.

What Are the Mechanisms for Returning an Overpayment?

CMS states that providers and suppliers should ensure that they are using the most appropriate mechanisms for reporting and returning overpayments and cautions that Medicare contractors will "scrutinize overpayments received through this process and may make referrals to OIG whenever the contractors believe circumstances warrant such a referral."[10]

To that end, the Proposed Rule addresses situations in which a provider or supplier submits claims originating from an arrangement that violates the anti-kickback statute, but for which the provider or supplier is not a party to, and is unaware of the existence of, the problematic arrangement. According to CMS, in these instances, the provider or supplier is unlikely to have "identified" an overpayment. To the extent that the provider or supplier has sufficient knowledge of an overpayment, it must report the overpayment to CMS, in accordance with Section 1128J(d) of the Act, and CMS will refer the matter to the Office of Inspector General of the Department of Health and Human Services ("OIG"). However, CMS states that its expectation is "that only the parties to the kickback scheme would be required to repay the overpayment that was received by the innocent provider or supplier, except in the most extraordinary circumstances."[11]

The Proposed Rule addresses the self-disclosure processes available under the Medicare Self-Referral Disclosure Protocol ("SRDP") and the OIG's Self Disclosure Protocol ("OIG SDP"). Currently, in certain instances, a provider or supplier might determine that it is necessary to make multiple reports of identified overpayments because not all of the overpayments fit squarely under one of the self-disclosure protocols. CMS acknowledges this possibility and specifically seeks comments on alternative approaches that would allow providers and suppliers to avoid making multiple reports of identified overpayments.

Currently, when a provider or supplier self-discloses under the SRDP, CMS suspends the obligation to return overpayments when it acknowledges receipt of a disclosure. Similar to what is currently in place under the SRDP, CMS is proposing that, when a provider submits a disclosure under the OIG SDP, the obligation to return overpayments is suspended when the OIG acknowledges receipt of the submission.

What Did CMS Estimate That the Cost Associated with the Rule Would Be?

As required for rulemaking purposes, CMS includes an estimate of the time and effort that would be required to report and return overpayments pursuant to the Proposed Rule. CMS estimates that it would take a provider or supplier approximately 2.5 hours to complete the applicable reporting form and return the overpayment; the estimation seems to contemplate that either (1) accountants and auditors or (2) in-house administrative personnel would be completing the forms. This assessment, though, clearly does not take into consideration the legal fees, compliance, and other costs associated with identifying an overpayment and determining when and how to report and repay. Therefore, the industry and stakeholders should consider providing comments related to the actual burden associated with investigating potential overpayments and taking appropriate corrective action, including refunding any monies owed. For example, significant allegations of overpayments may require a multidisciplinary team of employment personnel, compliance personnel, auditors, lawyers, and others to investigate, resolve, and correct the underlying situation.

Additionally, CMS calculated an estimate of the costs incurred by providers and suppliers in order to comply with the Proposed Rule based on an average hourly rate of accountants and auditors at $33.15, and bookkeeping, accounting, and auditing clerks at $16.99. CMS calculated the average cost of labor, including fringe benefits and overhead, for complying with the Proposed Rule to be $37.10 per hour. Obviously, this calculation does not take in account the average hourly rates of those personnel and outside consultants who may be required to investigate and appropriately respond to an overpayment situation.

To Whom Does This Rule Apply?

At this time, the Proposed Rule relates only to Medicare Part A and Part B providers and suppliers. According to the Proposed Rule, other stakeholders, including Medicare Advantage Organizations, Part D Prescription Drug Plans, and Medicaid Managed Care Organizations, will be addressed at a later date.

What Should Providers and Suppliers Do?

To date, regulators, courts, clients, and members of the bar have interpreted the requirements of Section 6402(a) of the ACA in various ways. The Proposed Rule sets forth CMS's interpretation of the policies and procedures required for the reporting and returning of overpayments. The Proposed Rule presents a unique opportunity for providers and suppliers to work collaboratively with CMS to help define these policies and procedures by providing comments.

Given CMS's rigid and unrealistic interpretation of the ACA, providers and suppliers must submit comments to the Proposed Rule. Epstein Becker Green ("EBG") attorneys have extensive experience in thinking creatively and strategically about conceptualizing and drafting comments. In addition, EBG can assist in facilitating relationships between providers, suppliers, and trade organizations.

* * *

For more information about this issue of IMPLEMENTING HEALTH AND INSURANCE REFORM, please contact one of the authors below or the member of the firm who normally handles your legal matters.


Jennifer K. Goodwin
Epstein Becker Green

Anjali N.C. Downs
Epstein Becker Green

Important Dates

Comments Due April 16, 2012


[1] 77 Fed. Reg. 9179 (Feb. 16, 2012).

[2] Patient Protection and Affordable Care Act (Pub. L. 111-148), as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152) [hereinafter collectively, "ACA").

[3] ACA, § 6402(a).

[4] For purposes of the Proposed Rule, CMS defines "person" as "a provider (as defined in § 400.202) or supplier (as defined in § 400.202). This definition does not include a beneficiary."

[5] 77 Fed. Reg. 9179, 9184 (Feb. 16, 2012).

[6] 77 Fed. Reg. at 9185.

[7] 42 U.S.C. 1395gg.

[8] 77 Fed. Reg. at 9182.

[9] Id. (emphasis added).

[10] 77 Fed. Reg. at 9183.

[11] 77 Fed. Reg. at 9184.

Jump to Page

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.