Stop FCA Risk: 60 Day Overpayment Rule for US Compliance Officers

Under CMS's Final Rule, effective January 1, 2025, the 60-day overpayment clock starts running when your practice has "identified" an overpayment under a revised standard tied to the False Claims Act's "knowing" language. You must report and return that money by the later of the deadline specified by CMS after identification or your cost report due date. A 180-day suspension is available, but only if you launch a timely, good-faith investigation the moment credible information surfaces.

TL;DR:

The 60-day overpayment reporting deadline starts from the moment credible information about an overpayment reaches anyone in a position to act, not when an investigation begins.

The new FCA-aligned standard means practices can be considered to have identified an overpayment even without formal audits if credible and actionable information appears.

The investigation must begin immediately upon receiving credible information, and the suspension period of up to 180 days only applies if the investigation is conducted in good faith and in a timely manner.

Cost-report linked overpayments extend your reporting deadline to the later of 60 days post-identification or the cost report due date, especially for systemic, intangible issues.

Strict documentation of investigation timings, methods, and communications is essential to defend compliance and minimize legal exposure, especially if a whistleblower or audit arises.

What the 60-Day Overpayment Rule Covers
When Is an Overpayment "Identified"? The Standard Just Changed
Counting the Days: Timeline Mechanics and Two Real Scenarios
How to Report and Return an Overpayment Correctly
What Happens If You Miss the Deadline
A Practical Compliance Checklist for the 60-Day Clock
Tangible vs. Intangible Overpayments: Why the Distinction Matters
How the 60-Day Rule Interacts With OIG Guidance and Other Requirements
Why This Rule Is Harder to Comply With Than It Looks
Turn Overpayment Detection Into a Documented, Defensible Process
Where to Verify the Rule Yourself
Sources

What the 60-Day Overpayment Rule Covers

The rule applies to Medicare Parts A and B, with parallel but distinct mechanics for Parts C and D. If your practice bills Medicare directly, you are a "person" under the regulation, and the obligation to report and return overpayments attaches the moment identification occurs, not when a payer flags the claim.

The lookback period matters as much as the deadline itself. You are required to report overpayments identified within the lookback period CMS prescribes, which means a routine chart review in 2026 can legally surface a coding error from 2020, and you still owe a refund. That six-year window is exactly why retrospective audits deserve real scrutiny rather than a quick scan.

Key scope points to keep straight:

Parts A and B carry the full 60-day and 180-day suspension framework described in 42 C.F.R. § 401.305.
Parts C and D (Medicare Advantage and Part D plans) have parallel provisions, but administrative correction paths sometimes differ in timing and process.
Cost-report-linked overpayments extend your deadline to whichever comes later: 60 days after identification, or the cost report's due date.

If your organization files annual cost reports, that second trigger date often becomes the operative one, especially for overpayments tied to settled cost report periods rather than individual claims.

When Is an Overpayment "Identified"? The Standard Just Changed

This is where the 2025 rule breaks sharply from prior guidance. CMS no longer asks whether you exercised "reasonable diligence." The Final Rule instead ties identification to the False Claims Act's "knowing" standard under 31 U.S.C. § 3729, which covers actual knowledge, deliberate ignorance, or reckless disregard of the truth.

That shift came after litigation challenged whether CMS could impose a diligence standard stricter than the FCA itself demands. Practically, it means the clock can start earlier than most compliance teams expect. You don't need a signed audit report to have "identified" an overpayment; credible information alone can trigger the duty to investigate.

Three things now create identification risk:

Credible information reaching anyone in a position to act on it, including a billing manager, coder, or compliance staffer.
Failure to investigate promptly after that information arrives, which can itself amount to reckless disregard.
Constructive knowledge, where a reasonable person in your position should have recognized the overpayment even without a formal finding.

Statistic Callout: The Final Rule's preamble confirms the 180-day suspension option exists precisely because CMS recognized that FCA-aligned knowledge standards compress the time practices have to act. Legal analysts at Morgan Lewis note this change trades regulatory predictability for closer alignment with existing FCA case law, which raises real operational uncertainty for practices without documented investigation protocols already in place.

Counting the Days: Timeline Mechanics and Two Real Scenarios

Day one is the date of identification, not the date someone opens a file to look into it. The 60-day count runs continuously through calendar days, including weekends, unless a suspension applies.

Here's how the suspension mechanics work in practice:

Identification occurs. Credible information about a potential overpayment reaches your compliance function.
Investigation begins immediately. Any delay between identification and the start of investigation counts against your 60 days, not against the suspension period.
Suspension applies for up to 180 days, but only while the investigation remains timely and conducted in good faith.
The clock resumes once you quantify the overpayment, at which point you have the remaining balance of your original 60 days (or less, if delay already ate into it) to report and return.

Two examples illustrate the split:

Scenario A: A biller notices a single duplicate payment on one claim. No related claims are suspected. You quantify it in a week and refund it. The 60-day clock never comes close to expiring, and suspension isn't needed.

Scenario B: A coder flags a pattern suggesting a modifier was misapplied across dozens of claims over three years. That triggers a broader investigation. You document the start date immediately, engage a sampling methodology, and file for the suspension, which buys you up to 180 additional days to complete the quantification.

Pro Tip: Document your investigation start date and time stamp the moment credible information arrives, even before you know whether an overpayment actually exists. That timestamp is your strongest evidence that the suspension applies in good faith.

60-day deadline and 180-day suspension timeline

How to Report and Return an Overpayment Correctly

You return the money to whichever entity actually paid the claim: the Medicare Administrative Contractor, intermediary, carrier, or in some cases the state Medicaid program. Written notification has to accompany the refund; a check alone doesn't satisfy the rule.

Your written notice generally needs to include the reason for the overpayment, the time period involved, and enough detail for the contractor to match the refund against the original claims. If the overpayment ties to a cost report, you'll typically report it through the cost report reconciliation process instead, which shifts your effective deadline to the cost report's due date if that lands later than the standard 60 days.

Documentation practices that hold up under later scrutiny include:

A written record of when credible information was first received and by whom.
Investigation methodology notes, including sampling approach if you didn't do a full chart-by-chart review.
Calculation worksheets showing how you arrived at the final overpayment figure.
Sign-off from a compliance officer or practice administrator before the refund goes out.
The refund transaction record itself, cross-referenced to the original claim numbers.

Practices building this kind of audit trail from the start tend to move faster when a payer later asks for proof the investigation was timely and conducted in good faith.

What Happens If You Miss the Deadline

An overpayment you knowingly retain past the deadline becomes what the law calls an "obligation," and an unpaid obligation is exactly the kind of thing the False Claims Act was written to catch. That reclassification turns a billing error into a potential fraud claim, and the exposure scales fast.

FCA liability carries treble damages, meaning you could owe three times the original overpayment amount, plus a per-claim civil penalty on top of that. HHS's Office of Inspector General can also layer on separate civil monetary penalties and, in serious or repeated cases, push for a Corporate Integrity Agreement that puts your practice under multi-year federal monitoring.

A few risk-management points worth internalizing:

Whistleblowers can file qui tam suits under the FCA, and a missed 60-day deadline is exactly the kind of fact pattern that motivates a former employee to do so.
Self-disclosure through the OIG's protocols can meaningfully reduce penalties compared to what enforcement looks like after a whistleblower or auditor finds the issue first.
Legal counsel should get involved the moment an investigation suggests the overpayment might be systemic rather than a one-off billing error, since that's when FCA exposure becomes a real possibility rather than a theoretical one.

Waiting to see if the payer notices tends to be the single costliest decision a practice can make once credible information about an overpayment exists.

A Practical Compliance Checklist for the 60-Day Clock

Meeting this deadline consistently comes down to workflow, not willpower. Build the process before you need it.

Detection. Overpayments surface through payment anomalies, employee hotline reports, internal chart reviews, or external payer audits. Each of these needs a defined intake step, so credible information doesn't sit in someone's inbox for two weeks before compliance even hears about it. Practices that lose the most reimbursement typically share one trait: detection happens too late to preserve suspension eligibility.

Triage. The moment credible information arrives, log the date, assign an owner, and make a preliminary call on scope. Is this one claim or a pattern? That decision shapes whether you need the full 180-day suspension or can resolve things in days.

Investigation. Full quantification is preferable, but a defensible sampling methodology works when claim volume makes a full review impractical. Whichever approach you choose, write down the methodology before you start, not after you've already reached a number that looks convenient.

Calculation and approval. Someone outside the original coding decision should review the final overpayment figure before it goes to refund. That second set of eyes matters both for accuracy and for the audit trail it creates.

Reporting and documentation. Written notice, refund transaction, and a complete file connecting credible information to investigation to resolution. This is the package a payer or OIG investigator will ask for if questions ever come up.

Governance. Assign clear escalation triggers, so a coder who spots a suspicious pattern knows exactly who to tell and how fast. Train staff annually on what counts as credible information, since physician signature and attestation gaps are a common source of the very overpayments this whole process exists to catch.

Pro Tip: An EHR-integrated detection platform can flag coding and documentation anomalies before a claim ever goes out, which shrinks the window between when an overpayment actually occurs and when your team identifies it, giving you far more runway inside the 60-day clock.

Assign an intake owner for credible information.
Timestamp the investigation start date the same day.
Choose full review or documented sampling.
Get independent sign-off on the final calculation.
File written notice and refund together, cross-referenced.
Retain the full audit trail for at least six years.

Tangible vs. Intangible Overpayments: Why the Distinction Matters

A tangible overpayment is easy to picture: a duplicate payment, a claim paid twice, or a coding error that resulted in a specific, calculable dollar amount tied to a specific claim. These are usually the fastest to investigate because the evidence is contained and the math is straightforward.

Intangible overpayments are murkier. Think of a systemic issue like a flawed charge-capture process that has been quietly overbilling a particular procedure code across hundreds of encounters for two years. There's no single claim to point to; the overpayment exists as a pattern that only becomes quantifiable once you've pulled the full data set and calculated an aggregate figure.

The rule doesn't formally treat these two categories differently in terms of the deadline, but the practical handling diverges sharply. A tangible overpayment often resolves well within 60 days. An intangible, systemic overpayment is almost always the scenario that justifies invoking the 180-day suspension, since quantifying a pattern across a large claim population takes real time to do accurately. Treating a systemic issue like a single-claim error, by rushing a rough estimate to beat the clock, tends to produce a refund figure that's wrong in either direction, and a wrong figure creates its own compliance problem down the line.

How the 60-Day Rule Interacts With OIG Guidance and Other Requirements

The 60-day rule doesn't operate in isolation. The OIG's Self-Disclosure Protocol offers a separate track for resolving overpayments that involve potential fraud exposure, and choosing that path can pause or reshape your 60-day obligations while OIG reviews the disclosure.

Provider Self-Disclosure through OIG generally makes sense when the overpayment investigation reveals conduct that looks intentional or reckless, rather than a straightforward billing mistake. Filing through that protocol signals good faith to regulators and, per OIG's own published settlement history, tends to result in materially lower penalties than cases OIG discovers independently.

Cost report reconciliation requirements add another layer. If your overpayment ties to a settled cost report, Medicare's cost report appeals and reopening rules interact with the 60-day timeline, sometimes extending your effective deadline and sometimes complicating exactly which contractor should receive the refund. State Medicaid programs layer their own reporting requirements on top of the federal rule, and those state-level deadlines don't always match the federal 60-day window, so a multi-state practice needs to track both separately rather than assuming one satisfies the other.

Compliance officers managing all of this at once should treat the 60-day rule as the federal floor, not the ceiling, of their obligations. A refund that satisfies CMS may still leave a state-level reporting requirement unmet, or leave an OIG disclosure opportunity on the table that would have reduced overall exposure.

How the 60-Day Rule Interacts With OIG Guidance and Other Requirements — overview diagram

Why This Rule Is Harder to Comply With Than It Looks

The FCA-aligned "knowing" standard sounds like a lower bar than "reasonable diligence," and in one sense it is. But it also means the clock can start based on information your practice already had sitting in an inbox, which raises real ambiguity about exactly when your 60 days actually began. Compliance teams that assume a clean paper trail will save them are underestimating how much weight investigators put on how fast you acted after credible information appeared, not just whether you eventually got the number right.

For Q1, three priorities matter more than a full policy overhaul: update your written overpayment policy to reflect the FCA-aligned standard, run a test of your detection workflow against a real (or simulated) credible-information scenario, and document your investigation process before you need it for a live case. A reasonable cadence looks like this: policy language updated within 30 days, workflow tested and gaps identified within 90 days, and a fully documented, trained-on investigation protocol in place within 180 days. Practices that treat this as a slow-rolling project tend to discover the gaps only after a payer or whistleblower finds them first.

— Elena

Turn Overpayment Detection Into a Documented, Defensible Process

Meeting the 60-day overpayment rule depends on speed, and speed depends on catching credible information about a coding or documentation gap before it becomes a six-figure retrospective audit. That's the exact problem HIMShield was built to solve for independent physician practices.

Himshield

A platform can scan your EHR data continuously, quantify coding, documentation, and charge-capture gaps by provider and by payer, and draft corrections for physician approval with e-signature. Instead of discovering a pattern six years into the lookback window, a Revenue Leakage Report can flag issues while still small enough to fix cleanly, and every flagged item comes with the calculation worksheet and evidence trail an investigation needs. This difference is between scrambling to build an audit trail after credible information surfaces and already having one ready.

Independent practices that want to see this in action can start with a free 30-day audit backed by a performance guarantee, with no long-term commitment required before seeing what's actually at risk.

Where to Verify the Rule Yourself

For counsel review or internal policy updates, rely on primary sources: the Federal Register Final Rule, the codified text at 42 C.F.R. § 401.305, and CMS's own fact sheet on reporting and returning requirements. Law firm summaries from Morgan Lewis and Foley & Lardner offer useful interpretation, but treat them as commentary, not a substitute for the primary text.