Overpayment Identification, Self-Disclosure Protocols, and 60-Day Rule

Overpayment Identification, Self-Disclosure Protocols, and 60-Day Rule

In federal healthcare program auditing, identifying an overpayment triggers strict statutory duties and tight legal deadlines. The Affordable Care Act (ACA) established explicit requirements for reporting and returning overpayments, linking non-compliance directly to False Claims Act liability. For the Certified Professional Medical Auditor (CPMA), understanding how overpayments are defined, identified, quantified, and disclosed is critical to safeguarding an organization from catastrophic legal exposure.

---

1. The ACA 60-Day Rule — 42 U.S.C. § 1320a-7k(d)

Section 6402 of the Patient Protection and Affordable Care Act (ACA), codified at 42 U.S.C. § 1320a-7k(d) and detailed in CMS regulations (42 CFR § 401.305), mandates that any person or entity that receives an overpayment must report and return the overpayment to the appropriate authority (such as the Medicare Administrative Contractor or state Medicaid agency).

Statutory Deadline

An overpayment must be reported and returned by the later of:

1. 60 days after the date on which the overpayment was identified; or
2. The date any corresponding cost report is due (if applicable).

Definition of "Identified" and Reasonable Diligence

A central issue in compliance auditing is determining when an overpayment is legally "identified." Under CMS regulations, a person has identified an overpayment when the person has, or through the exercise of reasonable diligence should have:

1. Determined that the person received an overpayment; and
2. Quantified the amount of the overpayment.

Reasonable Diligence Standard: CMS clarifies that "reasonable diligence" includes both proactive compliance monitoring and timely investigation of credible notices of potential overpayments. When a provider receives a credible notice (such as a compliance hotline tip, an internal audit finding, or a coding error alert), the provider must conduct a timely investigation.

The 8-Month Maximum Timeline: CMS guidelines specify that a reasonable investigation should generally take no longer than 6 months from the date of credible notice, absent extraordinary circumstances. Once quantified, the provider has 60 days to return the funds. Thus, from initial credible notice to final repayment, the total timeframe should not exceed 8 months (6 months investigation + 60 days refund).

The Statutory Lookback Period

CMS established a 6-year lookback period for reporting and returning overpayments. A provider that identifies an overpayment must audit billing records and return improperly received funds going back six years from the date the overpayment was identified.

---

2. Linkage to the Reverse False Claims Act

The 60-Day Rule has severe enforcement teeth because of its direct statutory connection to the Civil False Claims Act (FCA).

Under 31 U.S.C. § 3729(a)(1)(G) (the Reverse False Claims Act), any person who knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money to the federal government is liable for false claims. Retaining an identified overpayment beyond the 60-day deadline converts the overpayment into an obligated debt. Failure to return it exposes the provider to:

• Treble (3x) Damages under the FCA;
• Mandatory Civil Penalties ($13,508 to $27,018+ per claim);
• Mandatory interest and potential OIG program exclusion.

---

3. Overpayment Quantification and Statistical Sampling

When a medical auditor discovers coding errors during a routine sample audit (e.g., a 10-chart probe audit), determining the total overpayment liability requires systematic quantification.

Probe Audits vs. Full Universe Audits

• Probe Audit (Baseline Sample): Small sample (typically 10 to 30 claims per provider) designed to determine whether a systematic error pattern exists.
• Universe Audit: If a probe audit identifies a statistically significant error rate or systematic coding error (e.g., misinterpreting modifier rules), the auditor must expand the audit scope.

Statistical Sampling and Extrapolation

When a universe of claims is large (e.g., thousands of claims over a 6-year lookback period), auditing 100% of charts is often unfeasible. In such cases, auditors use statistically valid random sampling (SVRS):

• OIG RAT-STAT Software: The gold standard statistical tool used by federal government auditors and CPMAs to select random samples and calculate extrapolated overpayments.
• Point Estimate vs. Lower Confidence Limit (LCL): Extrapolation calculates a point estimate of total overpayments across the universe. In self-disclosure and overpayment refunds, providers typically calculate the overpayment at the 90% or 95% Lower Confidence Limit (LCL) to ensure a conservative, legally defensible refund amount.

---

4. Voluntary Self-Disclosure Protocols

When overpayments involve potential intentional fraud, kickbacks, or self-referral violations, simply returning money to a MAC via standard claim adjustments is legally insufficient to release civil or criminal liability. Providers must utilize formal Self-Disclosure Protocols.

HHS-OIG Health Care Fraud Self-Disclosure Protocol (SDP)

The OIG SDP is a structured, voluntary protocol for healthcare providers to self-disclose potential violations of federal criminal, civil, or administrative law involving fraud (FCA, AKS, CMPL).

Key Features and Benefits of the OIG SDP:

• Reduced Settlement Multipliers: While the FCA imposes 3x treble damages, the OIG generally settles SDP matters for a multiplier of 1.5 times actual single damages.
• No Mandatory CIA: Disclosing entities are generally not required to enter into a Corporate Integrity Agreement (CIA) as part of the settlement, saving substantial ongoing compliance costs.
• Suspension of 60-Day Clock: Filing a disclosure under the SDP tolls (suspends) the ACA 60-day repayment deadline while the disclosure is processed by the OIG.
• Minimum Settlement Thresholds:
  • For Anti-Kickback Statute (AKS) related disclosures: Minimum settlement of $100,000 (updated in 2021).
  • For all other fraud/overpayment disclosures: Minimum settlement of $20,000.

CMS Voluntary Self-Referral Disclosure Protocol (SRDP)

While the OIG SDP handles fraud and kickback matters, the CMS SRDP is specifically designed for providers to self-disclose technical or substantive non-compliance with the Stark Law (Physician Self-Referral Law).

• Administrative Flexibility: CMS possesses statutory authority to compromise and settle Stark Law overpayments for significantly less than the total gross revenues collected from improper referrals, taking into account the nature of the violation, good-faith cooperation, and financial impact.