New Year Rings in Material Changes to Medicare Overpayment Rule

THE OVERPAYMENT STATUTE

Under the Affordable Care Act, “persons” such as providers, suppliers, Medicare Advantage plans, and Part D sponsors that receive an overpayment are required to report and return the overpayment, accompanied by a written notification of the reason for the overpayment.[1] An “overpayment” is defined as “any funds” received or retained under the Medicare or Medicaid programs “to which the person, after applicable reconciliation, is not entitled.”[2] The statutory deadline by which overpayments must be reported and returned is the later of either:

• 60 days after the overpayment is “identified” or
• The date any corresponding cost report is due, if any.[3]

The overpayment statute incorporates the federal False Claims Act (FCA) by reference, providing that retention of an overpayment after the deadline is an “obligation” under the FCA.[4] The FCA contains a “reverse false claims” cause of action for either:

• Making, using, or causing to be made or used, a false record or statement material to an obligation to pay or transmit money or property to the government or
• Knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay or transmit money or property to the government.[5]

PRIOR OVERPAYMENT RULES

In 2016, CMS issued a final rule with respect to Medicare Part A and Part B (2016 Rule)[6] that defined “identified” as when the person “has, or should have through the exercise of reasonable diligence, determined that [it] has received an overpayment and quantified the amount of the overpayment”[7] (emphasis added). The 2016 Rule preamble discussed “reasonable diligence” as including “proactive compliance activities” and “reactive investigative activities undertaken in response to receiving credible information about a potential overpayment.”[8] CMS discussed a six-month “benchmark” for conducting reactive investigative activities into credible information of a potential overpayment, which could be extended in circumstances where the matter is unusually complex, such as Physician Self-Referral Law issues, or in other extraordinary circumstances, such as natural disasters.

As a practical matter, many “credible information” investigations can require considerable time given the complexity of Medicare and Medicaid rules and the effort necessary to develop facts, obtain claims data, and engage experts to conduct the review. Many organizations relied on this preamble guidance in conducting these investigations. Once the investigation confirmed the existence and quantified the amount of the overpayment, then the 60-day period to report and return the overpayment began to run.

2025 OVERPAYMENT RULE CHANGES

In the preamble to the 2025 Rule, CMS states that the updated rule “provide[s] for consistency in Medicare regulation related to reporting and returning overpayments” in response to a federal district court decision concerning the Medicare Part C overpayment rule. The district court held that the “reasonable diligence” standard impermissibly established FCA liability for mere negligence.[9] CMS proposed changes to the overpayment rules in two iterations. First, a 2022 proposed rule articulated the new “identified” definition finalized in the 2025 Rule.[10] Second, the proposed CY 2025 Physician Fee Schedule rule included additional changes in response to comments on the 2022 proposal. These changes were finalized and included the creation of a new “deadline suspension” provision, discussed below.[11]

Replacing the “Reasonable Diligence” Standard With “Knowingly”

The 2025 Rule replaces the “reasonable diligence” standard for identifying an overpayment with the FCA’s “knowingly” standard. Under the 2025 Rule, “a person has identified an overpayment when the person knowingly receives or retains an overpayment. The term ‘knowingly’ has the meaning set forth in 31 U.S.C. § 3729(b)(1)(A).”[12] This change applies to Medicare Parts A, B, C, and D.[13]

The FCA defines “knowingly” as a person who, with respect to information:

• Has actual knowledge of the information
• Acts in deliberate ignorance of the truth or falsity of the information or
• Acts in reckless disregard of the truth or falsity of the information.[14]

Under the 2025 Rule, once a person has identified an overpayment, such person then has 60 days to return the overpayment unless one of the deadline suspension reasons applies.[15] CMS states that “in cases where a provider or supplier acts in deliberate ignorance or reckless disregard of the existence of the overpayment, the 60-day period begins on the date that the provider or supplier acted in deliberate ignorance or reckless disregard of the truth or falsity of information regarding the overpayment.”[16]

Analysis and Implications

With this change, CMS reverts to the “identified” definition it originally proposed in 2012[17] but changed in the 2014 and 2016 Rules. CMS made those changes based on many industry comments that using the FCA “knowingly” standard to define “identified” was not clearly authorized by the statute, was confusing and ambiguous, and did not provide clear guidance. Those concerns remain. CMS punts on addressing those concerns and requests for greater clarity and tells organizations to look to “FCA caselaw” for the meaning of reckless disregard and deliberate ignorance.

On the positive side, the revised definition addresses the UnitedHealthcare court’s concerns that the “should have known by exercising reasonable diligence” standard could result in creating FCA reverse false claims liability for simple negligence. CMS also clearly states in the preamble that with respect to an organization that “is actively investigating a potential overpayment, the 60-day period for reporting and returning the overpayment begins when the provider or supplier has actual knowledge of the overpayment.”[18] This statement shows that CMS understands that an organization that is conducting an active investigation into a potential overpayment is by definition not acting recklessly or with deliberate ignorance. CMS also does not articulate a timeline for this initial investigation to occur. These two points should be helpful in ensuring that organizations have adequate time to conduct this initial investigation, but they also highlight the problems with the new “deadline suspension for related overpayments” provision discussed below.

What qualifies as an “active investigation” is likely an area that regulators and whistleblowers will examine in the future, so organizations should continue to reasonably and timely conduct investigations into potential overpayments. This fact-specific inquiry will include the complexity of the allegations, organizational resources, and unexpected delays in obtaining data. Organizations with “inactive” investigations, or that do not conduct an investigation at all, risk being accused of recklessness or deliberate ignorance.

CMS provides additional color on its views of recklessness and deliberate ignorance in its response to stakeholder comments. As they did in 2012, commenters pointed out that the overpayment statute includes a definition of “knowingly” but does not actually use the term in the substantive statutory text. CMS states:

[w]e acknowledge that commenters have stated that the [knowingly] defined terms are not used in the statute, but we see nothing in the statute indicating that this provision is mere surplusage or that Congress intended to create a lower knowledge standard than otherwise exists under the False Claims Act. Such an interpretation would effectively allow [organizations] to “bury their heads in the sand” and deliberately ignore or recklessly disregard overpayments.[19]

This framing of what qualifies as recklessness or deliberate ignorance may prove useful in combatting allegations that an organization has “identified” an overpayment, especially if the allegation is based on an assertion that the organization is not conducting an investigation fast enough. It should be difficult to characterize an organization that is reviewing a potential overpayment as “burying its head in the sand.”

Removing Quantification

The 2025 Rule removes quantification from the definition of “identified” in the Medicare Parts A and B rule. CMS states that “with respect to quantification of the overpayment, once a person has identified an overpayment, as the term is defined at § 401.305(a)(2), the person has 60 days to report and return the overpayment under § 401.305(b)(1)(i), even if the person has not yet calculated the precise amount of the overpayment at the time of identification. Because a person cannot return an indefinite sum, as a practical matter the overpayment amount must be calculated within 60 days of identification to meet the 60-day deadline.”[20]

Analysis and Implications

Removing quantification from the “identified” definition is a material change to the overpayment rule that imposes new difficulties, burdens, and risks that impact how organizations approach their overpayment investigations. Practically speaking, this change means that organizations will have to quantify identified overpayments much faster than they have in the past because quantification now occurs during the 60-day returning and reporting period.

New “Deadline Suspension” for Investigating Related Overpayments

The 2025 Rule also adds a new provision in the Medicare Parts A and B rule under which the 60-day timeline may be suspended in certain circumstances. The existing rule[21] suspends the 60-day report and return clock in the following instances:

• Either the US Department of Health and Human Services Office of Inspector General (OIG) or CMS acknowledges receipt of a disclosure under the agencies’ respective disclosure protocols. The clock will remain suspended until a settlement agreement is entered, the person withdraws from the protocol, or the person is removed from the protocol.
• A person requests an extended repayment schedule as defined in 401.603. The clock will remain suspended until CMS or one of its contractors rejects the extended repayment schedule request or the provider or supplier fails to comply with the terms of the extended repayment schedule.

Under a new provision at 42 C.F.R. § 401.305(b)(3), the 2025 Rule provides that the 60-day deadline for reporting and returning overpayments will be suspended when both of the following occur:

• A person has identified an overpayment but has not yet completed a good-faith investigation to determine the existence of related overpayments that may arise from the same or similar cause or reason as the initially identified overpayment and
• The person conducts a timely, good-faith investigation to determine whether related overpayments exist.[22]

If the conditions of § 401.305(b)(3)(i) are satisfied, the deadline for reporting and returning the initially identified overpayment and related overpayments that arise from the same or similar cause or reason as the initially identified overpayment will remain suspended until the earlier of:

• The date that the investigation of related overpayments has concluded and the aggregate amount of the initially identified overpayments and related overpayments is calculated or
• The date that is 180 days after the date on which the initial identified overpayment was identified.

Accordingly, if an organization identifies an initial overpayment and “believes” that there may be “related overpayments that arise from the same or similar cause or reason,” the 60-day deadline to return the initial and as-yet-unknown related overpayments is suspended while the organization conducts a good faith investigation into the potential related overpayments for up to 180 days. CMS states that it believes this tolling provision of the 2025 Rule “provides sufficient time [for] providers and suppliers to comply with [the reporting and returning of overpayments] requirements before being exposed to False Claims Act liability.”[23]

CMS states that this provision “does not impose an independent obligation to investigate related overpayments when a person has actual knowledge of an overpayment.”[24] However, CMS explains its new rule as follows:

[i]f a person believes related overpayments may exist, § 401.305(b)(3) permits the person up to 180 days to conduct an investigation into the existence of related overpayments, provided that the person conducts a timely, good-faith investigation. Without this provision, persons conducting such investigations might face a rolling series of relatively short-term deadlines as the investigation advances and uncovers additional overpayments, each with its own 60-day deadline.[25]

Analysis and Implications

It appears that CMS attempted to address commenters’ request to maintain the six-month benchmark for conducting investigations of potential overpayments in the revised rule. However, CMS finalizing its proposed “related overpayment” suspension provision does the opposite – it purports to create a strict 180-day deadline for conducting an investigation into “related” but not “identified” overpayments following the conclusion of an investigation identifying the “initial” overpayment.

This provision is clearly inconsistent with the “knowingly” identification definition that CMS adopts in the 2025 Rule. Specifically, CMS ignores the meaning of recklessness and deliberate ignorance by effectively deeming an organization as reckless or deliberately ignorant if its “timely, good faith review” into related overpayments takes longer than 180 days. This “deeming” rule is not supported by the overpayment statute or the FCA caselaw to which CMS directs organizations for an understanding of the meaning of recklessness or deliberate ignorance. If identification includes recklessness and deliberate ignorance, then an organization conducting an active investigation of either the initial or related overpayment is not acting recklessly or with deliberate ignorance. In addition, the FCA reverse false claims cause of action requires that the organization “knowingly conceals or knowingly and improperly avoids or decreases an obligation” (with obligation including returning an overpayment). An organization that is engaged in a reasonable, good faith investigation should not be viewed as knowingly concealing or knowingly or improperly avoiding an obligation.

Accordingly, this change in the 2025 Rule may be ripe for challenges arguing that CMS exceeded its statutory authority in making such a change, and that its interpretation of the overpayment statute is not the best one, especially in light of the Supreme Court of the United States’ recent decision in Loper Bright Enterprises v. Raimondo.[26]

PRACTICAL CONSIDERATIONS

Until someone successfully challenges the rule or the next administration amends it, organizations are faced with managing compliance and mitigating risk.

Investigating Overpayments

Removing quantification from the identification definition is a major change that will require accelerated quantification efforts once the overpayment has been confirmed. As a result, providers will need to evaluate their current overpayment policies and procedures to identify ways in which such processes may be made more efficient. They may also need to evaluate how to handle an investigation that may be partially, but not completely, concluded at the time the applicable regulatory deadline expires.

It is also important to remember that the overpayment statute and the 2025 Rule are not the only laws to consider when investigating overpayments. For example, overpayments can create FCA risk in their own right as potential false claims, so identifying and disclosing overpayments helps mitigate FCA risk. Despite the material changes to the overpayment rule implemented by the 2025 Rule, it is important that organizations not lose the forest for the trees. Compliance with the overpayment statute and rule is one component of a larger risk analysis that must be conducted when investigating claims that may be subject to the reporting and returning requirements for overpayments.

Returning and Reporting Identified Overpayments

The 2025 Rule also presents a practical question: What should an organization do when it is running up against the 180 days, but the “related” overpayment investigation is not complete (despite good faith efforts) and a final overpayment has not been quantified? There are several approaches that providers might consider in this situation, although like the determination of whether an overpayment has been identified in the first instance, a fact-specific analysis will be required in each case.

One option for an organization to consider is notifying its Medicare Administrative Contractor, prior to the 180-day period expiring, about the investigation and the nature of the overpayments, and returning the portion of the overpayment that the organization has been able to quantify to date. Another avenue for self-disclosure is through the OIG’s Self-Disclosure Protocol (SDP) or the CMS Self-Referral Disclosure Protocol (SRDP). The overpayment regulations contain a suspension of the 60-day deadline for the return of overpayments from the time OIG or CMS acknowledges receipt of the submission until the time a settlement is reached or the person withdraws or is removed from the SDP or SRDP.[27] However, deciding whether to pursue any of these options will require a careful analysis of the factual situation, including the nature of the overpayment issue and the status of the investigation, and organizations should work with experienced healthcare counsel when making this assessment.