The objective of having compliance plans and procedures in place is becoming increasingly important for Medicare providers and suppliers. On Feb. 16, the Centers for Medicare & Medicaid Services (CMS) released a proposed rule to implement Section 128(d) of the Social Security Act, which was introduced as a provision of the Patient Protection and Affordable Care Act (PPACA) and deals with the reporting and returning of overpayments. Although the proposed rule mirrors much of the existing rule, it is significant because it includes a definition for when an overpayment is considered “identified” and proposes a 10-year lookback period for reporting and returning identified overpayments.

The Social Security Act requires an entity that has received an overpayment to report and return the overpayment to the appropriate party (the federal government, the state, a carrier or a contractor). The deadline for reporting and returning an overpayment, which is identical to the current deadlines for similar functions, is whichever occurs later: 60 days after the date on which the overpayment was identified or the date any corresponding cost report is due.

The proposed rule also contains the existing definition of “overpayment,” which is defined as “any funds that a person receives or retains under title XVIII to which the person, after applicable reconciliation, is not entitled under such title.” The proposed rule provides that the term “applicable reconciliation” will become relevant when the provider submits a cost report. In addition, CMS in the regulations provides examples of what could be considered overpayments, including: a) Medicare payments for non-covered services, b) Medicare payments in excess of the allowable amount for an identified covered service, c) errors and non-reimbursable expenditures in cost reports, d) duplicate payments and e) receipt of Medicare payment when another payer had the primary responsibility for payment.

As previously mentioned, the proposed rule is particularly significant because of the inclusion of the previously undefined concept of “identified.” In the text of the rule, CMS proposes that an overpayment is identified “if the person has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the existence of the overpayment.” CMS goes on to suggest in the proposed rule that without such a definition, a provider or supplier might avoid activities that can reveal overpayments – activities such as “self-audits, compliance checks and other additional research.” This definition is critical to providers and suppliers because the 60-day reporting and returning clock would begin to run on the date of identification.

In an effort to assist providers and suppliers, CMS has provided a list of examples of scenarios in which an overpayment is identified and the provider or supplier should make a “reasonable inquiry with all deliberate speed” to determine if an overpayment exists. Those scenarios include:

  • When a provider receives an anonymous compliance-related hotline telephone complaint about a potential overpayment;
  • When a provider or supplier reviews billing or payment records and learns that it incorrectly coded certain services, resulting in increased payment;
  • When a provider or supplier learns that a patient death occurred prior to the date of service on a submitted claim;
  • When a provider or supplier learns that services were provided on its behalf by an unlicensed or excluded individual;
  • When a provider or supplier performs an internal audit and discovers overpayments;
  • When a provider or supplier is informed by a government agency of an audit that uncovered a potential overpayment; and
  • When a provider or supplier experiences a significant increase in Medicare revenue with no apparent reason for the increase.

This list of examples should give providers and suppliers a good starting point for evaluating and updating their current compliance plans. Retention of an overpayment becomes an obligation under the False Claims Act. Furthermore, such retention may result in the provider or supplier being found liable under the Civil Monetary Penalties Law, as well as possible exclusion from participating in federal healthcare programs.

In addition to making clear the definition of “identification,” requiring providers and suppliers to exercise diligence in investigating potential overpayments, CMS has proposed that an overpayment must be reported and returned only if a person identifies the overpayment within 10 years of the date it was received. CMS rationalizes the 10-year lookback period as being consistent with that of the False Claims Act’s statute of limitations. CMS believes that such a term is appropriate because it provides certainty for providers and suppliers, ensuring that they can close their books without ongoing potential overpayment liability looming, and because it also provides a long enough period for furthering CMS’s interest in ensuring that overpayments are returned to the Medicare Trust Funds in a timely manner. CMS also has proposed that the reopening rules be amended to allow reopening for a period of 10 years.


The proposed rules also cite the interplay between the obligation to report and return overpayments and the existing Medicare Self-Referral Disclosure Protocol (SRDP) for Stark law violations and the OIG Self-Disclosure Protocol (OIG SDP) for the reporting of potential fraud to the OIG. For example, it is proposed that the deadline for returning overpayments will be suspended when: a) the OIG acknowledges receipt of a submission to the OIG SDP, or CMS acknowledges receipt of a submission to the SRDP, until such time as a settlement agreement is entered; b) the person or entity withdraws from the OIG SDP or SRDP; or c) the person or entity is removed from the OIG SDP or SRDP. Furthermore, CMS proposes that once a provider or supplier notifies OIG of an identified overpayment via the OIG SDP, such notice will qualify as a report. However, CMS’s proposed rule cautions that providers and suppliers should be aware that “the process of reporting and returning overpayments pursuant to section 1128J of the Act cannot resolve any potential False Claims Act or OIG administrative liability associated with the overpayment (even though returning an overpayment may … limit any FCA or administrative liability arising from the retention of an overpayment).”

CMS’s implementation of Section 1128(d) should not go unnoticed. As a result of the proposed rule, providers and suppliers should recognize the added importance of revising and updating current compliance plans. Specifically, providers and suppliers should implement methods to determine when an overpayment is considered “identified,” as well as introduce measures to ensure timely compliance with reporting and returning overpayments. Failure to have an effective compliance plan in place could result in knowingly (through actual knowledge, reckless disregard or deliberate ignorance) having retained an overpayment. No matter how an overpayment ultimately is identified, the results of retaining the overpayment are clear- a potentially substantial monetary penalty, or worse, exclusion from participating in federal healthcare programs.

About the Authors

Jessica Lange is an associate at Wachler & Associates, P.C.  Ms. Lange dedicates a considerable portion of her practice to defending healthcare providers and suppliers in the defense of RAC, Medicare, Medicaid and third party payer audits.  Her practice also includes the representation of clients in Stark, anti-kickback, and fraud and abuse matters.

Rebecca Robichaud is an attorney at Wachler and Associates, P.C. She has represented clients in Medicare, Medicaid and other third party payer audits and appeals and also counsels clients in contract negotiations, Stark, anti-kickback, and fraud and abuse matters. Mrs. Robichaud graduated from the University of Notre Dame Law School in 2003 where she was an Administrative Editor for the Journal of Legislation and a Student Bar Association Representative.

Contact the Authors

To comment on this article please go to

Reading Between the Lines – Algorithms of Medical Necessity (Part I of II)

Share This Article