“Identifying” an Overpayment: The Long and (Still) Winding Road

Whatever happened with respect to the kerfuffle regarding the definition of “identified” in the Overpayment Statute? Almost 15 years after Congress set said kerfuffle in motion, the dust still hasn’t completely settled. But a recent status report published by CMS suggests that a final definition of “identified” may be on the way.

In 2010, as part of the ACA, Congress created what has come to be known as the Overpayment Statute.¹ In a nutshell, the Overpayment Statute requires providers, suppliers, and plans that have received an overpayment from Medicare or Medicaid to report and return that overpayment within 60 days of having “identified” the overpayment. What does it mean to have “identified” an overpayment? The Overpayment Statute doesn’t say.

Enter CMS, which, following a series of proposed and final rulemakings between 2012 and 2016,² landed on the following definition of “identified”: a provider, supplier, MAO, or PDP sponsor—collectively, a “provider,” for ease of reference—has “identified” an overpayment if it (i) has actual knowledge of the overpayment, or (ii) does not have actual knowledge of the overpayment but would have obtained such knowledge if it had exercised “reasonable diligence.”³

The industry objected to CMS’s second, negligence-based, constructive knowledge standard, and for good reason:

• the failure to report and return an overpayment can result in FCA liability, which requires that the conduct at issue be undertaken “knowingly”;⁴

• it is well-settled that “knowingly” under the FCA means that the provider either (i) had actual knowledge that its claim was false or (ii) acted with “reckless disregard” or “deliberate ignorance” as to the truth or falsity of its claim;⁵ and

• as a result, a provider should not be deemed to have “identified” an overpayment unless the provider (i) has actual knowledge of the overpayment or (ii) has acted with “reckless disregard” or “deliberate ignorance” as to its existence.

This “negligence” vs. “reckless disregard”/“deliberate ignorance” tug-of-war eventually landed on the doorstep of the U.S. District Court for the District of Columbia, which ruled in 2018 in favor of the industry and vacated CMS’s definition of “identified” under the MA overpayment rule.⁶

Although the government did not appeal this ruling, it also did not propose a replacement for the vacated rule, and as the months—and then the years—passed, CMS’ silence began to cause confusion, and consternation.

A resolution appeared to be in the offing in late 2022, when CMS proposed revising the Part A, B, C and D overpayment regulations as part of a larger proposed Medicare rulemaking.⁷ In the preamble of the proposed rule, CMS conceded that the 2018 district court ruling held that by requiring providers to use “reasonable diligence” in “searching for and identifying overpayments,” CMS had “impermissibly created False Claims Act liability for mere negligence.”⁸ To address this, CMS proposed to:

amend the [overpayment regulations] to remove the reference to “reasonable diligence” and replace it with language . . . that gives the terms knowing’’ and ‘‘knowingly’’ the same meaning given those terms in the False Claims Act . . . .

[Therefore,] [u]nder the proposed rule, a provider or supplier has identified an overpayment if it has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment.⁹

Unfortunately, this promise of closure was short-lived, because four months later, in April 2023, when CMS finalized most of the provisions in its 2022 proposed rule, the amended definition of “identified” was not among them.¹⁰ CMS did not explain this omission, observing only that it intended to address the definition of identified “in subsequent rulemaking.”¹¹

Although no such rulemaking has occurred, it appears that CMS has not forgotten about us altogether. On February 16, 2024, CMS published on its MA risk adjustment webpage a two paragraph status report on its 2022 proposal to modify the definition of “identified.” After summarizing much of the above history, the report states that CMS “has received inquiries regarding this proposal and want[s] to be clear that it remains under consideration and that CMS intends to issue a final rule to revise the definition of ‘identified’ in the overpayment rules as soon as is reasonably possible.”

Hope springs eternal.

---

1. The Overpayment Statute is codified at 42 U.S.C. §1320a-7k(d). ↩︎
2. See 81 Fed. Reg. 7654 (Feb. 12, 2016) (Parts A and B) (final rule); 79 Fed. Reg. 29844 (May 23, 2014) (Parts C and D) (final rule); 79 Fed. Reg. 1918 (Jan. 10, 2014) (Parts C and D) (proposed rule); and 77 Fed. Reg. 9179 (Feb 16, 2012) (Parts A and B) (proposed rule). ↩︎
3. See 42 C.F.R. §§ 401.305(a)(2) (Parts A and B), 422.326(c) (Part C), and 423.360(c) (Part D). ↩︎
4. 31 U.S.C. § 3729(a)(1)(G). ↩︎
5. 31 U.S.C. § 3729(b)(1). ↩︎
6. UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 191 (D.D.C. 2018), rev’d in part on other grounds sub nom; UnitedHealthcare Ins. Co. v. Becerra, 16 F.4th 867 (D.C. Cir. 2021), cert. denied, 142 S. Ct. 2851 (U.S. June 21, 2022) (No. 21–1140).  ↩︎
7. 87 Fed. Reg. 79452 (Dec. 27, 2022).  ↩︎
8. Id. at 79559.  ↩︎
9. Id.  ↩︎
10. 88 Fed. Reg. 22120, 22185 (Apr. 12, 2023). ↩︎
11. Id. at 22120. ↩︎