The 60-Day Overpayment Rule

The 60-day overpayment rule is short in the statute and large in consequence. It comes from the Affordable Care Act, which added section 1128J(d) to the Social Security Act — codified at 42 U.S.C. § 1320a-7k(d) — and it says that a person who has received an overpayment must do three things: report it, return it, and notify the payer in writing of the reason for the overpayment. Reporting without returning is not enough, and returning without an explanation is not enough; the duty is all three.

The duty runs to whoever administers the money — the Secretary of HHS, the state, or the Medicare Administrative Contractor that processes the practice's claims, “as appropriate, at the correct address.” Its defining feature is that it is self-executing: the practice does not wait to be asked. That is what separates it from a recoupment, which runs the other direction — a contractor identifies an overpayment and demands or withholds it. Those contractor-initiated mechanics are the subject of a separate article on Medicare overpayments and recoupment; this rule is about the money a practice finds on its own.

The statute sets the deadline as the later of two dates: the date 60 days after the overpayment was identified, or the date any corresponding cost report is due, if applicable. “The later of” means a practice gets whichever date is further out — the cost-report prong can only extend the deadline, never shorten it below the 60-day mark.

The two prongs exist because providers settle with Medicare in different ways. A facility that files an annual Medicare cost report reconciles certain amounts through that report, so the rule lets the cost-report deadline control where it genuinely applies. A physician practice, supplier, or other charge-based biller does not file a cost report for its claims, so for most billing operations there is only one operative deadline: 60 days, measured from the moment the overpayment was identified. Knowing which prong applies is mostly a matter of knowing whether the entity files a cost report at all.

Everything turns on identification, because that is what starts the clock — and what “identified” means changed recently, so it is worth stating the current standard plainly. Under a CMS rule effective January 1, 2025, a person has identified an overpayment when the person knowingly receives or retains it. “Knowingly” carries the False Claims Act's meaning: actual knowledge that there is an overpayment, deliberate ignorance of the truth, or reckless disregard of the truth. No proof of specific intent to defraud is required.

That is a change from how the rule first read. When CMS implemented the requirement for Medicare Parts A and B in 2016, it defined identification differently: a person had identified an overpayment when the person had, or should have through the exercise of “reasonable diligence,” determined that it received an overpayment and quantified the amount. The 2025 amendment replaced that reasonable-diligence formulation with the knowing standard above. A practice reading older guidance should know the operative test today is the knowing one — but the practical center of gravity is unchanged in one crucial respect: a practice cannot escape the clock by looking away. Deliberate ignorance and reckless disregard both count, so a habit of not investigating credible signs of an overpayment does not keep the duty from attaching.

In operational terms, the thing that triggers the duty is credible information: a finding from one of the Medicare audit programs, the result of a self-audit, a run of duplicate remittances, a coding error surfaced on review. The knowing standard means such a signal is acted on, not filed for later. The practice that treats a credible indication of an overpayment as something to investigate promptly is doing exactly what the standard expects; the one that treats it as something to ignore is taking on the risk the standard was written to reach.

A deadline with no consequence for missing it would be advisory. What gives the 60-day rule force is its final provision: any overpayment retained past the deadline is an “obligation” for purposes of the False Claims Act. That one sentence is the bridge the Affordable Care Act built between an ordinary billing error and federal fraud liability.

The bridge works through the False Claims Act's own definitions. The Act defines an “obligation” to include, in as many words, “the retention of any overpayment,” and it imposes liability on anyone who “knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay or transmit money” to the government. That second kind of violation — avoiding money owed back to the government rather than extracting money wrongly — is the reverse false claim. So an identified overpayment that a practice keeps past the deadline is transformed, by operation of the statute, into a potential reverse false claim.

The exposure is not only the money. A False Claims Act matter can be pursued by the government or by a whistleblower, it carries penalties well beyond the amount retained, and the fraud-and-abuse consequences that can follow a serious case include exclusion from the federal programs. The False Claims Act is a subject in its own right — the same statute is why a claim tainted by an Anti-Kickback Statute violation is itself treated as a false claim — but for the 60-day rule the point is narrow and sharp: the failure to return an identified overpayment on time is the conduct the reverse-false-claim provision reaches.

Two boundaries keep the rule in proportion. The first is the lookback period. CMS's Medicare Parts A and B rule (42 CFR § 401.305) requires a practice to report and return an overpayment only if it identifies the overpayment within 6 years of the date the overpayment was received. An older error that has not been identified sits outside the rule's reach — the lookback is a real limit, not a formality.

The second boundary is which program is involved. The statute covers both Medicare and Medicaid, but the detailed CMS rule at 42 CFR § 401.305 is the Medicare fee-for-service (Parts A and B) rule. Medicare Advantage (Part C) and the prescription drug benefit (Part D) are governed by separate CMS rules. And a Medicaid overpayment is returned through the state Medicaid agency's process, which varies from state to state — the way to find the mechanics that apply is the state's own provider manual and regulations, not a single federal procedure. The duty to return is federal; the how and where, for Medicaid, is state-specific.

The rule names a duty, not a single form. In Medicare fee-for-service, a practice reports and returns an identified overpayment through the applicable process its Medicare contractor sets out — typically a claims adjustment, a credit-balance report, a self-reported refund, or another established reporting channel — and includes the written explanation of the reason the statute requires. The mechanics are the contractor's; the deadline and the duty are the law's.

1. 01

   Surface it

   Build detection into routine work. A recurring credit-balance review and periodic self-audits are how most overpayments come to light before anyone outside the practice sees them. Posting a credit balance correctly — the subject of underpayments and overpayments in payment posting — is the first step, not the whole duty; an accurately posted credit balance still has to be evaluated and, if it is an overpayment, returned.
2. 02

   Quantify what you can, and do not stall

   Determine the amount owed. Because the knowing standard can attach before the figure is final, a good-faith, timely investigation is what the rule expects — and documenting when the overpayment was identified and what the practice did next is how it later shows the return was on time.
3. 03

   Return it through the contractor's process, with the reason in writing

   Use the claims-adjustment, credit-balance, or self-reported-refund path the contractor specifies, and state the reason for the overpayment as the statute requires. Keep the record of what was returned, when, and why.
4. 04

   Escalate the ones that are bigger than a refund

   Some overpayments signal a systemic problem or a potential fraud-and-abuse issue rather than a one-off error. Those belong with the practice's compliance program and counsel, and a formal disclosure route may fit — the OIG Self-Disclosure Protocol, or, for a physician self-referral (Stark) issue, CMS's self-referral disclosure protocol. A submission the agency has acknowledged suspends the return deadline while it is worked, which is one reason to route the hard cases rather than improvise them.

The distinction worth holding onto: posting a credit balance is an accounting action, and responding to a contractor's demand is a recovery action, but reporting and returning an identified overpayment is a compliance action with its own deadline. A practice can do the first two flawlessly and still miss the third.

For a billing team, the 60-day rule turns credit balances and self-audit findings from housekeeping into a clock. The practical work is making sure an identified overpayment is recognized as one, routed, and returned before the deadline — and that the practice can show it did.

• Treat a confirmed overpayment as a dated event. When a review confirms the practice kept money it was not entitled to, record when it was identified. That date — not the day someone gets around to it — is what the deadline runs from.
• Make credit-balance review routine, not occasional. An unreviewed credit balance is an unreturned overpayment waiting to be found by someone else, on someone else's timeline.
• Do not investigate by declining to investigate. The knowing standard reaches deliberate ignorance and reckless disregard, so a credible sign of an overpayment is something to look into promptly, not to set aside.
• Route the patterns to the compliance program. A single refund is a billing task; a recurring cause is a compliance one — and returning an identified overpayment is precisely the corrective action a program is built to take.