If your practice or facility receives Medicare money it wasn’t entitled to, the Medicare 60-day overpayment rule requires you to report and return it within 60 days of identifying the overpayment, or by the date any corresponding cost report is due, whichever is later. The obligation is set out at 42 U.S.C. ยง 1320a-7k(d) and applies to hospitals, physician practices, home health agencies, suppliers, and anyone else billing Medicare or Medicaid. Miss the deadline knowingly and the retained money becomes an “obligation” under the False Claims Act.
What Counts as an Overpayment
An overpayment is any Medicare or Medicaid money a person receives or keeps that they’re not entitled to after reconciliation.1Office of the Law Revision Counsel. 42 USC 1320a-7k – Medicare and Medicaid Program Integrity Provisions The definition is broad. It covers payments for services that weren’t medically necessary, claims with incorrect billing codes, duplicate payments, and reimbursements calculated at the wrong rate. It also covers payments tied to referrals or arrangements that violate federal fraud and abuse laws, even if the underlying service was legitimate.
When the 60-Day Clock Actually Starts
The single most consequential piece of this rule is what “identified” means, because that’s the trigger. Under a final rule that took effect January 1, 2025, CMS replaced the earlier “reasonable diligence” standard with the False Claims Act’s definition of “knowingly.” You have identified an overpayment when you have actual knowledge of it, act in deliberate ignorance of whether one exists, or act in reckless disregard of information suggesting one exists.2eCFR. 42 CFR 401.305 – Requirements for Reporting and Returning of Overpayments
The shift eliminates any safe harbor for willful blindness. Under the old standard, a provider could argue it hadn’t finished its “reasonable diligence” review, buying time. Under the current rule, a provider that receives credible information about a billing error and chooses not to investigate has already identified the overpayment in the eyes of the law.
A common mistake is treating the deadline as starting when the investigation concludes. It doesn’t. If an internal audit reveals a systemic coding error across hundreds of claims, you cannot spend six months quantifying the full scope and then start counting 60 days. The obligation begins when you have enough information to know an overpayment exists, even if the exact dollar amount is still being calculated. Red flags in audit data, patient complaints, or contractor notices need to be acted on rather than parked.
The Deadline and the Six-Year Lookback
Once identified, the overpayment must be reported and returned by the later of 60 days after identification or the date any corresponding cost report is due.2eCFR. 42 CFR 401.305 – Requirements for Reporting and Returning of Overpayments The cost-report exception primarily benefits hospitals and other facility-based providers whose final payment amounts aren’t settled until cost reports are filed. For most physician practices and suppliers, the straight 60-day window applies.
The obligation carries a six-year lookback measured from the date each overpayment was received.2eCFR. 42 CFR 401.305 – Requirements for Reporting and Returning of Overpayments Claims received more than six years before identification fall outside the window and don’t trigger the reporting obligation under this rule. The six-year boundary also sets the practical floor for how long you should retain billing records and audit documentation.
When the Clock Pauses
The 60-day deadline is suspended in three specific situations. It stops when the OIG acknowledges receipt of a submission under its Self-Disclosure Protocol. It stops when CMS acknowledges receipt of a disclosure under the Voluntary Self-Referral Disclosure Protocol. In both cases, the suspension lasts until settlement, or until the provider withdraws or is removed from the protocol. It also pauses when a provider requests an extended repayment schedule, and stays paused until CMS or its contractor rejects the request or the provider falls out of compliance with the schedule.3Federal Register. Medicare Program; Reporting and Returning of Overpayments
If settlement talks break down, the remaining balance of the original 60-day period resumes from wherever it left off. A provider that had 45 days left when it entered the OIG Self-Disclosure Protocol would have 45 days to report and return through the standard contractor process after exiting.3Federal Register. Medicare Program; Reporting and Returning of Overpayments
Which Disclosure Channel to Use
Not every overpayment gets reported the same way. The right channel depends on what caused the overpayment.
Most billing errors, coding mistakes, duplicate payments, and medical necessity issues go directly to the Medicare Administrative Contractor (MAC) that processed the original claims. Providers use the contractor’s claims adjustment, credit balance, or self-reported refund process.2eCFR. 42 CFR 401.305 – Requirements for Reporting and Returning of Overpayments
Potential fraud, such as violations of the Anti-Kickback Statute or billing for services rendered by unlicensed individuals, should go through the OIG’s Provider Self-Disclosure Protocol. That channel is designed for conduct that could trigger civil monetary penalty liability.4Office of Inspector General. Health Care Fraud Self-Disclosure
Overpayments tied to the physician self-referral law (Stark Law) go through CMS’s Self-Referral Disclosure Protocol. This channel exists because the Affordable Care Act gave HHS authority to reduce amounts owed for Stark violations, so a settlement here can result in a lower repayment than a full refund of all tainted claims.5Centers for Medicare & Medicaid Services. Self-Referral Disclosure Protocol
Providers already under an Integrity Agreement with the OIG should contact their OIG monitor before using any self-disclosure channel.4Office of Inspector General. Health Care Fraud Self-Disclosure Choosing the wrong channel doesn’t automatically expose you to penalties, but it delays resolution and may not toll the 60-day deadline until the submission reaches the correct destination.
How to Submit the Refund
Documentation requirements vary by MAC because CMS deliberately did not impose a uniform federal data element list in the final rule. In practice, most MACs need the provider’s National Provider Identifier, the affected claim numbers, dates of service, the reason for the overpayment, and the calculated refund amount. If you used a statistical sample to calculate the total, you must describe the methodology; that is the one data element CMS kept in the final regulation.3Federal Register. Medicare Program; Reporting and Returning of Overpayments
For Stark Law disclosures through the CMS Self-Referral Disclosure Protocol, the submission is more involved. As of February 2026, providers must use the most recent OMB-approved forms, including a disclosure form, physician information forms, a financial analysis worksheet, and a certification.5Centers for Medicare & Medicaid Services. Self-Referral Disclosure Protocol
Many MACs accept submissions through secure online portals that generate a confirmation receipt. If you submit by mail, use a trackable method. Proof of timely submission within the 60-day window can be the difference between a resolved overpayment and a False Claims Act case.
When a billing error touches thousands of claims, CMS permits statistical sampling to estimate the total, but the methodology must meet specific standards, including approval by a qualified statistician or someone with equivalent training, and a probability sample where every claim in the affected universe has a known, nonzero chance of selection.6Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 8 – Administrative Actions and Sanctions and Statistical Sampling for Overpayment Estimation
Interest on Late Returns
Overpayments that aren’t returned promptly accrue interest, and the rate is steep. As of April 20, 2026, the Medicare overpayment interest rate is 11.375 percent, set quarterly by the Treasury.7Centers for Medicare & Medicaid Services. Notice of New Interest Rate for Medicare Overpayments and Underpayments – 2nd Quarter Notification for FY 2026 Interest accrues from the date of final determination for each full 30-day period the payment is delayed.8eCFR. 42 CFR 405.378 – Interest Charges on Overpayment and Underpayments to Providers, Suppliers, and Other Entities
There is one important reprieve. Interest is waived entirely if the overpayment is fully paid within 30 days of the final determination.8eCFR. 42 CFR 405.378 – Interest Charges on Overpayment and Underpayments to Providers, Suppliers, and Other Entities For cost-reporting providers, if the cost report shows an amount due to CMS, interest runs from the report’s due date unless full payment accompanies the filing. Late cost reports trigger interest from the day after the filing deadline.
Penalties for Failing to Report and Return
An overpayment that a provider knowingly fails to return becomes an “obligation” to the federal government under the False Claims Act. Concealing or improperly avoiding that obligation is a violation, commonly called a reverse false claim.9Office of the Law Revision Counsel. 31 USC 3729 – False Claims You do not have to submit a fraudulent claim to trigger FCA liability. Keeping money you know you aren’t owed is enough.
FCA violations carry treble damages, meaning the provider owes three times the amount the government lost. Per-claim civil penalties apply on top of that. The most recent inflation adjustment sets those penalties at $14,308 to $28,619 per false claim.10Federal Register. Civil Monetary Penalties Inflation Adjustments for 2025 When a systemic billing error touches thousands of claims, the per-claim penalties alone can dwarf the underlying overpayment.
The OIG also has authority to exclude individuals and entities from all federally funded healthcare programs. An excluded provider cannot receive payment from Medicare, Medicaid, or any other federal health benefit program for items or services it furnishes, orders, or prescribes.11Office of Inspector General. Exclusions For most healthcare organizations, exclusion ends the business.
Providers that voluntarily identify and return overpayments within the 60-day window generally avoid FCA liability, because the violation requires knowing retention of the funds. Prompt self-reporting also carries weight with the OIG when it considers whether to pursue exclusion or accept a less severe resolution.
Extra Obligations Under a Corporate Integrity Agreement
If your organization is already operating under a Corporate Integrity Agreement, the 60-day rule still applies, and the CIA adds a separate layer. CIAs typically require reporting “reportable events” to the OIG within 30 days.12Office of Inspector General. Corporate Integrity Agreement FAQs
A reportable event generally includes any substantial overpayment, potential violations of criminal or civil law, employment of an excluded individual, or the filing of a bankruptcy petition. The OIG does not set a specific dollar threshold for what makes an overpayment “substantial.” Providers must evaluate each situation based on the totality of the facts and surrounding circumstances.12Office of Inspector General. Corporate Integrity Agreement FAQs
CIAs requiring independent claims reviews add another layer. When an Independent Review Organization identifies overpayments in its sample of paid claims, the provider must repay those amounts within 60 days of the finding.12Office of Inspector General. Corporate Integrity Agreement FAQs Falling behind on any of these obligations can result in stipulated penalties or, in serious cases, exclusion proceedings.