Medicare overpayment rule leaves practices scrambling

The newly amended rule from the Centers for Medicare & Medicaid Services (CMS) governing how physicians and hospitals need to report and return Medicare overpayments has sparked a range of concerns and emotions among providers.

They find the rule’s language vague and confusing, see the scope of what they’re being asked to do as burdensome on a number of levels and complain that the rule’s requirements add to the layers of regulations that they already face.

“It’s emotionally taxing as well as resource-taxing to the practice,” says Wanda Filer, MD, president of the American Academy of Family Physicians (AAFP). “They’re out there taking care of people. They don’t necessarily keep their ears attuned to everything CMS is throwing at them. They’re trying to keep their heads above water with Meaningful Use and other rapid changes that are underway.”   

Promulgated by CMS in February, the final rule requires healthcare providers and suppliers to report and return overpayments under Medicare Parts A and B within 60 days of the date the overpayment is identified, whether internally or by CMS or its contractors, or the date any corresponding cost report is due if that comes later. 

CMS scaled back the “look back period” during which providers must retroactively report and return overpayments from 10 to six years, which many in the healthcare field view as a step in the right direction—but still unduly onerous.

Providers are expected to exercise what CMS terms “reasonable diligence” in attempting to uncover and return overpayments. The potential consequences of not doing so remain the same as in the past: criminal charges, civil liability and exclusion from federal healthcare programs.

“The duty to identify and return overpayments is not a new one,” says Tony Salters, a CMS spokesperson. To avoid the penalties, he says, providers should adhere to the requirements by instituting proactive analytics processes that identify and calculate all overpayments going back the full six years, and then reporting and returning the money in question in a timely manner.

The term “reasonable diligence” means that providers should undertake both proactive compliance activities to monitor claims themselves, as well as reactive investigations in response to receiving “credible information” about a potential overpayment, Salters says. 

The rule itself says that these requirements “are meant to ensure compliance with applicable statutes, promote the furnishing of high quality care, and to protect the Medicare Trust funds against fraud and improper payments.”

Next: Impact on small practices

Impact on small practices

While perhaps no one disagrees with those goals, some physicians and organizations that represent them continue to have questions about the particulars like, for example, what the rule means when it says providers have a “clear duty” to report and return overpayments.

The AAFP, which signed a 2012 letter that circulated to dozens of specialty societies and advocated for a three-year look-back period, is encouraging members to return overpayments as soon as they’re identified but understands the burden that poses, Filer says. “The vast majority of these overpayments are due to inadvertent billing errors,” she says. “It’s a little unclear how CMS is going to define ‘clear duty.’ The clear duty of a provider is to care for your patients.”

Mark Silberman, JD, partner at Duane Morris LLP in Chicago, also isn’t certain what CMS means by “clear duty” on the part of providers. “It is not clearly defined, and I would hope they are gentle in their interpretation of that duty—at least until the practical impact can be evaluated,” he says.

Filer has primarily heard from smaller family practices that they find these Medicare audits to be burdensome. “That said, I’m hopeful that as CMS continues to monitor this, if they find this is not the best place to put their resources, three years might start to look more attractive,” she says.

The AAFP does not plan to issue general advice on how its members should comply with the rule given their vast differences in resources, size and overhead, Filer says.  “Practices are going to have to look at their own resources and what are the best practices for them,” she says. “Family medicine tends to run on quite thin margins. It’s not one where they’re going to be able to spend a huge amount of capital on doing this work.”

Nonetheless, given the potential penalties, she adds that as a general rule, “we’re telling practices that self-audits are a form of preventive care for your practice.”

The American College of Physicians has heard about the rule change but hasn’t taken a defined position and hasn’t heard much feedback from members to date, spokeswoman Jacquelyn Blaser told Medical Economics via email. 

Kenneth Kubitschek, MD, chief executive officer of Carolina Internal Medicine Associates in Asheville, North Carolina, believes the new rule mostly stemmed from problems with hospital providers and their employed physicians—and that the rule’s requirements are more realistic to expect from such large entities than a small practice like his, which has nine physicians, five non-physician providers and more than 50 total employees.

“[Hospitals] fiddled around for long periods instead of paying back millions of dollars,” he says. “That’s why [CMS] said, ‘OK, you’ve got 60 days.’ For a practice like ours, 60 days actually sounds kind of short. Because we’re busy, everybody’s busy, and trying to set aside time to dive into those kinds of things, to find out if it’s really a problem or just isolated—it’s a real challenge.”

Next: Legal ramifications

The 60-day clock begins when a practice identifies a problem, and Kubitschek, an editorial advisory board member of Medical Economics, says he’s not sure precisely how that time requirement is determined by CMS. He’s also not sure how a practice like his can be expected to turn back the clock six years when, for example, the person responsible for the overpayment might have retired.

Kubitschek and his colleagues at Carolina Internal Medicine Associates are beginning to sort that out, thinking about questions like whether finding one overpayment should trigger a full investigation of that doctor’s billing going back six years, or an investigation of how the practice has billed the particular code in question, Kubitschek says. But the road ahead will be littered with such questions.

“I guess we’re going to have to learn how to do it,” he says. “I’m casting about trying to figure it out.” Typically the practice refunds any overpayments it finds, but what if it billed for a lab the patient missed? He’s not sure whether to simply refund that one fee or attempt to extrapolate. “How do I apply that to a six-year window? I’m a little confused, and I’m hoping for more clarification.”

For now, the practice does not have a plan in place, and Kubitschek isn’t sure how it will comply within the rule’s time requirements. “I think they should graduate this in, and they should differentiate between misinterpretation of a rule and fraud, and if it’s fraud the look-back period should be longer,” he says.

Kubitschek also believes that the look-back period should be shorter for small practices because practices the size of his “don’t have the same capacity for applying the large numbers of personnel.”

Legal ramifications

Healthcare attorneys empathize with their clients’ state of mind but say they’re well-advised to practice what one calls “preventative law” in ensuring that their auditing practices err on the side of being as cautious and thorough as possible. They say that documentation of reasonable diligence can be critical to convincing CMS that a practice has not engaged in fraud, and that it has done all it can to root out inadvertent overbilling.

The final rule is an improvement over the original and not that different from the typical four-year “reopening period” that providers already deal with from other contractors, says Tony Maida, JD, partner with the health industry advisory group at McDermott, Will & Emery in New York. Some of those audits happen so long after the dates of service that the reopening period actually extends back closer to six years, adds Maida, a former deputy chief at the U.S. Department of Health and Human Services Office of the Inspector General.

Next: CMS hinting between the lines

Maida believes that CMS has hinted between the lines that practices should institute such compliance programs to be in Medicare. “There is no regulation and no law that applies to everyone that says you have to,” he says. “But that said, CMS thinks everybody should have one, and they’re probably right about that at some level. Given the enforcement environment we have grown up in during the last 10 or 20 years, you would be ill-advised not to have one at this point.”

In addition to staying in CMS’ good graces, the new rule will make a compliance program more important to potential investors—whether hospitals, other practices or anyone in the private equity sector—looking to buy into physician practices, Maida predicts. “A buyer is going to kick the tires on your compliance program and see if the revenue from that practice is reliable,” he says. 

A tight compliance program need not audit every claim, Maida says. “There’s always a risk you will have overpayment in an area you haven’t looked,” he says. But providers need to be able to show that they have a year-in, year-out assessment process that plans the internal audit around both areas where CMS has expressed concerns and the practice’s own experience with overpayments.

Among the processes that providers should evaluate is what sort of “hotline” they have to receive complaints of overbilling, Maida says. “This rule is probably a good time to reassess that process and make sure it is tight, that things don’t get lost in the cracks, that decisions are made about whether to investigate something.”

If a provider has received several complaints and did not respond, he adds, “That takes on more importance under this rule. The government says you got credible information about this issue, and you didn’t do anything, or you did an incomplete job, and that is another strike against you.”

The ability of CMS to mine data and find practices that seem like outliers means that physicians need to invest more in their internal auditing function, Maida says. “It’s very easy to find out now, in a way it wasn’t 10 years ago, who the top 10 billers are and pick a place [to audit],” he says. 

Silberman of Duane Morris LLP agrees with Maida that providers need to be able to demonstrate they have attempted to root out and report overpayment errors. That makes some sense to him because otherwise, he figures, practices could spend time mired in denial about such errors if they suddenly see a spike in revenue from overbilling without asking why.

The lack of an adequate internal auditing function provides an opening for the government to second-guess your processes, Silberman says. “What I try to tell my clients is, whatever you do, have a reason,” he says. “If you have a reasonable basis and explanation for why you did what you did, you can always have someone advocate for you. If you can’t explain it, the government fills in their own explanation.” 

Next: Practice what you preach

Silberman recommends that physicians practice what they preach to their patients: get regular checkups and take preventative steps. Approach the matter as a triage, starting with current auditing practices and then looking backward. “There’s no point in looking for what caused the injury if the patient dies on the table,” he says, extending the medical metaphor.

The next step is to decide whether you want to perform the audit yourself or hire an outside auditor. Doing so would increase costs but likely provide a more objective judgment. “We all know the government is doing it, data mining and trying to find patterns,” he says, adding that if you’re going to have what he calls an “unpleasant discussion” with the government, it’s very important to show you’ve been diligent about rooting out and trying to fix the problem.

Silberman extends the analogy to preventive medicine by noting that taking a better-late-than-never approach and waiting to look for a problem might only mean it grows biger “Some people find problems and decide they’re going to wait to see if it’s ever discovered. The risk to that is, the government can establish you didn’t use reasonable diligence, you’re outside the 60-day window and then you’re going to start looking at some pretty serious penalties.” 

While most overpayments are handled in civil court, Silberman adds, there’s no guarantee, particularly when a practice doesn’t seem like it has been exercising due diligence. “Find me a federal prosecutor who will verify that it’s not going to cross over into the criminal [realm],” he says. “Their answer is, ‘We’re going to have to wait and see what our investigation yields.’ ”

Silberman is concerned that physicians are leaving medicine, shifting to payer-less arrangements or pursuing employed relationships rather than more entrepreneurial paths because they find the administrative burden of actually running a practice that takes Medicare overwhelming.  

But he suspects CMS requirements will not be easing any time soon, especially since the federal government has collected $47 billion in fines in just the last two years. 

“They’re actually budgeting the recovery for fraud that hasn’t been committed yet,” Silberman says. “You know if you put forth the enforcement efforts, there is going to be a return on that investment.”