Each year, the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) issues dozens of audit reports. While each is important in its own way, some stand out with language that appears to reflect OIG’s fraying patience and may lay the groundwork for possible future enforcement action. A report issued on November 16, 2020, falls into this category.

Report A-01-18-0052, “Hospitals Did Not Comply with Medicare Requirements for Reporting Cardiac Device Credits” should be reviewed carefully by compliance officers and the legal departments that support them at hospitals with cardiology programs that routinely implant and at times explant, cardiac devices. In response to this report, hospitals may want to implement a review of their institution’s compliance with the obligation to return warranty credits received from manufacturers for recalled or prematurely failed cardiac medical devices.

This audit report stands out for several reasons:

• It is the eighth audit report on this topic issued by OIG since 2011;
• The findings are statistically significant – OIG found that for 3,233 of the 6,558 Medicare claims reviewed, hospitals likely did not comply with Medicare requirements associated with reporting manufacturer credits for recalled or prematurely failed cardiac medical devices;
• The findings are monetarily significant --OIG found the average unreported credit for a recalled or prematurely failed cardiac device was $10,124, leading to a conclusion that 911 hospitals received $33,095,068 in potential overpayments;
• OIG found that while the time it takes manufacturers to issue credits varied, manufacturers are not responsible for the widespread failure of hospitals to return device credits to the program. Indeed, OIG went out of its way to exonerate manufacturers from any responsibility for hospitals’ failure to report credits,[1] instead citing inadequate hospital processes as the reason for the hospitals’ retention of overpayments; and
• Using language that has significant implications for compliance, OIG asserted its belief that the audit report “constitutes credible information of potential overpayments” received by hospitals that failed to process device credits as required.

The methodology employed by OIG was relatively straightforward. They confirmed the existence of credits by obtaining a list of warranty credits for cardiac devices from manufacturers and matching that information with beneficiary and claims history. This match found that 6,558 claims that had a cardiac device replacement procedure for which the date of service corresponded to the device replacement procedure date on the credit listing. OIG then determined that 3,233, or nearly 50% of the claims were billed without the condition and value codes that should be used when a credit has been received.

To confirm their methodology, OIG conducted site visits at 4 of the 911 hospitals included in the audit. During those visits, OIG reported that hospital officials confirmed they had received nearly $2 million in credits for recalled or prematurely failed cardiac devices and admitted that they should have identified and refunded the credits to the Medicare program. The hospitals cited inadequate internal controls as the cause of their failure to return these overpayments in particular: billing systems that were not updated to reflect changes in 2014 regarding new condition and value code requirements; a lack of written policies and procedures; insufficient communication between departments when receiving reportable credits; and inadequate compliance testing. In a footnote, OIG observed:

One hospital had the highest dollar value of reportable credits, over $1 million, during our audit period. The three remaining hospitals had reportable credits that were among the top 5 percent of all hospitals during our audit period. Also, all four hospitals had findings related to cardiac device credits in previous OIG audits.

Audit Report at 5, footnote 14.

Some may dispute the validity of OIG’s methodology, but given OIG’s findings from its site visits, it seems clear OIG is convinced a widespread problem persists. OIG did recognize the challenges hospitals face in properly identifying, tracking and reporting device credits. These challenges include not only determining whether a credit was issued, but whether the value of the credit received for the explanted device are at least 50% of the cost of the replacement device. OIG also acknowledged timing issues where existence of a credit or its value is not known at the time a claim is submitted and in those instances where the existence of a credit is determined after claim submission, the need to process an adjustment claim with the appropriate condition and value codes. Despite recognizing these challenges, OIG went so far as to assert that its audit report constitutes credible information of potential overpayments received by hospitals that failed to process device credits as required.

A Provider’s Obligation to Identify and Return Overpayments under the 60-Day Rule

The Social Security Act, as amended, expressly requires that providers report and return an overpayment either (i) within 60 days of identifying an overpayment or (ii) the date when the corresponding cost report is due—whichever is later.[2] This rule has come to be known as the “60-Day rule.” In 2016, HHS finalized a regulation establishing a standard for what it means to “identify” an overpayment, and therefore, trigger the rule. A payment is “identified” when “the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.”[3] In practice, this means that upon receiving credible information of a potential overpayment, the provider has a duty to identify potential overpayments within a six-year look back period.[4]

Cautious about prematurely triggering the 60-day rule, providers often expend significant effort on the process of determining whether they actually possess credible information of an overpayment. At least for the 911 hospitals whose claims were subject to the audit, OIG appears to be trying to bypass this step by declaring rather bluntly its belief that “this audit report constitutes credible information of potential overpayments.” Clearly, OIG has concluded that for the 911 hospitals that billed the 3,233 claims OIG determined were at risk for overpayments, these institutions now possess credible information that demands a retrospective review in accordance with the 60-day rule.[5]

While many hospitals have adequate systems in place and others no doubt have made improvements in their systems since June 2017 -- the close of the audit period used for this report -- all hospitals that explant cardiac devices should ensure that they are processing cardiac device credits properly. Specifically, hospitals should consider their own practices and experience and evaluate whether the publication of this audit report with its widespread findings may itself provide some notice of a risk of potential overpayment that militates in favor of the exercise reasonable diligence to identify and report overpayments.

Failure to Return Overpayments Can Lead to Liability Under the Civil Money Penalties Provisions of the Social Security Act and Implementing Regulations Enforced by OIG

Section 1128A(a)(10) of the Social Security Act, 42 U.S.C. 1320a-7a(a)(10), states that OIG may through an administrative action, impose upon a provider a civil money penalty of not more than $20,000 for each instance where a provider, “knows of an overpayment (as defined in paragraph (4) of section 1320a–7k(d) of this title) and does not report and return the overpayment in accordance with such section.” Section 1320a-7k(d) is the law referenced above which imposes a duty on all providers to report and return overpayments and also defines what constitutes an “overpayment.”

Failure to Return Overpayments Can Lead to Liability Under the False Claims Act

While civil money penalties are always a consideration, the more favored approach to enforcement of Medicare billing rules is the use of the False Claims Act, 31 U.S.C. § 3729 – 3733. This statute vests the United States with the ability to recover up to three times the damages sustained, as well as civil penalties ranging from $11,665-$23,331 for each instance in which the obligation to return an overpayment was not fulfilled.[6] In addition, the statute’s qui tam provisions allow a private citizen – such as a hospital employee – to bring and action in the name of the United States and share in the recovery. Significantly, section 1320a-7k(d) addresses enforcement of the duty to return overpayments by defining an overpayment as an “obligation” to the United States which if not repaid, forms the basis for liability under the False Claims Act: “Any overpayment retained by a person after the deadline for reporting and returning the overpayment under paragraph (2) is an obligation (as defined in section 3729(b)(3) of title 31) for purposes of section 3729 of such title.” See also 42 CFR § 401.305(e) (same).

When a provider fails to return funds it is obligated to return, the conduct becomes a reverse false claim under 31 USC §3729 (a)(1)(G). As with other claims under the False Claims Act, liability for a reverse false claim can only be established if the provider retaining the overpayment did so “knowingly.” It is well known that under the False Claims act, “knowingly” means not only acting with knowledge of the falsity of information, but alternatively acting with reckless disregard, or deliberate ignorance, 31 U.S.C. § 3729(b)(1). In the face of eight OIG audit reports highlighting widespread hospital inattention to the obligation to identify and return credits for explanted cardiac devices, and further given specific instances of certain hospitals repeatedly failing to do so, one might ask whether the burden of establishing reckless disregard or deliberate ignorance is now somewhat easier to prove.

Conclusion and Actions to Consider

The language OIG uses in this report is definitive and there are signs OIG’s patience on this topic is running thin. For example, OIG observed that of the 911 hospitals found to be retaining overpayments in the audit, 163 (18 percent) had been part of a prior OIG audit on this topic. Moreover, the amounts retained by these “experienced” institutions were not insignificant. The current audit found that 24 of the 163 hospitals each received potential overpayments totaling more than $100,000.[7]

Clearly with the ongoing pandemic, hospitals are under unprecedented pressure to fulfill their mission and care for the nation’s population. Nevertheless, in its report, OIG instructed Medicare contractors to recover from all 911 hospitals implicated in the report the identified overpayments that fall within the 4-year reopening period prescribed under Medicare regulations and recover payments outside this period by instructing hospitals to conduct a 6-year lookback under the 60-day rule. Under current circumstances, OIG’s interest in bringing enforcement actions against hospitals based on their failure to report device credits may be tempered. Qui tam relators, however, are not likely to exhibit similar restraint. Furthermore, in the end, applicable law and regulations impose an independent duty on hospitals to return any identified overpayments. Accordingly, in the wake of the latest OIG audit report on this topic and to minimize possible exposure under the False Claims Act hospitals may want to:

• Assess your hospital’s current procedures for tracking explanted devices and the effectiveness of your claims submission and post payment adjustment systems to ensure compliance with the obligation to identify and report device credits. It may be helpful to conduct tests based on certain procedures and corresponding warranty credits to ensure that the system is identifying and processing reportable credits.
• If doubts about institutional compliance exist, under the direction of counsel, conduct a compliance review to determine if your hospital may be retaining potential overpayments resulting from reportable manufacturing credits relating to recalled or prematurely failed cardiac medical devices. This review should be conducted with reasonable diligence to identify overpayments during a 6-year lookback period and ultimately lead to the return of any identified overpayments.

Lawyers from Verrill’s Health Care & Life Sciences Group are available to respond to any questions you may have about this Alert or the OIG Audit Report.