The Medicare 60-Day Overpayment Rule: How to Comply (and What Triggers Worse)

If you identified a Medicare overpayment, you have exactly 60 days from the date of identification to report and return it under section 1128J(d) of the Social Security Act, implemented at 42 CFR § 401.305. Missing the deadline converts the overpayment into a False Claims Act liability with treble damages and per-claim penalties.

What the rule actually requires

The 60-day overpayment rule comes from section 6402(a) of the Affordable Care Act, codified at 42 USC § 1320a-7k(d) and implemented for Medicare Parts A and B in the February 12, 2016 CMS final rule. Two things must happen within 60 days of identification: the overpayment must be reported (to the MAC, contractor, state, intermediary, or carrier as applicable) and the funds must be returned. Failure to do either converts the retained amount into an "obligation" under 31 USC § 3729(b)(3) — the False Claims Act's reverse-false-claim provision.

When the 60-day clock starts

This is the question that breaks most practices. The clock does not start when the suspicion forms. It starts when the overpayment is identified, which the regulation at 42 CFR § 401.305(a)(2)(2)) — as amended at 89 FR 98553 (2024) — defines as the date the provider "knowingly receives or retains" the overpayment. "Knowingly" carries the False Claims Act scienter meaning: actual knowledge, reckless disregard of the truth or falsity, or deliberate ignorance.

The 2024 amendment also added § 401.305(b)(3)(3)): when a provider conducts a timely, good-faith investigation of related overpayments arising from the same or similar conduct, the 60-day return deadline for the originally identified overpayment and the related overpayments under investigation is suspended for up to 180 days under § 401.305(b)(3)(ii). The suspension permits an aggregated refund at investigation conclusion (or at the end of the 180-day cap, whichever comes first), so the practice does not have to refund the initial overpayment piecemeal while the related scope is being quantified.

A practice that sits on a credible signal without acting can be deemed to have knowingly retained the overpayment through reckless disregard or deliberate ignorance — the 60-day clock then starts at the point where the knowing-retention standard is met. The 180-day investigation suspension is only available when the provider is actively and in good faith investigating.

A credible signal is anything that would put a reasonable provider on notice. Examples we see most often:

• An employee or contractor report through the compliance hotline
• A pattern flagged in internal coding audit
• A MAC informational letter or probe result
• A whistleblower demand letter
• A payer recoupment notice from a commercial payer that implicates the same coding pattern

The first 48 hours after identification

1. Quarantine the funds. If quantification is complete, the amount is no longer the practice's to deploy. Move it into a holding account or at minimum flag it in the financial system as non-disbursable.
2. Document the identification date. Memo to file with the date, the source of the signal, and the quantification calculation. This is the document OIG or a Relator will subpoena first.
3. Engage healthcare counsel under privilege. Self-disclosure pathways and refund mechanics carry False Claims Act exposure; counsel should drive the analysis.
4. Issue a litigation hold. No deletion of emails, billing-system records, audit notes, or vendor communications touching the affected claims.
5. Run the six-year lookback. 42 CFR § 401.305(f)) requires examination of overpayments received up to six years before identification. Scope the lookback to the affected coding pattern; do not boil the ocean.
6. Choose the refund pathway. The MAC voluntary-refund process is the default. The OIG Self-Disclosure Protocol (SDP) applies when the conduct potentially violates federal fraud or abuse laws beyond simple overpayment.

The refund mechanism: do not improvise

The applicable refund process is whichever your MAC publishes. Most MACs use a voluntary-refund form that requires the overpaid amount, the specific claims (HICN/MBI, dates of service, claim control numbers), the reason for the refund, and a check or electronic funds transfer.

What we have seen go wrong in real refund submissions:

• Self-netting against future claims instead of writing a check. This is not a return under the rule.
• Submitting the refund without identifying specific claims. The MAC cannot reconcile this and may return the funds, restarting the timing dispute.
• Filing the refund under one TIN when the affected claims billed under a different TIN.
• Treating the refund as the end of the analysis. The corrective action — coder retraining, edit rules, policy update — must follow and must be documented.

When the OIG Self-Disclosure Protocol applies instead

The OIG SDP is the pathway when the underlying conduct potentially violates the False Claims Act, the Anti-Kickback Statute, or the Civil Monetary Penalties Law — not for simple billing errors. Examples: improper financial relationships with referral sources, kickback arrangements, knowing submission of medically unnecessary services. SDP requires a written disclosure, a damages calculation using OIG's methodology, and typically results in a settlement at 1.5x single damages. Compare to a litigated False Claims Act case at treble plus per-claim penalties.

A simple coding error that produced an overpayment goes through the MAC refund process. An overpayment driven by potentially fraudulent conduct goes through OIG SDP. Counsel makes this call.

What converts an overpayment into a False Claims Act case

The False Claims Act at 31 USC § 3729(a)(1)(G) — the reverse-false-claims provision — imposes liability on a person who knowingly conceals or improperly avoids an obligation to pay money to the government. Under 31 USC § 3729(b)(3), an "obligation" includes the retention of an overpayment. Knowingly under 31 USC § 3729(b)(1) covers actual knowledge, reckless disregard, and deliberate ignorance.

The 2024 enforcement summary in the DOJ Civil Division fraud statistics showed healthcare cases accounting for over $1.8 billion of $2.9 billion in total FCA recoveries. The 60-day-rule pathway — known overpayment retained past 60 days — is one of the more straightforward FCA theories for a Relator to plead. Once a former employee or competitor files a qui tam complaint citing a known overpayment held more than 60 days, the practice is litigating, not refunding.

State-law overlay

Several states impose parallel or stricter Medicaid overpayment rules. New York Social Services Law § 363-d and 18 NYCRR Part 521 require Medicaid providers to refund within 60 days and run a compliance program. California Welfare and Institutions Code § 14107.4 and Medi-Cal provider bulletins impose refund obligations on identified Medi-Cal overpayments. Texas Human Resources Code § 32.039 governs Medicaid overpayment recovery with shorter administrative response timelines on demand letters. Check state-Medicaid manuals when an overpayment touches a state-program billing line.

Common mistakes that turn a refund into an investigation

• Pausing the refund pending a "complete" investigation. Refund the quantified amount; continue investigating the broader scope on a parallel track.
• Letting the COO or practice administrator "handle it" without counsel. The refund submission is itself a representation to the government.
• Forgetting that statistical extrapolation may apply on a lookback. Where overpayments are systemic, the MAC or contractor may extrapolate sample findings to the universe.
• Treating the refund as a confidentiality event. Workforce members reporting through the hotline retain whistleblower protections; sanctioning them is independently actionable.

When to engage healthcare counsel

Any overpayment over $50,000, any pattern that touches more than one payer, any signal that an employee or contractor has communicated with OIG or a qui tam plaintiff's firm, any matter where the underlying conduct could implicate the Anti-Kickback Statute or Stark Law. The cost of counsel on a routine refund is small compared to the cost of mis-routing an SDP matter through the MAC.

How d3rx fits

d3rx maintains the overpayment workflow inside the compliance binder: identification log, quantification worksheet, six-year lookback tracker, refund submission record, and corrective action documentation. The binder is a source-grounded administrative aid. It does not represent the practice before CMS or OIG, does not provide legal advice, and does not replace counsel. See audit defense for the broader audit-response surface, or the compliance binder overview for the binder structure.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.