The Civil False Claims Act and the 60-Day Overpayment Rule ...

The Civil False Claims Act and the 60-Day Overpayment Rule
(or, the Tightening of the Noose on Providers)
Laura Laemmle-Weidenfeld, Esquire
Caitlin McCormick, Esquire1
Patton Boggs LLP
Washington, DC

As part of its crackdown on healthcare fraud, the federal government has endeavored over
the past several years to close the loophole on providers’ obligations to refund overpayments they
received, regardless of the reason. Prior to 2009, providers often disputed whether they were legally
obligated to voluntarily identify and repay to federal health care programs amounts that they
received in excess of what they were due, at least unless and until specifically requested to do so. No
statute or regulation appeared to clearly require such identification and refund. Although the federal
government often asserted that the civil False Claims Act (FCA) required such repayment, the so-
called “reverse false claims” provision on which it relied generally was construed to require
affirmative acts of concealment, not simply to prohibit retention of funds to which one was not
entitled.2 Likewise, the relevant criminal statute required an affirmative act of concealment.3 With
the revisions to the FCA in 2009, a new requirement in the Patient Protection and Affordable Care
Act and the Health Care Education Reconciliation Act of 2010 (collectively “the Affordable Care
Act” or “the ACA”) that identified overpayments be repaid within sixty days, and now proposed
regulations implementing the ACA 60-day rule, Congress and the current administration have
sought to place the burden on providers to identify and promptly repay an amounts they have
received to which they were not entitled. This presents a remarkable change in the way providers
must approach overpayments and in the task legal counsel have of advising their health care clients.

A. The False Claims Act Provisions

The version of the FCA in effect from 1986 until 2009 prohibited so-called “reverse false
claims,” making it unlawful to use a false record or statement to conceal, avoid, or decrease an
obligation to pay money to the United States. See 31 U.S.C. §3729(a)(7) (1986). Although the U.S.
Department of Justice often argued that this provision applied in circumstances where a defendant
had received payment improperly (either following the submission of a false claim, or simply in
error) and failed to repay it, the provision was seldom applied by the courts or even in earnest by the
Government, since typically these situations did not involve the use of a false record or statement to
affirmatively conceal, avoid, or decrease the obligation to pay money.

The Fraud Enforcement and Recovery Act of 2009 (“FERA”), which was signed into law on
May 20, 2009, and instituted the first amendments to the FCA since 1986, expanded the reverse
false claim provision significantly to now prohibit “knowingly conceal[ing] or knowingly and

1 Ms. McCormick is an associate at Patton Boggs LLP, where she focuses her practice on health care regulatory and
policy issues, including fraud and abuse.

2 31 U.S.C. § 3729(a)(7) (1986). See, e.g., United States ex rel. Branch Consultants, L.L.C. v. Allstate Ins. Co., 668 F. Supp. 2d
780 (E.D. La. 2009).

3 42 U.S.C. § 1320a-7b(a)(3).

improperly avoid[ing] or decreas[ing] an obligation to pay” the United States. 31 U.S.C.
§3729(a)(1)(G). In other words, the new provision does not require the submission of any false
record or statement, but simply the act of concealing or even merely “improperly” avoiding the
“obligation” to pay back funds. The revised statute defines “obligation” very broadly, to include an
“established duty, whether or not fixed,” that can arise from various relationships, statutes or
regulations, or even “from the retention of any overpayment.” 31 U.S.C. §3729(b)(3). The statute
does not define “improperly.”

B. The Affordable Care Act

A year after FERA, Congress passed the Patient Protection and Affordable Care Act and the
Health Care Education Reconciliation Act of 2010 (collectively, the “Affordable Care Act” or
“ACA”). Section 6402 of the ACA established a new requirement for “Reporting and Returning of
Overpayments,” which is codified at 42 U.S.C. § 1320a-7k(d). This provision narrowed the
loophole even further, requiring specifically that all providers and suppliers report and return
overpayments within the later of sixty days of identifying the overpayment or the date the
corresponding cost report is due, “if applicable.” 42 U.S.C. § 1320a-7k(d). It also defined
“overpayment” to mean “any funds that a person receives or retains under [a FHCP] to which the
person, after applicable reconciliation, is not entitled under such title.” 42 U.S.C. § 1320a-7k(d)(2).
Finally, it directly implicated the FCA, defining an overpayment retained after such deadline as an
“obligation” under the FCA. 42 U.S.C. § 1320a-7k(d)(3).

Thus, after the enactment of the ACA, providers were required to repay any identified
overpayment within 60 days or the upcoming cost report deadline, and the failure to do so could
become an obligation under the FCA which, so long as “knowingly and improperly” unpaid, would
in turn give rise to FCA liability.4 Several questions remained unanswered, however. For example,
does “identification” of an overpayment require a quantification of such overpayment in order to
start the clock on the sixty days, or is the mere probability of an overpayment without any
quantification sufficient? If quantification is not required to establish the obligation to repay, how is
the provider expected to report and repay the unquantified amount? If an overpayment is identified
for current claims, is the provider required to go back in time to look at older claims to determine
whether overpayments existed there as well? If so, how far back in time must the provider look
back?

C. CMS’s Proposed Rule on Overpayments

On February 16, 2012, nearly two years after the enactment of the ACA, the Centers for
Medicare and Medicaid Services (CMS) published its first Proposed Rule regarding this so-called 60-
day rule. Comments on the Proposed Rule are due by April 16, 2012, so a final rule is not expected
until many months into the future. Given that CMS twice previously had proposed, but not
finalized, rules relating to Medicare overpayments,5 it is difficult to assess the likelihood that the final
rule will be issued shortly after the comment period and whether the final rule will differ significantly
from the proposed rule.

4 The FCA imposes treble damages plus an inflation-adjusted penalty amount of $5500-11,000 per false claim.

5 See 63 FR 14506 and 67 FR 3662.

In any event, the current Proposed Rule applies only to Medicare Part A and Part B
providers and suppliers. CMS indicates that it will address the overpayment requirement in the
context of other Medicare providers separately and at a later date, and notes that such other
providers and suppliers continue to be subject to the statutory reporting obligation under 42 U.S.C.
§ 1320a-7k.

1. Overpayments

The Proposed Rule would adopt the statutory definition of the term “overpayment” without
embellishment Section 6402(a) specifies that an “overpayment” constitutes “any funds that a person
receives or retains under Title XVIII [Medicare] or Title XIX [Medicaid]… to which the person,
after applicable reconciliation, is not entitled under such title.”6 Although CMS does not propose to
expand upon this statutory definition, it does provide several examples of overpayments that would
be included under the definition. These examples are: (1) Medicare payments for noncovered
services; (2) Medicare payments in excess of the allowable amount for an identified covered service;
(3) errors and nonreimbursable expenditures in cost reports; (4) duplicate payments; and (5) receipt
of Medicare payments when another payor had the primary responsibility for payment. In other
words, under virtually any circumstances in which a provider/supplier receives more reimbursement
than it should have, CMS considers that an “overpayment,” subject to the 60-day refund rule.

2. When an Overpayment is “Identified”

One of the questions that has challenged providers and their counsel most since the passage
of the ACA is when an overpayment is deemed “identified” for purposes of the statute. Is it
“identified” when an anonymous hotline complaint is made, purporting to identify a specific
problem? Or is it “identified” once the provider has confirmed that, in fact, an overpayment was
received, all related overpayments also have been specified, and the dollar amount for all those
claims has been quantified? Or is “identification” something in between?

This is not an academic question. Overpayments often come to light over the course of days
or even weeks, and it often takes even longer for the provider to assess the extent of the possible
overpayments and the dollar value associated with them. For example, the provider could receive a
hotline complaint alleging that specific services should have been billed out using code X but instead
were billed using code Y. Assuming the complaint was this focused – and they often are not – the
provider much conduct at least some investigation to determine whether in fact (a) code X is being
used and (b) code Y would be more appropriate. And often with respect to hotline complaints, the
facts are not entirely accurate as reported. Thus, it often turns out that, using the hypothetical
above, code X actually was not being used, or maybe code X was being used and was not the most
appropriate but neither was code Y. Perhaps the problem is even deeper than the billing code being
used. If the actual root cause of the overpayment differs from that indicated in the hotline report,
when does the reporting period begin to run? When the inaccurate hotline report was submitted, or
when the proper root cause is identified? What if the hotline report identified only one claim, but
there is reason to believe the actual problem, once recognized for what it is, could apply to a large
category of claims encompassing hundreds of patients? Does the reporting and repayment time

6 42 U.S.C. §1320a-7k(d).

limit for the one claim differ from the time limit for the other hundreds of claims which have yet to
be identified with any specificity? And what if the amount reimbursed for those claims is not
immediately apparent?

Providers have wrestled with these questions since the spring of 2010, and the Proposed
Rule provides little clarification. CMS proposes that for the purpose of the Section 6402(a)
reporting requirement, a provider or supplier shall be deemed to have “identified” an overpayment
once it has “actual knowledge of the existence of the overpayment or acts in reckless disregard or
deliberate ignorance of the overpayment.”7 Thus, CMS effectively completes the importation of the
scienter requirement of the FCA into the sixty-day repayment rule.8 The statutory provision defined
the terms “knowing” and “knowingly” as having the same meaning given under the FCA, but the
statute otherwise does not employ those terms, leaving definitions for terms that otherwise are not
used.9 CMS, however, concludes that Congress inserted this definition intending it to apply to
determining when a provider /supplier has “identified” an overpayment.10 CMS indicates that doing
so, rather than limiting “identification” to actual knowledge, will encourage providers and suppliers
to “exercise reasonable diligence” in determining if an overpayment exists. Otherwise, according to
the preamble, “some providers and suppliers might avoid performing activities to determine whether
an overpayment exists, such as self-audits, compliance checks, and other additional research.”11

This language appears to carry greater significance than its semi-hidden location in the text
implies. By referencing self-audits and compliance checks as being generally required in order to
avoid deliberate ignorance and reckless disregard, CMS indirectly imposes requirements on
providers/suppliers that heretofore have not existed. Arguably self-audits and compliance checks
would be required after a potential overpayment is identified, in order to determine whether the root
cause of that overpayment extended to create others. But this language, which does not limit its
own reach to situations in which the provider/supplier already suspects a problem, seems to impose
a broad duty to perform self-audits and compliance checks even in the absence of an apparent
problem – a duty to go looking for problems. Requiring self-audits and compliance checks represents
a radical change for providers/suppliers not operating under Corporate Integrity Agreements and
could usher in a flood of new FCA complaints predicated on a provider/supplier’s failure to
conduct internal audits on a regular basis, without any other indicia of problematic billings.

3. Protocol for Reporting and Returning Overpayments

CMS proposes using its existing voluntary refund process currently described in Chapter 4
of the Medicare Financial Management Manual (“MFM Manual”) as the reporting and repayment
process for Section 6402(a). This process would be renamed the “self reported overpayment refund
process.” Under it, providers and suppliers must complete a form to provide certain information

7 77 FR 9182.

8 See 31 U.S.C. § 3729(b)(1).

9 42 U.S.C. § 1320a-7k(4)(A).

10 77 FR 9182.

11 Id.

that will allow CMS to identify the specific claim. These forms are currently available on CMS’ fiscal
intermediary contractors’ websites. While each contractor currently has its own form, over time,
CMS plans to develop a uniform form that all contractors will use.

Under this regime, the days of simply refunding money to the contractor with no
explanation are gone. In addition to refunding the amount of the overpayment, the reporting
process set forth in the MFM Manual also requires providers and suppliers to specify, among other
elements, the NPI number affected; why the refund is being made; how the error was discovered;
the corrective action plan implemented to ensure the error does not occur again; the timeframe for
the period when the problem that led to the overpayments existed, as well as the total amount of the
refund; and the methodology used in the event that statistical sampling is used to determine the
amount of the overpayment.12

d. Timeline for Reporting and Returning Overpayments

Under the ACA, overpayments must be reported within sixty days after the date on which
the overpayments were identified or on the date that a corresponding cost report is due. In the
Proposed Rule, CMS clarifies that if an overpayment is claims-related, then the provider must report
and return the overpayment within sixty days of identifying the overpayment. If the overpayment is
the type that ordinarily would be reconciled through the cost reports, then the provider can report
and return the overpayment either within sixty days after identifying the overpayment or on the date
that the cost report is due.

Note that this language does not mean that just because a provider files a cost report, it can
wait to refund the overpayment until the cost report is due (although that seems a reasonable
interpretation of the statutory language). The Proposed Rule specifies that the cost report provision
applies only to overpayments that are not claims-related.13 Thus, CMS explains, an overpayment
relating to upcoding must be reported and refunded within sixty days of identification “because the
upcoded claims for payment are not submitted to Medicare in the form of cost reports.” An
example of an overpayment that ordinarily would be reconciled on the cost report is “overpayments
related to graduate medical education payments.” 14 This interpretation espoused by CMS
significantly narrows the availability of the longer time frame for providers who submit cost reports.

In accordance with this provision, CMS specified in the “overpayment” definition in the
Proposed Rule that interim payments made with the knowledge that they will be reconciled to actual
costs through the cost reporting process do not fall within the definition of overpayments. Any
related issues will not become overpayments until the cost report reconciliation process occurs.15

CMS does attempt to address situations in which providers and suppliers may need to
investigate a matter to assess whether an overpayment has occurred, and how such an investigation

12 Id.

13 Id.

14 Id.

15 77 F.R. 9181.

would impact the sixty-day timeline. As reflected above, this has been one of the biggest issues for
providers and their counsel with respect to this new statutory requirement. The Proposed Rule notes
that the receipt of information by a provider or supplier regarding a potential overpayment “creates
an obligation to make a reasonable inquiry” to determine whether an overpayment has, in fact,
occurred.16 CMS states in the preamble that “[i]f the reasonable inquiry reveals an overpayment, the
provider then has 60 days to report and return the overpayment.”17 But the language in the
preamble and the regulation itself do not specify from when the sixty days run. Presumably this use
of “then” is intended to indicate that the sixty days begin to run once the provider has concluded its
reasonable inquiry and confirmed the overpayment, but the language is open to other interpretations
as well.

If the provider or supplier fails to make a reasonable inquiry, or fails to conduct such an
inquiry “with reasonable speed,” then the provider or supplier could be viewed as having knowingly
retained the overpayment on the grounds that it had “acted in reckless disregard or deliberate
ignorance” of an overpayment, CMS warns.18 One can presume from this, although the language
again is ambiguous, that when a provider/supplier identifies a reimbursement issue that raises larger
issues and requires an investigation, that the reporting and repayment time frame will be calculated
from the date on which the investigation “identifies” the overpayments.19 It leaves vague, though,
whether overpayments identified in the course of the investigation begin the clock as they are
identified if they are identified seriatim, or whether the clock begins for all of them when the
investigation concludes, identifying the universe of overpayments. It is not uncommon to identify
categories of overpayments through the course of the investigation rather than all at the end.
Certainly starting the clock at the end of the investigation once all the related overpayments were
identified would be the more efficient practice, but the literal language of the Proposed Rule actually
seems to indicate otherwise.

The language of the Proposed Rule also fails to specify whether quantifying the overpayment
is inherent in the definition of “identifying” the overpayment. This question is quite practical, not
academic: often providers/suppliers become aware of categories of claims that are likely problematic
(e.g., all claims submitted in connection with patients referred by a particular physician), but actually
specifying those claims and determining the amount paid on each of them can take additional time.
Because the overpayment must be not only reported by also refunded, and one cannot refund or
even report an amount one has not quantified using the prescribed reporting process, the better
reading of the statutory and proposed regulatory provision appears to be that quantifying the
overpayment is essential to identifying it.

16 Id.

17 Id.

18 Id.

19 Id.

5. Lookback period

Perhaps the most drastic provision in the Proposed Rule is the proposed lookback period,
i.e., the period of time for which the provider/supplier is responsible for returning overpayments.
Many providers/suppliers and their counsel had assumed the lookback period was limited to the
time period during which the claims could still be re-opened, typically four years.20 What most did
not expect was that CMS would significantly extend the applicable re-opening period.

In a surprise move, CMS proposed to revise the re-opening period in 42 C.F.R. § 405.980 to
ten years and to require providers to look back ten years for potential overpayments. In doing this,
CMS effectively proposes to adopt the FCA’s statute-of-repose provisions.21 As proposed, the CMS
states that “overpayments must be reported and returned only if a person identifies the overpayment
within 10 years of the date the overpayment was received.”22 This applies even where the provider
has no reason to suspect fraud.

For many providers, this lookback period, if adopted in the final rule, will create significant
problems. Many providers do not keep records going back ten years. Even if they did, of course, at
least the older of such records will likely be incomplete or otherwise compromised due to the
passing of time.

In effect, extending the lookback to ten years could extent the reach of the FCA to as much
as twenty years. The FCA bars causes of action that are filed more than six years after the fraud or
more than three years after the government discovers the fraud, but in any event after ten years.
Under the reverse false claim provisions, a defendant is liable for retaining an overpayment
improperly. Thus, if a defendant were to receive an overpayment in Year 1 and learn of the
overpayment in Year 10, then fail to act and improperly retain the overpayment until Year 20, a
whistleblower or the government could file a complaint in Year 20 relating to the overpayment in
Year 1, based on the defendant’s improper avoidance of repayment beginning in Year 10.

6. Interaction With Existing Disclosure Protocols

The Department of Health and Human Services Office of Inspector General (HHS-OIG)
and CMS already operate self-disclosure programs through which Medicare providers can report
potential violations of Federal healthcare laws. CMS operates a Medicare Self-Referral Disclosure
Protocol (SRDP) for potential violations of the Federal Physician Self-Referral (“Stark”) law, while
HHS-OIG operates a Self-Disclosure Protocol (OIG SDP) that is available for all potential
violations that are not limited to the Stark Law.

Under the Proposed Rule, once HHS-OIG acknowledges receipt of a submission to the
OIG SDP, CMS would suspend the provider’s or supplier’s obligation under 42 U.S.C. § 1320a-7k

20 42 C.F.R. § 405.980(b)(2).

21 Under the FCA, suit may be brought within six years of the false claim or statement or within three years of when
the government learned of it, but in no event longer than ten years after the false claim or statement.

22 77 FR 9184.

to report and return overpayments. Thus, providers and suppliers who utilize the OIG SDP process
would not be required to make a duplicate report to their contractor.

This approach seems so obvious that one would expect the same with respect to Stark-only
self-disclosures under the SRDP, particularly since SRDP self-disclosures are made to CMS itself. In
a byzantine twist uniquely worth of the Stark Law, though, CMS proposes to require providers self-
reporting under the SRDP also to report through the ACA process.23 The basis for this position
appears to be the express language of the SRDP, which only states that once CMS acknowledges
receipt of a disclosure made through the SRDP, the agency suspends the disclosing
provider/supplier’s obligation to refund the overpayment.24 In drafting the Proposed Rule, CMS
apparently construed its former silence on tolling the obligation to report the overpayment to mean
that such obligation was not tolled or otherwise satisfied. Perhaps tacitly acknowledging this
inconsistency, CMS specifically asks for comments regarding possible alternative approaches that
would eliminate duplicate reporting obligations for SRDP providers.25

Although the DOJ has not adopted a formal self-disclosure protocol, the False Claims Act
contains a provision reducing the defendant’s liability to double, instead of treble, damages where
the defendant (or would-be defendant) self-discloses “all information known to such person about
the violation within 30 days after the date on which the defendant first obtained the information.”26
A provider who reports the conduct potentially giving rise to FCA liability after the FCA’s 30-day
limit but before CMS’s 60-day limit technically would not be entitled to this relief under the FCA.
At least, however, the provider would be avoiding liability under the FCA’s reverse false claim
provision and, as a practical matter, under most circumstances one would expect the DOJ to be far
too busy with its current case load to expend significant effort pursuing providers who self-report
and refund overpayments within sixty days, regardless of the FCA’s 30-day self-disclosure deadline.

7. Financial Constraints on Repayment

Particularly in complex situations and situations involving a significant number of claims,
providers may struggle not only with quantifying the amount owed but in coming up with that much
money to repay the amount owed, within sixty days from discovery. CMS addresses that concern by
stating that providers/suppliers who identify an overpayment must not delay reporting because they
are concerned about their ability to pay, but instead should use CMS’ existing Extended Repayment
Schedule (ERS) process, as described in Chapter 4 of the Financial Management Manual. CMS does
not automatically grant all requests for ERS consideration, and providers will be required to submit
documentation demonstrating financial hardship and the need for an extended repayment plan.

23 77 FR 9183.

24 See CMS Voluntary Self-Referral Disclosure Protocol, OMB Control Number: 0938-1106, available at
http://www.cms.gov/PhysicianSelfReferral/98_Self_Referral_Disclosure_Protocol.asp#TopOfPage (last visited
3/9/2012).

25 Id.

26 31 U.S.C. §3729(a)(2).

8. Potential False Claims Act Liability and Proposal to Allow Exclusion for
Non Reporting

As discussed above, under Section 6402(a), if a provider or supplier does not report and
return an overpayment within the required timeframe, then that overpayment becomes an
“obligation,” triggering liability under the Federal False Claims Act.27 But the Proposed Rule also
carries potential civil monetary and exclusion implications for providers/suppliers.
The Civil Monetary Penalties (CMP) statute was amended, in the ACA, to impose CMPs for
knowing about an overpayment and yet failing to report and return it as required under 42 U.S.C.
§1320a-7k(d).28 This provision then connects with the permissive exclusion provisions, which
permit HHS-OIG to exclude any provider/supplier that violates the CMP statute.29

D. Conclusion
While CMS’s Proposed Rule may or may not ever become final in its current form, providers
nevertheless need to pay more attention to how they address overpayments. Any arguments on
which they may have relied in the not-too-distant past to justify not repaying known overpayments,
failing to investigate when potential overpayments were identified, and otherwise avoiding the issue,
have dissipated. Even without a final rule from CMS, it is clear from the FCA amendments and
ACA provisions that providers now are responsible for identifying, reporting and refunding
overpayments promptly. Therefore it is now more critical than ever for providers to implement – if
they have not done so already – a stringent and effective compliance program that identifies and
repays overpayments on a routine basis. Only in so doing can providers minimize their potential
FCA liability.

27 Id.; 31 U.S.C. §3729.
28 42 U.S.C. §1320a-7a(a)(10).
29 42 U.S.C. §1320a-7(b)(7).