The Centers for Medicare & Medicaid Services (“CMS”) published the long-awaited final rule February 12, 2016, clarifying the specific procedures applicable to the statutory requirement under the Affordable Care Act (“ACA”) for providers and suppliers to report and return overpayments within 60 days. While the final rule eased some of the law’s more unforgiving aspects, its limited scope brought up new questions about the breadth of the law itself.

Despite concerns raised by a number of commenters in response to the proposed rule, CMS limited the scope of the final rule to Medicare Parts A and B only. In other words, the final rule clarifies the obligations of Medicare providers and suppliers to report and return overpayments originating under Medicare Parts A and B. Commenters expressed concern about this limitation and the lack of rationale for distinguishing Medicare Parts A and B from Medicare Parts C and D; they also voiced the need shared by all providers and suppliers for guidance on the overpayment requirements. In response, CMS reasoned that differences in how the Medicare programs are administered necessitated separate rulemakings. Interestingly, the agency did not indicate whether a separate rulemaking would be forthcoming, but instead directed providers and suppliers to their existing statutory obligations under the ACA, and a prior rulemaking applicable to reporting and returning overpayments in the Medicare Parts C and D context, for further guidance. In its response, CMS appears to assume, without stating expressly, that the law and the agency’s prior rulemaking apply to providers and suppliers receiving payments under Parts C and D.

A closer look at CMS’ prior rulemaking, however, reveals that those regulations do not, in fact, apply to providers and suppliers billing Part C or D plans. Instead, that final rule, published May 23, 2014, only informs Medicare Advantage organizations in Part C and Prescription Drug Plan (“PDP”) sponsors in Part D of their obligations to report and return Medicare overpayments to CMS; the final rule does not address, or even reference, the obligation of providers and suppliers to return overpayments to those organizations or sponsors.

Turning to the language of the ACA itself, section 6402 requires a “person” who has received an overpayment to “report and return the overpayment to the Secretary, the State, an intermediary, a carrier, or a contractor, as appropriate.” The law defines “person” broadly to include “a provider of services, supplier, Medicaid managed care organization, Medicare Advantage organization, or PDP sponsor.” While Medicare Advantage organizations and PDP sponsors are expressly included in the definition of persons under the ACA, the law does not define “contractors” or clarify whether Medicare Advantage organizations and PDP sponsors should also be included in the list of entities to which overpayments must be returned. Therefore, on the one hand, all providers and suppliers have an obligation to report and return overpayments; but on the other, whether this obligation extends to overpayments owed to Medicare Advantage organizations and PDP sponsors is questionable.

Nevertheless, even if a provider or supplier could successfully argue against the application of the 60-day overpayment law, is there an obligation to return Part C and D overpayments anyway?

Before the enactment of the ACA, CMS attempted in 1998 and 2002 to regulate the return of overpayments and alluded to existing legal requirements supporting its position. The ACA also creates an obligation to return overpayments beyond what is required by the 60-day overpayment law. For example, the ACA amended the Civil Monetary Penalties Law (“CMPL”) to subject to civil penalties, any person who knows of an overpayment and fails to report and return it. Instead of definitively identifying to whom overpayments must be reported and returned, the CMPL simply mandates that any person must return overpayments. Furthermore, if a provider or supplier is assessed a civil penalty pursuant to the CMPL, the Office of Inspector General could exclude the provider or supplier pursuant to the permissive exclusion authority. Separately, even without the direct tie-in between the 60-day overpayment law and the reverse false claims provisions of the False Claims Act (“FCA”), a provider or supplier may violate the FCA if, for example, the person knowingly makes a false statement to avoid an obligation to pay money to the government. Compliance with the 60-day overpayment law and its related regulations will likely offer a strong defense to any challenges brought under these laws.

Finally, providers and suppliers should carefully consider their agreements with Medicare Advantage organizations and PDP plans, as well as those entities’ policies and procedures, which may clarify contractual obligations of providers and suppliers to report and return overpayments. As Medicare Advantage organizations and PDP plans wrestle with the law’s direct application to their businesses, these entities will likely flow down certain requirements to participating providers and suppliers to ensure they are meeting their obligations under the law. Therefore, while the 60-day overpayment law may not directly apply to Medicare Part C/D providers and suppliers, the duties of these entities to return overpayments they receive abound—and may continue to grow—and CMS’ recent rulemaking applicable to Medicare Parts A and B provides useful guidance and potential security from allegations arising under other, and arguably more opaque, areas of the law.