By John Fisher, JD, CHC, CCEP
Credible Information Indicating Overpayment: Duty to Investigate
Date: June 27, 2017
Executive Summary
The 60-day repayment rule requires health care providers to act promptly when they receive credible information indicating a potential overpayment. Under the final regulations, providers may be deemed to have identified an overpayment when they should have discovered it through reasonable diligence, not only when they obtain actual knowledge. Failure to investigate in a timely and good-faith manner can create significant exposure under the False Claims Act, including treble damages and per-claim penalties, and may also raise criminal concerns in serious cases. Providers should ensure that compliance policies, auditing processes, and staff education are designed to identify, investigate, quantify, and repay overpayments within required timeframes.
Addressing Potential Overpayment Situations Through Reasonable Care
The final regulations under the 60-day repayment rule require providers to exercise reasonable diligence in identifying potential overpayment situations. A provider’s duty to investigate is triggered when it receives credible information indicating that an overpayment may exist. Once triggered, the provider must take affirmative steps, in a timely and good-faith manner, to investigate the matter further. Failure to exercise reasonable diligence can result in significant penalties under the False Claims Act (FCA). In some circumstances, criminal liability may also attach, particularly when evidence strongly suggests that a problem may exist and a deliberate decision is made not to investigate or repay amounts owed.
Most health care providers are now generally aware of the 60-day repayment rule, which originated as part of the Affordable Care Act in 2010. The rule provides that failure to repay a known overpayment within 60 days after discovery may result in penalties under the FCA. As a result, a simple overpayment can be multiplied by a factor of three. Additional penalties may also be assessed, ranging from a minimum of $11,000 to approximately $22,000 per claim. Financial exposure under the FCA can be substantial, particularly when a systematic billing error affects many claims over an extended period. Because the lookback period for imputed false claims is six years, potential exposure can be amplified when a current-year audit reveals only the “tip of the iceberg.”
When the 60-Day Period Begins
The initial statutory provision left ambiguity regarding application of the 60-day repayment rule. One significant question was when the 60-day period begins to run. The statute states that the period begins upon “identification” of the overpayment, but it did not clarify when a provider is deemed to have identified an overpayment. It was unclear whether identification occurred when an allegation was made, when the amount of the overpayment was calculated, when the existence of the overpayment was verified, or at some other point. It was also unclear whether actual knowledge was required or whether knowledge could be imputed under certain circumstances.
CMS clarified the issue of identification in the final regulations, but the clarification places significant burdens on providers. Under the final rules, a provider is deemed to have identified an overpayment not only when it obtains actual knowledge, but also when it should have identified the overpayment through the exercise of reasonable diligence. This standard requires providers to conduct a timely, good-faith investigation when they receive credible information that an overpayment may exist. Failure to take reasonable investigative steps can result in imputed knowledge and deemed identification of the overpayment. In practical terms, the 60-day clock may begin when the investigation should have commenced.
What Constitutes an Overpayment
An overpayment exists when a provider receives funds to which it is not entitled. There is no threshold amount, substantiality requirement, or materiality requirement. Any overpayment can invoke the statute and become a potential false claim if it is not repaid within the 60-day period. In some situations, the amount may be so small that a provider considers whether it is worth the resources needed to identify, quantify, and repay it. However, providers should keep in mind that FCA liability may apply if a whistleblower action is filed or a government investigation later identifies the overpayment. Liability can be significant, particularly when multiple claims are involved. Criminal statutes may also impose felony penalties for the willful failure to return known overpayments.
Managing Self-Discovered Overpayments
Overpayments that are self-discovered and repaid before they become false claims are generally easier to manage. Once FCA exposure potentially attaches, these situations become more complicated. The OIG Self-Disclosure Protocol should be considered when there is potential for significant penalties. The protocol permits resolution at a minimum of 1.5 times the amount of the overpayment, but it requires full disclosure of the facts and the investigation. Only civil penalties are subject to settlement under the protocol. Facts disclosed through the self-disclosure process may still lead to criminal charges against an entity or individuals, and criminal charges cannot be settled through the protocol.
When the amounts involved are smaller, a provider may choose to repay without using the protocol process. The appropriate approach should be determined based on the specific facts and with the involvement of legal counsel experienced in these issues.
Compliance Program Considerations
A properly operated compliance program is one of the best defenses for mitigating exposure under the 60-day rule. Providers should conduct prompt investigations whenever there is a credible allegation of an overpayment. Compliance risk identification and proactive auditing can further reduce risk by identifying problems early and demonstrating that the compliance process is operating effectively. These steps can help avoid allegations that overpayments should have been discovered sooner through reasonable compliance efforts. Most importantly, ignoring alleged overpayments does not mitigate risk. All credible allegations should be investigated, and appropriate repayment should be made through one of the available methods. The requirements of the final rule should be incorporated into compliance program policies and procedures, and staff should be educated on the need to investigate and return overpayments within required timeframes.
Summary Conclusion
The final 60-day repayment rule makes clear that providers cannot wait for absolute certainty before taking action on potential overpayments. Once credible information suggests that an overpayment may exist, providers should promptly investigate, quantify any amount owed, and determine the appropriate repayment or disclosure path. Because failure to exercise reasonable diligence can lead to substantial FCA exposure and, in serious cases, potential criminal consequences, overpayment response procedures should be integrated into the provider’s broader compliance program. A timely, well-documented, and good-faith investigation remains the strongest practical safeguard against avoidable liability.
