> ## Documentation Index > Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt > Use this file to discover all available pages before exploring further. # Report and return overpayments (the 60-day rule) > The Medicare and Medicaid report-and-return obligation, what 'identified' means after the 2024 final rule, quantification lookbacks, and the voluntary refund process. Under **42 U.S.C. § 1320a-7k(d)**, a Medicare or Medicaid overpayment must be **reported and returned within 60 days** of being identified. Retaining an identified overpayment creates **False Claims Act** liability, which means treble damages and per-claim penalties on top of the overpayment itself. ## The statute Enacted by § 6402(a) of the Affordable Care Act. Its core elements:1 | Element | Rule | | ---------------------------- | ------------------------------------------------------------------------------------------------------------ | | **Who** | Providers, suppliers, Medicaid managed care organizations, Medicare Advantage organizations, Part D sponsors | | **What** | Any overpayment received | | **Deadline** | The later of 60 days after identification, or the date a corresponding cost report is due | | **Consequence of retention** | The overpayment becomes an "obligation" under the False Claims Act | | **Penalties** | FCA treble damages and per-claim penalties, plus civil monetary penalties | ## What "identified" means, the 2024 change This matters, and it changed recently. The regulation previously provided that a person had identified an overpayment when they had, **or should have through the exercise of reasonable diligence**, determined that they received an overpayment and quantified it. **CMS-4205-F**, published December 9, 2024 and effective January 1, 2025, replaced the "reasonable diligence" standard with the **False Claims Act knowledge standard** — a person has identified an overpayment when they have **actual knowledge**, or act in **reckless disregard** or **deliberate ignorance** of it.2 **Do not rely on pre-2025 guidance on the identification standard.** Confirm the current rule with counsel, including how the deadline is calculated and any suspension provisions applicable while you investigate and quantify. Practically, the trigger remains the same in operation: **the clock starts when you know, or are recklessly disregarding, that you were overpaid.** Discovering a billing error is the beginning of a process, not the end of one. ## What triggers the analysis Any of these should route to your overpayment process: * A credit balance from a payer overpayment * A duplicate payment * A billing or coding error discovered internally * An audit finding sustained * A lapsed license, credential, or enrollment discovered after billing * A clinician found to have been excluded * A recoupment whose root cause implies other claims are affected * A compliance report from an employee * A systematic error found through internal auditing **A single discovered error frequently implies more.** If you find one claim billed under a wrong provider, the question is immediately how many others. That question is the quantification, and it is where the lookback comes in. ## The process Immediately. The clock is running, and a discovery sitting in an inbox is the worst possible posture. Before quantifying, and before any communication with the payer. Counsel decides scope, privilege, and disclosure strategy. Determine: what happened, when it started, which claims are affected, and the dollar amount. **The lookback period** for how far back you must go is a legal question — confirm the applicable period with counsel under the current rule. Where the population is large, **statistical sampling and extrapolation** may be appropriate for quantification. Done properly this requires a statistician, and doing it properly protects you. | Route | When | | ----------------------------------------------- | ------------------------------------------------------- | | **Voluntary refund to the MAC or state agency** | Straightforward overpayments with no fraud dimension | | **OIG Self-Disclosure Protocol** | Where conduct may implicate fraud and abuse authorities | | **CMS Self-Referral Disclosure Protocol** | Stark-related overpayments | **This choice is strategic and belongs to counsel.** The routes have different consequences for penalties, for protection, and for what you are admitting. With the required documentation: the claims, the amounts, the reason, the period, and the corrective action taken. Discovery date, investigation steps, quantification methodology, counsel involvement, disclosure route, submission date, and remediation. **The documentation is what demonstrates good faith.** An organization that found a problem, investigated promptly, quantified carefully, and returned within 60 days is in a materially different position from one that cannot show when it knew. And document that too. A returned overpayment with no corrective action invites the next one, and demonstrates that the compliance program isn't working. ## Commercial payer analogues The 60-day rule applies to Medicare and Medicaid. For commercial payers, the **contract** governs, typically requiring refund within a stated period, with the payer often entitled to recoup by offset. Two things to note: * Some **states impose statutory refund obligations** reaching commercial payments * Retaining a known commercial overpayment can raise other theories even without the federal rule Treat commercial overpayments with the same process discipline. The clock may differ; the hygiene shouldn't. ## Building the process before you need it Any employee should be able to raise a concern, with a documented non-retaliation policy. **This is also how a concerned biller raises an issue internally rather than becoming a qui tam relator.** See [Billing compliance basics](/concepts/compliance/billing-compliance-basics). It is the most common detection mechanism, and weekly review preserves most of the 60-day window. See [Resolve credit balances](/guides/payments/resolve-credit-balances). Finding errors yourself, and returning promptly, is a fundamentally better posture than having them found. You do not want to be sourcing healthcare regulatory counsel on day 5 of 60. ## Verify it worked * [ ] A named owner for overpayment discoveries * [ ] A non-retaliation reporting channel that staff know about * [ ] Weekly credit balance review * [ ] Counsel identified in advance * [ ] Discovery-to-disclosure process documented * [ ] Current identification standard and lookback confirmed with counsel * [ ] Every discovery logged with dates * [ ] Corrective action documented alongside the return ## Common failure modes | Failure | Consequence | | ------------------------------------------------------------ | -------------------------------------------- | | Treating a discovered error as a billing correction | The 60-day clock runs unnoticed | | Quantifying without counsel | Scope and privilege problems | | Returning without assessing whether more claims are affected | Partial return; continuing exposure | | Monthly credit balance review | A third of the window burned before you look | | No reporting channel | Concerns go external | | No documentation of when you knew | Cannot demonstrate timeliness | | Returning with no corrective action | It recurs, and the program looks ineffective | ## Sources 1. 42 U.S.C. § 1320a-7k(d), enacted by ACA § 6402(a); False Claims Act, 31 U.S.C. §§ 3729–3733; civil monetary penalties at 42 C.F.R. § 1003.210. 2. CMS-4205-F, published December 9, 2024, effective January 1, 2025. See Foley & Lardner, [CMS Issues Final Regulations Implementing Changes to 60-day Refund Rule](https://www.foley.com/insights/publications/2024/11/medicare-overpayments-cms-final-regulations-60-day-refund/); Morgan Lewis, [Tick-Tock: CMS Overpayment Refund Final Rule and Practical Implications](https://www.morganlewis.com/pubs/2024/12/tick-tock-cms-overpayment-refund-final-rule-and-practical-implications). HHS OIG, [Self-Disclosure Information](https://oig.hhs.gov/compliance/self-disclosure-info/). ## Related topics - [Resolve credit balances (patient and payer)](/guides/payments/resolve-credit-balances.md) - [Handle recoupments and takebacks](/guides/compliance/handle-recoupments.md) - [Respond to payer audits and record requests](/guides/compliance/respond-to-payer-audits.md) - [Respond to NPI identity theft](/guides/compliance/respond-to-npi-identity-theft.md) - [Billing compliance: the lines you never cross](/concepts/compliance/billing-compliance-basics.md) - [When to call a lawyer (a triage map)](/concepts/compliance/when-to-call-a-lawyer.md) - [Patient refund timing requirements by state](/reference/banking/refund-check-requirements.md)