The 60-Day Overpayment Rule: How to Report and Return Overpayments Found in Internal Audits

Internal audits are one of the most important tools a healthcare organization has to keep its billing accurate. But audits also create a legal obligation. When an audit uncovers an overpayment, federal law requires the provider to report and return it within a specific timeframe. Overpayments retained after the deadline can become an "obligation" under the False Claims Act, exposing the organization to treble damages and penalties.

This requirement is commonly called the 60-day overpayment rule. It comes from Section 1128J(d) of the Social Security Act, added by the Affordable Care Act, and is implemented for Medicare Parts A and B in CMS regulations at 42 CFR 401.305. CMS significantly revised the rule in the calendar year 2025 Physician Fee Schedule final rule, published December 9, 2024, changing when an overpayment is considered "identified" and adding a new way to suspend the 60-day deadline while a provider investigates related overpayments.

This article explains what the 60-day overpayment rule requires, how the 2025 changes work, how to handle overpayments found in internal audits, how to report and return overpayments, and common mistakes to avoid. It is educational and not legal advice. Organizations with significant overpayment questions should consult qualified legal counsel.

What Is an Overpayment?

Section 1128J(d)(4)(B) of the Social Security Act defines an overpayment as any funds that a person receives or retains under Medicare (Title XVIII) or Medicaid (Title XIX) to which the person, after applicable reconciliation, is not entitled.

Common causes of overpayments include:

• Billing for services that were not medically necessary or not adequately documented.

• Coding errors, such as upcoding or unbundling.

• Billing for services furnished by unqualified or unenrolled practitioners.

• Duplicate payments.

• Billing during a period when the provider or practitioner was not properly enrolled.

• Services furnished by an excluded individual.

• Claims resulting from arrangements that violate the Anti-Kickback Statute or the physician self-referral law.

• Cost report errors.

The Statutory Requirement

Under Section 1128J(d)(2) of the Social Security Act, an overpayment must be reported and returned by the later of:

• The date that is 60 days after the date on which the overpayment was identified; or

• The date any corresponding cost report is due, if applicable.

Under Section 1128J(d)(3), any overpayment retained after the deadline is an "obligation" as defined in the False Claims Act at 31 U.S.C. 3729(b)(3). This is what connects the overpayment rule to potential False Claims Act liability.

When Is an Overpayment "Identified"? The 2025 Change

The Previous Standard

Under CMS's 2016 rule, a person identified an overpayment when the person had, or should have, through the exercise of reasonable diligence, determined that the person received an overpayment and quantified the amount. CMS's 2016 fact sheet also explained that providers could take time to investigate and quantify overpayments.

The Current Standard

In the CY 2025 Physician Fee Schedule final rule, CMS removed the "reasonable diligence" standard and adopted the False Claims Act definitions of "knowing" and "knowingly." CMS explained that this aligns the regulation with Section 1128J(d)(4)(A) of the Social Security Act, which provides that those terms have the meaning given in the False Claims Act. The change applies to Medicare Parts A, B, C, and D.

Under the current 42 CFR 401.305(a)(2), a person has identified an overpayment when the person knowingly receives or retains an overpayment. Under the False Claims Act, "knowingly" means having actual knowledge, acting in deliberate ignorance, or acting in reckless disregard of the truth or falsity of information.

In practical terms, this means a provider cannot avoid the obligation by choosing not to look. Ignoring credible information that suggests an overpayment may be treated as deliberate ignorance or reckless disregard.

The 180-Day Investigation Suspension

Because the new identification standard removed the previous built-in time to investigate and quantify, CMS added a provision allowing the 60-day deadline to be suspended while a provider conducts a timely, good-faith investigation.

Under 42 CFR 401.305(b)(3), the deadline for reporting and returning overpayments is suspended when a person has identified an overpayment but has not yet completed a timely, good-faith investigation to determine whether there are related overpayments arising from the same or similar cause or reason. The suspension applies to the initially identified overpayment and related overpayments.

The suspension lasts until the earlier of:

• The date the investigation of related overpayments concludes and the aggregate amount of the initially identified and related overpayments is calculated; or

• The date that is 180 days after the date the initial overpayment was identified.

When the suspension ends, the provider has the remainder of the 60-day period to report and return the overpayments. Taken together, this gives providers up to about 240 days from identification in situations where a timely, good-faith investigation of related overpayments is underway.

What "Timely" and "Good-Faith" Mean in Practice

The regulation does not provide a detailed checklist, so organizations should be prepared to show that their investigation was real and moving forward. Helpful practices include:

• Opening the investigation promptly after the initial overpayment is identified.

• Defining the scope, time period, and methods in writing.

• Assigning responsible individuals and deadlines.

• Keeping records of the work performed.

• Using appropriate sampling or full review methods.

• Concluding and quantifying as soon as reasonably possible, without waiting until the 180-day limit simply because it is available.

Other Suspensions

The regulation also suspends the deadline when CMS acknowledges receipt of a submission to the HHS-OIG Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol, as applicable, and when a person requests an extended repayment schedule, until CMS or its contractor rejects the request or the provider fails to comply with its terms.

The Six-Year Lookback Period

CMS's rule requires overpayments to be reported and returned if a person identifies the overpayment within six years of the date the overpayment was received. In practice, this means internal audits and investigations should consider claims going back up to six years when determining the scope of related overpayments.

How Internal Audits Trigger the Rule

Internal audits frequently uncover the kinds of facts that can lead to an identified overpayment. Consider these common scenarios:

Scenario 1: A Routine Audit Finds Errors in a Sample

A coding audit of 50 claims finds that 10 were billed at a higher level than documented. The organization now has credible information that overpayments exist for those 10 claims and possibly for other claims coded by the same individuals during the same period. The organization should treat the 10 claims as identified overpayments and determine whether a timely, good-faith investigation of related claims is warranted, which may suspend the deadline.

Scenario 2: An Excluded Employee Is Discovered

Screening reveals that an employee has been on the HHS-OIG List of Excluded Individuals and Entities for several months. Items and services furnished, ordered, or prescribed by an excluded individual are generally not payable by federal health care programs. The organization must determine the affected claims and evaluate whether to use the OIG Self-Disclosure Protocol, which has specific guidance for employment of excluded individuals.

Scenario 3: A Contractor Review Reveals a Pattern

A Medicare Administrative Contractor's Targeted Probe and Educate review finds documentation errors in a sample of claims. Even though the contractor addresses the sampled claims, the findings may provide credible information that similar errors exist in claims outside the sample. The organization should evaluate whether additional overpayments must be identified and returned.

Scenario 4: A Financial Arrangement Problem Surfaces

A review of physician contracts finds an arrangement that may not meet a physician self-referral law exception. Claims resulting from a prohibited referral may be overpayments. Organizations should consult counsel and consider the CMS Voluntary Self-Referral Disclosure Protocol.

Step-by-Step: Handling an Overpayment Found in an Internal Audit

Step 1: Document the Date of Identification

Record the date the organization first had credible information that an overpayment exists. This date starts the clock under 42 CFR 401.305(b).

Step 2: Escalate to Compliance and Counsel

Notify the compliance officer immediately. For significant amounts, potential fraud, excluded individuals, or financial arrangement issues, involve legal counsel.

Step 3: Decide Whether a Related-Overpayment Investigation Is Needed

Determine whether the issue may affect other claims arising from the same or similar cause, such as the same coder, service line, policy, or time period. If so, open a timely, good-faith investigation and document its scope and timeline.

Step 4: Quantify the Overpayment

Determine the amount of the overpayment using appropriate methods, such as claim-by-claim review or statistically valid sampling and extrapolation. Document the methodology. For larger matters, consider using a qualified statistician.

Step 5: Choose the Right Reporting Method

Options include:

• Claim adjustments or voided claims for specific claims, where appropriate.

• The Medicare Administrative Contractor's voluntary refund process, using the contractor's refund form and instructions.

• A cost report submission or amendment, where the overpayment relates to cost-reported items.

• The HHS-OIG Health Care Fraud Self-Disclosure Protocol, for conduct that potentially violates federal criminal, civil, or administrative law.

• The CMS Voluntary Self-Referral Disclosure Protocol, for potential physician self-referral law violations.

• For potentially criminal conduct, voluntary self-disclosure to the Department of Justice under the joint policy announced by DOJ's National Fraud Enforcement Division and HHS-OIG in October 2026.

The right choice depends on the facts and should be made with counsel when there is any potential fraud or legal violation beyond simple billing error.

Step 6: Report and Return on Time

Submit the report and payment before the applicable deadline, considering any suspension. If the organization cannot repay in full, consider requesting an extended repayment schedule under 42 CFR 401.607, which also suspends the reporting deadline under 401.305(b)(2)(iii) as described in the regulation.

Step 7: Correct the Root Cause

Implement corrective action, such as retraining staff, updating policies, changing system edits, or modifying contracts, and monitor to confirm that the problem has been fixed.

Step 8: Keep a Complete Record

Maintain documentation of the identification date, investigation, quantification, reporting, repayment, and corrective actions. This record demonstrates good faith if questions arise later.

A Worked Example: Following the Timeline

The following hypothetical example shows how the deadlines can work together.

On March 1, a physician practice's compliance officer receives the results of an external coding audit. The audit found that 12 of 60 sampled evaluation and management claims for one physician were billed at a higher level than the documentation supports. The practice now has knowledge of overpayments on those 12 claims, so March 1 is documented as the identification date.

The practice reasonably believes that the same physician's other claims during the same period may have similar problems. On March 5, it opens a written investigation covering the physician's evaluation and management claims for the previous three years, assigns a reviewer, and sets a target completion date. Because a timely, good-faith investigation of related overpayments is underway, the 60-day deadline is suspended.

The investigation, which uses a statistically valid sample and extrapolation, concludes on July 15, and the aggregate overpayment is calculated. Because the investigation concluded before the 180-day limit, which would have been late August, the suspension ends on July 15. The practice then has the remainder of the 60-day period to report and return the overpayments through its Medicare Administrative Contractor's voluntary refund process.

Throughout the process, the practice documents each step, retrains the physician, adds pre-billing review for high-level visits, and schedules a follow-up audit.

Quantification Methods

Choosing a reasonable method to calculate overpayments is an important part of compliance.

• Claim-by-claim review. Every affected claim is reviewed, and the overpayment is the sum of the amounts paid in error. This is the most precise method but can be time-consuming for large populations.

• Statistical sampling and extrapolation. A statistically valid random sample is reviewed, and the error rate or dollar error is projected to the full population. This approach is common for larger populations and should follow sound statistical methods, often with help from a qualified statistician.

• Data analysis. For certain issues, such as claims for services furnished by an excluded individual, the affected claims can often be identified directly from billing data.

Whatever method is used, document the population, sample design, review criteria, results, and calculations.

Roles and Responsibilities

Clear roles help keep overpayment matters on track:

• The compliance officer oversees identification, investigation, and reporting, and maintains the overpayment log.

• Billing and coding staff help identify affected claims and process refunds.

• Clinical leaders review medical necessity and documentation questions.

• Finance staff calculate amounts and manage repayment.

• Legal counsel advises on potential legal violations, disclosure options, and privilege.

• Leadership and the governing body receive regular reports and ensure resources are available.

Medicare Advantage, Part D, and Medicaid

The CY 2025 changes to the identification standard apply to Medicare Parts A, B, C, and D. Medicare Advantage organizations and Part D sponsors have their own overpayment regulations at 42 CFR 422.326 and 423.360.

Section 1128J(d) also applies to Medicaid overpayments. State Medicaid programs and Medicaid managed care plans have their own procedures for reporting and returning overpayments, and many states have their own false claims laws. Providers should review the requirements of each state Medicaid program and managed care contract.

Common Mistakes to Avoid

• Waiting to "identify" an overpayment. Delaying review of credible information to avoid starting the clock may be viewed as deliberate ignorance or reckless disregard.

• Failing to document the identification date. Without a clear date, it is difficult to demonstrate compliance with the deadline.

• Assuming the 180-day suspension applies automatically. The suspension requires a timely, good-faith investigation of related overpayments.

• Limiting the review to the sample. Audit findings in a sample may indicate broader problems that must be investigated.

• Using an unsupported quantification method. Methods should be reasonable and documented.

• Choosing the wrong disclosure path. Simple refunds are not appropriate for potential fraud or legal violations, which may require a self-disclosure protocol.

• Returning the money without fixing the problem. Continuing the same practice after identifying it increases legal risk.

• Overlooking Medicaid and Medicare Advantage. Overpayments may affect multiple payers with different rules.

Connecting the Overpayment Rule to Your Compliance Program

The overpayment rule works best when it is part of a broader compliance program. Risk assessments identify where overpayments are most likely, audit plans test those areas, hotline reports surface concerns, and corrective action processes prevent recurrence. HHS-OIG's General Compliance Program Guidance lists responding to detected offenses and developing corrective action initiatives as one of the seven elements of an effective compliance program, and timely return of overpayments is a central part of that response.

Building an Overpayment Policy

An effective overpayment policy typically includes:

• A definition of overpayment and examples relevant to the organization.

• The standard for identification under 42 CFR 401.305(a)(2).

• Responsibilities for escalation, investigation, quantification, and reporting.

• Procedures for timely, good-faith investigations and documenting their scope and timeline.

• Approved quantification methods.

• Reporting methods and decision criteria for using self-disclosure protocols.

• Requirements for corrective action and follow-up monitoring.

• Record retention requirements.

• Reporting to the compliance committee and governing body.

Frequently Asked Questions

When does the 60-day clock start?

The clock starts when the person has identified the overpayment, meaning the person knowingly receives or retains it, as defined by the False Claims Act standard of actual knowledge, deliberate ignorance, or reckless disregard.

Can I get more time to investigate?

Yes, in some cases. Under 42 CFR 401.305(b)(3), the deadline is suspended while a timely, good-faith investigation of related overpayments is conducted, for up to 180 days after the initial overpayment was identified. The provider then has the remainder of the 60-day period to report and return.

How far back do I need to look?

Overpayments must be reported and returned if they are identified within six years of the date the overpayment was received.

What happens if I miss the deadline?

A retained overpayment after the deadline becomes an obligation under the False Claims Act, which can create liability for treble damages and penalties.

Does the rule apply to overpayments caused by Medicare contractor errors?

The rule applies to funds a person receives or retains to which it is not entitled, after applicable reconciliation, regardless of who caused the error. If a provider knowingly retains an overpayment caused by a contractor's processing error, it should still report and return it.

What if the provider disagrees about whether an overpayment exists?

When there is a genuine question, the provider should investigate promptly, document its analysis, and consult counsel. Unreasonable delay in resolving the question may be viewed as deliberate ignorance or reckless disregard.

Do I need to return overpayments discovered during a payment suspension or audit?

Contractor audits and suspensions do not eliminate the obligation to report and return overpayments the provider itself identifies. Coordinate with counsel so that refunds are handled appropriately in light of the ongoing review.

Should I use a self-disclosure protocol instead of a simple refund?

Simple refunds through the Medicare Administrative Contractor are generally used for billing errors. Potential fraud, kickback, or other legal violations may call for the HHS-OIG Self-Disclosure Protocol, the CMS Voluntary Self-Referral Disclosure Protocol, or disclosure to DOJ. Consult legal counsel.

Conclusion

The 60-day overpayment rule turns internal audit findings into legal obligations. After the CY 2025 changes, an overpayment is identified when a provider knowingly receives or retains it under the False Claims Act standard, and the deadline can be suspended for up to 180 days while a timely, good-faith investigation of related overpayments is underway. Retaining an overpayment past the deadline can create False Claims Act liability.

Providers can comply by documenting identification dates, escalating findings promptly, conducting real and timely investigations, quantifying overpayments with sound methods, choosing the right reporting path, returning funds on time, correcting root causes, and keeping thorough records. A clear written overpayment policy helps make these steps routine.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in compliance, internal audits, and overpayment management. We help providers design and conduct internal audits, investigate related overpayments, quantify findings, prepare documentation for refunds, develop overpayment policies, and coordinate with legal counsel on disclosure decisions. If you would like help managing overpayments found in internal audits, please get in touch with us. We will be happy to help you with this topic.

References

• Federal Register. Medicare and Medicaid Programs; CY 2025 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies; Medicare Overpayments, Final Rule (December 9, 2024). https://www.federalregister.gov/documents/2024/12/09/2024-25382/medicare-and-medicaid-programs-cy-2025-payment-policies-under-the-physician-fee-schedule-and-other

• Centers for Medicare & Medicaid Services. CMS-1807-F, CY 2025 Physician Fee Schedule Final Rule. https://www.cms.gov/medicare/payment/fee-schedules/physician/federal-regulation-notices/cms-1807-f

• Centers for Medicare & Medicaid Services. Medicare Reporting and Returning of Self-Identified Overpayments, Fact Sheet. https://www.cms.gov/newsroom/fact-sheets/medicare-reporting-and-returning-self-identified-overpayments

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305

• Electronic Code of Federal Regulations. 42 CFR 401.607, Claims Collection. https://www.ecfr.gov/current/title-42/section-401.607

• Electronic Code of Federal Regulations. 42 CFR 422.326, Reporting and Returning of Overpayments (Medicare Advantage). https://www.ecfr.gov/current/title-42/section-422.326

• Electronic Code of Federal Regulations. 42 CFR 423.360, Reporting and Returning of Overpayments (Part D). https://www.ecfr.gov/current/title-42/section-423.360

• U.S. Social Security Administration. Social Security Act, Section 1128J, Medicare and Medicaid Program Integrity Provisions. https://www.ssa.gov/OP_Home/ssact/title11/1128J.htm

• U.S. Code. 31 U.S.C. 3729, False Claims. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title31-section3729&num=0&edition=prelim

• U.S. Department of Health and Human Services, Office of Inspector General. Health Care Fraud Self-Disclosure. https://oig.hhs.gov/compliance/self-disclosure-info/

• Centers for Medicare & Medicaid Services. Self-Referral Disclosure Protocol. https://www.cms.gov/medicare/regulations-guidance/physician-self-referral/self-referral-disclosure-protocol

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division and the Department of Health and Human Services Announce Self-Disclosure Protocol for Criminal Health Care Fraud. https://www.justice.gov/opa/pr/national-fraud-enforcement-division-and-department-health-and-human-services-announce-self

• U.S. Department of Justice, Office of Public Affairs. False Claims Act Settlements and Judgments Exceed $6.8B in Fiscal Year 2025. https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-68b-fiscal-year-2025

• U.S. Department of Health and Human Services, Office of Inspector General. Exclusions Program and LEIE Database. https://oig.hhs.gov/exclusions/

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/