ABA Health eSource
 October 2005 Volume 2 Number 2
Managing Provider Overpayment Problems
by Mary Jean Geroulo, Stewart Stimmel, LLP, Dallas, Texas

Mary Jean GerouloAll healthcare providers, from solo practitioners to national healthcare systems, receive incorrect payments from the Medicare program or other federal healthcare payors from time to time. These incorrect payments are frequently in the form of overpayments for which the billed service does not accurately reflect the service furnished by the provider. The vast majority of these incorrect payments are resolved through voluntary refunds or adjustments by the provider, but it is not uncommon for an overpayment problem to go undetected for months, or even years, by both the provider and the payor. Repayment in cases where the number of overpaid claims is substantial, or where the overpayment problem has persisted without correction for long periods of time, can be expensive for the provider who must make restitution, and can also trigger investigations or audits by the Centers for Medicare and Medicaid Services (“CMS”) or the Office of Inspector General (“OIG”) of the Department of Health and Human Services.

A quick search of the Internet will find articles from attorneys, professional associations, and specialty medical associations advising physicians and other healthcare providers against making voluntary disclosures and restitution to Medicare and other federal healthcare programs, for the receipt of overpayments. Although much of this advice is intended for providers for whom the overpayments may trigger federal enforcement activities, penalties, fines, and exclusion from participation in the federal healthcare programs, this advice is also directed, in part, to providers for whom the overpayment problems are the result of an oversight or simple mistake. Advising providers not to disclose is often contrary to federal laws and guidance. However, because disclosure can trigger audits under Medicare Part A by the provider’s fiscal intermediary (“FI”) or under Part B by the provider’s carrier (“Carrier”), or an investigation by the OIG even when there is no evidence of wrongdoing on the part of the provider, it is easy to see why some providers may be inclined to simply correct the practice that led to the overpayment and not disclose or repay. The decision not to repay, can, however, be costly and dangerous. 1

A provider’s obligation to disclose receipt of overpayments from the Medicare program and other federal payors is imposed by statute. 42 U.S.C. §1320a-7b(a)(3 ) is generally interpreted as imposing a duty on providers to disclose receipt of overpayments, whether such overpayments were received innocently or as a result of some impropriety on the part of the provider. 2

Any person “having knowledge of the occurrence of any event affecting (A) his initial or continued right to any such benefit or payment, or (B) the initial or continued right to any such benefit or payment of any other individual in whose behalf he has applied for or is receiving such benefit or payment, conceals or fails to disclose such event with an intent fraudulently to secure such benefit or payment either in a greater amount or quality than is due or when no such benefit or payment is authorized.” 3

A provider’s obligation to repay an overpayment is found in the Medicare program regulations. 4 Although providers only have to repay when “at fault” as to the claim that triggered the overpayment, Medicare’s definition of “without fault” is extremely limited. A provider is without fault only when 1) the overpayment is discovered within three years after the payment is made, or 2) when the provider has “exercised reasonable care” in billing for and accepting payment. “Reasonable care” is defined by the Medicare regulations as the provider making full disclosure of all material facts related to the claim and “on the basis of the information available to [the provider], including, but not limited to, the Medicare instructions and regulations, [the provider] had a reasonable basis for assuming that the payment was correct, or if [the provider] had reason to question the payment, [the provider] promptly brought the question to the FI or Carrier’s attention.” Given the volume of guidance published by CMS on issues related to payment of claims, this definition renders most overpayments that are less than three years from the date of service repayable. 5

The OIG strongly recommends that providers both disclose and repay all overpayments. The OIG’s guidance is voluntary, but because the OIG is charged with the authority to initiate investigations and enforcement actions relating to Medicare and other government reimbursement programs, this guidance cannot be ignored.

The OIG’s Compliance Guidelines instruct providers to take immediate corrective action, including restitution, when overpayments are received. 6 “Failure to repay overpayments within a reasonable period of time could be interpreted as an intentional attempt to conceal the overpayment from the government.” A “reasonable” period of time, according to the OIG, is not more than 60 days after a provider finds “credible evidence of misconduct.” To encourage providers to implement these voluntary programs, the OIG states that early protection and reporting of improper claims can reduce the provider’s exposure to civil damages and penalties, criminal sanctions, and administrative penalties associated with misconduct, but it is left to the discretion of the OIG whether these options will be made available to a provider. 7

The OIG’s Self-Disclosure Protocol repeats the OIG’s recommendation that providers should take the initiative to repay overpayments, but distinguishes between activities (including activities that result in overpayments) that “do not suggest violations of the law” and activities that are related to an ongoing fraud scheme. 8 In matters involving on-going fraud schemes, providers are advised to immediately consult with the OIG before taking any action, including initiating internal investigations. However, in matters that may not suggest violations of the law, the OIG advises providers to address those issues directly with the providers’ FI or Carrier, cautioning however, that the Carrier or FI has the discretion to refer the matter to the OIG if an FI or Carrier “concludes that the overpayment raises concerns about the integrity of the provider.”

Under applicable law, it is clear that providers have a statutory obligation to disclose receipt of overpayments, and generally have an obligation to repay those payments. With the exception of circumstances indicative of fraud or intentional wrongdoing, a mechanism for evaluating overpayments may be helpful to providers who must decide how to respond to overpayment situations by distinguishing between circumstances where simple restitution is called for and circumstances that call for a more measured and comprehensive response.

In general, all overpayments discovered within three years of the date of payment require repayment. However, response to the overpayments should be dependant on an evaluation of the practice or practices that resulted in the overpayments, the duration of time over which these overpayments occurred, and the total amount of the overpayments received. Once the overpayment problem is evaluated, it is helpful to categorize the problem. The following example provides a methodology for analysis of overpayments, and categorizes the overpayments into one of three groups, each of which should trigger a different response by the provider. Each provider will have different needs and risk tolerances, thus these groups may differ from provider to provider.

“Group I” overpayments are the result of one or more unrelated claims; and the number of claims and dollar amounts are not substantial.

“Group II” overpayments are the result of multiple incidents of overpayments for the same type of service, where the number of claims and dollar amounts are substantial, and the overpayments continue for months without detection.

“Group III” overpayments are the result of overpayments for more than one type of service and involve multiple incidents of overpayments for each type of claim. Here, the number of claims and dollar amounts are excessive, and the overpayments were received over a period of months or years before discovery.

Group I overpayments typically result from periodic mistakes in coding or documentation and should be repaid in accordance with the policies and procedures of the provider’s local FI/Carrier. These overpayments are typically insignificant in terms of the dollars involved and the number of claims, and are highly unlikely to trigger an investigation by the FI/Carrier when restitution is made.

Group II overpayments are often the result of a global coding problem, i.e., the provider used an incorrect code to bill for a particular service, either because of an oversight or a mistake, and the incorrect code resulted in continued overpayment for the service. This type of overpayment problem is often limited to one type of service, but can affect a substantial number of claims over an extended period of time. The dollar amounts involved for this type of overpayment may be small as to the individual claims, but can be substantial as to the total number of claims.

The decision to voluntarily repay this type of overpayment may be difficult for providers. Unlike a Group I overpayment, repayment of Group II overpayments can create a financial burden for a provider, so there is often little incentive to make voluntary restitution. And since the overpayments may have occurred over months or even years without detection, some providers may consider it unlikely that the overpayments will ever be discovered by the FI or Carrier. Thus, some providers may be inclined to correct the practice that created the problem and neither disclose or repay. As tempting as it may be to simply correct the problem and proceed without making restitution, that practice is extremely risky for the provider.

Providers who fail to repay in response to an overpayment problem risk having others, such as employees or patients, report the provider’s receipt of overpayments to Medicare or the OIG. Providers also risk discovery through a routine audit by the FI/Carrier. Since the OIG has characterized the failure to repay overpayments within a reasonable period of time as suggestive of an intentional attempt to conceal the overpayment from the government, involuntary disclosure could result in an investigation by the OIG and imposition of sanctions or penalties.

There is, however, also some risk in simply proceeding with repayment. Voluntary repayment of a substantial number of claims, even when there is no suggestion of wrongdoing on the part of the provider, can trigger an audit of the provider’s billing practices by the FI/Carrier. A billing problem that results in overpayments over a period of months or years could be suggestive of an unacceptable level of carelessness in the provider’s billing practices. If the audit reveals other undisclosed billing problems, the FI/Carrier could avail itself of remedies to recover the payments, such as withholding future payments, and could refer the matter to the OIG for further investigation as to wrongdoing.

If the provider finds no indication of additional overpayment problems after conducting an internal audit, the provider should process the repayment by following the FI/Carrier’s policies and procedures for filing repayments. Generally, providers are required to list identifying information for each account incorrectly paid, explain the circumstances that led to the overpayment problem, and submit payment for the total overpayment. Providers are also advised to carefully explain the steps the provider has taken to ensure that the problem will not recur.

If, however, the provider’s internal investigation reveals additional overpayment problems that are also substantial in nature, or if the total dollar amount of overpayments is excessive, i.e., greater than a few thousand dollars, 9 the provider should seek legal assistance before submitting the repayment. These are the “Group III” overpayment problems, and this type of problem is very likely to trigger an investigation by the FI/Carrier. A Group III problem can also result in a referral to the OIG if the nature of the problem is suggestive of more than a “mistake” on the part of the provider. The provider’s history of other overpayment problems and the provider’s relationship with its FI/Carrier should carefully assessed. If there are no other serious repayment issues, careful presentation of the circumstances surrounding the provider’s discovery of the overpayment problem and identification of the steps the provider took to correct the problem and ensure that the problem will not recur may help reduce the possibility that the problem will not be referred to the OIG for investigation. If the provider has had other serious repayment problems or has had problems with provider’s FI/Carrier in the past, the provider should consult with an attorney with expertise in dealing with white collar crimes before proceeding with disclosure and repayment.

1 See, 18 U.S.C. 1320a-7a (the “Civil Monetary Penalties Law” or CMPL: subjecting persons who submit claims to the federal government for payment that they know or should know are false to penalties of up to $10,000 for each claim and exclusion from participation in the federal health care programs).
2 This statute is rarely used to prosecute providers, but failure to disclose a payment error was one of the acts of conspiracy alleged in the 1997 indictment of Columbia/HCA officials in Tampa, Florida. United States v. Jarrell, No. 97-52-CR-FTM-24(M.D. Fla. Indictment files June 25, 1997).
3 18 U.S.C. §3282 (statute of limitations for non-capital offenses for laws not otherwise specifying a specific period in which action must be taken is five years from the date of occurrence).
4 See , 42 C.F.R. §405.30; §405.841; §371; and Medicare Financial Management Manual, Chapter 3 – Overpayments.
5 Medicare Financial Management Manual, Chapter 3 – Overpayments (Medicare’s fiscal intermediaries and carriers are instructed to assess a provider’s fault by looking at all the information available to the provider, including the Medicare instructions and regulations).
6 The OIG has issued compliance guidelines with similar standards for many types of providers, including, in part, hospitals and physicians. For ease of discussion, this article will refer to the Hospital Compliance Guidelines found at 63 Fed. Reg. 8987 (February 23, 1998).
7 See, Supplemental Compliance Program Guidance for Hospitals, 70 Fed. Reg. 4858 (January 31, 2005) (stating that “hospitals must disclose and return any overpayments that result from mistaken or erroneous claims,” and discussing various claims submission practices that can result in overpayments).
8 OIG's Disclosure Protocol located at www.oig.hhs.gov. See also, 63 Fed. Reg. 58399 (October 30 1998).
9 There is no hard and fast rule as to the amount of overpayments that will trigger an audit. However, the greater the dollar amounts involved in the overpayment and the greater the time period during which the overpayments occurred can be factors in determining whether the FI/Carrier will audit the provider's billing practices. Other factors that can contribute to the decision to audit are the provider's history of similar problems, and the size of the overpayments in relation to the number of claims or dollars billed by the provider.