CMS Finalizes New Medicare Overpayment Regulations

In 2010, as part of the ACA, Congress created what has come to be known as the Overpayment Statute.¹ The law was created in an effort to address and rectify mistaken payments made to providers, suppliers, and managed care organizations by the Medicare and Medicaid programs. The Overpayment Statute requires a “person” who has “received” an “overpayment” from Medicare or Medicaid to “report and return” the overpayment to the government within (i) 60 days of “the date on which the overpayment was identified” or (ii) the date any corresponding cost report is due, if applicable.

As we discussed in March and July, CMS finalized Medicare regulations implementing the Overpayment Statute in 2014 (for Medicare Parts C and D) and 2016 (for Medicare Part A and B) (collectively, the Overpayment Regulations).² A pivotal component of the Overpayment Regulations—concerning the meaning of the term “identified”—was vacated in 2018 in UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 191 (D.D.C. 2018) (United).³ In 2022, and again earlier this year, CMS proposed to modify the Overpayment Regulations to address the concerns raised in United, and to clarify certain other issues.⁴

The 2022 and 2024 proposals (collectively, the Proposed Rule) culminated in a recently released final rule that is scheduled to be published in the Federal Register on December 9, 2024 and will become effective January 1, 2025 (Final Rule). The Final Rule makes two major changes to the Overpayment Regulations, each of which is discussed below.

“Identified”

The Overpayment Statute does not define the term “identified.” This is not surprising perhaps, as the dictionary definition of “identify”—”to perceive the identity of something”⁵—is straightforward. For example, if I look at my monthly bank statement and see (i.e., “perceive”) that my employer inadvertently reimbursed me twice for the same $10 mileage expense, then I have “identified” an overpayment of $10 from my employer. 

Notwithstanding, CMS, in the Overpayment Regulations, chose not merely to define “identified” but to significantly expand the reach of the Overpayment Statute to cover both overpayments that (i) have been “identified” and (ii) should have been “identified.” Specifically:

• the 2014 regulations provide that a person “has identified an overpayment when the [person] has determined, or should have determined through the exercise of reasonable diligence, that the [person] has received an overpayment”; and

• the 2016 regulations provide that a person “has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment.”⁶

It was CMS’s constructive knowledge standard―specifically, the “should have determined through the exercise of reasonable diligence” language—that caused the court in United to vacate the 2014 regulations.

In response to the United decision, CMS did not abandon its interpretation of “identified” to cover both actual and constructive knowledge of an overpayment. Instead, the Proposed Rule simply modified the agency’s definition of what constitutes constructive knowledge.

• As noted, under the 2014 and 2016 Overpayment Regulations, constructive knowledge of a particular overpayment could be inferred if the provider would have had actual knowledge of the overpayment had it exercised “reasonable diligence.”

• Under the Proposed Rule—which CMS has now adopted in the Final Rule—constructive knowledge of a particular overpayment cannot be inferred unless the provider acted with “deliberate ignorance” or “reckless disregard” of the existence of the overpayment.

On the one hand, it will now be more difficult for the government (or a whistleblower) to establish that a provider or managed care organization had constructive knowledge of an overpayment. (Going back to our bank statement analogy, while it’s conceivable that a “reasonable” person would check their monthly bank statements for potential errors, it seems highly unlikely that a failure to do so rises to the level of acting with “reckless disregard” or “deliberate ignorance” of such errors.)

On the other hand, the above discussion, along with most of the back and forth on this topic over the past 14 years, arguably misses the forest for the trees. How so? The Overpayment Statute uses the term “identified.” It does not use the phrase “should have identified.” Thus, it is not at all clear that Congress intended the term “identified” to include anything other than actual knowledge of an overpayment or, therefore, that CMS’s inclusion of any constructive knowledge standard in the Overpayment Regulations meets the “single best reading” test recently adopted by the U.S. Supreme Court in Loper Bright.

This topic—the meaning and interpretation of the term “identified” in the Overpayment Statute— requires a more thorough and extended treatment than can be provided here. That said, it is worth at least touching on the statutory basis for CMS’s position. The agency’s argument in support of its constructive knowledge standard is this:

• the Overpayment Statute includes a definition of the terms “knowing” and “knowingly,” which have “the meaning given those terms” in the FCA; and

• the FCA defines “knowing” and “knowingly” to mean that a person either (i) has actual knowledge that a particular claim or statement is false or (ii) acts in deliberate ignorance or reckless disregard of the truth or falsity of the claim or statement.

The problem with this argument, however, is that the Overpayment Statute never actually uses either the term “knowing” or the term “knowingly.” It would appear, then, that Congress’ inclusion of this definition in the Overpayment Statute was a drafting error (e.g., a vestige of an earlier draft of legislation that was not adopted). Moreover, even if we were to assume, for the sake of argument, that this floating definition isn’t a drafting error, on what basis does CMS assume that Congress intended “knowing” and/or “knowingly” to modify the term “identified” (as opposed to some other provision in the Overpayment Statute)?

Deadline for Reporting Overpayments

As noted above, the Overpayment Statute provides that “[a]n overpayment must be reported and returned… by the later” of (i) “the date which is 60 days after the date on which the overpayment was identified” or (ii) “the date any corresponding cost report is due, if applicable.”

Where a provider has actual knowledge of an overpayment on Day 1, reporting and returning that overpayment by Day 60 may not pose insurmountable obstacles. But by interpreting “identified” to include constructive knowledge, CMS created a second problem (the existence of which further undermines the agency’s broad interpretation of “identified”).

The second problem is this: if a provider (i) does not have actual knowledge of any overpayment on Day 1, (ii) wishes to avoid the risk that it will be deemed to have had constructive knowledge of an overpayment, and (iii) thus undertakes an investigation to determine whether it has, in fact, received any overpayments, completing this investigation within 60 days may be impossible.

Historically, CMS recognized the legitimacy of this concern, but only in sub-regulatory preamble and not in the Overpayment Regulations themselves. CMS has rectified this in the Final Rule by revising the Medicare Part A and B Overpayment Regulations to provide that:

• if a person (i) “has identified an overpayment but has not yet completed a good-faith investigation to determine the existence of related overpayments that may arise from the same or similar cause or reason as the initially identified overpayment” and (ii) the “person conducts a timely, good-faith investigation to determine whether related overpayments exist,”

• then “the deadline for reporting and returning the initially identified overpayment and related overpayments that arise from the same or similar cause or reason as the initially identified overpayment” will be “suspended until the earlier” of (i) the “date that the investigation of related overpayments has concluded and the aggregate amount of the initially identified overpayments and related overpayments is calculated,” or (ii) the “date that is 180 days after the date on which the initial identified overpayment was identified” (for ease of reference, the “180-Day Suspension Period”).

A number of points are worth emphasizing here.

• First, several organizations that commented on the Proposed Rule asked CMS to clarify the interaction between the new 180-Day Suspension Period and the original 60-day report and return deadline. The agency stated that if a person “conduct[s] a timely, good faith investigation, the 60-day deadline is suspended until the investigation is concluded.” In other words, once the 180-Day Suspension Period ends, “the person has the remainder of the 60-day period to report and return the overpayment.”

For example, if a person began a timely, good faith investigation of related overpayments 20 days after identifying the initial overpayment, the suspension of the deadline would apply on day 20, and there would be 40 days remaining in the 60-day period to report and return the overpayment after the [180-Day Suspension Period] ends.

• A number of commenters asked CMS to “create a process to request an extension beyond 180 days for complex investigations.” The agency declined, arguing “the newly-established 180-day suspension for providers and suppliers that have situations that qualify, in addition to the 60 days to report and return overpayments” strikes the “appropriate balance” between “the needs of providers and suppliers” and “the required statutory mandates.”
  • CMS’s position with respect to this issue is particularly disappointing, as in prior rulemakings, CMS clearly stated that while eight months normally is sufficient to complete an overpayment investigation, in the case of “unusually complex investigations” or other “extraordinary circumstances,” 240 days might not be sufficient.⁷
    
    
  • In addition to being disappointing, deeming—as a matter of law, and in all cases and under all circumstances—a failure to complete an investigation within 240 days as necessarily constituting “reckless disregard” and/or “deliberate ignorance,” even where there is no dispute that the provider acted diligently and in good faith, may (and should) be a tough pill for many federal courts to swallow.

• Next, CMS emphasizes in the preamble of the Final Rule that the 180 Day Suspension Period “does not impose an independent obligation to investigate related overpayments when a person has actual knowledge of an overpayment.”
  • That is, if a provider “has actual knowledge of an overpayment and has no reason to believe that there are other related overpayments (that is, the [provider] is not acting in deliberate ignorance or reckless disregard to the truth or falsity of information about other related overpayments), then there is no obligation to investigate, calculate, and report and return such other overpayments. In such cases, the [provider] would have 60 days after identifying the isolated overpayment to report and return it.”
  • If a provider does have reason to believe that there are related overpayments, the provider has “up to 180 days to conduct an investigation into the existence of [such] overpayments, provided that the person conducts a timely, good-faith investigation. Without this provision, persons conducting such investigations might face a rolling series of relatively short-term deadlines as the investigation advances and uncovers additional overpayments, each with its own 60-day deadline.”

• It should be noted that under both the current and revised Overpayment Regulations there are several grounds for suspending the Overpayment Statute’s 60-day report and return deadline other than the need for an investigation to determine whether and the extent to which a provider has, in fact, received any overpayments. For example, submitting a disclosure to CMS (under its Self-Referral Disclosure Protocol) or HHS-OIG (under its Self-Disclosure Protocol) will suspend the running of the 60-day report and return clock.

• Finally, and importantly, the 180-Day Suspension Period is available only to Medicare Part A and B providers and suppliers. CMS declined to extend this provision to Medicare Part C and D MAOs and PDPs. The agency argued that MAOs and PDPs did not need additional time to investigate potential overpayments.
  • With respect to MAOs, CMS stated that these organizations “submit and delete diagnoses . . . on an ongoing basis based on individual encounters” and, “under this longstanding process” have “from the beginning of the data collection period through the final risk adjustment data submission deadline, which is a minimum of 13 months, to investigate any issues with their data submissions and submit corrections.”
  • With respect to PDPs, these organizations report and return overpayments “related to prescription drug event (PDE) and direct and indirect remuneration (DIR) data through the submission of corrected data,” which is “due within 6 months of the end of the contract year.” CMS then “recoups PDE/DIR-related overpayments through the global reopening process.” Thus, the “PDE/DIR-related overpayment reporting and returning process is operationally less complex, and therefore, an extensive investigation period prior to submitting corrected data is not necessary.”

Not surprisingly, the Final Rule leaves several questions unanswered. As noted above, in order for a provider to take advantage of the 180-Day Suspension Period, certain conditions must be satisfied. For example, the provider must already have “identified an overpayment,” which has then triggered the need (or desire) to “complete[] a good-faith investigation to determine the existence of related overpayments that may arise from the same or similar cause or reason as the initially identified overpayment” (emphasis added). But what if a provider’s constructive knowledge of a potential overpayment is not based on having obtained actual knowledge of any particular overpayment? For example, what if a provider learns that a recently hired coding clerk has been coming to work under the influence of alcohol, and the provider would like to investigate whether that has resulted in any overpayments. Does CMS mean to exclude the availability of the 180-Day Suspension Period under such circumstances due to the absence of actual knowledge of at least one overpayment? Presumably not, but a clarification with respect to this issue certainly would be helpful.

Finally, as noted above, CMS declined to provide any formal safety valve (e.g., exceptions process) to protect providers dealing with particularly complex investigations that require more than 240 days to complete. Under such a scenario—which is not uncommon—what is the provider supposed to do? Provide a status report to the relevant agency (e.g., CMS)? Report and return those overpayments of which the provider has actual knowledge and then make subsequent payments as the investigation proceeds? And as long as the provider is acting diligently and in good faith, does the passage of more than eight months even matter from a liability standpoint? After all, in addition to establishing that a provider received an overpayment and failed to report and return it withing the timelines established by the Overpayment Statute and Overpayment Regulations, in order for FCA liability to attach, the government or a whistleblower also must prove that the provider has “concealed” or “improperly avoided” returning an overpayment. But if a provider is, in fact, engaged in a diligent, good faith investigation of potential overpayments, then the provider, by definition, is not “concealing” any overpayments or attempting to “improperly avoid” their repayment.

Conclusion

In sum, the Final Rule is a step in the right direction, but as is often the case with “final” rules, its promulgation is really just another beginning. Questions and uncertainties remain. For example, has CMS offered the single best interpretation of “identified” in the Overpayment Statute? Are there any real/practical consequences to a diligent, good faith investigation extending beyond 240 days? As always, time—and, in all likelihood, additional litigation—will tell.

---

1. 42 U.S.C. §1320a-7k(d). ↩︎
2. 79 Fed. Reg. 29844 (May 23, 2014); 81 Fed. Reg. 7654 (February 12, 2016). ↩︎
3. The full cite is UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 191 (D.D.C. 2018), rev’d in part on other grounds sub nom; UnitedHealthcare Ins. Co. v. Becerra, 16 F.4th 867 (D.C. Cir. 2021), cert. denied, 142 S. Ct. 2851 (U.S. June 21, 2022) (No. 21–1140). ↩︎
4. 87 Fed. Reg. 79452 (December 27, 2022); 89 Fed. Reg. 61596 (July 31, 2024). ↩︎
5. Merriam-Webster online dictionary, https://www.merriam-webster.com/dictionary/identified, accessed November 2, 2024. ↩︎
6. 42 C.F.R. §401.305 (Medicare Parts A and B); 42 C.F.R. §422.326 (Medicare Part C); 42 C.F.R. §423.360 (Medicare Part D). ↩︎
7. 81 Fed. Reg. at 7662. ↩︎