The Affordable Care Act of 2010 imposed a requirement that providers that bill the Medicare program (including Parts A, B, Medicare Advantage and Part D) must report and return identified overpayments within sixty days. Failing to do so carries liability under the federal False Claims Act, which makes it unlawful to knowingly submit false or fraudulent claims for payment, and entitles the government to treble damages and per-claim penalties ranging from $5,500 to $11,000. When this "60-day rule" was enacted, it was unclear what constituted an "identified overpayment" or what triggered the 60-day clock.

Under the new regulation, 42 C.F.R. § 401.305, an "identified" overpayment is when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.

The critical element of this definition is that providers are responsible for overpayments that they know exist or should have known about through the exercise of "reasonable diligence." Providers that deliberately choose not to investigate potential overpayments would still be held liable under the False Claims Act for failing to return a known overpayment.

CMS also clarifies that providers will also be held responsible for overpayments that they did not directly cause. For example, errors made by billing agents or other instances that are out of the provider's control (such as, a CMS system error classifying a Medicare Advantage beneficiary as fee-for-service or duplicate payments by the Medicare contractor), will still be the provider's responsibility for repayment purposes. Practically speaking, this will require providers to undertake proactive and robust compliance measures to detect such errors.

For providers to exercise reasonable diligence, they must (1) implement proactive compliance activities to monitor the receipt of overpayments, and (2) undertake investigations "in a timely manner" in response to obtaining "credible information" of a potential overpayment. CMS considers a "timely" investigation to be "at most 6 months from receipt of the credible information, except in extraordinary circumstances."

Exercising reasonable diligence may require a provider to use statistical sampling to appropriately quantify the overpayment. The Final Rule gives the provider some time to undertake a deeper audit and/or engage in statistical sampling to determine the full extent of an "identified overpayment." Notably, the 60-day period does not begin until the provider has had the opportunity to undertake these follow-up activities so the notion of racing against the 60-day clock is somewhat alleviated.

The 60-day rule only applies to overpayments identified within six years after they were received. Providers may use several options when returning overpayments to CMS including claims adjustment, credit balance, OIG's Self-Disclosure protocol, CMS' Self-Referral Disclosure Protocol, or other appropriate processes.

The Final Rule imposes increased responsibility on providers. Providers should:

• Promptly evaluate and document any evidence of potential overpayments to determine whether the report is credible.
• Investigate whether additional overpayments exist and how they should be quantified (look back 6 years).
• Submit the quantified overpayment within 60 days.
• Implement policies, procedures and training regarding compliance with the 60-day rule.

Shachi Mankodi is Senior Counsel in the Office of Broad and Cassel. She is a member of the firm's nationally recognized Health Law Practice Group. She can be reached at smankodi@broadandcassel.com.