The statute
Enacted by § 6402(a) of the Affordable Care Act. Its core elements:1What “identified” means, the 2024 change
This matters, and it changed recently. The regulation previously provided that a person had identified an overpayment when they had, or should have through the exercise of reasonable diligence, determined that they received an overpayment and quantified it. CMS-4205-F, published December 9, 2024 and effective January 1, 2025, replaced the “reasonable diligence” standard with the False Claims Act knowledge standard — a person has identified an overpayment when they have actual knowledge, or act in reckless disregard or deliberate ignorance of it.2 Practically, the trigger remains the same in operation: the clock starts when you know, or are recklessly disregarding, that you were overpaid. Discovering a billing error is the beginning of a process, not the end of one.What triggers the analysis
Any of these should route to your overpayment process:- A credit balance from a payer overpayment
- A duplicate payment
- A billing or coding error discovered internally
- An audit finding sustained
- A lapsed license, credential, or enrollment discovered after billing
- A clinician found to have been excluded
- A recoupment whose root cause implies other claims are affected
- A compliance report from an employee
- A systematic error found through internal auditing
The process
1
Route the discovery to a defined owner
Immediately. The clock is running, and a discovery sitting in an inbox is the worst possible posture.
2
Engage counsel
Before quantifying, and before any communication with the payer. Counsel decides scope, privilege, and disclosure strategy.
3
Investigate and quantify
Determine: what happened, when it started, which claims are affected, and the dollar amount.The lookback period for how far back you must go is a legal question — confirm the applicable period with counsel under the current rule.Where the population is large, statistical sampling and extrapolation may be appropriate for quantification. Done properly this requires a statistician, and doing it properly protects you.
4
Choose the disclosure route
This choice is strategic and belongs to counsel. The routes have different consequences for penalties, for protection, and for what you are admitting.
5
Report and return within the deadline
With the required documentation: the claims, the amounts, the reason, the period, and the corrective action taken.
6
Document everything
Discovery date, investigation steps, quantification methodology, counsel involvement, disclosure route, submission date, and remediation.The documentation is what demonstrates good faith. An organization that found a problem, investigated promptly, quantified carefully, and returned within 60 days is in a materially different position from one that cannot show when it knew.
7
Fix the underlying process
And document that too. A returned overpayment with no corrective action invites the next one, and demonstrates that the compliance program isn’t working.
Commercial payer analogues
The 60-day rule applies to Medicare and Medicaid. For commercial payers, the contract governs, typically requiring refund within a stated period, with the payer often entitled to recoup by offset. Two things to note:- Some states impose statutory refund obligations reaching commercial payments
- Retaining a known commercial overpayment can raise other theories even without the federal rule
Building the process before you need it
1
Define a named owner for overpayment discoveries
2
Create a reporting channel
Any employee should be able to raise a concern, with a documented non-retaliation policy. This is also how a concerned biller raises an issue internally rather than becoming a qui tam relator. See Billing compliance basics.
3
Run the credit balance report weekly
It is the most common detection mechanism, and weekly review preserves most of the 60-day window. See Resolve credit balances.
4
Conduct periodic internal audits
Finding errors yourself, and returning promptly, is a fundamentally better posture than having them found.
5
Identify counsel in advance
You do not want to be sourcing healthcare regulatory counsel on day 5 of 60.
Verify it worked
- A named owner for overpayment discoveries
- A non-retaliation reporting channel that staff know about
- Weekly credit balance review
- Counsel identified in advance
- Discovery-to-disclosure process documented
- Current identification standard and lookback confirmed with counsel
- Every discovery logged with dates
- Corrective action documented alongside the return
Common failure modes
Sources
- 42 U.S.C. § 1320a-7k(d), enacted by ACA § 6402(a); False Claims Act, 31 U.S.C. §§ 3729–3733; civil monetary penalties at 42 C.F.R. § 1003.210.
- CMS-4205-F, published December 9, 2024, effective January 1, 2025. See Foley & Lardner, CMS Issues Final Regulations Implementing Changes to 60-day Refund Rule; Morgan Lewis, Tick-Tock: CMS Overpayment Refund Final Rule and Practical Implications. HHS OIG, Self-Disclosure Information.