Late last week, the Centers for Medicare & Medicaid Services (CMS) published its final rule regulating how healthcare providers must report and return overpayments. This rule implements the Affordable Care Act’s requirement that healthcare providers who receive an overpayment from Medicare return the overpayment within 60 days of its identification. Overpayments not returned within the 60-day limit become “obligations” to the Federal government within the meaning of the False Claims Act (FCA), exposing the provider to the possibility of civil penalties and treble damages.

The final rule is significantly more provider-friendly than the originally proposed rule. The original rule, published on February 16, 2012, drew substantial criticism during the public comment period. CMS announced early last year that it was delaying the publication of the final rule in order to address the “significant policy and operational issues” raised by commenters.

The original rule, which was not binding, applied the repayment requirement to a 10-year look-back period, matching the outer limit of the FCA’s statute of limitations. The final rule scales down the look-back period to six years, following the statute of limitations that applies to most FCA claims. The final rule also includes a less stringent definition of when an overpayment is “identified.” Under the previously proposed rule, an overpayment was identified as soon as a provider “acts with actual knowledge of, in deliberate ignorance of, or with reckless disregard to the overpayment’s existence.” Providers who received information regarding potential overpayments were required to “conduct [an] inquiry with all deliberate speed after obtaining the information.” The final rule states that identification occurs when a provider “has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” Providers have six months after receiving credible information to conduct an investigation into the allegations and quantify any overpayments that are identified. Healthcare providers must engage in “both proactive and reactive” measures to meet the reasonable diligence requirements of the final rule, including good faith compliance monitoring and timely investigation of allegations by “qualified individuals.”

The final rule is a return to a more certain standard for healthcare providers grappling with complex reimbursement rules that, if applied incorrectly, may give rise to claims of FCA liability. Yet underlying this rule is an expectation that healthcare providers act diligently to identify and account for overpayments and issue refunds. The new rule is an continuation of the Federal government’s shift to place more responsibility on providers to investigate, identify, and report program integrity and compliance issues.