Did you know that any overpayment by Medicare that is not repaid within 60 days of being identified converts to a false claim, which can result in prosecution? New regulations released by the Centers for Medicare & Medicaid Services (CMS) in February extend the scope of what constitutes an overpayment, expand the timeframe during which a physician practice must be on the lookout for potential problems, and make practices liable for overpayments going back six years. This is a new world order and will require practices to change their processes and refresh their compliance plans. Any practice that has not yet adopted a compliance plan, with procedures on this and other billing and administrative issues, should do so immediately.

The regulations are barely a page long, but the related commentary spans 25 pages in the Federal Register.¹ This article explains the regulations but also draws on the commentary provided by the regulators to address implications that the regulations themselves did not confront.

What is an overpayment?

The regulations say an overpayment is any funds received or retained under Medicare Part B to which the person “is not entitled.”¹ (The rules extend to Part A as well, but we do not cover those here.) Obvious overpayments include duplicate payments, payments in excess of the allowable amount, payments when another payer is primary, and payments for services by an excluded person.

Less obvious are payments that result from the following:

• Accidental or intentional up-coding,

• Claims resulting from violations of the anti-kickback or physician self-referral (“Stark”) laws,

• Payments for services that are not medically necessary,

• Payments not supported by adequate documentation,

• Payments for services provided by nonqualified individuals,

• Payments for services that do not meet coverage requirements, “incident-to” guidelines, the teaching physician rules, or the Stark group practice definition.

The definition of overpayment is sweeping, and the regulations put the burden on the recipient to be proactive about identifying them.

When is an overpayment identified?

The identification of an overpayment triggers a 60-day obligation to repay the identified amount. After 60 days, the claim becomes false. A false claim is subject to triple the charges plus up to $11,000 for each improper claim, a value that will increase over time. Whistleblowers can also file suit over unreported false claims.

The government takes the position that the 60-day period begins when the person has or should have through the exercise of “reasonable diligence” determined he or she has received an overpayment and quantified the amount. Regulators in the commentary said “reasonable diligence” includes “both proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments and investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment.” Investigations could be conducted in response to routinely reviewing explanations of benefits, receiving a tip on a compliance hotline, being notified of potential problems found in an internal audit or raised by a government agency, receiving a significant increase in revenues without an obvious reason, or generating profits out of proportion to hours worked or relative value units associated with the work.

The regulators said that the reasonableness of any inquiry is fact-dependent. But they also said that a single overpaid claim creates an obligation to investigate further before reporting the initial overpayment to determine whether there are more overpayments on the same issue. In addition, the practice has only six months from the date when the practice should have known of the overpayment to investigate and quantify it. Documenting the investigation is not a requirement, but regulators said “it is certainly advisable” for providers to document their reasonable diligence.

The regulators said that an entity getting paid through reassignment of Medicare claims still has a duty to determine if it has received overpayments, so a group practice would have the same obligations as a single physician. Providers are also responsible for the acts of their agents, meaning practices should review their billing company agreements to make sure the company is obligated to notify the practice of any issues and what actions to take. The practice should also have the right to monitor the billing company's activities as well as the claims themselves. But the practice had better exercise that right.

Quantifying the overpayment amount

Providers are required to conduct audits that accurately quantify the overpayment. Although compliance audits generally require reviewing a handful of claims, once you have an obligation to investigate, your net will need to be much larger. Statistical sampling and extrapolation may be used – in fact, the regulators said providers reviewing a sample of payments can't report only on those payments and not extrapolate the results across the universe of similar payments. The sample does not have to be statistically valid, but it must be random. No extrapolation method is specified, but the method used must be reasonable, credible, and one that you can explain. In some instances, every overpayment can be identified and repaid. When that is unfeasible, it is extremely important to determine how the sample will be selected and why. Because the regulation forces providers to look back six years, each year may require a different size sample.

Reporting and repayment

Reporting and repayment of overpayments should be directed only to the Medicare Administrative Contractor (MAC) for your practice's jurisdiction. Each MAC has a form on its website for repayments. Even though the forms may be designed for reporting and repaying single claims, regulators said that practices can use them to repay multiple claims and extrapolated claims. Also, ignore any directions that still ask for statistically valid samples. CMS is planning to standardize the forms in the future.

While there are no specifics for reporting, CMS suggests providers state how the problem was discovered, what corrective action has been taken, and what methodology was used to identify the claims, whether extrapolated or not.

It is particularly important to keep records of extrapolated repayments because the money cannot be applied to individual claims. Being able to substantiate that a repayment has been made for a class of claims can be important if an auditor later investigates the same claims.

A provider may request that the MAC offset an overpayment against a pending claim, but we recommend against this because MACs rarely coordinate their overpayment and claims payment processes adequately, which can lead to new problems. Providers facing financial hardship – defined as when the amount of repayment is more than 10 percent of the previous year's total Medicare payments – can ask for an extended repayment schedule.

Implications

Most practices will have to at least tweak their compliance programs to describe how they will begin monitoring for and identifying overpayments – and assign responsibility and accountability for this work to appropriate personnel within the practice. Many compliance programs review claims on a prepayment basis, thinking that then there is no obligation to look at prior paid claims. The new regulations, however, undermine that concept and obligate practices to review up to six years, depending on the nature of the problem.

The reasonable diligence standard forces you to make significant choices. For example, if you have one physician who has had a problem, reasonable diligence would require that you look at everyone billing the same service unless the one physician was completely aberrant. On the other hand, if you provided an educational program on documentation three years ago, it's not clear whether you would have to investigate claims submitted in years prior to the course in addition to years following. Many other quandaries will surely arise.

Getting out of a government audit with no negative findings is now more important than ever because an overpayment found for a specified period creates a new obligation to investigate other time periods. Here are a number of helpful audit tips:

• When a request for records comes, read the records. If they are focused on one problem, look at the context for that service.

• Remember that every claim paid by Medicare must show medical necessity, so if notes outside of the requested timeframe substantiate medical necessity, provide them.

• Send the auditor absolutely everything that is requested.

• Include a cover letter that explains any idiosyncratic documentation issues as well as provides a guide to the submission. Do as much as you can to spoon feed the information to the auditor, leaving little room for analysis or interpretation. Consider having a knowledgeable lawyer review the cover material before you send it.

Physician employment contracts need to address the extent to which a physician in the practice who creates an overpayment has a personal obligation to repay the money to the practice. We have routinely written provisions in employment agreements requiring individual repayment for overpayments determined on post-payment audits. We have even extended this post-termination, so that if the individual has moved on, he or she still has to repay. We will now have to expand these to include internal audits and address how to manage disputes over the results of those audits. Practices will also have to decide whether to enforce these post-employment policies, especially in the case of retired physicians.

Proceed with caution

The obligation to be proactive about finding and returning overpayments is a new administrative burden for physicians that you should deploy as a part of your compliance program, but the entire undertaking is nuanced. When problems are found, expert guidance is critical to define the scope of the investigation, how to extrapolate, what led the practice to find the problem, how the investigation was conducted, and how to correct it going forward. To the extent that attorney-client privilege can be used to protect internal investigations, it should be used as early as possible.