Return to Search This revised product comprises Subregulatory Guidance for Medicare Overpayments and its content is based on publicly available content within the SSA Section 1128J(d), SSA Section 1893(f)(2)(A) and 42 CFR Section 405.379. CMS policy or operation subject matter experts also reviewed/cleared this product. This product educates
providers about the overpayment collection process. This process happens when provider payments exceed the amounts due and payable by law. Providers must return self-identified and Medicare Advantage Contractor (MAC)-identified overpayments to Medicare. We identify payment options, the recoupment limitation(s), and the overpayment collection process. The revised product contains no substantive changes to the previous version dated March 2021. The previous version of this product is
available to the public and currently posted on the CMS website at //www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/OverpaymentBrochure508-09.pdf. Download the Guidance Document Final Issued by: Centers for Medicare & Medicaid Services (CMS) Issue
Date: August 03, 2022 DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.
§ 422.326 Reporting and returning of overpayments.
(a) Terminology. For purposes of this section -
Applicable reconciliation occurs on the date of the annual final deadline for risk adjustment data submission described at § 422.310(g), which is announced by CMS each year.
Funds means any payment that an MA organization has received that is based on data submitted by the MA organization to CMS for payment purposes, including § 422.308(f) and § 422.310.
Overpayment means any funds that an MA organization has received or retained under title XVIII of the Act to which the MA organization, after applicable reconciliation, is not entitled under such title.
(b) General rule. If an MA organization has identified that it has received an overpayment, the MA organization must report and return that overpayment in the form and manner set forth in this section.
(c) Identified overpayment. The MA organization has identified an overpayment when the MA organization has determined, or should have determined through the exercise of reasonable diligence, that the MA organization has received an overpayment.
(d) Reporting and returning of an overpayment. An MA organization must report and return any overpayment it received no later than 60 days after the date on which it identified it received an overpayment, unless otherwise directed by CMS for purposes of § 422.311.
(1) Reporting. An MA organization must notify CMS, of the amount and reason for the overpayment, using a notification process determined by CMS.
(2) Returning. An MA organization must return identified overpayments in a manner specified by CMS.
(e) Enforcement. Any overpayment retained by an MA organization is an obligation under 31 U.S.C. 3729(b)(3) if not reported and returned in accordance with paragraph (d) of this section.
(f) Look-back period. An MA organization must report and return any overpayment identified for the 6 most recent completed payment years.
Healthcare Law, Medicare & Medicaid Fraud
Oberheiden, P.C.
Former U.S. Prosecutors & Defense Counsel
About Oberheiden, P.C.
Oberheiden, P.C. represents Medicare providers, physicians, clinics, home health and hospice agencies, and other Medicare healthcare providers in audits and investigations.
Healthcare providers have an obligation to report and refund federal program overpayments. This duty stems from the Affordable Care Act (“ACA”) and the Centers for Medicare & Medicaid Services’ (“CMS”) regulation mandating refund of Medicare overpayments. Both the statute and regulations have been drafted to support compliance with applicable statutes, promote the provision of quality care, and protect the Medicare Trust Funds against improper payments, including fraudulent payment. This article will discuss these duties and relevant compliance considerations and issues regarding the calculation and repayment of such overpayments.
First, under the ACA (42 U.S.C. 1320a-7k(d)), a provider who has received an overpayment must report and return it. The provider must send the overpayment to the correct recipient (the Secretary, the State, an intermediary, a carrier, or a contractor) and include, in writing, the reason for the overpayment. An “overpayment” is any funds received under Title XVIII (Medicare) or XIX (Medicaid), to which, after applicable reconciliation, the provider is not entitled (under these titles). The deadline for these two actions is the later of the date that any corresponding cost report is due or 60 days after the overpayment is identified. Importantly, any overpayment retained is an obligation under the Federal False Claims Act.
Second, in February 2016, CMS published its final rule requiring that Medicare Parts A and B healthcare providers and suppliers report and refund overpayments. An overpayment is defined as the difference between the amount that CMS actually paid to the provider and the amount that the provider should have been paid, noting that there is no de minimis exception to overpayment’s definition.
Founder
Attorney-at-Law
Former Senior Trial Attorney
U.S. Department of Justice
Local Counsel
Former Assistant U.S. Attorney
Local Counsel
Former U.S. Attorney & Former District Attorney
Local Trial & Defense Counsel
Former U.S. Attorney
Local Counsel
Former Federal Prosecutor
Local Counsel
Former Special Agent (OIG)
Former Supervisory Special Agent (FBI)
Former Special Agent (FBI & IRS-CI)
Former Special Agent (FBI)
Former Supervisory Special Agent (FBI)
Former Special Agent-in-Charge (DEA)
Examples of “funds to which the person is not entitled” may include reimbursement for:
- duplicate claims
- wrong billing code
- not covered or medically unnecessary services
- unbundled codes
- wrong site/level of service
- up-coded services
- services not rendered
- services ordered/performed by and excluded or un-licensed person
- failure to comply with the conditions of payment (as contrary to conditions of participation)
- Stark/Anti-Kickback laws violation affiliated tainted claims
- failure to comply with secondary payer rules
- credit balances
- cost reports (non-allowable costs reported)
Similar to the ACA’s overpayment provision, the CMS rule’s deadline is the later of the date that is 60 days after the overpayment’s identification, or the due date of any applicable corresponding cost report (a separate final rule was published in the May 23, 2014 Federal Register (79 FR 29844) that addresses Medicare Parts C and D overpayments). This rule clarifies requirements for the reporting and returning of self- identified overpayments. A failure to report and reimburse means that providers and suppliers remain subject section 1128J(d) of the Social Security Act and could face False Claims Act (FCA) liability, Civil Monetary Penalties Law (CMPL) liability, and exclusion from federal healthcare programs. Nonetheless, providers and suppliers shall continue to be required to comply with all other current CMS procedures when a determination (by CMS, Medicare Administrative Contractors (MACs), etc.) is made that overpayment exists.
Accordingly, a person who has received a Medicare Part A or Part B overpayment must report and return the overpayment in the form and manner set forth in the Code of Federal Regulations.
Duty to Investigate
First, the reporting requirement’s 60-day clock starts running when a person has identified an overpayment. This means when a person has determined that an overpayment occurred, or if that person should have made such a determination through the exercise of reasonable diligence that he/she (i) received an overpayment, and, (ii) he/she quantified the amount of the overpayment. Importantly, if a provider fails to exercise reasonable diligence in conducting an investigation into a potential overpayment, the 60 day time period will begin on the day that the provider receives “credible information” of a potential overpayment.
The provider’s receipt of “Credible information of a potential overpayment” gives rise to a duty to investigate on the part of the provider. It is important for providers to understand that whether or not information is “credible” is an inherently fact-dependent matter. The following constitutes a non-exclusive listing of situations, where, if the provider is made aware of them, reasonable due diligence will be required:
- Incorrect coding is revealed through a review of provider’s billing and payment records
- An overpayment is revealed pursuant to an internal audit
- Repeated hotline complaints about the preceding or similar issues
- A detailed hotline complaint
- The provider learns that an unlicensed or excluded individual provided the services
- The government or a government contractor informs a provider that an audit revealed an overpayment
- The provider learns of an unexpected increase in Medicare revenue.
Reasonable diligence on the part of a provider means: (1) proactive and good faith compliance efforts conducted by qualified individuals to identify overpayments and (2) good faith investigations conducted in a timely manner by qualified individuals in response to credible information about a possible overpayment. In short, the CMS regulations expressly state that providers have both a clear duty to undertake proactive compliance activities to ensure that their claims are correct and appropriate and to determine if they have received an overpayment. Failure on the part of the provider to perform such actions carries with it the risk of potential liability for retention of such overpayments that would otherwise be detected by following the preceding compliance efforts.
A provider’s timely performance of reasonable diligence means that the investigation of credible information (except in extraordinary circumstances) should be prompt and in good faith, but never more than six months from the receipt of credible information. Extraordinary circumstances include, but are not limited to: (1) extraordinarily complex investigations that may be anticipated to require more than 6 months of investigation (e.g. ones involving Self-Referral Disclosure Protocol program (SRDP)); or (2) situations where there is a state of emergency or natural disasters (e.g. Hurricane Katrina). In any case, providers and suppliers should maintain accurate records documenting all reasonable diligence efforts so that they will be able to demonstrate their compliance with the rule’s requirements.
The 60-day deadline for reporting and returning overpayments begins on one of two dates. First, the day when reasonable diligence is completed. Second, the day the relevant person received credible information if the person failed to conduct reasonable diligence. Generally, providers should allow for, in the appropriate circumstances, 2 months for reporting and returning after the timely 6-month investigation. It is important to note, however, that the refunding deadline will be suspended when: (1) the Provider requests an extended repayment schedule, or (2) CMS or the Department of Health and Human Services’ Office of the Inspector General (OIG) acknowledges receipt of submission to, respectively, the OIG Self-Disclosure Protocol or CMS Self-Referral Disclosure Protocol (noting that self-disclosure to the Department of Justice (DOJ) does not suspend a refund obligation under the Overpayment Regulation).
Documenting the Investigation
Providers should maintain records of their overpayment investigations. Examples of important investigative records include:
- Documentation of any alleged violation
- Descriptions of the investigatory process
- Records of review of important documents
- Well-maintained witness interviewed log
- Well-maintained log of documents reviewed
- Descriptions of any sampling methodologies utilized
- Results of any relevant investigations
- Statement of impact cost to the federal program and its beneficiaries
- The provider’s corrective action plan
Sampling and the Medicare Regulation
The CMS final rule establishes that a quantification of the overpayment amount may be determined using extrapolation methodologies, statistical sampling, or other appropriate methodologies (such as random selections of claims from a population or extrapolation only from within the time period covered by the population emanating from the relevant sample). Notably, if a provider calculates the overpayment amount pursuant to one particular methodology, the report must contain a description of that methodology’s statistically valid sampling/extrapolation. Importantly, providers should not return only a subset of claims identified for overpayment without extrapolating the overpayment’s full amount. Indeed, until the full overpayment amount is determined, the provider should not report and return overpayment on any individual claims (re the “prove sample”). The idea behind this is that if a provider finds a single overpaid claim, it would then be appropriate to perform further inquiry so as to determine if that provider has more overpayments before that provider reports and returns the singularly identified overpaid claim.
To Whom Should Providers Submit Their Reports and Refunds and Can Providers Appeal?
Providers and suppliers will have to determine the identity of the appropriate recipients of their overpayment reports and refunds. For example, the proper recipient may be a provider’s relevant Medicare contractor or the OIG’s Self Disclosure Protocol (SDP) or SRDP programs. Providers must remember that forwarding the overpayment report and refund to an inappropriate agency will not satisfy their obligations with regard to any applicable process. The provider must correctly identify the relevant Medicare contractor or other recipient. Next, it is the general rule that for self-reported overpayment claims, the provider does not have an automatic right to appeal. The exception to this rule is a provider’s right to appeal a revised determination by a government contractor issued when an overpayment is returned through adjusting specific claims (but only if a new determination is issued). CMS recommends that providers and suppliers retain audit and refund documentation in case a government contractor or OIG audit alleges that the provider or supplier has not adequately refunded an overpayment.
Co-Payment and Deductibles?
Providers are required to refund overpayments of co-payments and deductibles pursuant to Medicare regulations. Specifically, providers must promptly refund to the beneficiary any incorrect collections and notify the MAC of the refund. Failure to refund the overpayment within 60 days results in a requirement that the provider set aside an amount equal to the incorrect collection in a separate account and notify the MAC of such set aside.
Enforcement and Penalties
A provider’s retention of an overpayment after the reporting deadline can give rise to liability under the False Claims Act (31 U.S.C. §§ 3729 et seq.). False Claims Act penalties include damages of three times the amount of the overpayment and civil monetary penalties of $10,957-$21,916 per claim.
How to Report the Overpayment: Cover Letter
Reporting the overpayment will require completing the Overpayment Refund or Recovery Request Form if reporting to a MAC (such as CGS Administrators, LLC) and preparing a Cover Letter. The Cover Letter should identify the following information:
- The provider’s name and address;
- The provider’s number;
- The audit period;
- The services/items (CPT/HCPCS) for which payment is refunded;
- The cause of the overpayment;
- How the provider became aware of the overpayment;
- An explanation of the audit methodology (should be claim specific);
- An explanation of any statistically valid samples (should identify the population, sample size selection, sample item selection, error rate, and extrapolation);
- Where appropriate, inclusion of RATSTATS (SDP identifies 100 claims as a minimum);
- The provider’s actions taken to correct the error that caused the overpayment and to prevent reoccurrence;
- The identity, phone number, and email contact information for any contact person regarding further questions or additional necessary information; and
- Enclosure of the check or request for recovery adjustment.
Compliance Considerations for Providers
It is important for providers to be proactive regarding their compliance with healthcare laws and regulations. Providers should regularly access and review their compliance program documentation and standards, especially regarding such matters as audit and monitoring functions and responses to hotline tips. Moreover, providers should establish defensible policies for: (1) responding to and investigating Credible Information of Overpayments, and (2) Quantification of Overpayments within the 6-month limit. In addition, providers should routinely maintain all relevant documentation of: (1) the nature of any credible information, (2) the timing and nature of investigation processes, including documentation of all important dates (date of receipt of credible information, 6-month deadline for investigation and quantifications, and 60-day deadline to address any relevant identification); (3) quantification, and (4) verification of receipt of reports.
Our healthcare fraud defense attorneys assist service providers and businesses under investigation for alleged Qui Tam Lawsuit, Stark Law, False Claims Act, or Anti-Kickback violations. Contact Oberheiden, P.C. today for a free and confidential consultation.
Dr. Nick Oberheiden, founder of Oberheiden P.C., focuses his litigation practice on white-collar criminal defense, government investigations, SEC & FCPA enforcement, and commercial litigation.