Navigating New Medicare Overpayment Rules and Practical Tips to Comply

On November 1, 2024, the Centers for Medicare & Medicaid Services (CMS) finalized the Medicare regulations interpreting the federal 60-day overpayment refund requirement (the Overpayment Statute) for Medicare Parts A and B as part of the Calendar Year (CY) 2025 Medicare Physician Fee Schedule Final Rule. The revisions were also publicized in the Federal Register on December 9, 2024. This rule, which will go into effect on January 1, 2025, is based on aligning the definition of "identified" overpayments with the knowledge standard under the False Claims Act (FCA). The new rule affects Medicare providers and suppliers, introducing significant changes to the reporting and returning of Medicare Part A, B, C, and D overpayments.

CMS adopted a new definition of what it means to have "identified" an overpayment to trigger the 60-day reporting period under the federal Overpayment Statute. With this change, CMS has dropped the "reasonable diligence" standard. CMS also adopted a definite 180-day timeframe for conducting investigations for "related overpayments." This new 180-day timeframe is commonly difficult for several providers to meet. This article will delve into the history of the issue, the previous requirements, and the federal statutes and regulations involved. It will also discuss the former issues, how the new rule addresses these issues, and the specific changes occurring under the rule. Additionally, practical implications for providers, including compliance record maintenance and overpayment investigations, will be explored. The article will also provide examples and a timeline of the changes in reporting overpayments.

History of the Issue

Previous Requirements
Under the previous Medicare overpayment requirements, a person who received an overpayment was required to report and return it by the later of:

1. 60 days after the overpayment was identified, or
2. The due date of any corresponding cost report (42 CFR § 401.305(b)(1)).

The prior definition of 'identified' overpayments was when a recipient had, or should have, determined through reasonable diligence that they received an overpayment and quantified the amount (42 CFR § 401.305(a)(2)). This allowed providers some flexibility to conduct thorough investigations before the 60-day clock started.

Issues with the Previous Requirements
The 'reasonable diligence' standard was criticized for effectively imposing False Claims Act (FCA) liability for mere negligence, as it required providers to repay funds if they could have discovered the overpayment through reasonable diligence, rather than having specific knowledge of the overpayment. This standard was vacated in 2018 by the U.S. District Court for the District of Columbia in UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173 (D.D.C. 2018) which ruled that it exceeded CMS's regulatory authority.

Changes Under the New Rule

New Definition of 'Identified' Overpayments
The new rule changes the definition of 'identified' overpayments to when a person knowingly receives or retains an overpayment. CMS noted in the rule’s comments that 'knowingly' is defined by cross-reference to the FCA and means having actual knowledge, acting in deliberate ignorance, or acting in reckless disregard of the truth or falsity of the information (31 U.S.C. 3729(b)(1)(A));. Note, the Overpayment Statute does cross-reference the FCA’s definition of "knowingly’. 2 U.S.C. § 1320a-7k(d)(4)(A). However, parties can debate and challenge the CMS stance that Congress intended the meaning of "identified" to be tied to the FCA’s "knowledge" standard.

CMS's decision to align the definition of 'identified' overpayments with the FCA's knowledge standard was influenced by the ruling in UnitedHealthcare Insurance Co. v. Azar. The court found that requiring Medicare Advantage Organizations (MAOs) to use "reasonable diligence" in searching for and identifying overpayments impermissibly created FCA liability for mere negligence. This ruling highlighted the need for a more precise and legally consistent standard, leading CMS to adopt the FCA's definitions of "knowing" and "knowingly."

180-Day Investigatory Timeframe
The new rule introduces a 180-day timeframe for conducting a timely, good-faith investigation into related overpayments. The 60-day deadline for reporting and returning overpayments is suspended during this period, but only up to 180 days. This change aims to provide a clear timeline for providers to investigate and quantify overpayments.

CMS received numerous comments on the proposed changes, with some stakeholders expressing concerns about the removal of the "reasonable diligence" standard and the introduction of a strict 180-day investigatory period. Commenters argued that the new standard could lead to confusion and inconsistent interpretations. In response, CMS emphasized that the False Claims Act (FCA) provides a well-established body of case law that can guide providers in understanding the requirements for identifying overpayments.

Practical Implications

Example Timeline for Identifying and Investigating Overpayments
Updated Revised Rules (Effective January 1, 2025)
Under the former rules, the process for identifying and investigating overpayments was guided by the "reasonable diligence" standard. Providers had to report and return overpayments within 60 days after the overpayment was identified or the due date of any corresponding cost report. Now under the updated revised rules, the definition of "identified" overpayments has changed to when a person knowingly receives or retains an overpayment. The new rules introduce a 180-day investigatory timeframe, during which the 60-day clock for reporting and returning overpayments is tolled. Here is an example timeline:

• Day 1: Initial overpayment identified. The 60-day clock starts.
• Day 15: Additional related overpayments suspected. Investigation begins. The clock is now tolled.
• Day 195: Investigation must be completed, and the 60-day clock starts counting again with the remaining days.
• Day 245: By this time, the provider must report and return all relevant overpayments.

Compliance and Investigation

Maintaining Compliance Records
Providers should carefully document the date on which they discover the initial overpayment and the date on which their good faith investigation begins. This documentation should include:

• Detailed records of the investigation process.
• Demonstrate allocating sufficient resources to the investigation, including adequate, knowledgeable staff with the ability to investigate the area and use proper analytical tools.
• Plans and demonstration of internal communications and coordination among departments.

Conducting a Timely, Good-Faith Investigation
A 'timely, good-faith investigation' involves:

• Promptly initiating the investigation upon identifying an overpayment.
• Dedicating adequate resources and personnel to the investigation.
• Documenting each step of the investigation process.

To demonstrate compliance, providers should:

• Keep detailed records of all actions taken during the investigation.
• Ensure that the investigation is consistent with organizational policies and procedures.
• Communicate transparently with relevant stakeholders.

Difficult Areas of Compliance
While CMS did try to revise the rules to accommodate the complexities of investigating overpayments, completing all required actions within a 180-day timeframe will still be difficult for providers. Many healthcare providers operate with limited resources. Allocating sufficient personnel and financial resources to the investigation without disrupting other operations can be difficult.

Investigating overpayments often requires specialized knowledge in areas such as medical coding, billing, and compliance. Finding and dedicating personnel in-house with the necessary expertise can be challenging and may require retaining external consultants. Overpayment investigations can be dynamic, with new information emerging that may require significant changes to the investigation plan. The 180-day investigatory period set by CMS can create pressure to complete the investigation quickly, leaving little time for regular reviews and adjustments in a timeline and thorough analysis. Additionally, maintaining confidentiality while involving multiple departments and personnel in the investigation adds another layer of complexity.

Providers should form a small, trusted team with the necessary expertise to handle the investigation. Ensure that team members are cross-trained to handle multiple aspects of the investigation. A single member of the team, preferably legal counsel, should provide project management to consistently move the investigation forward and document results. This person should schedule regular progress reviews to assess the status of the investigation and make necessary adjustments to the plan. In cases where the overpayment issue is particularly complex or involves multiple departments and systems, external consultants can provide valuable insights and support. Engage external consultants when specialized knowledge or additional resources are needed. Ensure that these consultants are bound by confidentiality agreements.

Impact of Loper V. Bright Decision
The Supreme Court's decision in Loper Bright v. Raimondo may affect the guidance provided by CMS. The decision reduces the likelihood of courts deferring to CMS's interpretation of the overpayment statute, potentially leading to challenges against the new rule.

Tips for Compliance in 2025 and Beyond

1. Initiate Investigations Promptly: Start investigating as soon as an overpayment is identified to maximize the available time. Carefully document the date on which the initial overpayment is discovered and the date on which the investigation begins.
2. Allocate Resources: Ensure that sufficient resources and personnel are dedicated to the investigation. This includes allocating adequate staff and financial resources to handle the investigation efficiently. Provide training to staff on the new CMS rules and the importance of timely and thorough investigations.
3. Develop a Clear Investigation Plan: Develop a clear investigation plan with defined milestones to ensure that the investigation progresses smoothly and is completed within the 180-day timeframe. Regularly review the progress of the investigation and adjust the plan as needed to stay on track.
4. Document Everything: Keep detailed records of the investigation process, including dates, actions taken, and communications. This includes documenting internal communications, pulling in proper departments to efficiently investigate, and process for determining and allocating sufficient resources. Make sure documentation includes contemplations and analysis of the Overpayment Status updates and how the organization is complying with those updates.
5. Communicate Transparently: Communicate transparently with internal stakeholders. Notify relevant government contractors or regulators about ongoing investigations and provide updates as needed. Ensure clear and consistent communication with regulators by appointing a single source to communicate with them and limiting communication through this source as much as possible.
6. Partial Refunds: Consider making partial or staged refunds to demonstrate good faith while the investigation is ongoing.
7. Proactively Revise Policies and Procedures: Stay informed of updates to overpayment rules as they come out as Loper Bright might affect the guidance provided by CMS. Revise internal policies and procedures as needed and retrain staff.
8. For specific cases, Consider CMS Voluntary Self-Disclosures: The revised overpayments provisions did not change existing regulations for the Department of Health and Human Services Office of Inspector General (OIG) Self-Disclosure Protocol, the CMS Voluntary Self-Referral Disclosure Protocol, which suspends report-and-return deadlines. See 42 C.F.R. § 401.305(b)(2). Before utilizing this strategy, providers should discuss the implications and process of these options as self-disclosure usually entails providing specific ways in which fault occurred. While timelines for settlement have decreased in recent years and settlement can usually be made for a significantly lesser amount than the identified overpayment, there is always the possibility other regulators and entities can be informed and pursue action, such as the U.S. Department of Justice.

Conclusion
The new CMS rule on Medicare overpayments introduces significant changes that providers must navigate carefully. By understanding the new requirements, maintaining thorough documentation, and conducting timely, good-faith investigations, providers can ensure compliance and mitigate potential risks. As the regulatory landscape evolves, staying informed and proactive will be key to successfully managing overpayment issues.