The 60-Day Overpayment Rule: What Changed in 2025 and Why Finding an Error Starts a Clock

How Identification Now Works Under the False Claims Act Standard, What the Investigation Window Protects, and How to Build a Response Protocol Before You Need One

Introduction: The Moment a Billing Error Becomes a Legal Obligation

A coder flags a pattern during a routine internal review. A payer remittance shows a duplicate payment. A departing biller mentions that a particular code has been submitted incorrectly for months. An external audit returns findings on a sample of thirty claims.

In each case the practice has just crossed a line, and most practices do not recognize it at the time. What began as a billing question has become a federal legal obligation with a running deadline, and the consequences of mishandling the next sixty days are considerably more serious than the underlying error.

The obligation comes from what is commonly called the 60-Day Rule. A provider who receives Medicare or Medicaid funds to which it is not entitled must report and return those funds within 60 days of identifying the overpayment. Failure to do so does not simply leave the original error in place. It converts retention of the money into an independent violation of the False Claims Act, with treble damages and per-claim penalties attaching to conduct that had nothing to do with how the claim was originally submitted.

This is the mechanism by which an honest coding mistake becomes an enforcement matter. The original error may have been entirely inadvertent and carry no FCA exposure at all. Keeping the money after you knew about it is a separate act, and the government treats it as one.

The rule changed materially on January 1, 2025, and a great deal of the guidance practices are still operating from is now wrong. CMS replaced the standard for when an overpayment is considered identified, removed the requirement that the amount be quantified before the clock starts, and codified a defined investigation window. Practices working from the pre-2025 mental model, in which the deadline did not begin until an investigation had confirmed and calculated the overpayment, are exposed in a way they do not realize.

This guide covers what the rule requires, precisely what changed, how the new identification standard works in practice, when the deadline can legitimately be suspended, how far back the obligation reaches, how audit findings create obligations for claims no auditor ever reviewed, and how to build an internal protocol that handles all of this without improvisation.

The Statutory Framework

The obligation originates in Section 6402 of the Affordable Care Act, which added Section 1128J(d) to the Social Security Act, codified at 42 U.S.C. 1320a-7k(d). It requires a person who has received an overpayment to report and return it by the later of two dates: 60 days after the overpayment is identified, or the date any corresponding cost report is due, if applicable.

CMS implemented the statute through regulation in stages. A 2014 final rule addressed Medicare Advantage organizations and Part D prescription drug plan sponsors. A 2016 final rule, published at 81 FR 7683 on February 12, 2016, addressed Medicare Part A providers and Part B suppliers and is codified at 42 CFR 401.301 through 401.305. That framework was substantially amended effective January 1, 2025.

Who It Applies To

Providers, suppliers, Medicare Advantage organizations, and Part D plan sponsors. For a physician practice, this means essentially any entity billing Medicare or Medicaid, regardless of size or specialty.

The Cost Report Element

The alternative deadline tied to a corresponding cost report applies only to entities that file cost reports. CMS has clarified that applicable reconciliation is limited to cost report reconciliation, meaning the circumstance where a provider receives cost-based interim payments and reconciles them against actual reimbursable costs when the cost report comes due. For a typical physician practice, this branch of the deadline is not in play, and the operative deadline is 60 days after identification.

What Counts as an Overpayment

An overpayment is any funds received or retained under Medicare or Medicaid to which the person is not entitled after applicable reconciliation.

No amount is too small. The regulation contains no de minimis threshold. This surprises practices that assume small-dollar errors are administratively excused, and it is a meaningful part of why an identification-and-refund protocol matters more than case-by-case judgment.

Common sources in physician practices include:

• Coding errors, including services billed at a level the documentation does not support
• Billing for services not rendered or not documented
• Duplicate submissions and duplicate payments
• Credit balances arising from payer and patient payment overlap
• Services billed under the wrong provider, including claims billed under a provider not properly enrolled or reassigned
• Claims that failed to meet coverage or medical necessity criteria under the applicable determination
• Services rendered during a period when the provider was not credentialed or the enrollment was inactive
• Claims tainted by an underlying legal violation, including arrangements that do not satisfy Anti-Kickback Statute safe harbors or Stark Law exceptions
• Payments received after a payer has already paid, where coordination of benefits was misapplied

A Note on Credit Balances

Credit balances sitting unresolved on the practice’s aged report are overpayments the practice has already identified in any practical sense. Practices frequently carry these for months or years as an accounting nuisance rather than recognizing them as retained federal funds. This is among the most common and most easily corrected exposures in the entire rule.

What Changed on January 1, 2025

CMS finalized revisions to the overpayment regulations as part of the CY 2025 Medicare Physician Fee Schedule Final Rule, published in the Federal Register on December 9, 2024 and effective January 1, 2025. The amendment appears in the regulatory history of 42 CFR 401.305 at 89 FR 98553.

Two changes carry practical consequence:

• The definition of identified changed. The prior reasonable diligence standard was replaced with the False Claims Act definition of knowingly, meaning actual knowledge, reckless disregard, or deliberate ignorance.
• The quantification construct was removed. Under the prior framework, the clock did not start until the provider had both confirmed the overpayment and calculated its amount. That linkage is gone.

CMS also codified a defined suspension period for good faith investigation of related overpayments, which is discussed in its own section below.

The net effect is that the clock now starts earlier, on a standard borrowed from fraud law, and starts whether or not the practice yet knows how much money is involved.

The Old Standard: Reasonable Diligence and Quantification

Under the 2016 rule, an overpayment was identified when the provider had, or should have had through the exercise of reasonable diligence, determined that it received an overpayment and quantified the amount.

This produced a two-step sequence that practices found workable. Information surfaced. The practice conducted a reasonably diligent investigation, generally understood as taking up to six months absent extraordinary circumstances. When that investigation confirmed the overpayment and calculated its amount, the 60-day clock began.

The practical consequence was that a practice had roughly eight months from the first indication of a problem to the refund deadline. Many internal compliance protocols were built around exactly that assumption, and a fair number of them have not been updated.

The New Standard: The False Claims Act Definition of Knowingly

Effective January 1, 2025, an overpayment is identified when the person has knowledge of it within the meaning of the False Claims Act. That standard has three prongs:

• Actual knowledge that an overpayment was received
• Reckless disregard of the truth or falsity of information indicating an overpayment
• Deliberate ignorance of that information

CMS pointed providers to the existing body of False Claims Act case law for interpretation and characterized the question of whether a person has the requisite knowledge as a fact-specific inquiry.

The Duty to Investigate

The framing has inverted in a way that matters. The operative question is no longer whether there is credible evidence sufficient to justify an investigation. It is whether failing to investigate would itself constitute reckless disregard or deliberate ignorance under the FCA. If it would, the practice must investigate.

This is a genuinely different posture. Under the old standard, a practice receiving an ambiguous signal had latitude to weigh whether it warranted inquiry. Under the new standard, that ambiguous signal may itself create a duty, and choosing not to look becomes the thing that establishes knowledge.

The Protection Inside the Standard

There is an important counterweight. So long as the practice is actively investigating a potential overpayment, it has not yet knowingly identified one. Active, documented investigation is what distinguishes a practice working the problem from a practice ignoring it, and it is the difference between the two prongs of the standard.

CMS has also addressed the timing where the culpable state of mind is not actual knowledge. Where a provider acts in deliberate ignorance or reckless disregard, the 60-day period begins on the date the provider so acted, rather than on some later date of eventual acknowledgment. A practice cannot improve its position by delaying the moment it admits what it already had reason to know.

Why the Court Decision Behind the Change Matters

The revision did not originate in a desire to make life harder for providers. CMS stated that the update was intended to provide consistency across Medicare overpayment regulations in response to a federal district court decision addressing the Medicare Part C overpayment rule. That court held that the reasonable diligence standard impermissibly established False Claims Act liability for what amounted to mere negligence.

The logic is worth understanding because it cuts in providers’ favor on one axis. Reasonable diligence is an objective negligence standard: you should have known. The FCA scienter standard requires something more culpable than carelessness. In that narrow sense, the new standard is harder for the government to satisfy.

The trade is that the standard now attaches much earlier in the timeline and without the quantification safe harbor. A practice gains a marginally higher bar on culpability and loses several months of runway. For most practices the second effect dominates.

The Quantification Problem CMS Created

This is the most operationally awkward feature of the revised rule. The 60-day period runs from identification even if the practice has not yet calculated the precise amount of the overpayment.

CMS acknowledged the obvious tension. A practice cannot return an indefinite sum. As a practical matter, therefore, the amount must be calculated within the same 60 days in order to meet the deadline. What was previously a sequential process, investigate and quantify first and then run a 60-day return clock, is now a compressed parallel process in which investigation, quantification, and refund all have to fit inside the same window.

What This Means for Practice Operations

Sixty days is not a long time to scope a billing issue across multiple providers and years of claims, extract and validate the data, calculate the refund, prepare the submission, and execute it. Practices that have never done this before routinely discover that data extraction alone consumes several weeks.

The implication is that the internal protocol has to exist before it is needed. A practice designing its response process after identification has already spent part of its window on design.

Where the Suspension Provisions Become Essential

Given the compression, the suspension provisions described in the next two sections are not technicalities. They are the mechanism by which a practice facing a genuinely complex overpayment obtains the time to handle it properly, and knowing how to use them is a core competency for anyone managing this process.

When the 60-Day Deadline Can Be Suspended

The regulation provides for suspension of the deadline in defined circumstances. These are the practice’s principal tools when the sixty days are not workable.

Disclosure Under the OIG Self-Disclosure Protocol

The deadline is suspended once the OIG acknowledges receipt of a Self-Disclosure Protocol submission. Suspension continues for the duration of settlement negotiations. When negotiations conclude, or the provider is no longer actively engaged in the process, the suspension ends and the return obligation resumes.

Disclosure Under the CMS Voluntary Self-Referral Disclosure Protocol

The same structure applies to the SRDP, which is the pathway for actual or potential violations of the physician self-referral law. Upon submission, the obligation to return the disclosed overpayment within 60 days is suspended until a settlement agreement is entered, the provider withdraws, or CMS removes the provider from the protocol.

Notably, being already subject to a government inquiry, including an investigation, audit, or routine oversight activity, does not automatically preclude acceptance of an SRDP disclosure.

Good Faith Investigation of Related Overpayments

Addressed in the following section.

Satisfying the Obligation Through Settlement

A person satisfies the reporting obligations of the regulation by making a disclosure under the OIG SDP or the CMS SRDP that results in a settlement agreement through the process described in the respective protocol. Where that occurs, the disclosure pathway has discharged the reporting requirement rather than merely paused it.

The 180-Day Investigation Window

Alongside the identification change, CMS codified a suspension of the 60-day deadline for up to 180 days while a provider conducts a timely, good faith investigation into whether related overpayments exist arising from the same or similar cause or reason as the initially identified overpayment.

What the Window Is For

It addresses the scope problem. A practice that identifies one improperly billed claim will frequently suspect that the same error affected other claims. Determining how many, across which providers, over what period, is real analytical work. The window exists so that the practice can do that work without the initial identification forcing a premature and incomplete refund.

What It Requires

The investigation must be timely and conducted in good faith. Both words carry weight. A practice that identifies an overpayment and then does nothing for four months before beginning to look has not conducted a timely investigation, and the window is unlikely to protect it.

The related overpayments must arise from the same or similar cause or reason. The window is not a general extension applicable to any overpayment; it is scoped to the propagation of a single identified problem.

Documentation Is the Whole Game

Because the protection depends on the character of the investigation rather than on a filing, the practice’s contemporaneous documentation is what establishes entitlement to it. At minimum, record:

• The date and source of the initial identification, and what specifically was identified
• The date the investigation commenced and who authorized it
• The defined scope of the investigation and the reasoning behind that scope
• The methodology, including how claims were selected and reviewed
• A running record of work performed, with dates
• Findings, quantification, and the date the investigation concluded
• The refund calculation and the date and method of the return

A practice that can produce this file has a coherent account of its conduct. A practice that cannot is reconstructing its own good faith after the fact, which is a materially weaker position.

A Word of Caution

The interaction between the identification standard, the investigation window, and the 60-day deadline is technical and fact-specific. Where the potential exposure is material, the sequencing decisions should be made with qualified legal counsel rather than resolved internally by reference to a general description like this one.

The Six-Year Lookback

Under 42 CFR 401.305(f), an overpayment must be reported and returned if the person identifies it within six years of the date the overpayment was received.

Reading the Provision Correctly

The six years runs from receipt of the overpayment, not from identification. A practice identifying an issue today has an obligation reaching back six years from today for payments received in that window. Payments received more than six years ago fall outside the reporting and return requirement under this rule.

How Six Years Was Arrived At

The proposed rule contemplated a ten-year lookback, corresponding to the outer limit of the False Claims Act statute of limitations. CMS finalized six years in the 2016 rule at 81 FR 7671, a significant narrowing from the proposal.

The Practical Weight of Six Years

Six years of claims is a very large number for most practices. This is why scoping decisions in the investigation phase carry so much financial consequence, and why the same or similar cause language in the investigation window matters. An error correctly scoped to a single provider over eighteen months is a manageable refund. The same error scoped to every provider over six years is a different category of event.

Scoping should be driven by evidence of where the error actually propagated, documented accordingly, and not by either optimism or panic.

A Note on the SRDP

Self-referral overpayments reported to the SRDP were historically subject to a four-year timeframe drawn from the reopening regulations. Disclosures made on or after March 14, 2016 became subject to the six-year lookback under the final overpayment rule.

Reverse False Claims: What Retention Actually Triggers

The regulation states plainly that any overpayment retained after the reporting and return deadline is an obligation for purposes of 31 U.S.C. 3729.

That cross-reference is the entire enforcement mechanism. Under 31 U.S.C. 3729(a)(1)(G), the reverse false claims provision, a party incurs False Claims Act liability if it knowingly conceals, or knowingly and improperly avoids or decreases, an obligation to pay or transmit money to the government. Once the deadline passes with the money still in the practice’s account, the retained overpayment is such an obligation.

What This Means Financially

FCA exposure is not limited to returning the money. It includes treble damages and per-claim civil penalties, which for a practice with a large number of affected claims can dwarf the overpayment itself. It can also carry exclusion exposure and, in appropriate cases, corporate integrity agreement obligations.

The Point Most Practices Miss

The original billing error and the retention are separate acts with separate liability profiles. A coding error made without knowledge of its impropriety may carry no FCA exposure at all, because the FCA requires scienter and an honest mistake does not supply it.

Retention after identification is different. By definition the practice knows. The knowledge element that was absent from the original submission is present in the retention, which is precisely why the government finds these cases attractive: the hard element of proof has been supplied by the provider’s own conduct.

A practice that discovers a billing problem and handles it correctly has a repayment. The same practice sitting on the same finding has an enforcement matter.

The Scope Question: From One Claim to a Pattern

The hardest judgment in this entire area is deciding how far the obligation extends beyond the claim that surfaced it.

Why Scope Cannot Be Avoided

A practice that refunds only the single claim it happened to notice, while possessing information suggesting the same error occurred elsewhere, is exposed. The reckless disregard and deliberate ignorance prongs of the identification standard reach exactly this conduct. Refunding the visible claim and declining to look at the obvious neighbors is close to a textbook illustration of the standard.

A Framework for Scoping

• Characterize the error mechanism. Was it individual and idiosyncratic, or systemic? A single miskeyed entry is unlikely to have propagated. A template that omits a required element, a misconfigured charge rule, or a provider’s consistent documentation habit will have.
• Identify the population at risk. Determine which providers, which codes, which service lines, and which time periods the mechanism could plausibly have affected.
• Test before extrapolating. Review a defensible sample from the at-risk population to determine whether the error actually occurred there, rather than assuming it did or assuming it did not.
• Establish the temporal boundaries. Determine when the mechanism began, which is frequently traceable to a system change, a template revision, a provider start date, or a coding guideline update.
• Document the reasoning. The scope conclusion is a judgment. What protects it is the record of how it was reached.

On Statistical Extrapolation in Self-Disclosure

Where the affected population is too large to review claim by claim, statistical sampling and extrapolation may be used to estimate the refund. This is a legitimate and common approach, and the OIG Self-Disclosure Protocol contemplates it.

It should be done properly. A sampling methodology that is defensible in a self-disclosure requires genuine statistical competence, because the estimate the practice submits will be scrutinized and because an unsound methodology can produce a refund substantially larger than the actual exposure. The same expertise used to challenge a contractor’s extrapolation is used to construct the practice’s own.

The Audit Connection: How Findings Create Obligations Beyond the Sample

This is where the 60-Day Rule intersects with everything else in a practice’s compliance program, and it is routinely missed.

Retrospective Internal Audits

An internal retrospective audit that identifies improperly billed claims has, by design, produced knowledge. That knowledge starts the clock on the audited claims and raises the scope question for the unaudited population sharing the same characteristics.

This is not an argument against retrospective auditing. It is an argument for conducting it deliberately, with a defined response protocol ready, rather than commissioning an audit and then confronting the findings without a plan. Practices that understand this dynamic tend to weight their internal auditing toward prospective, pre-submission review, which prevents errors from becoming overpayments in the first place.

Contractor Audit Findings

When a Medicare contractor reviews thirty claims and denies six, the contractor will recover on those six. The practice then faces a separate question the contractor did not ask: do the same deficiencies exist in the claims that were not reviewed?

The contractor’s recovery does not discharge the practice’s independent obligation with respect to unreviewed claims. A practice that pays the contractor demand and does nothing further, while holding findings that plainly indicate a systemic issue, has an unresolved exposure that is larger than the demand it just satisfied.

Extrapolated Demands

Where a contractor has extrapolated, the projection may already cover the affected population, which changes the analysis. Where the practice successfully challenges the extrapolation and liability collapses to the sample, the underlying findings still exist and the scope question returns. Winning the extrapolation challenge is a favorable outcome that does not by itself resolve the reporting obligation for claims outside the sample.

Failed Educational Interventions

A practice that has been through multiple rounds of a probe-and-educate process without correcting its error rate has an extensively documented record of knowledge. That record is relevant both to the identification standard here and to the scienter analysis under the False Claims Act generally.

Choosing the Return Pathway

Three pathways exist and they are not interchangeable. Selecting the wrong one can forfeit protections or create unnecessary exposure.

Pathway One: Contractor Refund Process

The default. The regulation directs the use of an applicable claims adjustment, credit balance, self-reported refund, or other reporting process established by the Medicare contractor.

• Appropriate when: the overpayment results from ordinary billing or coding error with no underlying legal violation, the scope is defined, and the amount is calculable.
• Advantages: fastest, least costly, no negotiation, no admission beyond the billing correction itself.
• Limitations: does not suspend the 60-day deadline and does not resolve exposure where the overpayment arises from conduct implicating the Anti-Kickback Statute, the Stark Law, or other legal violations.

Pathway Two: OIG Self-Disclosure Protocol

The pathway for potential fraud and abuse violations, including Anti-Kickback Statute conduct and conduct implicating the civil monetary penalties authorities.

• Appropriate when: the overpayment arises from conduct that may violate federal fraud and abuse law rather than from billing error alone.
• Advantages: suspends the 60-day deadline upon OIG acknowledgment, can substantially reduce penalties relative to a government-initiated action, and demonstrates good faith.
• Limitations: involves negotiation, requires a damages calculation the OIG will scrutinize, takes time, and is an affirmative disclosure of potentially culpable conduct.

Pathway Three: CMS Voluntary Self-Referral Disclosure Protocol

The pathway specific to actual or potential violations of the physician self-referral law.

• Appropriate when: the overpayment arises from a financial relationship that does not satisfy a Stark Law exception.
• Advantages: suspends the 60-day obligation upon submission, provides a defined process, and CMS has authority to reduce amounts owed.
• Limitations: Stark-specific, requires detailed legal and financial analysis of the arrangement, and is subject to the six-year lookback for disclosures made on or after March 14, 2016.

The Selection Decision

This decision should be made with counsel. The threshold question is whether the overpayment stems purely from billing or coding error or from conduct with a legal dimension. That characterization drives the pathway, and characterizing a fraud and abuse matter as a simple billing error in order to use the faster route is a serious mistake that forfeits the protections the disclosure protocols provide.

Extended Repayment Schedules

Where the refund amount would create genuine financial hardship, an extended repayment schedule may be available through the Medicare contractor, allowing the obligation to be satisfied in installments.

Program rules address circumstances in which the total amount of outstanding overpayments not covered by an approved repayment schedule reaches a defined proportion of the provider’s Medicare payments for the relevant period, which is one of the triggers relevant to hardship consideration.

Two practical points. First, requesting an extended repayment schedule is a distinct process from reporting and returning the overpayment, and the reporting obligation is not satisfied by the request alone. Second, interest generally accrues on amounts repaid over time, so the schedule addresses liquidity rather than reducing the obligation.

Practices facing a refund large enough to threaten operations should evaluate the repayment schedule option early rather than treating it as a fallback after the deadline has passed.

Building an Internal Identification and Refund Protocol

Given a 60-day clock that starts on knowledge rather than on quantification, the protocol has to exist in advance. The following is a workable structure.

Step 1: Define What Triggers the Protocol

Write down the events that require escalation to the compliance officer. Typical triggers include internal audit findings, external audit findings, payer refund requests, unresolved credit balances above a defined age, employee reports of billing irregularities, denial patterns suggesting systemic error, and coding review findings.

The point of a written trigger list is that it removes discretion at the moment discretion is least reliable.

Step 2: Establish a Single Intake Point

Every trigger routes to one accountable individual, normally the compliance officer, who logs the date received and the source. That log entry is the beginning of the documentation file and frequently becomes the reference point for the entire timeline.

Step 3: Make a Prompt Investigation Decision

Within days, not weeks, determine whether the information warrants investigation. Under the current standard, the question is whether failing to investigate could constitute reckless disregard or deliberate ignorance. Document the determination and its basis either way, including where the decision is that no investigation is warranted.

Step 4: Scope and Commence the Investigation

Define the scope in writing with reasoning, assign responsibility, and begin. Timeliness is a legal element, not merely good practice, and the commencement date should be recorded.

Step 5: Determine Whether Counsel Should Be Involved

Engage counsel where the potential overpayment is material, where the conduct may implicate fraud and abuse law, where a disclosure protocol may be appropriate, or where the scope reaches multiple providers or multiple years.

Step 6: Quantify

Calculate the refund, using statistically sound sampling where claim-by-claim review is impractical. Retain the methodology and the underlying data.

Step 7: Select the Pathway and Execute

Choose among the contractor refund process, the OIG SDP, and the CMS SRDP, execute the return, and retain proof of the submission and the date.

Step 8: Remediate the Cause

Returning the money without fixing the mechanism guarantees recurrence, and recurrence after a documented identification is substantially worse than the original error. Correct the template, the workflow, the system configuration, or the documentation practice, retrain the responsible individuals, and verify the fix by auditing post-remediation claims.

Step 9: Close the File

Assemble the complete record: trigger, decision, scope, methodology, findings, calculation, pathway, submission, and remediation. Retain it for at least six years consistent with the lookback period, and preferably longer.

Common Mistakes

• Operating on the pre-2025 framework. Assuming the clock does not start until the amount is quantified. That linkage was removed effective January 1, 2025.
• Waiting to investigate. Delay is itself the conduct the reckless disregard and deliberate ignorance prongs are designed to capture.
• Refunding only the claim that surfaced. Where information indicates the error propagated, ignoring the related population is exposure rather than restraint.
• Investigating without documenting. The investigation window protects a practice that can demonstrate a timely, good faith investigation. Undocumented diligence is difficult to demonstrate.
• Carrying unresolved credit balances. These are retained federal funds sitting on an aging report, and they are among the easiest exposures to eliminate.
• Treating a fraud and abuse matter as a billing error. Using the contractor refund process for conduct implicating the Anti-Kickback Statute or Stark Law forfeits the disclosure protocols’ protections.
• Assuming a contractor’s recovery resolves everything. Paying an audit demand does not discharge the independent obligation for unreviewed claims sharing the same defect.
• Extrapolating without statistical competence. An unsound methodology in a self-disclosure can produce a refund materially larger than the actual exposure, and it will be scrutinized.
• Applying a de minimis threshold that does not exist. The regulation contains no small-dollar exemption.
• Refunding without remediating. The same error recurring after a documented identification is a materially worse fact pattern than the original.

How DoctorsManagement Supports Overpayment Identification and Response

The 60-Day Rule sits at the intersection of coding, statistics, compliance program design, and legal strategy. DoctorsManagement is a healthcare consulting, accounting, and auditing firm, and we provide the analytical components of that work alongside your legal counsel, who should make the disclosure pathway and characterization decisions.

Our auditors hold both the Certified Professional Coder and Certified Professional Medical Auditor credentials and receive ongoing training through NAMAS, our education division. For matters requiring statistical estimation, our team includes statisticians, economists, and data analysts.

Services relevant to overpayment identification and response include:

• Coding and Documentation Review: Independent determination of whether an overpayment actually exists, which is the threshold question and frequently resolves matters where the initial concern proves unfounded
• Scope Analysis: Characterization of the error mechanism, identification of the population at risk, and defensible sampling to determine actual propagation before a refund is scoped
• Statistical Estimation: Sound sampling methodology and damage calculation where claim-by-claim review is impractical, prepared to withstand scrutiny in a self-disclosure
• Self-Disclosure Support: Damage quantification and supporting analysis for OIG SDP and CMS SRDP submissions, working with your counsel
• Audit Response and Defense: Contractor audit representation, appeal support, and extrapolation challenge, including analysis of what contractor findings imply for unreviewed claims
• Compliance Program Development: Design of the identification, escalation, investigation, and refund protocol, along with the documentation standards that make the investigation window usable
• Remediation and Training: Root cause correction, provider and coder training, and post-remediation verification auditing

What We Do Not Do

We are not a law firm and we do not practice law. We do not determine whether conduct violates the Anti-Kickback Statute or Stark Law, select the disclosure pathway as a legal matter, negotiate settlements, or provide legal advice. Those decisions require an attorney experienced in healthcare fraud and abuse matters, and we work alongside counsel rather than in place of one.

If your practice has identified a potential overpayment, contact DoctorsManagement at www.doctorsmanagement.com/audit-appeal-defense or call (800) 635-4040. The clock runs from identification, which means the analytical work should begin immediately.

Frequently Asked Questions

What is the 60-Day Overpayment Rule?

It requires providers who receive Medicare or Medicaid funds to which they are not entitled to report and return those funds by the later of 60 days after the overpayment is identified or the date any corresponding cost report is due. It originates in Section 6402 of the Affordable Care Act, is codified at 42 U.S.C. 1320a-7k(d), and is implemented at 42 CFR 401.301 through 401.305. Retaining an overpayment past the deadline creates False Claims Act liability.

What changed on January 1, 2025?

Two things. The definition of identified changed from the reasonable diligence standard to the False Claims Act definition of knowingly, meaning actual knowledge, reckless disregard, or deliberate ignorance. And the quantification requirement was removed, so the 60-day clock now starts on identification even if the practice has not calculated the amount. CMS also codified a suspension of up to 180 days for good faith investigation of related overpayments.

When exactly does the clock start?

When the practice has knowledge of the overpayment under the FCA standard. Where the culpable state is deliberate ignorance or reckless disregard rather than actual knowledge, CMS has indicated the period begins on the date the provider acted with that state of mind, not on a later date of acknowledgment. Importantly, a practice that is actively investigating a potential overpayment has not yet knowingly identified one.

Do I have to return the money before I know how much it is?

The clock runs from identification regardless of quantification, and CMS acknowledged that as a practical matter the amount must therefore be calculated within the same 60 days. Where the scope is genuinely complex, the 180-day investigation window for related overpayments and the suspension available through the OIG SDP or CMS SRDP are the mechanisms for obtaining additional time.

How far back do I have to look?

Six years from the date the overpayment was received, under 42 CFR 401.305(f). Note that the period runs from receipt of the payment, not from the date of identification. The proposed rule had contemplated ten years, matching the outer FCA limitations period, before CMS finalized six.

Is there a minimum dollar amount below which the rule does not apply?

No. The regulation contains no de minimis threshold. This is one reason a standing protocol works better than case-by-case judgment, and it is why unresolved credit balances deserve more attention than practices typically give them.

If a Medicare contractor already recovered on audited claims, am I done?

Not necessarily. The contractor’s recovery addresses the claims it reviewed. If the findings indicate the same defect exists in claims the contractor did not review, the practice has an independent obligation with respect to those claims. Paying the demand and taking no further action while holding findings that plainly suggest a systemic issue leaves exposure unresolved.

Which disclosure pathway should I use?

It depends on the nature of the conduct, and the decision should be made with counsel. Ordinary billing and coding errors generally go through the Medicare contractor’s refund process. Conduct potentially violating fraud and abuse law goes to the OIG Self-Disclosure Protocol. Conduct implicating the physician self-referral law goes to the CMS Voluntary Self-Referral Disclosure Protocol. Both disclosure protocols suspend the 60-day deadline; the contractor refund process does not.

Can I use statistical sampling to calculate the refund?

Yes, and it is common where the affected population is too large for claim-by-claim review. The methodology must be statistically sound, because the estimate will be scrutinized and because an unsound approach can produce a refund materially larger than the actual exposure. This requires genuine statistical competence rather than a spreadsheet estimate.

What if returning the overpayment would put the practice in financial distress?

An extended repayment schedule may be available through the Medicare contractor, allowing payment in installments. Requesting one is a separate process from reporting and returning, and interest generally accrues, so it addresses liquidity rather than reducing the obligation. Evaluate it early rather than after the deadline has passed.

How can DoctorsManagement help?

We provide independent coding review to determine whether an overpayment exists, scope analysis and defensible sampling, statistical damage estimation for self-disclosures, audit response and extrapolation challenge, compliance protocol design, and root cause remediation. We are not a law firm and work alongside your counsel, who should make the pathway and legal characterization decisions. Contact us at www.doctorsmanagement.com/contact-us or call (800) 635-4040.

External Resources and References

• 42 CFR 401.305: Requirements for Reporting and Returning of Overpayments
• CMS Medicare Overpayments Fact Sheet (MLN006379)
• CMS Medicare Financial Management Manual, Chapter 4: Debt Collection
• OIG Self-Disclosure Information
• CMS Voluntary Self-Referral Disclosure Protocol
• CMS Physician Self-Referral Overview
• Department of Justice: The False Claims Act
• OIG Fraud and Abuse Laws for Physicians
• OIG Work Plan
• CMS Regulations and Guidance
• DoctorsManagement Audit Appeal and Defense
• DoctorsManagement Coding and Documentation Review
• DoctorsManagement Healthcare Compliance Audit
• DoctorsManagement Total Compliance Solution

The overpayment regulations were substantially amended effective January 1, 2025 and remain subject to further revision and to evolving judicial interpretation. The application of the identification standard, the investigation suspension, and the lookback period is fact-specific. Practices that identify a potential overpayment should promptly consult qualified healthcare counsel. DoctorsManagement is available to provide the coding, auditing, statistical, and compliance program components of the response.

Contact Us

This article is provided for informational and educational purposes only and does not constitute legal advice. DoctorsManagement is a healthcare consulting, accounting, and auditing firm. It is not a law firm and does not practice law, determine whether conduct violates federal fraud and abuse law, select disclosure pathways as a legal matter, or negotiate settlements.

The post The 60-Day Overpayment Rule: What Changed in 2025 and Why Finding an Error Starts a Clock appeared first on DoctorsManagement.