Healthcare Law Alert – Final Regulations Issued on Medicare 60-Day Overpayment Report/Repay Requirement Some Good News for Providers

Since March 23, 2010, the effective date of the federal Accountable Care Act, Medicare-participating providers (hospitals, physicians, skilled nursing facilities, home health agencies, laboratories, etc.) have been required to report and refund Medicare overpayments within 60 days of “identifying” such overpayments or face exposure under the federal False Claims Act — a significant factor because the False Claims Act carries both civil and criminal penalties, including the possible trebling of monetary damages and qui tam relator interest.  Now, finally, four years after the proposed regulations were first issued, the Center for Medicare and Medicaid Services (CMS) has clarified what constitutes the “identification” of an overpayment, which triggers the 60-day report/repayment clock. The final regulations, which will be effective on March 14, 2016, also answer questions on the required look-back period following the discovery of an overpayment and where providers can report and repay the overpayment for purposes of stopping the 60-day clock.  In general, the final regulations bring news that is mostly good, with CMS answering many if not all of the questions that arose in the wake of the issuance of the proposed regulations.

The following summarizes important points covered in the final regulations and the narrative from CMS that accompanied their issuance.


According to the final regulations, a provider is deemed to have “identified” an overpayment when it has or should have, through reasonable diligence, determined that it has received an overpayment from the Medicare program and has quantified the amount of the overpayment.  (Emphasis added)

The very welcome news in this pronouncement is that the 60-day clock does not start running from the instant a provider gets its first whiff that something is wrong, referred to by CMS as “credible information about a potential overpayment.”  There is one important caveat, however.  If, in response to an initial inkling that something is amiss, a provider does nothing, or very little, in response, the substantial benefit afforded by the definition of “identify” disappears, as explained further below.

According to the narrative if, upon receipt of “credible information of an overpayment” the provider undertakes an investigation with “reasonable diligence” in order to determine if it has, indeed, received an overpayment, the 60-day clock does not start running until that investigation is concluded AND the provider has calculated the overpayment amount, if any. CMS also provides specific guidance as to its expectations on the outside timeframe for conducting a reasonably diligent investigation and quantifying the overpayment amount — at most 6 months, absent extraordinary circumstances such as complex issues arising under the federal physician self-referral prohibition or “Stark” law. Thus, with the 60-day clock starting after such investigation and quantification, a provider is granted a total of 8 months from the point when it initially received “credible information” with respect to a possible overpayment within which to report and return any such overpayment. This is a substantial improvement, considering that some earlier interpretations suggested that the 60-day time period was the total allotted for investigation, calculation and reporting/repaying the overpayment.

The unpleasant caveat to this relatively rosy picture is presented in the narrative’s discussion of the so-called “ostrich defense” – situations where a provider avoids identifying an overpayment by not commencing a reasonably diligent investigation when it receives credible information suggesting a possible overpayment.  In such circumstances, CMS has indicated that the 60-day clock will start running when the provider first received the credible information. Because the federal False Claims Act makes the failure to report and repay an overpayment within 60 days – i.e. the “knowing retention of an overpayment” – a “false claim”, providers who ignore credible information regarding a problem can very quickly find themselves the target of a whistleblower lawsuit and/or direct federal enforcement action alleging a violation of the False Claims Act.  As noted above, such violations can carry both civil and criminal penalties as well as treble monetary damages. Therefore, when providers have any inkling of a problem that may have resulted in an overpayment and decline to investigate the matter further, the results can be catastrophic.

CMS has also indicated in the narrative that it considers “reasonable diligence” in an investigation to include both proactive and reactive compliance efforts.  A provider must show both pre-planned, ongoing compliance activities (annual audit work plans, etc.) conducted in good faith by qualified individuals as well as timely investigations, also conducted by qualified individuals, launched in response to credible information about potential overpayments.   In other words, “reasonable diligence” means more than just investigating suspected overpayment situations; it requires ongoing compliance activities aimed at identifying possible overpayments in high risk areas, even in the absence of a specific concern or complaint.  For example, if new rules, coverage guidelines, or regulatory interpretations are issued, CMS expects a provider’s compliance program to be designed to monitor such developments and implement required changes.  Failure to have such a compliance program could start the 60-day clock running at the point when such rules, guidelines and/or interpretations were made public. In short, the new regulations make having a robust compliance program even more important than before.

What constitutes “credible information of potential overpayments” is also a critical component of this analysis.  While the final rule does not define “credible information”, CMS notes that audit reports/findings by Medicaid contractors (including RACs), and the OIG, as well as hotline calls, may provide such “credible information”, triggering the “reasonable diligence” investigation. Also, CMS has clarified that knowledge by employees and agents (and possibly contractors) of an overpayment, or “credible information” about a possible overpayment, is attributable to the provider as a whole and thus increases the risk to providers who do not have policies and procedures that encourage/require employees and others to report issues up through the ranks to appropriate management in a timely fashion.

Lookback Period

The final regulations also establish the retrospective period that providers must review when undertaking a “reasonably diligent” investigation.  CMS has set the so-called “lookback” period at 6 years.  Notably, if the “credible information” is an audit report, such as those produced by Medicare contractors, and the audit did not go back 6 years, providers must, of their own volition, look back for the entire 6-year period to determine if other similar issues gave rise to overpayments beyond those that may have been identified in the audit.  The narrative also notes that this 6-year look back period will be applied to Stark self-disclosures made pursuant to the Self-Referral Disclosure Protocol (SRDP), although disclosures pending at the time the new regulations take effect will still be concluded under the current 4-year lookback period.

Calculation of the Overpayment

The narrative accompanying the final regulations contains a few interesting comments regarding the calculation of the overpayment amounts.  Firstly, CMS confirms that when calculating the overpayment, a provider may determine the amount it should have been paid, had the claim been billed correctly and calculate the overpayment as the difference between what it was paid and what it should have been paid.  The comments also indicate, however, that when a claim is not eligible for reimbursement at all due to other problem such as when a referral is made in violation of the federal self-referral prohibition or “Stark” law, the overpayment is the entire amount received for the claim.  The comments draw a distinction between claims submitted with incorrect codes versus claims that are entirely disallowed because they arose in circumstances where payment is entirely precluded under the applicable regulations.   In addition, the comments confirm that the lookback period for underpayments is not being extended to the same term as the overpayment lookback period and, thus, a provider may not include as an offset underpaid claims it has identified unrelated to the problematic claims in the calculation.  The comments note that the underpayment lookback period remains 3 years and a provider may not go back to correct underpayment beyond that time period.

The commentary also confirms that the report and repayment obligations also apply to issues arising in cases where Medicare is/should have been the secondary payor.

Finally, the commentary indicates that a provider may request a financial hardship evaluation if its financial condition is such that it is unable to shoulder the repayment obligations.  However, the provider is still required to calculate the repayment obligation in full; hardship accommodations are only discussed after the fact.

How to Report and Repay and to Whom

The final regulations indicate that providers can report and return overpayments through their Medicare contractor’s voluntary repayment process, claims adjustments and credit balance process, the OIG’s Self-Disclosure Protocol (SDP) and CMS’s Self-Referral Disclosure Protocol (SRDP) (sometimes referred to as the Stark self-disclosure process).  CMS has confirmed that the 60-day period will toll upon receipt of acknowledgment from either the OIG or CMS when their self-disclosure processes are used.  However, should a provider fail to finally resolve the issue via those procedures so that it is removed or otherwise exits those disclosure programs, the balance of time remaining on 60-day clock prior to the time being tolled will remain available for reporting and repaying via another mechanism (to the degree the provider continues to believe an overpayment has been identified).

Interestingly, CMS specifically stated that self-disclosures to the Department of Justice (DOJ) will not be treated like those made through the SDP or SRDP because, according to CMS, “DOJ is a separate department and we are not aware of any formal self-disclosure process by DOJ that is analogous to the SRDP or SDP.”  Therefore, from CMS’s perspective and as stated explicitly in the final regulations, self-disclosures to DOJ will not toll the 60-day period and DOJ is not one of the entities to which repayment can be made.   As the United States Attorney for the Northern District of New York has been rather public and vocal on this issue, it remains to be seen if that office will issue any follow-up statements regarding its stance on how self-disclosures should be handled and whether the US Attorney should be contacted regardless of what reporting and repayment mechanism a provider chooses to use.


Now that CMS has spoken, providers will have no excuse for delaying reporting and returning overpayments.  A robust compliance plan is more critical than ever and a timely, thorough response is necessary whenever concerns involving a potential overpayment come to light.  Regulators will likely have little tolerance for reports and repayments made more than 8 months after credible information about a possible overpayment was or should have been known.


Visit our Healthcare Practice Area to learn more about the legal services we can provide in this area. If you have any questions or would like more information on the issues discussed in this communication, please contact any member of our Healthcare Practice Area.

This communication is for informational purposes and is not intended as legal advice.