On September 7, 2018, the United States District Court for the District of Columbia issued an order vacating Medicare’s 2014 Overpayment Final Rule, relating directly to Medicare Advantage (“MA”), that could have broad ramifications throughout the healthcare industry, including not only on MA plans, but potentially on traditional Medicare, Medicaid and in related False Claims Act jurisprudence. In UnitedHealthcare Insurance, et al., v. Alex M. Azar II, Secretary of the Department of Health and Human Services, et al., the Court granted summary judgment in favor of UnitedHealthcare and vacated the MA Overpayment Final Rule (defined below). In vacating the MA Overpayment Final Rule, the Court first concluded that the MA Overpayment Final Rule did not satisfy the “actuarial equivalence” provisions in the statute, and for a number of reasons (below) must be vacated. Secondly, the Court concluded that the MA Overpayment Final Rule – by creating a new and statutorily unauthorized “simple negligence” standard for FCA liability relating to violations of the MA Overpayment Final Rule – was inconsistent with the FCA and with APA rule-making requirements and was invalid for that reason as well.

Background

Under the MA Program, Medicare-eligible individuals may elect to receive their healthcare through private insurance companies, including UnitedHealthcare and its co-plaintiffs. Each year MA insurers contract with the Centers for Medicare and Medicaid Services (“CMS”) to provide healthcare benefits to MA participants.

Unlike traditional Medicare (Parts A and B), which pays healthcare providers and suppliers directly for each medical service provided, CMS pays MA insurers based on a pre-determined per-member-per-month rate, based in part on the demographic characteristics of the beneficiaries being covered. In determining the per-member-per-month rate to pay MA insurers, the Social Security Act requires CMS to ensure “actuarial equivalence” between its payments for healthcare under traditional Medicare and MA plans. Historically, CMS has audited already-paid bills from a subsection of MA insurers to compare diagnosis codes with the underlying patient medical charts and, if the costs were unsupported by the charts, required repayment. CMS proposed to apply its findings from these audits (called Risk Adjustment Data Validation (“RADV”) audits) to extrapolate an error rate for the entire insurance contract and to require the MA insurer to repay the extrapolated overpayments to CMS. However, because this approach would have compared unaudited diagnosis codes from traditional Medicare records to audited MA records, it would have ignored errors in CMS records, thereby violating the statutory requirement of actuarial equivalence. Therefore, CMS adopted a “Fee-for-Service Adjuster” to be applied to the results of the RADV audits so that repayment of audited “overpayments” was required only to the extent that the MA insurer’s errors exceeded the estimated error rate in CMS’s payments under traditional Medicare.

The Patient Protection and Affordable Care Act (the “ACA”) imposes a statutory obligation on MA insurers (and others) to report and return overpayments to CMS by the later of the date which is 60 days after the date on which the overpayment was identified or the date any corresponding cost report is due. Further, the ACA makes an overpayment retained after the deadline for reporting and returning the overpayment an “obligation” under the False Claims Act (the “FCA”), creating the potential for treble (triple) damages, civil penalties and potential debarment from Medicare. Significantly with respect to the impact of the UnitedHealthcare decision, the obligation to report and return overpayments within 60 days after identification also applies to providers and suppliers that submit claims under traditional Medicare.

Under a proposed rule CMS introduced in 2014 (the “MA Overpayment Proposed Rule”), an “overpayment” would have been identified when the MA insurer had “actual knowledge of the existence of the overpayment or act[ed] in reckless disregard or deliberate ignorance of the existence of the overpayment.” However, CMS altered that definition (without providing for notice and comment under the Administrative Procedure Act) in its final rule (the “MA Overpayment Final Rule”), stating that a MA insurer has “identified” an overpayment when “it has determined, or should have determined through the exercise of reasonable diligence, that the MA organization has received an overpayment.” In the preamble to the MA Overpayment Final Rule, CMS defined “reasonable diligence” to mean “at a minimum … proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments.” Thus, under the MA Overpayment Final Rule, failure to conduct such proactive compliance activities could subject an MA insurer to liability under the FCA.

The Court’s Decision

Dialing back CMS regulations, the Court in UnitedHealthcare held that CMS improperly applied a simple negligence standard to FCA liability. The FCA, and the ACA by extension, impose liability for false claims that are submitted “knowingly” – which requires an individual (or MA insurer) to have actual knowledge, act in deliberate ignorance or act in reckless disregard – a higher standard than simple negligence.

Further, the Court found that CMS ignored statutory requirements of actuarial equivalence in promulgating the MA Overpayment Final Rule and established a system where actuarial equivalence could not be achieved. In the MA Overpayment Final Rule, CMS did not adopt anything comparable to a Fee-for-Service Adjuster (as it did with the RADV audits) to take into account that the sources of data are not compatible. Instead, CMS used unaudited traditional Medicare records to determine payments to MA insurers, but used audited medical charts to determine overpayments to MA insurers, thus systemically devaluing payments to MA insurers. The Court agreed with UnitedHealthcare’s argument that CMS failed to ensure actuarial equivalence because CMS applied “a more searching form of scrutiny than CMS applies to its own enrollee data.”

As a result of CMS’s failure to comply with actuarial equivalence, its imposition of a simple negligence standard in place of the statutory knowledge standard, and its failure to comply with the Administrative Procedure Act’s requirements for notice and comment period, the Court vacated the MA Overpayment Final Rule.

Application to Traditional Medicare Overpayment Final Rule

Significantly, the UnitedHealthcare decision also calls into question the CMS overpayment final rules applicable to traditional Medicare and promulgated subsequent to the MA Overpayment Final Rule. Under 42 CFR § 401.305, “a person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment” (the “Traditional Medicare Overpayment Final Rule”). In the preamble to the Traditional Medicare Overpayment Final Rule, CMS used the same definition of reasonable diligence as it used in the MA Overpayment Final Rule—proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments and investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment. Because CMS has applied the same negligence standard in the Traditional Medicare Overpayment Final Rule that it applied in the, now vacated, MA Overpayment Final Rule, the UnitedHealthcare decision may support challenges to the CMS Traditional Medicare Overpayment Final Rule.

Additional Information

For further information or questions about the decision in UnitedHealthcare or Medicare overpayment rules, please contact any member of Kutak Rock’s National Healthcare Practice Group or the authors of this Client Alert.