Overpayments: The Identification Date and the Sixty-Day Clock
Money received in error becomes a legal obligation the moment it is knowingly retained. Sixty days later it becomes something worse, because an overpayment kept past the deadline is treated as an obligation owed to the government and pulls the retention into false claims territory.
The rule in short
A person who receives an overpayment must report and return it by the later of sixty days after the overpayment was identified or the date any corresponding cost report is due. An overpayment is identified when it is knowingly received or retained, using the knowledge standard of the false claims statute. The deadline can be suspended during a timely good-faith investigation of related overpayments, and by a self-disclosure or an extended repayment request. The lookback period runs six years.
The rule is short. A person who has received an overpayment must report and return it by the later of two dates: sixty days after the overpayment was identified, or the date any corresponding cost report is due. Miss that deadline and the retained money becomes an obligation for purposes of the false claims statute, which converts a billing error into treble damages exposure.
The word that decides everything
Identification is defined by knowledge. A person has identified an overpayment when the person knowingly receives or retains it, and knowingly carries the meaning it has in the false claims statute: actual knowledge, deliberate ignorance of the truth, or reckless disregard of the truth. No specific intent to defraud is required, and no proof of specific intent is required to establish the obligation.
Two consequences follow. Ignorance maintained on purpose does not help, so an organization that receives a credible signal and declines to look has identified the overpayment as surely as one that audits and finds it. And identification does not require certainty. A person who recklessly disregards evidence of an overpayment has identified it, whatever the internal file says about ongoing review.
Sixty days, and the three ways it pauses
The default is sixty days from identification. Three suspensions matter in practice. First, where a person has identified an overpayment but has not completed a good-faith investigation into related overpayments arising from the same or a similar cause, the deadline is suspended while a timely, good-faith investigation runs. That suspension ends at the earlier of the conclusion of the investigation with the aggregate amount calculated, or one hundred eighty days after the initial identification.
Second, an acknowledged submission to a self-disclosure protocol suspends the deadline until a settlement is entered or the person withdraws or is removed from the protocol. Third, a request for an extended repayment schedule suspends it until the request is rejected or the schedule is breached. Nothing else pauses the count, and an internal decision to keep investigating past the one-hundred-eighty-day mark does not.
The scope suspension exists so that a provider finding one error is not forced to refund that single claim within sixty days while the same defect is still being traced through five years of billing. It is not open-ended. One hundred eighty days after the initial identification the suspension lapses whether or not the investigation is finished, and the whole amount known at that point becomes due. Plan the review backwards from that ceiling rather than forwards from the discovery.
The lookback period
An overpayment must be reported and returned if it is identified within six years of the date it was received. That figure is the outer boundary of the refund obligation and does not limit other authorities. Contractors performing audits work to their own reopening rules, and a false claims action has its own limitation period, which can be longer in defined circumstances.
The six-year period also sets the practical scope of an internal investigation. Where a systemic billing defect is found, the question is how far back the same configuration was in place, and the answer usually determines the size of the exposure more than the merits do. Records retention policies that discard billing detail before six years are a recurring obstacle at exactly this point.
Choosing how to give the money back
The reporting mechanism depends on what caused the overpayment. Routine errors go back through a claims adjustment, a credit balance report or the contractor's self-reported refund process. Conduct implicating the criminal remuneration prohibition goes to the inspector general's protocol. A defective financial relationship under the self-referral rules goes to the agency's own self-referral protocol. Choosing the wrong route wastes the suspension it would otherwise have bought.
| Route | Used for | Effect on the deadline | What it resolves | Principal cost |
|---|---|---|---|---|
| Contractor refund process | Coding, eligibility and duplicate payment errors | None; the sixty days apply | The claims refunded, nothing more | The principal amount |
| Good-faith scope investigation | An error suspected of being systemic | Suspended up to one hundred eighty days | Nothing by itself; it sizes the refund | Investigation expense |
| Inspector general self-disclosure | Conduct implicating the remuneration prohibition | Suspended until settlement or withdrawal | Civil exposure, by settlement | A multiplier on the damages |
| Self-referral disclosure protocol | Financial relationships failing an exception | Suspended until settlement or withdrawal | The self-referral overpayment | A negotiated reduction of the amount owed |
| Extended repayment schedule | Amounts the provider cannot pay at once | Suspended while the request is pending | Timing only | Interest on the balance |
The findings that most often start the clock
Three sources dominate. Contractor audits, including extrapolated statistical samples, produce a determination the provider can appeal through the administrative levels while the underlying question of identification remains live. Internal compliance work produces the cleanest identifications and the shortest arguments about when knowledge arose. And structural defects produce the largest numbers, because a financial relationship that fails the self-referral prohibition taints every claim referred under it.
Arrangements that fail the intent-based rules described in the remuneration prohibitions and their safe harbors reach the same place by a different route, since a claim resulting from a violation is a false claim by statute. Where the billing entity is not the treating clinician, the analysis in reassignment of benefits and who may bill determines who owes the refund. Matters resolved by settlement usually end under the supervision described in corrective action plans and integrity agreements.
Points to carry away
- An overpayment is identified when it is knowingly received or retained, including through reckless disregard.
- The refund is due sixty days after identification, or when a corresponding cost report is due if that is later.
- A good-faith investigation of related overpayments suspends the deadline for up to one hundred eighty days.
- An acknowledged self-disclosure suspends the deadline until the disclosure resolves.
- An overpayment reported and returned must be identified within six years of receipt.
- Retention past the deadline creates an obligation for purposes of the false claims statute.
Questions readers ask
Does a provider have to search for overpayments it has no reason to suspect?
The obligation attaches to knowledge, and knowledge includes deliberate ignorance and reckless disregard. There is no free-standing duty to audit everything continuously, but there is a duty not to look away from a credible signal. A contractor letter, a whistleblower complaint, an unexplained billing pattern or a compliance hotline report are all signals that make inaction reckless. Once one is received, the question stops being whether to investigate and becomes how quickly the investigation can be completed.
Can extrapolation be used to calculate what is owed?
Yes, and the regulation contemplates it. Where the amount is calculated using a statistical sampling methodology, the report must describe the statistically valid sampling and extrapolation method used. That cuts both ways. A provider may extrapolate from a sample rather than reviewing every claim across a long period, which is often the only feasible route. But a poorly designed sample invites the contractor to substitute its own, usually with a larger result.
What happens if the provider cannot afford to repay in one payment?
A request for an extended repayment schedule suspends the return deadline while it is pending. The suspension continues until the request is rejected, or until the provider fails to comply with the terms of a granted schedule. That makes the request valuable for reasons beyond cash flow, because it converts a hard sixty-day deadline into a negotiated one. It does not reduce the amount owed, and interest generally accrues on the outstanding balance.
Sources
- eCFR — 42 CFR 401.305, Requirements for Reporting and Returning of OverpaymentsThe identification standard, the deadline, the suspensions and the six-year lookback.
- Cornell Legal Information Institute — 42 U.S.C. 1320a-7k, Medicare and Medicaid Program Integrity ProvisionsThe statutory duty to report and return, and the deadline it sets.
- Cornell Legal Information Institute — 31 U.S.C. 3729, False ClaimsThe knowledge standard borrowed by the regulation and the reverse false claim provision.
- eCFR — 42 CFR 401.603, Extended Repayment ScheduleThe repayment schedule whose request suspends the return deadline.
- eCFR — 42 CFR 422.326, Reporting and Returning of OverpaymentsThe parallel obligation applying within managed care contracts.
- Office of Inspector General — Self-Disclosure InformationThe disclosure route whose acknowledgment suspends the deadline.
Lawwise is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Healthcare Regulation
Using Health Information Without Written Authorization
A covered entity may use or disclose protected health information without authorization to the individual, for treatment, payment and health care operations, under an opportunity to agree or object, and for an enumerated set of public interest purposes. Everything outside that list requires a written authorization, and psychotherapy notes, marketing and any sale of information require one regardless. Permitted disclosures are separately limited to the minimum necessary to accomplish the purpose.
The Self-Referral Prohibition and the Exceptions to It
Where a physician or an immediate family member holds an ownership interest in or a compensation arrangement with an entity, the physician may not refer designated health services to that entity for federal payment and the entity may not present a claim for them, unless the arrangement satisfies an exception in full. Liability does not depend on intent. Amounts collected on prohibited referrals must be refunded, and knowing violations carry additional penalties.
Provider Enrollment, Revalidation and Revocation
Enrollment establishes the effective date from which claims may be paid, and certain practitioner types may bill retrospectively for up to thirty days before it. Enrollment must be revalidated every five years, or every three for equipment suppliers, and a revalidation request must be answered within sixty calendar days. Revocation carries a reenrollment bar of one to ten years, extended to twenty for a second revocation, and it takes effect thirty days after the notice is mailed.