Skip to Main Content
October 14, 2021

Understanding the Impact of the D.C. Circuit’s Decision on the Medicare Advantage Overpayment Rule

This Briefing is brought to you by AHLA’s Payers, Plans, and Managed Care Practice Group.
  • October 14, 2021
  • Samantha Groden , Dentons US LLP
  • Christopher Janney , Dentons US LLP
  • Margo Smith , Dentons US LLP
  • Janice Ziegler , Dentons US LLP

In 2014, the Centers for Medicare & Medicaid Services (CMS) promulgated a rule implementing the statutory overpayment report-and-return obligation imposed on Medicare Advantage (MA) plan sponsors by the Affordable Care Act (Overpayment Rule or Rule). UnitedHealthcare Insurance Company and other MA organizations (MAOs) under the umbrella of UnitedHealth Group Incorporated (collectively, United) successfully challenged the Overpayment Rule before the U.S. District Court for the District of Columbia. According to the district court’s 2018 decision, the Overpayment Rule (1) violated provisions in the Medicare statute setting forth the MA reimbursement risk-adjustment model, (2) was arbitrary and capricious in violation of the Administrative Procedure Act (APA), and (3) established an impermissible standard for determining if and when an overpayment has been “identified.”

CMS appealed the first two of these conclusions. On August 13, 2021, the D.C. Circuit reversed the judgment of the district court, unanimously holding that the Overpayment Rule requirement that MAOs return identified overpayments does not violate the MA statutory reimbursement framework or the APA. In a sweeping decision, the court concluded that the “actuarial equivalence” standard in the Medicare statute cannot be used as a basis for MAOs to retain what would otherwise be known overpayments tied to unsupported diagnoses.

Importantly, the D.C. Circuit’s opinion did not affect the lower court’s ruling that the Overpayment Rule established an impermissible standard (i.e., negligence)[1] for determining when an overpayment has been “identified,” since CMS did not appeal that portion of the district court’s decision. Indeed, the D.C. Circuit’s discussion of the intent standard under the Overpayment Rule, and the duties MAOs do (and do not) have thereunder, may be helpful to defendants in federal civil False Claims Act (FCA) litigation going forward. Among other things, the court stated that the Overpayment Rule “only requires [MAOs] to refund amounts they know were overpayments”—that is, “payments they are aware lack support in a beneficiary’s medical records.”[2] The court also stated that “nothing in the Overpayment Rule obligates insurers to audit their reported data.”[3]

The D.C. Circuit’s holding is significant because it defeats (at least for now) a defense to FCA litigation that would have been a powerful weapon for MAOs. Left open by the D.C. Circuit’s decision, however, are two key questions, each with important practical ramifications. We preview these issues here and address them more substantively in the final section of this article.

First, what is the applicable standard for identifying an overpayment? As noted above, the district court held that “negligence” is not the proper standard for determining whether an overpayment has been “identified,” and CMS did not challenge this determination. However, the D.C. Circuit does not specifically address whether the applicable standard is “actual knowledge” and/or “reckless disregard”/“deliberate ignorance.” The former would be the highest and most industry-friendly standard, and (as reflected in the above statements from the D.C. Circuit’s decision) it is one that the court, at least in passing, suggests might be applicable. The latter is an intermediate standard between negligence and actual knowledge. It is the standard most commonly associated with the FCA (with which the Overpayment Rule is intertwined) and the standard that the district court suggested might be applicable.[4]

Second, how will the standard for identifying an overpayment be applied? There are a large and growing number of FCA risk adjustment cases currently being litigated. Some of these have been filed by the U.S. Department of Justice (DOJ), while others have been filed by private whistleblowers (and sometimes joined by DOJ at its discretion). In each of these cases, some combination of MAOs, downstream providers, and consultants are alleged to have taken certain actions, or to have failed to take certain actions, the net result of which is (1) the submission of inaccurate risk adjustment data, and (2) corresponding economic damage to the Medicare program. To the extent the defendants in these cases did not have actual knowledge that the risk adjustment data they were submitting (or failing to correct) was inaccurate, and were not merely “negligent,” the key question is what (if any) of the alleged conduct on the part of the defendants rises to the level of a “reckless disregard” for the accuracy of risk adjustment data or “deliberate ignorance” as to its accuracy?

Background

To understand United’s challenge to the Overpayment Rule, it is important to understand the obligations imposed on MAOs by the Overpayment Rule, and how the MA reimbursement framework interacts with those obligations.

Overpayment Rule

In 2010, as part of the Affordable Care Act, Congress amended the Medicare program’s integrity provisions by creating Section 1128J(d) of the Social Security Act, entitled “Reporting and Returning of Overpayments.” The law requires any “person” who has received an “overpayment” in connection with the Medicare or Medicaid programs to report and return the overpayment to the federal government within 60 days of the date on which the overpayment was “identified” (or, if applicable, by the date any corresponding cost report is due, whichever is later).[5] The statute defines “person” broadly to include all health care providers, suppliers, Medicaid managed care organizations, MAOs, and Medicare Part D sponsors.[6] Failure to return an identified overpayment after the statutory deadline may trigger liability under the FCA.[7]

In 2014, CMS promulgated the Overpayment Rule to implement the statutory report-and-return requirement with respect to MAOs.[8] Consistent with the statute, the Overpayment Rule provides that if an MAO “identifies” an “overpayment,” the MAO must report and return it within 60 days.[9] The Rule provides that an overpayment is considered “identified” under two sets of circumstances:

  • First, an MAO will be deemed to have “identified” an overpayment when the MAO “has determined” that it received an overpayment.[10] In other words, if an MAO has actual knowledge that it has received an overpayment, then the MAO has “identified” that overpayment for purposes of the Overpayment Rule (and the 60-day report-and return-clock will begin to run).
  • Second, the Rule provides that even if an MAO does not have actual knowledge that it received an overpayment, the MAO nevertheless will be deemed to have “identified” an overpayment, and the 60-day report-and-return clock will begin to run, at the point in time when the MAO “should have determined through the exercise of reasonable diligence” that it received an overpayment.[11] (As noted above, and discussed further below, the government did not appeal the portion of the district court’s decision striking down this provision of the Overpayment Rule, and the D.C. Circuit emphasized that fact in its decision.)

Finally, the Overpayment Rule establishes a six-year lookback period, requiring MAOs to report and return overpayments identified within the six most recent completed payment years.[12]

Overview of MA Reimbursement Framework

Unlike under the Medicare fee-for-service (FFS) program (or “traditional Medicare”), where CMS generally pays providers for each inpatient stay and each outpatient item or service furnished to a beneficiary,[13] CMS pays MAOs a fixed, monthly amount intended to cover the anticipated cost of all Medicare Part A and Part B covered items and services, as well as approved supplemental benefits under the MA plan, for their MA enrollees.[14] Recognizing that Medicare beneficiaries vary widely in terms of how healthy they are—and, therefore, how expensive they are to treat—Congress requires CMS to adjust the monthly, per-capita payments for each MA enrollee based on “age, disability status, gender, institutional status, and such other [risk] factors as the Secretary determines to be appropriate . . . so as to ensure actuarial equivalence” (Actuarial Equivalence Requirement).[15] This process generally is referred to as “risk adjustment.”

To implement the Actuarial Equivalence Requirement, CMS uses a Hierarchical Condition Category risk adjustment model (CMS-HCC model), pursuant to which CMS makes capitation payments to MAOs based on their anticipated expenditures for enrollees.[16] Generally speaking, the capitation payment for each MA enrollee is equal to a county-specific base payment rate multiplied by the risk adjustment factor score (or “risk score”) assigned to that enrollee by CMS based on the CMS-HCC model.[17] The risk score for a particular MA enrollee in a given year is, generally speaking, a reflection of certain demographic data and the diagnoses submitted to CMS for such beneficiary in the preceding year.

The CMS-HCC model is designed such that, in each payment year, a risk score of 1.0 corresponds to the “average” traditional Medicare beneficiary.[18] A risk score above 1.0 represents an MA enrollee who (based on their diagnoses and/or demographic characteristics) is higher risk than the average traditional Medicare beneficiary and (because the risk score is multiplied by the base payment rate) will generate a higher capitation payment to the MAO.[19] Conversely, a risk score below 1.0 represents an MA enrollee who (based on their diagnoses and/or demographic characteristics) is lower risk than the average traditional Medicare beneficiary and (because the risk score is multiplied by the base payment rate) will generate a lower capitation payment to the MAO.

Notably, CMS determines the 1.0 risk score based on diagnosis and demographic data for traditional Medicare beneficiaries (i.e., beneficiaries under Medicare Parts A and B) in the preceding year. As explained more fully below, this mooring to traditional Medicare beneficiary data in the risk score calculation is central to the arguments United made in its challenge to the Overpayment Rule.

To ensure that the risk scores for MA enrollees and traditional Medicare beneficiaries are comparable, the Medicare statute requires CMS to compute and publish, on an annual basis, the “average risk factor” (i.e., the average risk score) for traditional Medicare beneficiaries in each county “using the same methodology as is to be applied in making payments” to MAOs under the subsection of the Medicare statute that includes the Actuarial Equivalence Requirement (Same Methodology Requirement).[20] In other words, CMS must determine risk scores for traditional Medicare beneficiaries using the same methodology it uses in determining the risk scores and capitation payments for MA enrollees.

Risk Score Calculation Under MA Reimbursement Framework

To enable CMS to calculate MA enrollees’ risk scores, MAOs are required to submit to CMS risk adjustment data that is from acceptable data sources and contains diagnoses documented in the MA enrollee’s medical record as the result of a face-to-face visit.[21]

In calculating MA enrollees’ risk scores, CMS is required by statute to apply a “Coding Intensity Adjuster” that reduces the risk scores of all MA enrollees by the same specified percentage.[22] Congress enacted this Coding Intensity Adjuster to account for differences in diagnosis coding under the traditional Medicare and MA programs. Specifically, MAOs have a financial incentive to capture and report diagnosis codes, since an MA enrollee’s diagnoses affect the enrollee’s risk score, which in turn affects the capitation payment amount received by the MAO for that enrollee. In contrast, physicians who bill on a FFS basis under Medicare Part B do not have this same financial incentive because they are, generally speaking, paid for each item or service provided, regardless of the particular diagnosis codes submitted.[23]

Moreover, there are more opportunities to report diagnoses in the MA context. While Medicare FFS diagnoses are drawn exclusively from claims submitted to CMS, MAOs may review medical records and submit diagnoses that are supported by such records, even if the diagnoses codes were not reported by a physician on a health care claim or through encounter data.[24] For example, many MAOs have established programs to (1) review medical records retrospectively in an effort to identify diagnosis codes that were properly supported by the medical records for a particular enrollee, but not submitted on a claim, and (2) promote annual health risk assessments and other enrollee health encounters that serve as a vehicle for diagnosing chronic and other conditions.

To ensure the accuracy of the diagnosis data that is submitted by MAOs, and to curb any incentive to code for unnecessary or inappropriate diagnoses, CMS imposes two specific requirements on MAOs. First, MAOs are required to certify that the encounter data submitted to CMS is “accurate, complete and truthful” based on “best knowledge, information and belief.”[25] Second, MAOs have certain repayment obligations under the agency’s risk adjustment data validation (RADV) audit process. CMS conducts RADV audits on a subset of MAO data. Pursuant to these audits, the agency reviews and compares the reported diagnoses against the MA enrollee’s medical chart and records to determine if the diagnosis codes reported are appropriately supported by the medical record.[26] The MAOs must return any payments that CMS determines are based on an unsupported diagnosis.[27]

In 2008, CMS proposed expanding the repayment obligation under the RADV audits to require that an MAO’s repayment obligation be calculated based on the extrapolation of the MAO’s RADV audit error rate across all of its encounter data.[28] Commenters raised concerns that such a requirement would violate the Actuarial Equivalence Requirement unless CMS also audited and validated the traditional Medicare claims data that feeds into the CMS-HCC risk adjustment model; their rationale was that the failure to audit and validate diagnoses for traditional Medicare beneficiaries in the same manner before extrapolating any potential audit results would make MA enrollees falsely appear healthier and therefore would result in systemic underpayments to MAOs.[29] In response to these concerns, in 2012, CMS proposed applying a Fee-For-Service Adjuster (FFS Adjuster) to “account[ ] for the fact that the documentation standard used in RADV audits to determine a contract’s payment error (medical records) is different from the documentation standard used to develop the Part C risk-adjustment model (Medicare FFS claims).”[30] Under this proposal, MAOs would only be liable for repayment if their extrapolated, contract-level payment error exceeded any offsetting payment error in traditional Medicare.[31]

United’s Challenge to the Overpayment Rule

In January 2016, United filed a complaint in the U.S. District Court for the District of Columbia challenging the Overpayment Rule. In seeking summary judgment, United argued that the Overpayment Rule violated the Actuarial Equivalence Requirement and the Same Methodology Requirement under the Medicare statute and was arbitrary and capricious, in violation of the APA.[32] Further, United claimed that CMS lacked the statutory authority to apply a simple negligence standard of liability under the Overpayment Rule for an MAO’s failure to report and return an overpayment for purposes of FCA liability since this constituted an unlawful departure from the standard for liability under the FCA itself.[33]

In September 2018, the district court granted United’s motion for summary judgment and vacated the Overpayment Rule, holding that the Rule violated both the Actuarial Equivalence and Same Methodology Requirements.[34] The court reasoned that because MA capitation payments are “set annually based on costs from unaudited traditional Medicare records,” the Overpayment Rule “systematically devalues payments to [MAOs] by measuring ‘overpayments’ based on audited patient records.”[35] The district court also agreed with United that the Rule was arbitrary and capricious because CMS failed to provide any justification for departing from its prior policy of using the FFS Adjuster in the context of RADV audits.[36] Finally, the court ruled that CMS’ adoption of a negligence standard with respect to the identification of overpayments, which would have required MAOs to exercise reasonable diligence to identify misreported diagnosis codes, was (1) inconsistent with the liability standard established in the FCA, which requires actual knowledge, deliberate ignorance, or reckless disregard, and (2) not a logical outgrowth of the proposed rule, in violation of the APA.[37]

Shortly after the district court’s ruling, CMS announced in a proposed rule that it would no longer use the FFS Adjuster. The agency’s proposal was based on a 2018 CMS study, which found that “errors in [traditional Medicare] claims data do not have any systematic effect on the risk scores calculated by the CMS-HCC risk adjustment model, and therefore do not have any systematic effect on the payments made to MA organizations.”[38] Based in part on the findings from this study, CMS filed a request for partial reconsideration by the district court in November 2018. After this request was denied, CMS appealed the district court’s ruling as to the Actuarial Equivalence and Same Methodology Requirements, as well as its finding that the Overpayment Rule was arbitrary and capricious, in violation of the APA. As noted above, CMS did not appeal the district court’s holding concerning when an overpayment has been “identified” for purposes of the Overpayment Rule.

D.C. Circuit Opinion

In a sweeping opinion, the D.C. Circuit unanimously ruled in favor of CMS, upholding the Overpayment Rule against United’s statutory and APA challenges.[39] Specifically, the D.C. Circuit reversed the district court’s grant of summary judgment to United and its resulting vacatur of the Overpayment Rule, remanding the case to the district court to enter judgment in favor of CMS. Although not stated in the D.C. Circuit’s decision, the lower court’s vacatur of the portion of the Rule addressing when an overpayment is “identified” presumably stands, given it was not appealed.[40]

Rather than evaluate the Overpayment Rule within the larger context of the Medicare and MA reimbursement framework—i.e., analyzing the Rule under the assumption that the numerous statutory and regulatory provisions relating to MAO reimbursement have a common and integrated purpose—the D.C. Circuit examined the Overpayment Rule and each of United’s three arguments in isolation.

Actuarial Equivalence Requirement

United claimed that the Overpayment Rule violated the Actuarial Equivalence Requirement, which, as noted above, requires CMS to adjust its monthly capitation payments to MAOs for various risk factors to ensure actuarial equivalence between payments made for the MAO’s enrollee population and traditional Medicare beneficiaries, whose data is used to calculate capitation payments to the MAO.[41] The Overpayment Rule, United argued:

results in different payments for identical beneficiaries because it relies on both supported and unsupported codes to calculate risk in the [traditional Medicare] program, but only supported codes in the MA program. That necessarily means that MA plans are not paid the same as CMS for identical beneficiaries. It makes MA beneficiaries appear artificially healthier than their CMS counterparts; and it inevitably underpays plans.[42]

In other words, United posited that the Overpayment Rule results in different risk score calculations and payments for traditional Medicare beneficiaries and MA enrollees. While the risk score calculation for the average traditional Medicare beneficiary would include unverified and unsupported diagnosis codes, the individual risk score calculations for MA enrollees would be limited to those diagnosis codes that are supported in the medical record. To correct this deficiency, United proposed three ways in which CMS could achieve actuarial equivalence under the current structure of the Overpayment Rule: (1) audit a sample of traditional Medicare data for unsupported diagnosis codes, remove an extrapolated portion of those errors from this data, and use the validated data in the CMS-HCC risk adjustment model; (2) account for the differences with an adjuster; or (3) bring enforcement actions against providers who submit fraudulent diagnoses relating to MA enrollees.[43]

The D.C. Circuit rejected United’s arguments on two bases. First, the court found that “nothing in the Medicare statute’s text, structure, or logic makes the [Actuarial Equivalence Requirement] applicable to the overpayment-refund obligation in [the statute] or to the Overpayment Rule.”[44] “Reference to actuarial equivalence,” the court stated, “appears in a different statutory subchapter from the requirement to refund overpayments and neither provision cross-references the other.”[45] Based on the language in the statutory provision establishing the Actuarial Equivalence Requirement, the court concluded that the Actuarial Equivalence Requirement “is not broadly applicable, but instead limited to the specified context of CMS’s calculation and disbursement of monthly payments in the first instance.”[46] According to the court, then, the Actuarial Equivalence Requirement and “overpayment-refund obligation apply to different actors, target distinct issues arising at different times, and work at different levels of generality.”[47] Further, the court explained, the Actuarial Equivalence Requirement and the overpayment-refund obligation serve different ends, with the former aimed at requiring CMS to model “a demographically and medically analogous beneficiary population in traditional Medicare to determine the prospective” monthly capitation payments to MAOs, and the latter applying after the fact to require MAOs to refund any payment increment based on a diagnosis that lacks medical record support.[48]

Second, the D.C. Circuit reasoned, even if the Actuarial Equivalence Requirement did apply to the Overpayment Rule, United did not establish that the Overpayment Rule “in fact will result in [MAOs] receiving payment for only supported codes.”[49] According to the court, United failed to identify any reason why traditional Medicare data used in the MA risk adjustment model would “suffer systematically from unsupported codes like those that the Overpayment Rule targets.”[50] Further, United did not demonstrate to the court’s satisfaction that the unsupported diagnosis codes in traditional Medicare data would cause United (or other MAOs) to be underpaid.[51] In support of these conclusions, the court pointed to the 2018 CMS study released after the district court’s decision, which found that errors in traditional Medicare data do not systematically affect risk scores or payments to MAOs.[52] According to the D.C. Circuit, United’s assertion of a substantial number of unsupported diagnosis codes in the traditional Medicare data set was “implausible” based on the court’s understanding of the different ways the programs’ reimbursement schemes work in practice and, as such, the conclusions of the CMS study were “unsurprising.”[53] Again, and in all events, the court held that United failed to demonstrate either that (1) any errors occurred at a scale or in “any particular pattern,” such that the “misattribution of some costs in the [traditional Medicare] data [can] be assumed to distort CMS’s analysis,” or (2) the obligation to refund overpayments, as defined in the Medicare statute and the Overpayment Rule, in fact has led or will lead to systemic underpayment of Medicare Advantage insurers relative to traditional Medicare.[54]

Same Methodology Requirement

As noted above, the Same Methodology Requirement directs CMS to compute and publish the average risk score for traditional Medicare beneficiaries using the “same methodology” applied in the MA risk adjustment model to determine the monthly payment amount to MAOs.[55] Using much the same reasoning it applied to United’s arguments relating to the Actuarial Equivalence Requirement, the D.C. Circuit determined that the Same Methodology Requirement does not bear on the overpayment refund obligation. According to the court, the Same Methodology Requirement “does not impose a substantive limit on the operation of the risk-adjustment model, . . . [n]or does it have any bearing on whether a particular payment to [an MAO] constitutes an ‘overpayment.’”[l56]

Arbitrary and Capricious

Finally, United argued that the Overpayment Rule was arbitrary and capricious because it “marks an unexplained departure from CMS’s prior statements.”[57] Specifically, United posited that the Rule is inconsistent with CMS’ rationale for adopting the FFS Adjuster for RADV audits and its previous policy statements about the need for a Coding Intensity Adjuster.[58] The D.C. Circuit found that because the Overpayment Rule does not implicate, let alone violate, the Actuarial Equivalence Requirement, “CMS had no obligation to consider an FFS Adjuster or similar correction in the overpayment-refund context.”[59] In support of this conclusion, the court asserted that the contract-level RADV audits are an error-correction mechanism that is materially distinct from the Overpayment Rule, which “requires only that an insurer report and return to CMS known errors in its beneficiaries’ diagnoses that it supported as grounds for upward adjustment of its monthly capitated payments.”[60] The court concluded that the agency’s position was reasonable and, therefore, not arbitrary and capricious.

Implications for Medicare Advantage Organizations

On the one hand, of course, the D.C. Circuit’s decision clearly is significant. Although several district courts have wrestled with the Actuarial Equivalence and Same Methodology Requirements in the context of FCA suits against MAOs,[61] the D.C. Circuit is the first federal appellate court to issue an opinion analyzing such arguments, and its position seems fairly clear: the overpayment statute and Overpayment Rule provide independent and sufficient grounds to require that if, for example, (1) MAO submits risk adjustment data to CMS indicating that Enrollee Doe has Diagnoses X, Y and Z; (2) CMS pays MAO $100 based on this risk adjustment data; (3) MAO later determines that Diagnosis Z should not have been submitted (because, for example, it was not adequately documented in Enrollee Doe’s medical record); and (4) CMS would have paid MAO $80 had only the correct diagnoses been submitted, then the $20 difference between what MAO was paid ($100) and should have been paid ($80) is an “overpayment,” which MAO is obligated to report and return.

For this reason alone, the D.C. Circuit’s decision makes it more likely that the federal government and qui tam whistleblowers will pursue FCA cases against MAOs for failing to report and return overpayments based on unsupported diagnoses.[62] Indeed, notwithstanding the unfavorable ruling by the district court in the 2018 United case, Deputy Assistant Attorney General Michael Granston highlighted fraud in the MA program as an “important priority” for DOJ in December 2020, noting several large settlements with MAOs relating to alleged manipulation of “the risk adjustment process” resulting from the submission of unsupported diagnosis codes.[63] Presumably, the D.C. Circuit’s reversal of the district court will only embolden the government and whistleblowers to pursue FCA cases against MAOs, as the relative cost/benefit analysis of filing and settling such actions has changed.[64]

On the other hand, while many in the industry thought the legal and public policy arguments presented by United were compelling (and continue to hold that view), many also viewed the arguments as something of a long shot. (Indeed, consistent with that view, most MAOs have been returning overpayments, such as the $20 at issue in the above hypothetical, pending a resolution of the actuarial equivalence and other arguments raised by United.) Put somewhat differently, and more colloquially, many MAOs have recognized that the D.C. Circuit was being asked to tip over a very large apple cart, one immediate result of which would have been this: MAOs would have been permitted to keep hundreds of millions of dollars that were directly tied to data that the MAOs had themselves concluded was inaccurate. That’s a tough pill to swallow, and the D.C. Circuit found a way to avoid (as the court put it) such “absurd consequences”[65] by analyzing the refund obligation memorialized in the statute and Overpayment Rule as a program integrity mandate separate and distinct from the Actuarial Equivalence Requirement, the Same Methodology Requirement, and certain other MA payment considerations.

Irrespective of the merits of United’s arguments, or the correctness of the D.C. Circuit’s ruling, the decision leaves two critical questions unanswered: (1) what exactly is the applicable standard for “identifying” an overpayment, and (2) how does this standard apply in the risk adjustment context?

What Is the Applicable Standard for “Identifying” an Overpayment?

Recall that the 2014 Overpayment Rule provided that an MAO would be deemed to have “identified” an overpayment if the MAO either (1) had actual knowledge of an overpayment or (2) did not have actual knowledge of an overpayment but would have had such knowledge had it exercised “reasonable diligence.” As noted above, in 2018, the district court ruled that the latter, negligence-based standard, was inconsistent with the standard established in the FCA and was not a logical outgrowth of the proposed rule, in violation of the APA.

The FCA imposes liability for “knowingly” submitting a false claim, which is defined to include actual knowledge, deliberate ignorance, or reckless disregard.[66] The district court found that the “reasonable diligence” standard in the Overpayment Rule “extends far beyond the False Claims Act,” and thus CMS acted beyond its statutory authority to “impose FCA consequences through regulation.”[67] In making this determination, the court observed that CMS had previously recognized the contours of the FCA in the preamble to a 2000 MA rule, which required certification to the “best knowledge, information and belief” of an insurer, with a sanction only in cases of “[a]ctual knowledge of falsity,” “reckless disregard,” or “deliberate ignorance.”[68] Thus, under the district court ruling, where the government or a whistleblower takes the position that an MAO did not know that a diagnosis code was unsupported, but should have known this fact, it is not enough to demonstrate that any “reasonable” person would have concluded through their diligence that the diagnosis code at issue should not have been submitted.

The D.C. Circuit not only highlighted, but appeared to take some comfort in, the fact that the federal government did not appeal this aspect of the district court’s ruling. For example, the court stated that while it was United’s position that “the Overpayment Rule essentially requires insurers to audit all of the data they submit to CMS (especially given the prospect of liability under the False Claims Act),” this “premise is unsupported.”[69] Indeed, the court asserted, “[n]othing in the Overpayment Rule obligates insurers to audit their reported data.” To the contrary, and “[a]s the district court held,” the Overpayment Rule “only requires insurers to refund amounts they know were overpayments, i.e., payments they are aware lack support in a beneficiary’s medical records. That limited scope does not impose a self-auditing mandate.”[70]

These statements at least suggest that in order for an overpayment tied to the submission of inaccurate risk adjustment data to be deemed “identified,” the MAO must have actual knowledge of the existence of the overpayment; that is, it is not enough for the government or a whistleblower to establish that but for the MAO’s “reckless disregard” or “deliberate ignorance” regarding the accuracy of its risk adjustment data, the MAO would have known of the existence of the overpayment. Time will tell whether the D.C. Circuit ultimately takes the position that it actually meant what it suggested or, alternatively, that these statements were merely dicta.

How Will the Standard for Identifying an Overpayment Be Applied?

In the interim, a second open question is this: now that we know the standard for “identified” is not negligence—and assuming for the sake of argument that a demonstration of “reckless disregard” or “deliberate ignorance” will, in fact, suffice—what actions (or inactions) on the part of MAOs, providers, and/or consultants actually rise to the level of “reckless disregard” or “deliberate ignorance”?

As noted above, there are a large and growing number of FCA risk adjustment cases currently being litigated.[71] In most of these cases, the principal allegations are not that the MAO knew, at the time it was submitting risk adjustment data to CMS, that the data was inaccurate. Nor for the most part are the allegations that at some point after submitting risk adjustment data to CMS, the MAO learned that its submission of risk adjustment data was inaccurate. Rather, the allegations are generally that (1) had the MAO done A or B (or had the MAO not done C or D), then the MAO would have obtained actual knowledge that inaccurate risk adjustment data had been submitted, and (2) this constructive knowledge is sufficient to establish “reckless disregard” and/or “deliberate ignorance.”

Against this backdrop, the government and whistleblowers have alleged that MAOs that have submitted inaccurate risk adjustment data also have done one or more of the following:

  • undertaken “one-way” retrospective chart reviews (i.e., looking for supported diagnosis codes to add) but not “two-way” reviews (i.e., looking both for supported diagnosis codes to add and unsupported diagnosis codes to delete);
  • failed to develop computer algorithms to find inaccurately reported diagnosis codes by comparing previously submitted codes against medical records;
  • identified chronic and other illnesses without any evidence of subsequent or related treatment and/or management of the enrollee’s condition;
  • emphasized internally the importance of maximizing the MAO’s revenues and profits;
  • utilized physician “champions” to communicate the importance of thorough diagnosis coding to their clinical colleagues;
  • prioritized MA patients over traditional Medicare beneficiaries in scheduling annual wellness visits in order to take advantage of the opportunity that such visits present to thoroughly diagnose a patient’s existing medical condition;
  • provided physicians with lists of diagnosis codes that are common to MA enrollees (such as diabetes) and likely to result in a higher risk score;
  • provided physicians with lists that identify potential chronic conditions the MA enrollee may have, which lists have been customized for each enrollee based on the information in their medical records and/or prior claims history;
  • asked physicians to evaluate whether their MA patients have particular conditions;
  • ignored complaints by physicians relating to the type and amount of work they are being asked to do relating to the search for (and identification of) diagnoses; and/or
  • failed to provide adequate compliance training programs for physicians related to diagnostic coding for the MA program.

The key question, then, is this: even assuming (1) these allegations are true, and (2) there is a causal relationship between these actions/inactions and the submission of inaccurate risk adjustment data, do these actions and/or inactions, either individually or collectively, rise to the level of “reckless disregard” or “deliberate ignorance” on the part of the MAO with respect to the accuracy of the risk adjustment data the MAO is submitting to CMS? With the sweeping arguments relating to the Actuarial Equivalence and Same Methodology Requirements now (seemingly) no longer available, we’re about to find out.

In the interim—i.e., as these cases work their way through the courts—MAOs should closely monitor the risk adjustment litigation and regulatory landscape and fine-tune their policies, procedures, and practices with regard to risk adjustment data submissions, taking into account (1) their duty to certify the accuracy of these submissions “to the best of their knowledge, information and belief,”[72] and (2) their general obligation to comply with their CMS contracts and to implement measures that prevent, detect, and correct fraud, waste, and abuse.[73] Navigating these waters will not be easy, but in light of the D.C. Circuit’s sweeping rejection of United’s equally sweeping Actuarial Equivalence and Same Methodology arguments, there do not appear to be any other alternatives.

The authors would like to thank Talia Linneman for her research assistance in connection with this article.

 

[1] The Overpayment Rule as originally promulgated provided that a MA insurer “has identified an overpayment when the [insurer] has determined, or should have determined through the exercise of reasonable diligence, that the [insurer] has received an overpayment.” 42 C.F.R. § 422.326(c) (emphasis added).

[2] UnitedHealthcare Ins. Co. v. Azar, 2021 WL 3573766, at *13 (D.C. Cir. Aug. 13, 2021) (emphasis in original).

[3] Id.

[4] As previously noted, the Overpayment Rule as originally promulgated provided that an MA insurer “has identified an overpayment when the [insurer] has determined, or should have determined through the exercise of reasonable diligence, that the [insurer] has received an overpayment.” 42 C.F.R. § 422.326(c). But as the D.C. Circuit explained:

section 1320a-7k(d)(3) of the Medicare statute provides that an overpayment that is not timely reported and returned ‘is an obligation (as defined in section 3729(b)(3) of title 31),’ i.e., the False Claims Act, under which liability requires proof of ‘knowingly’ submitting false claims for payment to the government, 31 U.S.C. § 3729(a). The False Claims Act defines ‘knowingly’ as having ‘actual knowledge’ or acting ‘in deliberate ignorance’ or ‘reckless disregard of the truth or falsity of the information.’ Id. § 3729(b)(1)(A).

UnitedHealthcare, 2021 WL 3573766, at *11.

[5] 42 U.S.C. § 1320a-7k(d).

[6] Id. § 1320a-7k(d)(4)(C).

[7] Id. § 1320a-7k(d)(3). The FCA provides that any person who knowingly submits a false claim to the government or knowingly conceals, avoids, or decreases an obligation to pay or transmit money to the federal government, is liable for a civil penalty and treble damages. See 31 U.S.C. § 3729.

[8] See 42 C.F.R. § 422.326; 79 Fed. Reg. 29844 (May 23, 2014). At the same time, CMS promulgated a similar rule in the Part D context governing Part D sponsor report-and-return obligations. 42 C.F.R. § 423.360; 79 Fed. Reg. 29844 (May 23, 2014). CMS also promulgated rules applying the statutory overpayment requirement to the Medicare fee-for-service program and the Medicaid managed care program. See 42 C.F.R. § 401.305; 81 Fed. Reg. 7654 (Feb. 12, 2016) (Medicare fee-for-service) and 42 C.F.R. § 438.608(a)(2), (d); 81 Fed. Reg. 27498 (May 6, 2016) (Medicaid managed care). Notably, despite the fact that each of the rules stem from the same statutory mandate, they differ in varying respects. For instance, while the MA, Part D, and traditional Medicare regulations implementing the overpayment report-and-return obligation each impose a reasonable diligence requirement, the regulation addressing overpayment reporting in the Medicaid managed care context does not. 

[9] 42 C.F.R. § 422.326(b), (d).

[10] Id. § 422.326(c).

[11] Id.

[12] Id. § 422.326(f). In terms of mechanics, the Rule requires that MAOs notify CMS using the process determined by CMS and return the overpayment in a manner specified by CMS. Id. § 422.326(d). In practical terms, then, if an MAO identifies a diagnosis it submitted to CMS that lacks support (e.g., because it is not properly documented in the beneficiary’s medical record), the Overpayment Rule, as implemented through CMS guidance, provides that the MAO must correct the previously submitted information. See Medicare Managed Care Manual, Ch. 7, Section 40 (Jan. 1, 2012). MAOs are deemed to have returned an overpayment when they have submitted corrected data that is the source of the overpayment. 79 Fed. Reg. 29844, 29921 (May 23, 2014). All diagnosis code deletions CMS receives by a specified deadline are included in a risk score rerun and the “return” of the overpayment is effectuated by routine CMS payment processes. See, e.g., 79 Fed. Reg. at 29921 (“[P]ayments will continue to be recovered through the established payment adjustment processes and schedules.”).

[13] Under Medicare Part A, CMS pays hospitals a fixed amount for an inpatient stay based on a beneficiary’s assigned Medicare Severity Diagnosis Related Group (MS-DRG). The MS-DRG is determined on the basis of the beneficiary’s various diagnoses at the time of discharge, as well as the services and procedures performed during the beneficiary’s inpatient stay, and (for some MS-DRGs), other demographic factors (including the patient’s gender, age, and discharge status disposition). Under Medicare Part B, CMS pays for outpatient items and services on a fee-for-service (FFS) basis.

[14] 42 U.S.C. § 1395w-23(a)(1)(A).

[15] Id. § 1395w-23(a)(1)(C)(i).

[16] See, e.g., CMS, Announcement of Calendar Year (CY) 2021 Medicare Advantage (MA) Capitation Rates and Part C and Part D Payment Policies (Apr. 6, 2020), https://www.cms.gov/files/document/2021-announcement.pdf (setting forth how CMS will apply the CMS-HCC risk adjustment model for CY2021).

[17] Medicare Payment Advisory Comm’n, Medicare Advantage Program Payment System, at 2 fig. 1, 3 (Oct. 2020), http://www.medpac.gov/docs/default-source/payment-basics/medpac_payment_basics_20_ma_final_sec.pdf?sfvrsn=0 (hereinafter MedPAC MA Payment Summary). The base payment rate for each MAO is equal to the lower of a county-specific benchmark published annually by CMS or the MAO’s annual bid submitted to and approved by CMS. See 42 U.S.C. § 1395w-23(a)(1)(B); MedPAC MA Payment Summary, at 1, 2 fig. 1; see also 42 C.F.R. § 422.254(a)(1) (requiring MAOs to submit an annual bid). The benchmark published by CMS is calculated under statutory formulas whereby county-level rates vary depending on average historic FFS spending (i.e., Medicare Part A and Part B) per Medicare beneficiary in the county at issue. See 42 U.S.C. § 1395w-23(j); MedPAC MA Payment Summary, at 1; see also Congressional Research Service, Medicare Advantage (MA)-Proposed Benchmark Update and Other Adjustments for CY2020: In Brief, at 3 (Feb. 7, 2019), https://www.everycrsreport.com/files/20190207_R45494_090e90209c67f2a124f6e85182619fc485e4c683.pdf. The calculation of the initial base payment rate depends on the specific county benchmark, which is determined annually using a statutory formula, and each MAO’s annual bid. If an MAO’s bid is at or above the benchmark, then its base payment rate is equal to the benchmark. If, however, an MAO’s bid falls below the benchmark, its base payment rate will be equal to its bid. The risk-adjustment model is then used to further tailor these base rates to the MA beneficiaries as described above. See generally 42 U.S.C. § 1395w-23; MedPAC MA Payment Summary.

[18] See Medicare Managed Care Manual, Ch. 7, Section 70.5.1 (Jan. 1, 2012) (“[A] risk score of 1.0 reflects the Medicare-incurred expenditures of an average beneficiary.”); see also id. at Section 70.1 (“The relative factors are used to calculate risk scores for individual beneficiaries, which will average 1.0 in the denominator year for the FFS population.”).

[19] See Medicare Managed Care Manual, Ch. 8, Section 60.2 (Nov. 2, 2007) (explaining that the monthly payment to MAOs is adjusted by the MA enrollee’s risk score).

[20] 42 U.S.C. § 1395w-23(b)(4)(D).

[21] 42 C.F.R. § 422.310(b); Medicare Managed Care Manual, Ch. 7, Section 40 (Jan. 1, 2012) (setting forth the risk adjustment data submission requirements).

[22] 42 U.S.C. § 1395w-23(a)(1)(C)(ii); see also CMS, Announcement of Calendar Year 2022 MA Capitation Rates and Part C and Part D Payment Policies, at 6 (Jan. 15, 2021), https://www.cms.gov/files/document/2022-announcement.pdf (setting the MA coding pattern adjustment at 5.9%, which is the statutory minimum, for calendar year 2021). Although CMS has the authority to impose a higher adjustment than the minimum required by statute, the agency has never done so. Medicare Payment Advisory Comm’n, Report to Congress: Medicare Payment Policy, at 368 (Mar. 2020), http://www.medpac.gov/docs/default-source/reports/mar20_entirereport_rev_sec.pdf?sfvrsn=0.

[23] CMS argued before the D.C. Circuit that providers under traditional Medicare “have no financial incentive to code diagnoses that are not needed to justify payment, so conditions that are not actively treated are likely to go unreported.” Final Brief for Defendants-Appellants at 45 n.3, UnitedHealthCare Ins. Co. v. Azar, 2021 WL 3573766 (D.C. Cir. Aug. 5, 2020) (No. 18-5326). Notably, payments to hospitals under Medicare Part A are based on the MS-DRG, which takes into account both certain diagnoses as well as procedures performed. Thus, while, Medicare Part A providers may not have as strong of an incentive as MAOs to report all potential diagnoses (e.g., those that might not drive MS-DRG assignment), it is not clear that such providers have no incentive to code diagnoses thoroughly.

[24] See R. Kronick and W.P. Welch, Measuring Coding Intensity in the Medicare Advantage Program, 4 MEDICARE & MEDICAID RESEARCH REVIEW, no. 2, 2014, at E3.

[25] 42 C.F.R. § 422.504(l) (“As a condition for receiving a monthly payment,” the MAO agrees that “its chief executive officer (CEO), chief financial officer (CFO), or an individual delegated the authority to sign on behalf of one of these officers, and who reports directly to such officer, must . . . certif[y] (based on best knowledge, information, and belief) the accuracy, completeness, and truthfulness of relevant data that CMS requests.”).

[26] See CMS, Contract-Level 15 Risk Adjustment Data Validation: Medical Record Reviewer Guidance In effect as of 01/10/2020, https://www.cms.gov/files/document/medical-record-reviewer-guidance-january-2020.pdf (outlining the RADV review procedures).

[27] See 42 C.F.R. § 422.330; see also id. § 422.311 (setting forth the RADV audit dispute and appeal processes).

[28] See 74 Fed. Reg. 54634, 54674 (Oct. 2, 2009) (discussing July 2008 guidance regarding recovery of contract-level payments); see also CMS, Announcement of Calendar Year 2009 Medicare Advantage Capitation Rates and Medicare Advantage and Part D Payment Policies, at 22 (Apr. 7, 2008), https://www.cms.gov/Medicare/Health-Plans/MedicareAdvtgSpecRateStats/downloads/Announcement2009.pdf (“[B]ecause we will have statistically-valid plan-level error estimates, we will make plan-level payment adjustments rather than adjustments to payments for specific beneficiaries whose risk scores were not supported by the medical record reviews, as we have done previously.”).

[29] See, e.g., Letter from Am. Academy of Actuaries to CMS (Jan. 21 2011), https://www.actuary.org/sites/default/files/files/RADV_comment_letter_012111_final.4.pdf/RADV_comment_letter_012111_final.4.pdf (“The CMS-HCC risk-adjustment factors were developed with FFS data that, to the best of our knowledge, were not validated or audited for accuracy. The proposed audit process, however, effectively would apply those factors only to MA data that are validated. In other words, the data used in the RADV audit to determine a plan’s payment error are fundamentally and materially different from the data used to develop the risk-adjustment model.”); see also UnitedHealthcare Ins. Co. v. Azar, 2021 WL 3573766, at *8 (D.C. Cir. Aug. 13, 2021) (summarizing commenters’ concerns).

[30] CMS, Notice of Final Payment Error Calculation Methodology for Part C Medicare Advantage Risk Adjustment Data Validation Contract-Level Audits, at 4-5 (Feb. 24, 2012), https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/recovery-audit-program-parts-c-and-d/Other-Content-Types/RADV-Docs/RADV-Methodology.pdf.

[31] Id. at 4.

[32] See Memorandum in Support of United’s Motion for Summary Judgment, UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173 (D.D.C. Oct. 17, 2017) (No. 1:16-cv-00157-RMC).

[33] See id.

[34] UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 184-87, 192 (D.D.C. 2018).

[35] Id. at 184.

[36] Id. at 187-90.

[37] Id. at 190-91.

[38] See 83 Fed. Reg. 54982, 55040 (Nov. 1, 2018).

[39] See UnitedHealthcare Ins. Co. v. Azar, 2021 WL 3573766, at *3 (D.C. Cir. Aug. 13, 2021).

[40] On September 27, 2021, United filed a Petition for Panel Rehearing urging the D.C. Circuit panel to correct its opinion, which United suggests "contain[s] an oversight and mistakenly order[s]" the district court “to enter judgment in favor of Appellants, without qualification, even though the government did not appeal all aspects of the district court’s decision” (i.e., with respect to the Overpayment Rule's negligence standard). Plaintiffs-Appellees’ Petition for Panel Rehearing to Correct the Instructions on Remand, UnitedHealthCare Ins. Co. v. Azar, 2021 WL 3573766 (D.C. Cir. Sept. 27, 2021) (No. 18-5326). In its petition, United also indicated that it is considering its options with regard to seeking further review of the D.C. Circuit opinion. As of publication of this article, those issues remain pending.

[41] 42 U.S.C. § 1395w-23(a)(1)(C)(i); see also UnitedHealthCare, 2021 WL 3573766 at *12.

[42] Final Brief for Plaintiffs-Appellees at 22-23, UnitedHealthCare Ins. Co. v. Azar, 2021 WL 3573766 (D.C. Cir. Aug. 5, 2020) (No. 18-5326).

[43] Id. at 29-30.

[44] UnitedHealthcare, 2021 WL 3573766 at *12.

[45] Id. at *2.

[46] Id. at *13.

[47] Id. at *14.

[48] Id. at *2.

[49] Id. at *15-18. The court also noted the fact that United had not challenged the Coding Intensity Adjuster in this case and had never challenged the accuracy of the risk-adjustment model in the annual publication process. Id. at *16.

[50] Id. at *16.

[51] Id.

[52] Id. at *18. As noted above, the study itself was described in connection with a proposed rule that CMS issued in November 2018 that would make certain changes to the risk adjustment data validation process. 83 Fed. Reg. 54982, 55040 (Nov. 1, 2018). Among other things, CMS indicated that it would be modifying its prior methodology to remove the FFS Adjuster. That regulation has not yet been finalized.

[53] UnitedHealthcare, 2021 WL 3573766 at *9, 16. Much of the court’s reasoning, and the high burden of proof to which United was held, also appears to have been driven by the court’s understanding of the different incentives on providers under traditional Medicare as compared to MA. On several occasions, the court referenced the fact that FFS providers are generally paid for items or services, rather than diagnoses, stating they had different financial incentives than MAOs. See, e.g., id. at *16.

[54] Id. at *16, 18.

[55] 42 U.S.C. § 1395w-23(b)(4)(D).

[56] UnitedHealthcare, 2021 WL 3573766 at *19.

[57] Final Brief for Plaintiffs-Appellees at 35, UnitedHealthCare Ins. Co. v. Azar, 2021 WL 3573766 (D.C. Cir. Aug. 5, 2020) (No. 18-5326).

[58] Id. at 35-37. The RADV program has been a series of stops and starts, with little clear guidance from CMS. For years, many MAOs reasonably believed that CMS would issue an adjustment amount in connection with such audits given the agency’s acknowledgment of the need for a FFS Adjuster in principle in 2012. As such, the 2018 report, which reversed the agency’s position on the FFS Adjuster, was a surprise to many.

[59] UnitedHealthcare, 2021 WL 3573766 at *20.

[60] Id. at *20 n.1. The court’s attempt to distinguish the RADV audit process as merely an “error correction mechanism” from the Overpayment Rule is difficult to understand as both processes are designed to recoup overpayments.

[61] See, e.g., United States ex rel. Ormsby v. Sutter Health, 444 F. Supp. 3d 1010 (N.D. Cal. 2020); United States ex rel. Poehling v. UnitedHealth, 2019 WL 2353125 (C.D. Cal. Mar. 28, 2019).

[62] The momentum for increased enforcement, particularly in situations where providers and MAOs are alleged to have manipulated the risk adjustment process for financial gain, already is evident in the government’s recent conduct, including the risk adjustment false claim litigation filed against Anthem in March 2020 and the government’s decision in July 2021 to intervene in six complaints alleging that Kaiser Permanente companies violated the FCA by submitting inaccurate diagnoses codes.

[63] See Michael D. Granston, Deputy Asst. Att’y Gen., U.S. Dep’t of Justice, Remarks at the ABA Civil False Claims Act and Qui Tam Enforcement Institute (Dec. 2, 2020), https://www.justice.gov/opa/speech/remarks-deputy-assistant-attorney-general-michael-d-granston-aba-civil-false-claims-act.

[64] Notably, approximately two weeks after the D.C. Circuit decision was issued, the U.S. Department of Justice and Sutter Health announced a $90 million settlement in a long-standing risk adjustment case. See U.S. Dep’t of Justice, “Sutter Health and Affiliates to Pay $90 Million to Settle False Claims Act Allegations of Mischarging the Medicare Advantage Program” (Aug. 30, 2021), https://www.justice.gov/opa/pr/sutter-health-and-affiliates-pay-90-million-settle-false-claims-act-allegations-mischarging. While that case involved a provider (rather than an MAO), there is reason to believe that the volume of settlements will increase in the health plan risk adjustment context as well.

[65] UnitedHealthcare Ins. Co. v. Azar, 2021 WL 3573766, at *15 (D.C. Cir. Aug. 13, 2021).

[66] 31 U.S.C. § 3729(b)(1)(A).

[67] UnitedHealthcare Ins. Co. v. Azar, 330 F. Supp. 3d 173, 191 (D.D.C. 2018).

[68] Id.

[69] UnitedHealthcare Ins. Co. v. Azar, 2021 WL 3573766, at *13 (D.C. Cir. Aug. 13, 2021).

[70] Id. (emphasis in original).

[71] See, e.g., United States ex rel. Poehling v. UnitedHealth Group Inc., No. 2:16-cv-8697 (C.D. Cal.); United States ex rel. Ross v. Indep. Health Ass’n, No. 12-CV-0299 (W.D.N.Y); United States ex rel. Ormsby v. Sutter Health, No. 15-cv-01062 (N.D. Cal.); United States ex rel. Cutler v. Cigna Corp., No. 7:17-cv-07515 (S.D.N.Y.); United States v Anthem, Inc., No. 1:20-cv-02593 (S.D.N.Y.).

[72] 42 C.F.R. § 422.504(l)

[73] Id. § 422.503(b)(4)(vi).