The statute
Enacted by § 6402(a) of the Affordable Care Act. Its core elements:1What “identified” means, the 2024 change
The regulation previously provided that a person had identified an overpayment when they had, or should have through the exercise of reasonable diligence, determined that they received an overpayment and quantified it. CMS-4205-F, published December 9, 2024 and effective January 1, 2025, replaced the “reasonable diligence” standard with the False Claims Act knowledge standard — a person has identified an overpayment when they have actual knowledge, or act in reckless disregard or deliberate ignorance of it.2 Practically, the trigger remains the same in operation: the clock starts when you know, or are recklessly disregarding, that you were overpaid. Discovering a billing error starts the report-and-return process.What triggers the analysis
Any of these should route to your overpayment process:- A credit balance from a payer overpayment
- A duplicate payment
- A billing or coding error discovered internally
- An audit finding sustained
- A lapsed license, credential, or enrollment discovered after billing
- A clinician found to have been excluded
- A recoupment whose root cause implies other claims are affected
- A compliance report from an employee
- A systematic error found through internal auditing
The process
1
Route the discovery to a defined owner
Route it immediately, because the clock may already be running.
2
Engage counsel
Before quantifying, and before any communication with the payer. Counsel decides scope, privilege, and disclosure strategy.
3
Investigate and quantify
Determine: what happened, when it started, which claims are affected, and the dollar amount.The lookback period for how far back you must go is a legal question — confirm the applicable period with counsel under the current rule.Where the population is large, statistical sampling and extrapolation may be appropriate for quantification. Done properly this requires a statistician, and doing it properly protects you.
4
Choose the disclosure route
This choice is strategic and belongs to counsel. The routes have different consequences for penalties, for protection, and for what you are admitting.
5
Report and return within the deadline
With the required documentation: the claims, the amounts, the reason, the period, and the corrective action taken.
6
Document everything
Discovery date, investigation steps, quantification methodology, counsel involvement, disclosure route, submission date, and remediation.The documentation is what demonstrates good faith. An organization that found a problem, investigated promptly, quantified carefully, and returned within 60 days is in a materially different position from one that cannot show when it knew.
7
Fix the underlying process
Document the fix as well. Returning an overpayment without corrective action leaves the error free to recur and shows that the compliance program isn’t working.
Commercial payer analogues
The 60-day rule applies to Medicare and Medicaid. For commercial payers, the contract governs, typically requiring refund within a stated period, with the payer often entitled to recoup by offset. Beyond the contract:- Some states impose statutory refund obligations reaching commercial payments
- Retaining a known commercial overpayment can raise other theories even without the federal rule
Building the process before you need it
1
Define a named owner for overpayment discoveries
2
Create a reporting channel
Any employee should be able to raise a concern, with a documented non-retaliation policy. This is also how a concerned biller raises an issue internally rather than becoming a qui tam relator. See Billing compliance basics.
3
Run the credit balance report weekly
It is the most common detection mechanism, and weekly review preserves most of the 60-day window. See Resolve credit balances.
4
Conduct periodic internal audits
Finding errors yourself, and returning promptly, is a fundamentally better posture than having them found.
5
Identify counsel in advance
Engage healthcare regulatory counsel before a discovery, so you are not searching for counsel while the 60-day clock runs.
Verify it worked
- A named owner for overpayment discoveries
- A non-retaliation reporting channel that staff know about
- Weekly credit balance review
- Counsel identified in advance
- Discovery-to-disclosure process documented
- Current identification standard and lookback confirmed with counsel
- Every discovery logged with dates
- Corrective action documented alongside the return
Common failure modes
Sources
- 42 U.S.C. § 1320a-7k(d), enacted by ACA § 6402(a); False Claims Act, 31 U.S.C. §§ 3729–3733; civil monetary penalties at 42 C.F.R. § 1003.210.
- CMS-4205-F, published December 9, 2024, effective January 1, 2025. See Foley & Lardner, CMS Issues Final Regulations Implementing Changes to 60-day Refund Rule; Morgan Lewis, Tick-Tock: CMS Overpayment Refund Final Rule and Practical Implications. HHS OIG, Self-Disclosure Information.