WRONGLY 'IDENTIFIED': WHY AN ACTUAL KNOWLEDGE STANDARD SHOULD GOVERN HEALTH CARE PROVIDERS' FALSE CLAIMS ACT OBLIGATIONS TO REPORT AND RETURN MEDICARE AND MEDICAID OVERPAYMENTS.

• Author: Goldin, Nicholas J.

INTRODUCTION

In 2015, Medicare spent $632 billion on health care for America's elderly (and other covered groups). (1) Medicaid spent another $554 billion to provide health care to America's needy. (2) The government estimates that improper payments account for as much as 10% of Medicare and Medicaid spending. 3 Given the vast amount of money at stake, and the fact that there is bipartisan support for recovering taxpayer dollars, (4) it is no surprise the federal government has made it a priority to recoup the money lost to health care fraud each year. (5) The results are noticeable: annual recoveries for health care fraud through the federal government's most powerful anti-fraud weapon, the False Claims Act (FCA or "the Act"), (6) have increased from $932 million in 2000 to a high-water mark of more than $3 billion in 2012. (7) Health care providers now pay millions of dollars to settle allegations that they have committed health care fraud in violation of the FCA. (8)

Among the anti-fraud laws at the government's disposal, the FCA is the most imposing. Congress has described it as "one of the most potent civil tools for rooting out waste and fraud in Government." (9) Today, it has become the government's "favorite weapon" to turn on health care fraud, (10) and "has grown to assume almost mythical proportions in the fight against health care fraud." (11) One reason the FCA is so valuable to the government, and "a modem nightmare for the health care industry," (12) is that it carries the potential for especially large liability. (13) Sanctions for violating the Act include treble damages (14) and penalties of up to $21,563 per individual false claim. (15) Of even greater concern to the health care community, the United States Department of Health and Human Services may also exclude providers who violate the FCA from future participation in Medicare and Medicaid. (16) Since providers depend on these programs for a sizable portion of their overall revenues, (17) they have particular reason to fear exclusion. (18) Another powerful feature of the Act is its relatively unusual qui tam mechanism, whereby any private individual who becomes aware of fraud can bring suit on behalf of the government and recover a portion of the government's award. (19) Thus, even if the government does not know about a particular incident of health care fraud, the FCA's qui tam function monetarily incentivizes any private individual who does know about it to come forward and sue the alleged fraudster. And in addition to the federal Act, in a majority of states providers may face prosecution under a state law version of the FCA too. (20)

One way a health care provider can violate the FCA is to retain payments from Medicare or Medicaid to which the provider is not legally entitled. (21) Medicare and Medicaid work by reimbursing health care providers for services performed based on an established fee schedule. (22) Providers submit codes describing the services they have rendered, and Medicare or Medicaid reimburses the appropriate amount. (23) If a provider submits the wrong code, it may receive more money than it is legally entitled to. (24) When providers do this intentionally, it is known as "upcoding." (25) However, even if a provider is overpaid accidentally, once it realizes the mistake it violates the FCA unless it reports and returns the overpayment within a certain period of time.

There is no doubt that intentional upcoding is a form of fraud. Similarly, it is clear that health care providers who realize they have been overpaid should return the money as soon as feasible. However, providers may not always know when they have been overpaid for the simple reason that correctly billing a Medicare or Medicaid claim can be quite difficult. Medicare in particular is, "to say the least, a complicated program." (26) The Medicare statute is more than 400 pages long, and its implementing regulations require another "1200 dense Code of Federal Regulations pages." (27) The Supreme Court has called Medicare a "massive, complex health and safety program ... embodied in hundreds of pages of statutes and thousands of pages of often interrelated regulations," (28) while a district court has referred to the Medicare statute as "convoluted and complex" and a "model of nn-clarity." (29) One commentator has called Medicare's regulatory complexity "unrivaled anywhere in the world," and noted that its regulations outnumber even those of the labyrinthine Internal Revenue Code. (30) Perhaps in part because of this regulatory complexity, Medicare overpayments are far from uncommon: in fiscal year 2014 alone, the Recovery Audit Program discovered more than one million improper Medicare claims resulting in $2.39 billion in overpayments nationwide. (31) The previous year nearly 1.5 million improper Medicare claims led to $3.65 billion in overpayments. (32) While some of these improper claims may have been intentionally fraudulent, others were likely caused by "the complexity of the Medicare maze." (33)

As part of the Affordable Care Act (ACA), (34) Congress enacted the so-called "Sixty-Day Rule," (35) which requires providers to report and return all overpayments from Medicare or Medicaid within sixty days of when the overpayments are "identified." (36) Otherwise, the provider risks violating the FCA. (37) However, the Sixty-Day Rule does not explain what it means for a particular overpayment to be "identified," (38) thus leaving it to the Centers for Medicare & Medicaid Services (CMS) to flesh out the precise meaning of that term. (39)

A hospital submitting a large volume of Medicare and Medicaid claims is nearly certain to receive overpayments. For example, consider the results of three recent audits of prominent teaching hospitals, each involving Medicare claims selected because they were at risk for billing errors. First, in an audit of 240 Medicare Part A and B claims submitted by St. Louis's Barnes Jewish Hospital (40) primarily between 2009 and 2010, the Office of Inspector General (OIG) found that 58 claims had been overpaid, resulting in $725,185 in overpayments to the hospital. (41) A similar audit at Chicago's Northwestern Memorial Hospital (42) revealed that 85 out of 171 Medicare claims sampled there were overpaid in 2011 and 2012, causing Medicare to overpay the hospital by $272,181. (43) Finally, an audit of Medicare Part A and B claims submitted by Mary Hitchcock Memorial Hospital (44) from 2009 to 2012 revealed overpayments on 255 out of 445 sampled claims, totaling $770,735 in overpayments. (45)

Consider the tremendous liability these hospitals could have faced if, hypothetically, a court was to determine they had "identified" these overpayments at some point more than sixty days before the OIG audits. To take the most extreme case, OIG's audit of Mary Hitchcock found that 255 out of 445 audited Medicare claims were improperly submitted, causing the government to overpay Mary Hitchcock by $770,735. (46) If Mary Hitchcock retained this money for more than sixty days after "identifying" it, these overpayments might have cost the hospital $2,312,205 in FCA treble damages. (47) On top of that, Mary Hitchcock might also have owed up to $21,563 in penalties per overpaid claim. (48) If the maximum penalty were assessed for all 255 overpaid claims, Mary Hitchcock would have owed $5,498,565 in additional penalties, bringing the grand total to $7,810,770. (49) Of even more concern to Mary Hitchcock, it might also have faced exclusion from future participation in Medicare. (50) In fact, Mary Hitchcock faced none of these sanctions--OIG merely recommended that the hospital refund the overpayments discovered by the audit and "strengthen controls to ensure full compliance with Medicare requirements." (51) But, continuing with the hypothetical assumption that Mary Hitchcock "identified" the overpayments more than 60 days before the audit, if a prosecutor looking for a political score or a qui tam plaintiff looking for a payday had gotten there before OIG, Mary Hitchcock might have faced an FCA action with the potential for devastating liability.

When a health care provider knows that particular claims were overpaid by particular amounts, there is no doubt the overpayments are "identified" within the meaning of the Sixty-Day Rule. But suppose instead that the provider is notified of a set of 1,000 claims that are at risk of having been overpaid, although no one knows with certainty which were actually overpaid, or by how much. (52) There are three moments at which any actually overpaid claims in this set can become "identified." First, the overpayments could be "identified" the moment the provider is put on notice that they might exist. Second, the overpayments could be deemed "identified" at the moment a reasonable investigation should have discovered and quantified the overpayments (even if, due to the provider's failure to conduct a competent investigation, the overpayments have not yet in fact been discovered and quantified). Finally, overpayments could be deemed "identified" only when the provider has actual knowledge of both (a) which claims were overpaid, and (b) the amount of the overpayments.

Under the first approach, the sixty-day clock would begin to run before the provider has even had a chance to begin its investigation. This may be an unfair result because, to determine which of the 1,000 flagged claims were actually overpaid, the provider would need to locate and review all relevant medical records, talk to the physicians who provided the services at issue, and then consult with coding experts (and possibly counsel) to determine whether the submitted codes were appropriate based on the supporting medical evidence. (53) Under the second approach, too, the sixty-day report and return clock may begin to run before a hospital on notice of potential overpayments knows what it actually needs to return. Only the third approach...