ACA Audits
What every supplier needs to know
by Denise M. Leard

When most people think of the Patient Protection and Affordable Care Act (ACA), individual health insurance coverage is the first thing that comes to mind. But the ACA also gave the Centers for Medicare & Medicaid Services (CMS) tools to fight fraud, waste and abuse. Among these tools is a requirement to report and refund overpayments, found in Section 1128J(d) of the Social Security Act (Report and Refund Provisions). In plain language, this section requires suppliers to report and refund any payments that they are not entitled to within 60 days; if they don’t, the overpayment becomes a false claim. The Report and Refund Provisions place an affirmative duty on suppliers to use reasonable diligence to identify potential overpayments. If a supplier has reason to believe an overpayment exists, they have 180 days to take steps to identify any applicable overpayment.

Understanding Overpayments

One of the key provisions of the ACA is its definition of the word of “identified.” According to the final rule implementing the Report and Refund Provisions, a person has identified an overpayment when they have or should have—through the exercise of reasonable diligence—determined that they have received an overpayment and quantified the amount. This means that if a supplier has credible information that an overpayment exists, they must make efforts to determine the actual amount.

Additionally, the rule states: “If a contractor or government audit discovers a potential overpayment, the audit notice from the contractor or government triggers the provider’s or supplier’s obligations.” CMS’s position is that a Medicare overpayment request is credible information that an overpayment exists. So, if a Medicare claim is audited and denied, a supplier has an obligation to conduct an inquiry to determine if additional overpayments exist.

CMS has started using the Report and Refund Provisions to require suppliers to conduct self-audits and make refunds. In June 2018, the Office of Inspector General (OIG) released a report called “Most Medicare Claims for Replacement Positive Airway Pressure Device Suppliers Did Not Comply with Medicare Requirements.” The report was the result of an OIG audit that found that Medicare paid for replacement positive airway pressure (PAP) device supplies that, in its opinion, were not reasonable and necessary and/or suppliers did not have sufficient documentation to comply with Medicare requirements.

The OIG selected 110 sample claims made in 2014 and 2015 for replacement PAP supplies and reviewed the documentation for compliance with Medicare guidelines. The office found that only 24 of the 110 claims met Medicare guidelines. Based on the results of the sample, the OIG estimated that it made payments of $631,272,181 for replacement PAP supplies in those years that it should not have. 

The OIG recommended that Medicare contractors notify the suppliers that an overpayment existed for the 86 claims that did not meet Medicare guidelines, and instruct them to investigate and return any identified overpayments in accordance with the 60-day rule. As a result, the suppliers who had claims deemed invalid received notices from the durable medical equipment Medicare administrative contractors (DME MAC) advising them to “review claims submitted related to replacement PAP device supplies to determine if overpayments exist within the six-year lookback period.”

Recent audit letters from the DME MACs have included similar language, such as:

  • “As required by 42 CFR 401.305, a provider/supplier who has received an overpayment must report and return within 60 days after having identified
  • the overpayment.”
  • “This requirement applies to overpayments identified within six years of the date (it) was received.”
  • “Please review the claims you have submitted related to replacement PAP device supplies to determine if overpayments exist within the six-year lookback period.”

Similar language has appeared in letters from the Unified Program Integrity Contractor (UPIC):

  • “The rate of error identified in this small sampling of claims is significant; therefore, it is likely that you have been overpaid by Medicare on other claims
  • or services not identified in this letter or its attachments.” 
  • “If so, you are obligated to refund the program. After reviewing the education provided herein, (we recommend) that you conduct a self-assessment in order to identify any additional overpayments your practice or facility has received as a result of the actions which are the subject of this letter.” 
  • “Additionally, CMS published a final rule regarding overpayments in the Federal Register ... to provide clarity and consistency in the reporting and returning of self-identified overpayments.”

If a supplier does not conduct a self-audit when requested, and if an overpayment is found by a CMS contractor, that overpayment is basis for liability under the False Claims Act. Civil penalties can include recovery of up to three times the amount of the claim and an additional penalty of up to $22,927 per claim. Filing a false claim may also result in criminal penalties with fines of up to $100,000 and imprisonment of up to 10 years. The Report and Refund Provisions of the ACA should not be taken lightly.

Regardless of whether or not a supplier is instructed by CMS or by one of its contractors to perform a self-audit, a supplier is required to do so by the ACA. It is important to be aware of the Report and Refund Provisions and to be sure these requirements are incorporated into your compliance plan and self-audit activities. Failure to do so can be extremely costly.



Denise M. Leard, Esq., is an attorney with the Health Care Group of Brown & Fortunato, P.C., a law firm based in Amarillo, Texas. Leard represents HME companies, pharmacies and other health care providers throughout the United States. Leard earned a B.A. from the University of Washington and received her law degree from the University of Oklahoma College of Law.