April 16, 2012
Ms. Marilyn Tavenner, Acting Administrator Centers for Medicare & Medicaid Services Department of Health and Human Services Attention: CMS-6037-P
P.O. Box 8013
Baltimore, Maryland 21244-8013
RE: RIN 0938-AQ58: Medicare Program; Reporting and Returning Overpayments
Dear Ms. Tavenner,
The American Clinical Laboratory Association (“ACLA”) appreciates the opportunity to comment on the Centers for Medicare & Medicaid Services’ (“CMS’s” or “the agency’s”) Proposed Rule, “Medicare Program; Reporting and Returning Overpayments” (“proposed rule”).1 ACLA is an association representing clinical laboratories throughout the country, including local, regional, and national laboratories. As providers of millions of clinical diagnostic laboratory services for Medicare beneficiaries each year, ACLA member companies will be impacted directly by the proposed rule.
I. Summary of ACLA’s Comments
ACLA believes strongly that providers should return funds to which they are not entitled. We believe the government is correct to expect providers to repay such funds expeditiously, once the existence and the amount of the overpayment is determined. However, because of the volume of health care transactions that a typical provider engages in, and the use of automated systems to process these transactions, identifying and returning an overpayment is not a simple or easy process. Identifying an overpayment and quantifying it often are complex, time- consuming and labor-intensive. As a result, ACLA believes CMS’s proposal for reporting and returning overpayments must take into account how such errors can occur and how involved the quantification process is. We are especially concerned that the addition of language expanding the reach of the regulation to cover overpayments that the provider “should have identified” will allow the government to impose harsh penalties in instances where the overpayment resulted from accidental errors, rather than from “reckless disregard” of credible allegations of error.
According to the proposed rule, the obligation to repay an overpayment arises once an overpayment has been “identified;” therefore the definition of that term is important. ACLA is concerned about several aspects of the proposed definition of “identified.” First, CMS has included language usually associated with the False Claims Act, which imposes liability if a provider acts in “reckless disregard” of the existence of an overpayment. However, this language is not in the statute, and its inclusion would broaden the statute and make its application more difficult and more subjective. We also are troubled by CMS’s suggestion that
liability can arise under this “reckless disregard” approach if a provider does not commence an investigation with “deliberate speed,” a suggestion that again raises numerous definitional issues and adds more subjective judgments to the process. The current definition of “identified” does not acknowledge that an overpayment must be quantified in order to be reported and returned to the Medicare program. As we discuss below, after a provider confirms the existence of an overpayment, it often will take a substantial amount of time to determine the amount of that overpayment. ACLA is concerned that CMS may not recognize the complexity of the quantification process. Further, when the definition is applied to real-world situations, it leaves many questions unanswered. ACLA suggests an alternative definition that takes into account the realities of identifying an overpayment and that reinforces Medicare providers’ responsibility to follow up on alleged overpayments.
As written, the proposed rule imposes too great a burden on providers in too short a timeframe. While ACLA understands that Congress established the period of time in which an overpayment must be reported and returned, CMS’s embellishments on and interpretations of the statute could make it impossible for some providers to comply. The agency has failed to acknowledge the tremendous amount of work that goes into identifying, reporting, and returning an overpayment.
CMS was aiming for consistency with the False Claims Act’s statute of limitations when it proposed a 10 year look-back period for reporting and returning overpayments, but its proposal is problematic. It is not consistent with the False Claims Act, and the look-back period, coupled with CMS’s faulty definition of when an overpayment is “identified,” could force providers to maintain records for two decades. ACLA also believes the look-back period is too long.
II. Substantive Comments
Our comments below expand upon our main concerns, offer our support for aspects of CMS’s proposal, and raise certain other issues.
A. Statutory background
The proposed rule purports to clarify statutory text that was included in Section 6402(a) of the Patient Protection and Affordable Care Act, Pub. L. 111-148 (the “ACA”) that added Section 1128J to the Social Security Act. That section requires a provider or supplier to report and return an overpayment and state the reason for the overpayment.2 The deadline for reporting and returning an overpayment is “60 days after the date on which the overpayment was identified,” or “the date any corresponding cost report is due, if applicable.”3 An overpayment retained after the deadline for reporting and returning the overpayment is an “obligation,” or a “reverse false claim,” for purposes of the False Claims Act, 31 U.S.C. § 3729 et seq.4 Section 6402(a) of the ACA defines only the terms “knowing and knowingly” (which are not used in the subsection), “overpayment,” and “person.” An “overpayment” is defined as “any funds that a
person receives or retains under subchapter XVIII or XIX to which the person, after applicable reconciliation, is not entitled under such subchapter.”5 The statute does not define the term “identified.”
B. CMS’ definition of when an overpayment is “identified” should be clarified.
ACLA believes there are a number of issues with the way CMS has tried to define the term “identified,” which is a key component of the regulation. First, it has introduced a “reckless disregard” standard, which creates a number of ambiguities and uncertainties. Second, and closely related to the first point, CMS has suggested that liability could occur if it appeared that a provider did not commence an investigation into the existence of an overpayment with “deliberate speed,” which raises a concern that the government could find a provider liable even if the provider attempted to determine the nature of the overpayment but the government believed it had not done so quickly enough. Finally, we are concerned that CMS may not fully appreciate how much effort is required to determine whether or not an overpayment has occurred and to quantify an overpayment. ACLA believes it is important for CMS to understand and to recognize that that process often takes far longer than the 60 days that is referenced in the statute as the time for repayment.
1. The introduction of False Claims Act language into the definition of “identified” creates numerous uncertainties and ambiguities.
a. CMS has no basis for using False Claims Act language in its definition of “identified.”
In the proposed rule, CMS states that a person has “identified” an overpayment when “the person has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment.”6 “Reckless disregard” and “deliberate ignorance” are phrases used in the definition of “knowing or knowingly” in the False Claims Act, which is referenced in Section 6402(a) of the ACA.7 Although Congress defined the term “knowing or knowingly” in Section 6402(a) of the ACA, it did not use the term in the section. Regardless of this fact, and without citing any support, CMS states, “We believe Congress’ use of the term ‘knowing’ in the ACA was intended to apply to determining when a provider or supplier has identified an overpayment.”8 However, it seems just as likely that Congress did not intend those terms to apply to identification of an overpayment and that the inclusion of the definition was one of the many drafting errors in the nearly 1,000 page bill, because Congress did not use the terms in this section of the statutory text.
The statute imposes requirements only on a provider who identifies an overpayment, not on a provider who should have identified an overpayment. Congress is well aware of how to draft legislation that limits liability only to those who have actual knowledge, as it did here, or to extend liability to those who know or “should have known.” In fact, in Section 6402(d) of the
ACA, a section on newly-created Civil Monetary Penalties (“CMPs”) related to overpayments, Congress imposes liability only on a person who “knows of an overpayment…and does not report and return the overpayment in accordance with such section.” This is in contrast with other CMP provisions, such as penalties for a person who contracts “with an individual or entity that the person knows or should know is excluded from participation in a Federal health care program.”9 In Section 6402(d), Congress did not refer to a person who “knows of or should have known of an overpayment,” and in Section 6402(a), it did not refer to an overpayment that “was identified or should have been identified.” CMS should not misrepresent Congress’ intent and broaden the regulatory language in its interpretation of Section 6402(a).
b. The “reckless disregard” standard would be difficult to apply.
By introducing a “reckless disregard” standard, CMS has broadened the potential reach of the statute significantly and has introduced a dangerous level of subjectivity. For example, if a health care entity accidentally programs its computers incorrectly, and as a result, erroneously bills and is paid for a service, it may be considered an overpayment that the entity has recklessly disregarded. The addition of the “reckless disregard” standard suggests that CMS could argue that the company should have been aware of the error, and therefore is liable for a false claim. Even if the company has a robust compliance program that fails to uncover the error, it appears that CMS may consider it to be a reverse false claim if the government later discovers it. ACLA is concerned that the addition of this language, without some qualification, could turn every incorrect billing episode into a reverse false claim, with its attendant severe penalties. It seems obvious that a provider must have some credible reason to believe an overpayment exists before it can be found to have failed to act. CMS should at least clarify that a provider with an active and robust compliance program that contains the elements suggested by the Office of the Inspector General’s (“OIG’s”) compliance program guidance and the Federal sentencing guidelines cannot be found to have acted with “reckless disregard or deliberate ignorance” with respect to overpayments. A provider who conducts self-audits but misses an overpayment should not be treated as if it willfully ignored overpayments it may have received.
The inclusion of the “reckless disregard” language also raises issues with the application of the 60 day repayment period. The statute says that a provider has 60 days to repay the overpayment once it is identified after an applicable cost report. However, CMS seems to suggest that if the provider acts in reckless disregard of the existence of an overpayment, the provider is liable immediately. This is incorrect, because at a minimum, a provider has at least 60 days after identifying an overpayment to report and return it. No liability can attach until that 60 day period has run.
Consider the example of a provider informed of a potential overpayment on August 1 and for whom it is not possible to begin a “reasonable inquiry” into the actual existence of the overpayment until September 1.
The proposed definition fails to account for the reality and the complexity of how providers learn of possible overpayments, how they respond to them, and how they plan and staff their “reasonable inquiries.”
The regulation should be changed to clarify that the provision is violated if a provider fails to report and return an overpayment within 60 days after gaining actual knowledge of the overpayment (including quantification), or 60 days after the date on which the provider receives credible information suggesting the existence of an overpayment and the provider has not taken any bona fide steps during that period to determine whether the overpayment actually exists.
2. CMS should clarify when an investigation has occurred with “deliberate speed.”
In the preamble to the proposed rule, CMS says that “failure to make a reasonable inquiry, including failure to conduct such inquiry with all deliberate speed after obtaining the information, could result in the provider retaining an overpayment because it acted in reckless disregard or deliberate ignorance of whether it received an overpayment.”10
It is not clear how CMS intends to determine whether an ongoing investigation occurred with “all deliberate speed.” In almost all circumstances, multiple people will be involved in determining whether an overpayment exists and in what amount. An overpayment inquiry may
begin when a health care professional alleges a potential overpayment. Personnel from the provider’s billing department will undertake an initial review and perhaps collect documentation. The compliance department may conduct a more thorough review, and, depending on the complexity and magnitude of the potential overpayment, retain outside counsel to assist it and to conduct interviews. In-house counsel or external counsel will apply the law to the facts gathered in the course of the investigation and render an opinion about whether a practice complies with the law, does not comply with the law, or may comply with the law. All of this may take several weeks or a number of months, or even longer. How would an outside observer determine whether the investigation was proceeding with all deliberate speed? We believe CMS should issue additional guidance about what it expects in this situation, and in particular, what documentation it expects providers to maintain in order to show the bona fide nature of an investigation.
3. CMS should include “quantification” as part of the identification process.
ACLA believes that an “identified” overpayment should be one that has been quantified with reasonable certainty. CMS does not address the issue of whether a provider has “identified” an overpayment if it is not yet quantified. Indeed, it is not possible to return an overpayment that has not been quantified, and most complex overpayments will take longer than 60 days to quantify. For example, some large provider organizations may have upward of 30 locations in different states that may or may not have followed the same billing or documentation procedure that led to an overpayment. It is a complex and resource-intensive process to determine which locations actually followed an erroneous procedure, over what period of time, and for which types of claims. It is potentially even more complex to quantify the overpayment when a practice may have gone on for a number of years in several locations. Furthermore, some overpayments may span several MACs, and a provider will have to determine the amount to repay to each of the MACs.
Each of the MACs’ voluntary overpayment forms requests the amount of the overpayment. Those MACs that permit a provider to request an extended repayment plan require the provider to include the estimated monthly payment, which is not possible if the overpayment has not been quantified. Thus, CMS should clarify and incorporate into a new definition that “actual knowledge” of an overpayment is insufficient for a provider to have “identified” the overpayment – it also must have quantified the overpayment.
Although we believe strongly that an overpayment may not be identified until it is quantified, if CMS does not accept that premise, it should implement a program that allows providers to identify and report the fact of an overpayment, and then provide additional time to quantify it.
4. Much of the information that CMS requires will not be available within 60 days of the overpayment’s identification.
ACLA is aware that it is the ACA that calls for overpayments to be reported and returned within 60 days of their identification or the date of a corresponding cost report, if applicable.
However, CMS’s proposed embellishments on this requirement could make it impossible for many providers to meet the deadline.
CMS is requesting far more information than is required by the statute. The statute requires a provider to report only the reason for the overpayment.11 CMS proposes to require the following information (all within 60 days): (1) how the error was discovered; (2) a description of the corrective action plan implemented to ensure the error does not occur again; (3) the reason for the refund; (4) whether the provider or supplier has a corporate integrity agreement with the OIG or is under the OIG Self Disclosure Protocol (“SDP”); (5) the timeframe and the total amount of the refund for the period during which the problem existed that caused the refund; (6) Medicare claim control number, as appropriate; (7) NPI number; (8) a refund in the amount of the overpayment; and (9) if a statistical sample was used to determine the overpayment amount, a description of the statistically valid methodology used to determine the overpayment.12 This information has been requested on the MACs’ forms for some time, and it is the same type of information that a provider typically includes in a Self Disclosure Protocol (“SDP”) submission to the OIG. However, the OIG allows a provider to have three months from the time the provider is accepted into the SDP to report on overpayments, which effectively could give the provider five months or more to organize the same information. (The MACs’ forms and accompanying instructions do not specify a time period during which the form must be submitted.)
Because of the expansive proposed 10 year look-back period (discussed below), a provider may have to gather all of this information for overpayments that occurred one decade ago (or as much as two decades ago, depending on how long it took to identify the overpayment in the first place), if they are related to or derive from the same cause as an identified overpayment. If the relevant documentation is available at all, it may be in storage, it may be saved on other media (e.g., magnetic tapes), and staff turn-over may complicate further the task of gathering and analyzing the information. While it may be possible to complete a thorough investigation eventually, it typically will not be possible to gather all of the information requested in 60 days.
As difficult as it will be to locate all of the relevant information, it can be even more difficult to quantify an overpayment in that short period of time, especially for large health care entities. This is another reason we have suggested that the definition of “identified” should account for quantifying an overpayment, not merely knowing that it exists in some amount. The many layers of the proposed rule that CMS has laid on top of the basic statutory requirement will make it unworkable in practice for providers to comply.
5. CMS should amend its definition for when an overpayment has been “identified.”
In light of the foregoing, ACLA urges CMS to adopt a new definition of when an overpayment has been “identified” and to include it in the rule’s definition section for the sake of clarity. ACLA’s proposed definition is as follows:
A person has identified an overpayment when the person has actual knowledge of an overpayment and is able to quantify the overpayment with reasonable certainty, or when a person does not initiate an inquiry within a reasonable amount of time after receiving credible information suggesting the existence of a potential overpayment.
This definition solves several problems. It removes False Claims Act language from the definition entirely, in recognition of the fact that it better reflects Congress’ intention to impose liability for only those overpayments that are identified, not those that “should have been identified.” It considers that an overpayment cannot be reported and returned if it is not quantified. It acknowledges that even when an overpayment can be quantified, in some circumstances (such as when statistical sampling and extrapolation are used), it may not be possible to know with 100 percent accuracy the exact amount of an overpayment. It also acknowledges that sometimes it will not be possible right away, in light of all of the circumstances, to undertake an inquiry into the existence of an overpayment, and some providers may need more time to commence an inquiry.
By adopting this above definition, CMS can mitigate several of the problems presented by the proposed rule.
C. CMS’s proposed 10-year look-back period is too long and is inconsistent with the False Claims Act.
CMS’s proposed a 10-year look-back period to maintain consistency with the False Claims Act’s statute of limitations. However, this look-back period is not consistent with the False Claims Act and it is unreasonably long. While ACLA appreciates the sentiment that “providers and suppliers should have certainty after a reasonable period that they can close their books,” we disagree with CMS’s approach to the look-back period for overpayments. CMS goes far beyond the statutory text when it proposes that an overpayment must be reported and returned if it is “identified” within 10 years of when it was received. It also exceeds its mandate when it proposes expanding to 10 years the period for reopening a reported overpayment. CMS should shorten the look-back period, change the language it uses to describe the look-back period, or both.
1. As written, the 10-year look back period is not consistent with the False Claims Act.
CMS proposes that an overpayment must be reported and returned if it is identified within 10 years of receipt. However, liability is triggered under the False Claims Act not when a
provider receives an overpayment, but when a provider “knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money or property to the Government.”13 The False Claims Act’ statute of limitations begins with a violation of the act, not with the receipt of an overpayment that preceded the actual violation of the act.14 Thus, contrary to its assertion, CMS’s proposal is not consistent with the False Claims Act.
Because of the way CMS chose to define when an overpayment has been “identified,” its look-back proposal effectively could double the amount of time that a provider could be subject to False Claims Act liability and must maintain records. CMS may allege in February, 2032 that a provider acted in “reckless disregard” of an overpayment (i.e., that it “identified” the overpayment) in March, 2022 for failing to follow-up on a hotline call that month about an alleged overpayment that the provider received in April, 2012. Presumably, so long as the overpayment was received within 10 years prior to such a hotline call, the provider would be obligated to investigate the existence of the overpayment, and if it did not, it could be subject to False Claims Act liability 10 years hence. The apparent consequence of the way the proposed rule is written is that a provider could face False Claims Act liability in 2032 for a payment received two decades prior.
2. If CMS imposes a look-back period, it should not be longer than six years.
CMS says it chose a 10 year timeframe because it is the “outer limit of the False Claims Act statute of limitations.” Even if the wording of the regulation is fixed, 10 years is the far outer limit of the statute of limitations and it is applied extremely rarely. It is unreasonable to apply a timeframe used only in exceptional circumstances to each and every overpayment received by each and every Medicare provider and supplier.
ACLA believes that if CMS maintains a look-back period in the final rule, it should not be longer than six years, which is the same period as the standard False Claims Act statute of limitations. While we do not disagree that providers should review past claims to ensure that they are entitled to all funds they receive, ten years is extensive. Further, the current proposal is unworkable in reality. Staff turn-over, faded memories, and an inability to locate documents will make it impossible, or nearly so, for a provider to defend itself against a charge stemming from an alleged overpayment received almost two decades ago. Also, the task of determining whether or not an overpayment exists is a complex undertaking, with several levels of investigation and a tremendous amount of work to identify an overpayment.
3. CMS should change the language it uses to describe the look-back period.
CMS should provide a clearer description of the look-back period. The agency must do this especially if it chooses to retain its problematic definition for “identified.” Currently, the regulation states: “An overpayment must be reported and returned…only if a person identifies the overpayment within 10 years of the date the overpayment was received.” ACLA suggests that CMS change this language so that it reads: “The requirement to report and return an overpayment in accordance with § 401.305 shall apply for six years after the date of the alleged overpayment.” Especially if CMS does not shorten the look-back period to six years, it should clarify that the look-back period is wholly independent of when the overpayment is “identified.”
D. The interplay between this rule and the OIG’s Self Disclosure Protocol and CMS’s Self-Referral Disclosure Protocol is inconsistent and unclear.
In the proposed rule, CMS explains that reports of overpayments made through its Self- Referral Disclosure Protocol (“SRDP”) will be treated differently than reports made through the OIG’s SDP, but it fails to explain its rationale for the differences, and it leaves other questions unanswered. While we support the effort to coordinate the reporting programs, we ask for clarification on some key points.
1. The procedures are needlessly inconsistent.
CMS proposes that when a provider makes a report through the SDP, the provider will satisfy the “reporting” obligation, and the obligation to return an overpayment would be suspended until a settlement agreement is entered with the OIG (or the provider withdraws or is removed from the SDP). However, if a provider makes a disclosure through the SRDP, the running of the 60-day deadline to return the physician self-referral-related overpayment would be suspended, but not the reporting requirement. Immediately after describing this, CMS states “we seek comment on alternative approaches that would allow providers and suppliers to avoid making multiple reports of identified overpayments.”15 ACLA suggests that providers and suppliers who disclose through the SRDP should not also have to report through the process set forth in the proposed rule. CMS has not articulated a reason why a report through the SRDP should not suffice as a report of an overpayment.
2. CMS’s section on reports made through the SDP or SRDP leaves several questions unanswered.
The agency proposes that a provider or supplier will have met the reporting obligation “by making a disclosure under the OIG’s Self-Disclosure Protocol resulting in a settlement agreement using the process described in the OIG Self-Disclosure Protocol.”16 CMS fails to take into account how the protocol operates in reality. A provider makes an initial disclosure to the OIG, and the OIG must accept a provider for participation in the protocol. The OIG has no legal
obligation to accept a provider into the SDP or to respond to an initial disclosure promptly, and oftentimes, the amount of time that passes between the provider’s initial disclosure and when the OIG accepts or rejects a provider exceeds 60 days. If 60 or more days elapse and the provider is not accepted into the protocol, the provider would be in violation of the reporting requirements and the repayment requirements. CMS has not explained how it will handle such cases, and the lack of clarity could put providers at risk if they report through the SDP.
CMS proposes that the repayment obligation would be suspended from the time that “OIG acknowledges receipt of a submission to the OIG SDP” until a settlement agreement is entered.17 CMS fails to specify which submission it means: an initial submission prior to being accepted into the protocol, or a full submission after having been accepted. Further, a provider who is not accepted into the protocol will not reach a settlement agreement with the OIG. Similarly, the repayment obligation would be suspended when CMS acknowledges receipt of a “submission” under the SRDP and until a settlement is entered, but it fails to specify which submission. CMS must clarify its intention and set forth clear guidelines it expects providers to follow, and it must communicate its expectations to the OIG, as well.
E. CMS’s burden estimate is too low.
In its assessment of the burden associated with the requirements included in the proposed rule, CMS vastly underestimates the burden on each provider to comply with the proposed rule. CMS states that the burden associated with the requirement to report and return an overpayment “would be the time and effort necessary to report and return the overpayment in the manner described” in the proposed rule.18 The agency estimates that each provider and supplier would, on average, report and return approximately three to five overpayments and that “it would take a provider or supplier approximately 2.5 hours to complete the applicable reporting form and return an overpayment.”19
To report and return an overpayment within the specified time, a person first must identify the overpayment, and based on CMS’s proposed definition, the person must have actual knowledge of the overpayment or act in deliberate ignorance or reckless disregard of the overpayment. CMS fails to take into account the hours of work that go in to gaining “actual knowledge” of an overpayment before it can be reported and returned: investigating and confirming the very existence of an overpayment, determining the practice or error that is the “reason” for the overpayment, determining how widespread the problem is and calculating the amounts by MAC, developing the corrective action plan that must be reported with the overpayment, and documenting all of these steps, and others. CMS must revise its estimate of the time it will take to comply with the proposed rule’s requirements to reflect the true costs of compliance. It is not merely the time to fill out a form, write a check, and mail it that should be accounted for in the burden estimate.
F. ACLA’s other comments
1. ACLA supports CMS’s approach to the responsibility of providers who are not a party to a kickback.
ACLA agrees that a provider that is not a party to a kickback arrangement cannot identify an overpayment and would have no duty to report it. CMS states that its expectation “is that only the parties to the kickback scheme would be required to repay the overpayment that was received by the innocent provider or supplier, except in the most extraordinary circumstances.”20 Laboratories are among those providers that could receive orders, perform tests, and report results back to an ordering physician without any knowledge of a kickback arrangement between the physician and some other person in a position to influence referrals of a patient to the physician. The laboratory services would be the indirect result of the kickback, but the laboratory would have no knowledge of or part in the kickback scheme. We agree with CMS’s position that innocent providers should not be held responsible for identifying or reporting an “overpayment,” in this case.
2. CMS should confirm that valid reporting of an overpayment according to the proposed rule’s requirements would cut off substantive liability under the False Claims Act’s qui tam provisions.
We ask CMS to confirm that a valid report of an overpayment through the process proposed in this rule shall bar any substantive liability under the FCA qui tam provisions. Otherwise, it would serve as a disincentive to report an overpayment in good faith, if such information then could be used by another individual against the provider under those provisions. We believe that any such disclosure by a provider would result in a “public disclosure” under existing law and should prevent its use in a qui tam suit against the provider, but we request that CMS confirm that this interpretation is correct.
3. CMS should develop a uniform reporting protocol in concert with this rule.
The content of the required report should not be divorced from the rest of the reporting and repayment requirements, and CMS should develop a uniform reporting protocol now. The agency already has specified what information it believes ought to be included in a report, and it would be easy to develop a form to be used by all of the MACs, similar to the way it developed the form for reopenings.21 Some overpayments may stem from practices that span several MACs’ jurisdictions. It would decrease the burden on providers if the information it had to report on all overpayments was uniform from the beginning.