Final Medicare Overpayment Rules a Mixed Bag for Providers
The Centers for Medicare & Medicaid Services (CMS) released highly anticipated updates this month to the Medicare regulations interpreting the federal 60-day overpayment refund requirement (the Overpayment Statute). The result is a mixed bag.
In a qualified win for providers, CMS adopted a new definition of what it means to have "identified" an overpayment that triggers the 60-day report-and-return clock under the federal Overpayment Statute, finally abandoning its doomed "reasonable diligence" standard. On the other hand, CMS also codified a bright-line 180-day timeframe for conducting follow-on audits to investigate additional "related overpayments" that are suspected to "arise from the same or similar cause" as the initially identified overpayment.
As discussed herein, this often unrealistic 180-day allowance ultimately may be irreconcilable with the new regulatory definition of "identified" and with operative governing statutes. This summary explains the regulatory changes and offers context and practical takeaways for providers grappling with potential overpayment issues.
The changes appear in CMS' calendar year (CY) 2025 Medicare Physician Fee Schedule Final Rule (Final Rule), released on Nov. 1, 2024, which is scheduled for Federal Register publication on Dec. 9, 2024.1 The new regulations will go into effect Jan. 1, 2025.
Brief Essential Background
The federal Overpayment Statute requires any person who receives or retains Medicare or Medicaid funds to which they are not entitled to report and return the overpayment to the appropriate government official or contractor within 60 days after "identification" of the overpayment.2
Failure to timely report and return an identified overpayment causes the retained overpayment to become a potential false claim subject to enforcement under the federal civil False Claims Act (FCA).3 The FCA is a fraud enforcement statute that, among other things, penalizes individuals for "knowingly" concealing or improperly avoiding an obligation to pay or refund money to the federal government.4 For purposes of FCA liability, "knowingly" is defined as having "actual knowledge" of false information and/or acting in "deliberate ignorance" or "reckless disregard" of the truth or falsity of information.5
To state the obvious, the moment at which an overpayment is "identified" is a crucial definitional issue under the Overpayment Statute. Unfortunately, the statute does not define "identified."
In original regulations interpreting and implementing the Overpayment Statute, the agency took the position that an overpayment is deemed to have been "identified" when the recipient has either actually determined or should have determined "through the exercise of reasonable diligence" that it received an overpayment and has "quantified the amount of the overpayment."6
This definition of "identified" was vacated in 2018 by the U.S. District Court for the District of Columbia (in a Medicare Advantage case challenging this same definition in the analogous Part C regulation) because the court determined that CMS' "reasonable diligence" standard effectively and impermissibly imposed FCA liability for mere negligence, exceeding the agency's regulatory authority.7
In response to this litigation, CMS issued a proposed rule on Dec. 27, 2022, revising its regulatory definition of "identified" and aligning it with the FCA definition of "knowingly."8 Then, citing concerns raised by commenters, CMS issued a further proposal as part of its CY 2025 Medicare Physician Fee Schedule Proposed Rule, published July 31, 2024, proposing a 180-day suspension of the 60-day overpayment report-and-return clock to permit time for providers to conduct a timely, good faith investigation.9
As discussed below, CMS has now finalized both proposals as proposed, effective Jan. 1, 2025.
"Identification" of Initial Overpayments Requires FCA-Level Knowledge
Per the Final Rule, CMS abandoned its former, overreaching "reasonable diligence" language and now defines "identified" simply through cross-reference to the FCA knowledge standard. In so doing, CMS has tied the meaning of "identified" to a voluminous and ever-evolving body of FCA case law, which CMS declares is consistent with Congress' intent per the federal Overpayment Statute.10
Specifically, CMS adopted the following revisions to the regulatory definition of when an overpayment has been "identified," thus triggering the 60-day report-and-return clock:
A person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment knowingly receives or retains an overpayment. The term "knowingly" has the meaning set forth in [the federal civil False Claims Act].11
180-Day Investigatory Timeframe for Additional Related Overpayments
In connection with the revision described above, commenters expressed concern that CMS also struck prior provider-friendly language indicating that the amount of an overpayment must be "quantified" before it is considered to be "identified."
Indeed, in CMS's view expressed in the Final Rule, quantification is no longer a component of "identification." As CMS now explains, "once a person has identified an overpayment, … the person has 60 days to report and return [it], even if the person has not yet calculated the precise amount of the overpayment at the time of identification." (Emphasis added.)
Nevertheless, responding to commenters' concerns about the removal of the "quantification" criterion, CMS acknowledged providers' requests for the agency to formally recognize that overpayment investigations take time and that immediate or rolling refunds may not be feasible or practicable. To address these concerns, CMS endeavored to clarify anticipated investigation timelines. Thus, CMS proposed (and has now finalized) a new provision that affirmatively suspends the Overpayment Statute's 60-day report-and-return clock for up to 180 days when a provider conducts a "timely, good faith investigation" to identify related overpayments stemming from the same reason as the initially identified overpayment.12
Specifically, the new provision provides that when an initial overpayment has been identified, and the provider conducts a "timely, good-faith investigation" to determine whether related overpayments exist:
… the deadline for reporting and returning the initially identified overpayment and related overpayments … will remain suspended until the earlier of:
(A) The date that the investigation of related overpayments has concluded and the aggregate amount of the initially identified overpayments and related overpayments is calculated; or
(B) The date that is 180 days after the date on which the initial identified overpayment was identified.13
As explored further below, after the deadline suspension period expires, the report-and-return clock resumes its ticking. No matter what.
It bears mention that several commenters opposed CMS' "strict, bright-line, or arbitrary timeframe for investigating and reporting overpayments," noting that the 180-day timeframe "does not take into the account the true complexity of these overpayment investigations," particularly when investigations require input from and coordination between various provider stakeholders, including the compliance department, legal department and clinical professionals.
But CMS brushed off these concerns, responding simply and repeatedly that the agency believes 180 days "provides enough time." The agency seems to suggest that meeting the 180-day timeframe is simply a matter of provider commitment and resource allocation ("we appreciate that investigations are often complex and require the devotion of resources"). CMS expressly declined commenters' requests to provide additional time and/or to create "a process to request an extension beyond 180 days for complex investigations."
CMS' Hypothetical Investigation and Refund Timeline
To better explain the new 180-day deadline suspension period for overpayment investigations, the Final Rule describes a hypothetical scenario, which is paraphrased below in two parts for clarity.
First, if a provider does not undertake a timely, good faith investigation in response to an initially identified overpayment, the following timeline applies:
- Day 1: An initial overpayment is identified resulting from a physician's inadequate medical record documentation in support of a specific claim. The 60-day report-and-return clock has started.
- Day X: Additional related overpayments are suspected, but no investigation is undertaken.
- Day 60: The provider must report and return the initial overpayment identified on Day 1.
- Day X + 60: The provider becomes liable for additional related overpayments that were not investigated. (As CMS states elsewhere in the Final Rule, the 60-day report-and-return clock will have begun to run for any additional related overpayments "on the date that the provider or supplier acts in deliberate ignorance or reckless disregard of the truth or falsity of information regarding the overpayment.")
Alternatively, if the provider does undertake a timely, good faith investigation following the identification of an initial overpayment, the timeline might look something like this:
- Day 1: An initial overpayment is identified. The 60-day report-and-return clock has started.
- Day 10: Additional related overpayments are suspected. The provider begins a timely, good faith investigation regarding potential additional related overpayments. The 60-day clock is tolled. (At this point, the provider has used 10 days of its allotted 60 days. The remaining 50 days are suspended.)
- By Day 180 (i.e., 180 days after the initial overpayment was identified, or potentially sooner if the investigation is concluded earlier): The provider must have completed its investigation. The deadline suspension ends and the clock restarts.
- By Day 230 (i.e., 50 days later): The provider's 60-day clock expires. The provider must report and return all relevant overpayments, including the initial overpayment and all related overpayments.
Note that under this policy, the sooner the provider begins a timely, good faith investigation, thus tolling the 60-day clock, the longer it has to effectuate the resulting refund. If the investigation is begun on Day 1, the 60-day clock may not expire until Day 240 (i.e., up to 180 days to investigate + 60 days to report and return). Conversely, if the investigation is begun on Day 30, the 60-day clock will expire by Day 210 (up to 180 days to investigate + 30 unused days remaining on the refund clock as of the date when the investigation began).
Troubling Implications of CMS' 180-Day Investigatory Timeframe
In establishing the regulatory framework described above, CMS has effectively created two separate operational definitions of "identified" – one for initially identified overpayments and a second for additional related overpayments that potentially may be identified through a follow-on investigation and audit.
As CMS suggests in the Final Rule, when a provider investigates a potential overpayment in the first instance but no initial overpayment has yet been determined to exist,
But once the initial overpayment has been identified, a provider then has up to 180 days to investigate suspected related overpayments and calculate the aggregate overpayment amount before the 60-day report-and-return clock restarts. This amounts to a de facto determination that the related overpayments are "identified" as of the 181st day of investigation, thus triggering the 60-day clock.14
Under the new CMS framework, the report-and-return clock restarts whether or not the provider has actual knowledge or has acted in deliberate ignorance or reckless disregard of potential related overpayments. In effect, after 180 days, a diligent provider actively and dutifully investigating related overpayments is nevertheless deemed to have "identified" related overpayments, even if the provider's complex investigation, undertaken deliberately and in good faith, remains ongoing. This appears to amount to a declaration by CMS that any provider whose good faith audit takes longer than 180 days has necessarily acted in deliberate ignorance or reckless disregard of the potential existence of overpayments. Really?
This result is problematic and troubling. It also makes little sense and arguably again exceeds CMS' regulatory authority by effectively attempting to interpret the FCA's "knowledge" standard. As one commenter aptly noted, the Final Rule "would appear to consider a related overpayment to be unlawfully retained – therefore exposing the organization to False Claims Act liability – even before the organization actually identifies the related overpayment." Indeed!
Practical Takeaways for Providers
It is no surprise to anyone who spends time in this space that even seemingly straightforward overpayment self-audits can be incredibly time consuming. No two payment audits are exactly the same. Multifaceted root causes dictate different audit strategies, often requiring complex data reporting from multiple clunky systems by a single overburdened team member. Simplicity and expediency, the holy grails of any self-audit, waiver like a mirage on the horizon that recedes farther and farther with each new wrinkle.
Ambitious timelines slip.
So, what is a well-intentioned, compliance-oriented provider to do when, despite sincere best efforts, overpayments remain unquantified 180 days or even 240 days (taking into account the 60-day report-and-return window) after identification of an initial overpayment?
It may be instructive to consider the enforcement implications of missing the 60-day report-and-return deadline. Under the Overpayment Statute, a retained overpayment becomes a potential false claim on the 61st day after it has been "identified" but not returned.15 At that point, FCA liability attaches only if the identified overpayment is "knowingly" concealed or the provider's refund obligation is "knowingly and improperly" avoided.16
Keeping this legal framework in mind, a provider with an ongoing investigation that finds itself unable to refund all potential overpayments by the 60-day deadline might consider notifying the relevant government contractor or regulator that an investigation is ongoing, and overpayments will be reported and returned upon identification. Further, where feasible, partial or staged refunds may also be appropriate in recognition of the provider's ongoing refund obligation and as a showing of good faith in advance of the conclusion of the investigation.
Importantly, as with any planned government outreach, there usually are competing considerations that warrant a fact-specific analysis and thoughtful communications strategy. That said, under appropriate circumstances, an affirmative, clear and transparent notification about an ongoing investigation may help mitigate possible FCA enforcement risk by undercutting a potential downstream argument that the provider is somehow knowingly concealing an overpayment or knowingly and improperly avoiding a refund obligation.
Other key recommendations are likely already familiar to health system leadership. For example, it remains critical that providers are able to demonstrate through internal documentation, if called up on to do so, that their investigation process has proceeded consistent with organizational policies and procedures, with appropriate dedication of resources and in good faith. Further, thoughtful messaging to team members and implementation of appropriate controls around the flow of information in connection with ongoing investigations are important tools to help providers manage potential whistleblower risk. And, as always, it is difficult to overstate the importance of cultivating a culture of compliance within an organization so team members feel heard and valued and can take pride in the integrity of the organization and its leaders.
In sum, although the new 180-day investigatory timeframe for related overpayments may understandably elicit some anxiety and the full implications and enforcement landscape remain uncertain, compliance-oriented providers can take comfort that strategies exist to manage these processes and risks, and many core overpayment investigation and refund best practices remain fundamentally unchanged.
Please reach out to the author with your observations and questions. This development is top-of-mind for Holland & Knight's Healthcare & Life Sciences Team, as it is for many of our clients, and we welcome the opportunity to discuss these changes with you and explore potential implications for your organization.
Notes
1 The Final Rule revises the regulations governing Medicare overpayments under Parts A, B, C and D. This summary focuses on those provisions directly impacting Medicare providers and suppliers (herein "providers") under fee-for-service Medicare Parts A and B.
2 See generally 42 U.S.C. § 1320a-7k(d).
3 See 42 U.S.C. § 1320a-7k(d)(3) (cross-referencing 31 U.S.C. § 3729(b)(3)).
4 See 31 U.S.C. § 3729(a)(1)(G).
5 See 31 U.S.C. § 3729(b)(3).
6 See, e.g., 42 C.F.R. § 401.305(a)(2) (2016). Corresponding definitions under Part C and Part D appear at 42 C.F.R. §§ 422.326(c) and 423.360(c) respectively.
7 See UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 191 (D.D.C. 2018).
8 87 Fed. Reg. 79452, 79559 et seq. (Dec. 27, 2022).
9 89 Fed. Reg. 61596, 62004 et seq. (Jul. 31, 2024).
10 It is an open question whether CMS is correct that Congress intended the meaning of "identified" to be tied to the FCA’s "knowledge" standard. While the Overpayment Statute does cross-reference the FCA’s definition of "knowingly," it does not use the defined term in the operative statutory language. See 42 U.S.C. § 1320a-7k(d)(4)(A). Thus, CMS’s interpretation notwithstanding, there is room to debate whether the Overpayment Statute’s untethered reference to "knowingly" really should inform the meaning of "identified." But that is another debate for another day.
11 42 C.F.R. § 401.305(a)(2) (2025).
12 The Final Rule does not affect, and CMS did not revise, existing regulations suspending report-and-return deadlines when providers utilize the U.S. Department of Health and Human Services Office of Inspector General (OIG) Self-Disclosure Protocol, the CMS Voluntary Self-Referral Disclosure Protocol or request an extended repayment schedule. See 42 C.F.R. § 401.305(b)(2).
13 42 C.F.R. § 401.305(b)(3)(ii) (2025).
14 See 42 U.S.C. § 1320a-7k(d)(2)(A) (providing that the 60-day report-and-return clock begins ticking at the moment of "identification").
15 42 U.S.C. § 1320a-7k(d)(3); accord 42 C.F.R. § 401.305(e).
16 31 U.S.C. §§ 3729(a)(1)(G) and (b)(3).