CMS Issues Final Rules for Medicare Parts A and B Overpayments: Key and Lingering Questions

In November 2024, the Centers for Medicare & Medicaid Services (“CMS”) released a final rule¹ addressing, among other things, the Medicare Parts A and B overpayment provisions of the Affordable Care Act (the “Final Rule”). It finalizes, effective January 1, 2025, proposed changes to the same provisions made by CMS in July 2024,² the (“2024 Proposed Rule”) and December 2022³ (the “2022 Proposed Rule”).

Broadly, the Final Rule modifies the Medicare Parts A and B overpayment requirements in two ways. First, it adds express provisions allowing the deadline for returning overpayments to be suspended for 180 days while a provider conducts a timely, good-faith investigation to determine the existence of related overpayments. Second, it changes the standard for when an overpayment has been identified from (a) when a recipient has or should have determined, through the exercise of reasonable diligence, that the person received an overpayment and quantified the amount of the overpayment, to (b) when a recipient knowingly receives or retains an overpayment. This change aligns the definition of “identified” with the knowledge standard under the False Claims Act.

As discussed further below, the Final Rule arguably raises more questions than it answers.

The Prior State of the Overpayment Laws

As brief background, under the Medicare overpayment requirements, a person who has received an overpayment is required to report and return it by the later of: (1) the date 60 days after the date the overpayment was identified; or (2) if applicable, the due date of any corresponding cost report.⁴ The prior iteration of the regulation expressly provided for the deadline to be suspended in a few scenarios, but none explicitly allowed for suspension of the reporting and return deadline during the course of an investigation into related overpayments.⁵

The prior definition of when an overpayment was “identified,” however, left payees with flexibility to determine when the 60-day clock started. Under the prior regulations, a person had “identified” an overpayment only when they had, or should have through reasonable diligence, “determined that the person has received an overpayment and quantified the amount of the overpayment.”⁶ Many interpreted this language to mean that providers could conduct a complete and thorough investigation into related overpayments to quantify the full extent of the issue, and that the 60-day clock began to run only after they had completed that process. For large healthcare systems or other providers with complex, multi-year overpayment matters, the time needed to conduct such investigations can be significant.

Analysis of the Final Changes

At first glance, the Final Rule appears to extend the time allowed to payees to identify overpayments by extending the presumptive outward date—from 60 days to 180 days—for when the recipient of Medicare funds should have been able to identify overpayments related to an initially identified overpayment. But in practice, the Final Rule may actually reduce the time providers have to identify and return overpayments.

Changes to the Meaning of “Identified”

Under the Final Rule, the definition of “identified” no longer references quantifying an overpayment. Now, “[a] person has identified an overpayment when the person knowingly receives or retains an overpayment.”⁷ “Knowingly” is defined by cross-reference to the False Claims Act and means that a person “(i) has actual knowledge of the information; (ii) acts in deliberate ignorance of the truth or falsity of the information; or (iii) acts in reckless disregard of the truth or falsity of the information.”⁸

The plain language of this new definition does not address quantification. Instead, it appears to simply change the question providers will need to grapple with from “When has an overpayment been identified and quantified?” to “At what point does a provider knowingly receive or retain an overpayment?” It also raises additional questions: providers will need to determine, for example, whether quantification or an understanding of the extent of an overpayment issue is a prerequisite for “knowingly” retaining overpayments. CMS suggests that it is not, stating that “[t]he 60-day deadline . . . begins once an overpayment is identified . . . even if the person has not yet calculated the precise amount of the overpayment at the time of identification.”⁹ CMS states further that “[b]ecause a person cannot return an indefinite sum, as a practical matter the overpayment amount must be calculated within 60 days of identification to meet the 60-day deadline.”¹⁰

According to CMS, commenters raised a number of these concerns in response to the 2022 Proposed Rule.¹¹ And in the Final Rule, in response to comments seeking additional guidance as to when a provider is in “reckless disregard or deliberate ignorance” of an overpayment, CMS generally pointed commenters to the “existing body of False Claims Act caselaw and examples” and suggested that a new section of the regulations, Section 401.305(b)(3)(ii), addresses commenters’ concerns about ambiguities in the investigatory timeline. But the body of False Claims Act caselaw is vast and complex, and as discussed below, Section 401.305(b)(3) similarly leaves open questions for providers.

Changes to The Deadline During a Good-Faith Investigation

In response to commenters’ concerns about the proposed removal of the term “quantified” from the definition of when an overpayment has been “identified,” CMS proposed to add a new section to the regulations. Section 401.305(b)(3)(ii) suspends the deadline for reporting and returning overpayments when both (a) a person has identified an overpayment but not yet investigated related overpayments, and (b) the person conducts a “timely, good-faith investigation” into whether related overpayments exist.¹² The deadline is suspended until only the earlier of the date the investigation has concluded or the date when 180 days have passed since the initial overpayment was identified.¹³

Ultimately, Section 401.305(b)(3)(ii) suspends the 60-day deadline during the pendency of a good-faith investigation into related overpayments, but only up to 180 days, whereas the term “quantified” in the prior regulations arguably allowed flexibility to quantify related overpayments. This provision does not seem to adequately address commenters’ concerns. In a large health system where one overpayment raises widespread concerns about related overpayments, 180 days may not be enough time to thoroughly investigate and be in a position to make a full repayment. Further, the rule does not specify how providers should address situations when their investigation is not completed within the 180-day time frame.

Lingering Questions

This Final Rule leaves a number of questions without definitive answers. For example, at what point is a payee effectively on notice that an investigation is required? The answer may depend on drawing inferences from the vast body of False Claims Act caselaw, which is not uniformly consistent across cases and jurisdictions and does not address every possible set of facts.

Second, the Final Rule raises new questions. For example, now that “quantified” has been removed from the definition of “identified,” how can overpayments be reported—or importantly, returned—if the full amount of the overpayment is unknown?¹⁴

Conclusion

The proposed changes do little to resolve the ambiguities in the prior rule. Both CMS and Medicare payees could arguably benefit from a rule that makes clear when a payee is on notice of an overpayment, and either identifies a clear, prescriptive timeline for moving forward or provides an objective standard for when the 60-day clock is triggered.

If you have any questions concerning this Final Rule, please do not hesitate to contact one of the authors or your regular Ropes & Gray advisor.