False Claims Act Implications of CMS’s Final Medicare Overpayment Rule
Client Alert | November 7, 2024
The Final Rule brings the standard for determining when a person has “identified” an overpayment in line with the FCA’s knowledge standard and formalizes a six-month good-faith investigation period—but risks for providers remain.
Introduction
On November 1, 2024, the federal Centers for Medicare and Medicaid Services (CMS) issued a Final Rule (the “Final Rule“) regarding the identification, reporting, and return of overpayments by Medicare participants. The Final Rule applies to participants in Medicare Parts A through D––providers, suppliers, managed care organizations, Medicare Advantage organizations, and prescription drug plan sponsors. The Final Rule will be published in the Federal Register on December 9, 2024, and will go into effect on January 1, 2025.
Under the Affordable Care Act (ACA), recipients of federal health care program funds must report and return any overpayments within 60 days of “identifying” them. The Final Rule starts the 60-day clock for return of overpayments when an entity “knowingly receives or retains an overpayment,” replacing a prior standard—rejected in a 2018 court decision—that had started the clock at the point when an entity “should have determined through . . . reasonable diligence” that it received an overpayment. The Final Rule also introduces a 180-day suspension of the 60-day clock to allow for “good-faith” internal investigations into potential overpayments. Prior to the Final Rule, CMS had suggested that “most” such investigations should be completed within 180 days, but did not make that a formal deadline. However, investigations undertaken in good faith can last well over six months, and in finalizing the rule, CMS declined to reconsider the 180-day timeline or allow for extensions. Because the Final Rule also provides that the period for investigating overpayments ends at the latest when the 180-day suspension period ends, entities may face FCA challenges based on claims that investigations lasting longer than 180 days were not conducted in “good faith.”
Background
An “overpayment” occurs when CMS reimburses an entity for health care goods or services in excess of the amount to which the entity is entitled. Under the ACA, an entity must report and return an overpayment 60 days after the date on which the overpayment is “identified.”[1] The ACA does not specify what it means to “identify” an overpayment. An overpayment not returned by the appropriate deadline is considered an “obligation” under the “reverse” provision of the federal False Claims Act (FCA), which prohibits knowing and improper avoidance of an obligation to pay money to the government.[2]
In a series of regulations promulgated in 2014 and 2016, CMS stated that a Medicare participant “identifies” an overpayment when it “has determined, or should have determined through the exercise of reasonable diligence, that [it] has received an overpayment.”[3] This was essentially a negligence standard, and meant that reverse FCA liability could be premised on something less than recklessness, which is the minimum level of scienter the FCA requires. For several years, the CMS regulations remained intact, and in fact met with deference by some courts—most notably in the case of Kane ex rel. United States v. Healthfirst, Inc., 120 F. Supp. 3d 370 (S.D.N.Y. 2015). There, in analyzing reverse FCA allegations regarding Medicaid overpayments, the court credited CMS’s definition of “identified” in the Medicare context.[4]
Change came in UnitedHealthcare Ins. Co. v. Azar, which struck down the “reasonable diligence” standard.[5] The district court there held that the standard impermissibly created potential FCA liability based on mere negligence as to an obligation to return an overpayment, when the FCA itself requires at least reckless disregard.[6] In response to the UnitedHealthcare decision, CMS proposed a rule in late 2022 that—for the entire Medicare program—defined “identified” by reference to the relatively more stringent definition of “knowing” and “knowingly” contained in the FCA itself.[7]
Both the UnitedHealthcare decision and the 2022 Proposed Rule, however, left a key question unanswered, namely: how can providers avoid being charged with “knowledge” of an overpayment—within the meaning of the FCA—if they take longer than 60 days to conduct a good-faith investigation to determine whether overpayments have occurred? Particularly in large organizations with high volumes of claims, the running of that clock without any action to return monies to the government is very often a sign that a good-faith investigation into potential overpayments remains underway, not that overpayments were quickly identified and are being concealed or disregarded.
While the Final Rule provides a measure of clarity, it ultimately does not answer this question—and in fact, it creates new risks for providers facing potential FCA challenges.
Changes Effectuated by the Final Rule
At the most basic level, the Final Rule codifies the UnitedHealthcare court’s holding by providing that the 60-day clock for repayments begins when an entity “knowingly receives or retains an overpayment,” and explicitly incorporates the FCA’s definition of the word “knowingly.”[8]
The Final Rule also introduces a new provision ostensibly aimed at affording Medicare participants time to conduct internal investigations into potential overpayments. In 2015, CMS acknowledged that such investigations could take around 180 days, but prior to now the agency had not implemented either a requirement that such investigations be completed in that timeframe or an explicit provision tolling the deadline for return of overpayments pending such investigations.[9] The Final Rule, dovetailing off of CMS’s observation in 2015, provides for a maximum 180-day suspension of the 60-day clock to allow providers to conduct internal investigations.[10] In particular, the 180-day suspension applies if a provider has identified at least one overpayment and conducts a “good-faith investigation to determine the existence of related overpayments.”[11]
While the 180-day period seems aimed at providing greater clarity around CMS’s expectations for the timeline for investigating potential overpayments, a six-month investigation period is likely to prove a poor fit for many Medicare participants. Smaller providers facing relatively straightforward overpayment issues may have little trouble completing investigations in 180 days. But larger institutions such as hospitals—for which potential overpayments could span multiple providers and disease states and involve a variety of personnel over long periods of time—are likely to face significant challenges investigating and calculating potential overpayments on a six-month timeframe. Such investigations require time not only by compliance personnel but also by caregivers themselves, who are expected to provide information to aid in the investigation while juggling the non-stop realities of patient care and the operation of the enterprise itself. Even a fast-moving investigation in this sort of setting could easily take more than six months to yield conclusions.
That much could perhaps be addressed by a longer investigation period, at least for large institutional providers. But the Final Rule exacerbates the challenges for such providers by providing that the investigation period closes either when the aggregate overpayments have been identified and calculated or when 180 days have passed.[12] Because the Final Rule states that only a “good-faith” investigation will trigger the 180-day suspension period, the rule creates a risk that the government—or FCA relators—will argue that any investigation longer than 180 days was not conducted in “good faith,” and thus that any provider that does not return putative overpayments within 60 days after the expiration of the 180-day window has acted “knowingly” and faces reverse FCA liability for that reason. As the previous CMS guidance did, the Final Rule leaves open what types of information or scenarios would trigger an obligation to investigate short of having “actual knowledge” of the potential overpayment.
The comments CMS received on the Proposed Rule pointed to the challenges of completing an investigation of potential overpayments within six months. CMS acknowledged that they “heard from many commentators on the issue of time needed for investigations and calculations of overpayments,” and that some comments proposed that the rule include a process to extend the 180-day period for complex investigations, or include an 8-month investigation suspension.[13] Nonetheless, CMS stated that general support for codification of an investigatory period led them to believe that they had “appropriately balanced the needs of providers and suppliers with the required statutory mandates.”[14] It remains to be seen whether or not courts agree with that assertion—particularly in the wake of the Supreme Court’s Loper Bright decision, which empowers federal courts to independently evaluate, rather than defer to, federal agencies’ interpretations of the statutes they implement.[15] For now, Medicare participants undertaking complex overpayment investigations may be faced with a difficult choice in some cases: investigate for longer than 180 days and risk an accusation of “bad faith,” or somehow make a repayment to the payor before the potential overpayment is confirmed and/or quantified. The dilemma appears designed to force on providers a commitment of resources to quickly investigate potential overpayments that may not be available in all cases. Among other questions about how the Final Rule will be implemented, it remains to be seen whether CMS, Medicare Administrative Contractors, and/or potential FCA enforcers will be willing to consider a provider’s facts and circumstances in cases where investigative deadlines cannot be met. Additionally, while this Final Rule is specific to Medicare, FCA cases in other regulatory contexts regularly present the question of the appropriate timeline for internal investigations to identify potential overpayments. It remains to be seen whether the 180-day suspension period and the “good faith” requirement—and the risks they pose—have broader implications for defendants facing FCA investigations and litigation outside the health care arena.
Gibson Dunn will continue to monitor developments related to the Final Rule. And, of course, we would be happy to discuss these developments—and their implications for your business—with you.
[1] 42 U.S.C. § 1320-7k(d).
[2] Id.; 31 U.S.C. § 3729(a)(1)(g).
[3] See, e.g., 42 C.F.R. § 422.326(c) (Medicare Advantage rule); 42 C.F.R. § 401.305(a)(2) (Part A and B rule), 42 C.F.R. § 423.360(c) (Part D rule).
[4] 120 F. Supp. 3d at 383-93.
[5] 330 F. Supp. 3d 173 (D.D.C. 2018), rev’d on other grounds sub nom. UnitedHealthcare Ins. Co. v. Becerra, 16 F.4th 867 (D.C. Cir. 2021).
[6] UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d at 191.
[7] Contract Year 2024 Medicare Parts A, B, C, and D Overpayment Provisions, 87 Fed. Reg. 79452, 79559 (Dec. 27, 2022).
[8] Dep’t of Health & Hum. Servs., Centers for Medicare & Medicaid Servs., RIN 0938-AV33 and 0938-AU96, at 2446 (emphasis added).
[9] Medicare Program; Contract Year 2015 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs, 79 Fed. Reg. 29,844, 29,923 (May 23, 2014).
[10] Dep’t of Health & Hum. Servs., Centers for Medicare & Medicaid Servs., RIN 0938-AV33 and 0938-AU96, at 2447.
[11] Id.
[12] Id.
[13] Id. at 1871-72.
[14] Id. at 1871.
[15] Loper Bright Enterprises v. Raimondo, 144 S. Ct. 2244, 2273 (2024).
Gibson Dunn lawyers regularly counsel clients on the False Claims Act issues and are available to assist in addressing any questions you may have regarding these issues. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s False Claims Act/Qui Tam Defense practice group:
Washington, D.C.
Jonathan M. Phillips – Co-Chair (+1 202.887.3546, [email protected])
Stuart F. Delery (+1 202.955.8515,[email protected])
F. Joseph Warin (+1 202.887.3609, [email protected])
Gustav W. Eyler (+1 202.955.8610, [email protected])
Lindsay M. Paulin (+1 202.887.3701, [email protected])
Geoffrey M. Sigler (+1 202.887.3752, [email protected])
Joseph D. West (+1 202.955.8658, [email protected])
San Francisco
Winston Y. Chan – Co-Chair (+1 415.393.8362, [email protected])
Charles J. Stevens (+1 415.393.8391, [email protected])
New York
Reed Brodsky (+1 212.351.5334, [email protected])
Mylan Denerstein (+1 212.351.3850, [email protected])
Denver
John D.W. Partridge (+1 303.298.5931, [email protected])
Ryan T. Bergsieker (+1 303.298.5774, [email protected])
Robert C. Blume (+1 303.298.5758, [email protected])
Monica K. Loseman (+1 303.298.5784, [email protected])
Dallas
Andrew LeGrand (+1 214.698.3405, [email protected])
Los Angeles
James L. Zelenay Jr. (+1 213.229.7449, [email protected])
Nicola T. Hanna (+1 213.229.7269, [email protected])
Jeremy S. Smith (+1 213.229.7973, [email protected])
Deborah L. Stein (+1 213.229.7164, [email protected])
Dhananjay S. Manthripragada (+1 213.229.7366, [email protected])
Palo Alto
Benjamin Wagner (+1 650.849.5395, [email protected])
© 2024 Gibson, Dunn & Crutcher LLP. All rights reserved. For contact and other information, please visit us at www.gibsondunn.com.
Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.