Yahitza Nuñez

Associate Editor

Loyola University Chicago School of Law, LL.M. 2019

On September 7, 2018, the United States District Court in the District of Columbia (“D.C. District Court”) vacated Medicare’s overpayment “report and return” rule as applied to Medicare Advantage Organizations (“MAOs”). The Patient Protection and Affordable Care Act (PPACA) created the requirement to report and return overpayments. The Centers of Medicare and Medicaid (CMS) issued rules to provide definitions that the PPACA did not define, create a procedure, payment options and timeframes. MAOs may no longer need to comply with CMS’ overpayment rule, but the PPACA remains intact. Providers who service Medicare beneficiaries will need to conduct the same analysis in order to comply with the PPACA “report and return” requirement.

Overpayment Rule

Under the PPACA, MAOs are required to report and return overpayments within “60 days after the date on which the overpayment is identified.” The PPACA explicitly stated that failure to return an overpayment would cause the initial claim for payment a violation of the False Claims Act (FCA). The new report and return requirement left many terms undefined and in May 2014, CMS issued its final rule, 42 C.F.R. §422.326, addressing MAO overpayments (“MAO overpayment rule”).

MAOs are private insurance companies that operate under Medicare Part C (“Part C”). The MAOs step into the shoes of CMS and provide beneficiaries services under Medicare Parts A and B, and in some instances under Part D. MAOs are paid a “pre-determined monthly sum for each person they cover, based in part upon the characteristics of the particular beneficiary being covered.” The organization pays doctors, other healthcare providers, and hospitals for services provided. CMS reimburses the MAO on a per-member-per-month rate that has been determined in advance. The Social Security Act requires CMS to ensure “actuarial equivalence between traditional Medicare plans and MAOs.” CMS must adjust the “payment amount for such risk factors as age, disability status, gender, institutional status, and such other factors as the Secretary determines as appropriate.”

UnitedHealth Group’s family of companies brought suit against CMS regarding the MAO overpayment rule and its application under the FCA. On September 7, 2018, the United States District Court in the District of Columbia (“D.C. District Court”) determined that the CMS’ 2014 final rule applicable to MAOs violated the Administrative Procedures Act. First, the court found that the MAO overpayment rule “establishes a system where actuarial equivalence cannot be achieved.” The method in which CMS conducted the risk analysis was “built on unaudited data about traditional, fee-for-service Medicare beneficiaries, which must contain errors,” and as a result the rate at which MAOs received payment was based on flawed data. Second, the Court found that the MAO overpayment rule “fails to recognize a crucial data mismatch and, without correction,” it fails to compute expenditures for traditional Medicare in the same methodology as it expects to apply to Medicare Advantage payments. Third, “CMS was arbitrary and capricious in adopting the [MAO overpayment rule] without explaining its departure from prior policy.” Last, the MAO overpayment rule’s definition of “identified” was distinctly different than the proposed rule and did not provide adequate notice. Also, the negligence standard for failure to report and return overpayments in the MAO overpayment rule extends beyond the FCA and the PPACA, and CMS does not have the legislative authority to create a more stringent standard through regulations.

Future of 60-Day Report and Return Rule

The D.C. District Court decision vacated the MAO overpayment rule and MAOs no longer need to comply with the MAO overpayment rule. However, this does not remove an MAOs duty to comply with PPACA. MAOs must report and return an overpayment, by the later of, 60 days after the overpayment is identified or when the corresponding cost report is due. The PPACA defines an overpayment as “any funds that a person receives or retains under [Medicare] or [Medicaid] to which the person, after appropriate reconciliation, is not entitled.” Thus, MAOs must report any overpayment “after appropriate reconciliation” within 60 days the overpayment is identified or the date the corresponding cost report is due, whichever is later.

The time period to file an appeal expired on November 7, 2018, and as of today, no appeal had been filed. Providers under Medicare Parts A, B and D must still comply with the “report and return” rules applicable to their programs. In 2016, CMS issued new overpayment rules that extended the application of the “report and return” requirement to providers under Medicare Parts A and B and Parts C and D. The rules provided definitions, process, payment options, and timeframes for debt collection process.

To ensure compliance, whether services are provided under Parts A, B, C, or D, the provider should consider:

• Implementing policies and procedures to review billing and receivables;
• Periodic audits of the billing and coding department to proactively identify overpayments;
• Investigating suspected incidents of non-compliance or reports of suspicious billing activity;
• Determining high-risk departments/units and performing periodic audits;
• Documenting the diligence performed as part of the inquiry; and,
• Determining whether self-reporting is appropriate.

When determining whether to self-report, the provider should first determine which agency it will self-report to. Next, the provider should determine whether they are eligible to self-report under the agency’s guidelines. If the provider is eligible, they should then determine whether the benefits outweigh the risks to the healthcare organization. To begin, the PPACA and the overpayment rules allow for a six-year lookback period. The government is not limited to the scope of the provider’s disclosure and could lead to expanded exposure and liability. Self-reporting does not guarantee leniency, immunity or benefits. The biggest benefit to self-reporting is that the amount to be re-paid is likely to be lower than if the government identifies the issue. Self-reporting also illustrates the strength and effectiveness of the provider’s compliance program. Finally, before self-reporting the provider should identify the laws that were violated, acknowledge potential violations, take corrective action, and perform an initial investigation/audit to determine damages. Last, but not least, rope in your general counsel and/or compliance officer to make sure you have dotted all the i’s and crossed all the t’s.