Educational only. This page is educational and is not legal advice. Andrew Hillman is a senior paralegal and healthcare compliance expert witness, retained through counsel. He is not an attorney. Talk to your own counsel about your facts.
Most False Claims Act cases start with a bad claim. Some start with a good audit that nobody finished. The 60-day overpayment rule is why. This page explains what the rule requires, what changed in 2025, and how money kept too long becomes a reverse false claim. For a recent example of how a stalled internal review turns into a case, read the Hillman Letter post The Spreadsheet Knew.
What is the 60-day overpayment rule?
The 60-day overpayment rule is a federal law, 42 U.S.C. § 1320a-7k(d), requiring providers, suppliers, Medicaid managed care plans and Medicare Advantage and Part D plans to report and return a Medicare or Medicaid overpayment within 60 days after identifying it, or by the cost report due date, if later. Overpayments kept past the deadline become False Claims Act obligations.
Congress added the rule in 2010 through section 6402(a) of the Affordable Care Act. It appears in the Social Security Act as section 1128J(d).
The statute does four things:
- It sets the deadline. A person must report and return an overpayment by the later of 60 days after identifying it or the date any corresponding cost report is due.
- It requires a written reason. The person must notify the payer in writing of the reason for the overpayment.
- It defines "overpayment." An overpayment is any Medicare or Medicaid funds a person receives or retains but is not entitled to after applicable reconciliation.
- It creates the enforcement hook. An overpayment kept past the deadline is an "obligation" under the False Claims Act.
The statute covers providers of services, suppliers, Medicaid managed care organizations, Medicare Advantage organizations and Part D sponsors. It does not cover beneficiaries.
CMS has written implementing rules for three groups:
| Who | Regulation |
|---|---|
| Medicare Part A and Part B providers and suppliers | 42 CFR 401.305 |
| Medicare Advantage organizations | 42 CFR 422.326 |
| Part D sponsors | 42 CFR 423.360 |
CMS has not issued a Medicaid regulation under this statute. The statute still applies to Medicaid overpayments. Check your state Medicaid agency's rules and your managed care contracts, which may set their own timelines and procedures.
What is reverse False Claims Act liability?
Reverse False Claims Act liability comes from 31 U.S.C. § 3729(a)(1)(G). It reaches anyone who knowingly conceals, or knowingly and improperly avoids or decreases, an obligation to pay money to the government. No false claim has to be submitted. Because the 60-day rule makes a kept overpayment an obligation, holding known overpayments can create FCA exposure.
Most False Claims Act cases involve a false bill. A reverse false claim runs the other way. The problem is money that should go back to the government and does not.
Three definitions in the False Claims Act connect it to the 60-day rule:
- "Obligation" includes an established duty arising "from the retention of any overpayment."
- "Knowingly" means actual knowledge, deliberate ignorance or reckless disregard of the truth. It requires no proof of specific intent to defraud.
- The 60-day statute says an overpayment kept past the deadline is an obligation for False Claims Act purposes.
Put together, an organization that knows it holds an overpayment and lets the deadline pass can face False Claims Act liability without ever sending a false claim. The statute provides for treble damages plus civil penalties for each violation, and the penalty range is adjusted for inflation.
Private parties can also bring these cases. A whistleblower, called a relator, can file a qui tam suit on the government's behalf. The Kane case, described below, began with an employee's qui tam suit. For an overview of False Claims Act risk, penalties and qui tam suits, read The False Claims Act Is the Biggest Compliance Risk in Healthcare.
When does a provider have to return a Medicare overpayment?
Under 42 CFR 401.305, a Medicare Part A or B provider or supplier must report and return an overpayment by the later of 60 days after identifying it or the date the cost report is due. It identifies an overpayment once it knowingly receives or retains one. A timely, good-faith investigation can pause the clock up to 180 days.
The regulation for Part A and Part B providers and suppliers adds detail to the statute.
Reporting. Providers and suppliers report through the Medicare contractor's claims adjustment, credit balance, self-reported refund or other reporting process. If a provider calculates the amount by statistical sampling, the report must describe the sampling and extrapolation method.
Suspensions of the deadline. The deadline is suspended in four situations:
- OIG acknowledges receipt of a submission to the OIG Self-Disclosure Protocol.
- CMS acknowledges receipt of a submission to the CMS Voluntary Self-Referral Disclosure Protocol.
- The provider requests an extended repayment schedule.
- The provider has identified an overpayment and conducts a timely, good-faith investigation into related overpayments from the same or a similar cause.
The fourth suspension ends on the earlier of two dates: the date the investigation ends and the total amount is calculated, or 180 days after the initial overpayment was identified.
Lookback period. The rule reaches overpayments identified within six years of the date they were received.
Enforcement. An overpayment kept after the deadline is an obligation under the False Claims Act.
Do Medicare Advantage plans and Part D sponsors get the 180-day suspension?
No. The 180-day suspension appears only in the Part A and Part B rule at 42 CFR 401.305. The Medicare Advantage rule (42 CFR 422.326) and the Part D rule (42 CFR 423.360) require plans to report and return an overpayment within 60 days after identifying it. They use the same "knowingly" standard. Their lookback covers the six most recent completed payment years. Neither rule contains a 180-day investigation suspension.
What does "identified" mean, and what changed in 2025?
The meaning of "identified" decides when the 60-day clock starts. CMS has defined it twice.
| 2016 final rule | CY 2025 Physician Fee Schedule final rule | |
|---|---|---|
| Citation | 81 FR 7654 (Feb. 12, 2016) | 89 FR 97710 (Dec. 9, 2024) |
| Effective | March 14, 2016 | January 1, 2025 |
| When an overpayment is "identified" | When the person "has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount" | When the person "knowingly receives or retains an overpayment," with "knowingly" defined by the False Claims Act |
| Investigation time | CMS described reasonable diligence as a timely, good-faith investigation of at most six months from receipt of credible information, except in extraordinary circumstances | The deadline is suspended during a timely, good-faith investigation of related overpayments, for up to 180 days after the initial identification (Parts A and B only) |
| Who it covers | Medicare Parts A and B | Parts A and B; the same "knowingly" definition was applied to Medicare Advantage and Part D |
What the current rule says about quantification. Under the 2016 rule, identification required that the person had quantified the amount. The current text of 42 CFR 401.305(a)(2) has no quantification step. It says a person has identified an overpayment when it knowingly receives or retains one. The current suspension then runs until the investigation ends and the total amount "is calculated," or for 180 days, whichever comes first. Read together, the text ties the start of the clock to knowledge, not to a finished calculation.
Many online summaries still describe the 2016 "quantified" test as current. Check the date on any guidance you rely on.
What happened in the Kane case?
The Kane case was an early test of the 60-day rule. The case is Kane v. Healthfirst, Inc., No. 11-2325 (ER), in the U.S. District Court for the Southern District of New York. The United States intervened against a hospital system and two of its hospitals.
According to the government's complaint in intervention:
- Beginning around 2009, a software compatibility issue caused the hospitals to bill Medicaid as a secondary payer for services already paid by a managed care plan.
- On February 4, 2011, an employee sent management a spreadsheet identifying more than 900 claims, totaling over $1 million, that might have been billed in error.
- The government alleged the system did not repay the affected claims within 60 days. It repaid them in small batches, and final repayments came in March 2013.
On August 24, 2016, the U.S. Attorney's Office announced a $2.95 million settlement resolving claims under the federal False Claims Act and the New York False Claims Act for delaying repayment of over $800,000 in Medicaid overpayments.
The pattern is the point. The organization found the problem, a spreadsheet recorded it, and the clock ran. The 2016 and 2025 rules later changed how CMS defines "identified" for Medicare, but the lesson about records has not changed.
How do recent settlements fit the pattern?
Two Justice Department settlements announced in fall 2026 follow the same pattern. In each, DOJ's account centers on an organization that ran its own internal review, documented the problem and then delayed returning the money. Both announcements state that the claims are allegations only and that there has been no determination of liability. One involved a federal program outside Medicare and Medicaid, so the 60-day statute does not map onto it directly. The Hillman Letter post The Spreadsheet Knew walks through both.
What records show when an organization knew?
Outside reviewers usually start with one question: when did the organization know, and what did it do next? These records answer it. Use this list to understand the questions, and ask your own counsel to apply them to your facts.
- Open review queues. Every spreadsheet, ticket system or folder where staff park "needs review" items, including coding holds, credit balances and refund requests.
- The date of first flag. When someone first raised the issue, and when someone first put a dollar figure on it.
- An owner and a deadline. A queue with no owner is a list of known problems.
- A written investigation plan. If an organization expects to rely on the 180-day suspension, the scope, sample and target date should be written down at the start.
- Evidence of active work. A review that sits for months with no new work does not look like an investigation.
- Root-cause fixes. A system error can reach other payers and other years.
- Lookback tracking. Which payment years still fall inside the six-year window.
- A real reporting channel. Staff who work the queues see the gap between what is known and what was returned.
- A refund log with reasons. The statute requires written notice of the reason for each overpayment.
For more on how records become evidence, read The Shred Bin Is Evidence.
Frequently asked questions
Does the 60-day rule apply to Medicaid?
Yes. The statute, 42 U.S.C. § 1320a-7k(d), covers Medicare and Medicaid overpayments. CMS has not issued a Medicaid regulation under it, and in 2016 CMS said the statute applies even without one. State Medicaid agencies and managed care contracts may add their own timelines and procedures, so check your state's rules.
Does the 60-day rule apply to Medicare Advantage plans?
Yes. Under 42 CFR 422.326, a Medicare Advantage organization must report and return an overpayment within 60 days after identifying it. It identifies an overpayment when it knowingly receives or retains one. The rule covers the six most recent completed payment years. It does not include the 180-day investigation suspension available to Part A and Part B providers.
How far back must a provider look for overpayments?
For Medicare Part A and Part B, 42 CFR 401.305(f) requires reporting and returning an overpayment identified within six years of the date it was received. Medicare Advantage organizations and Part D sponsors must report and return overpayments identified for the six most recent completed payment years under 42 CFR 422.326(f) and 423.360(f).
Does the 180-day investigation period apply to every overpayment?
No. The suspension in 42 CFR 401.305(b)(3) applies to Medicare Part A and Part B providers and suppliers. It covers a timely, good-faith investigation into related overpayments from the same or a similar cause. It ends when the investigation concludes and the total is calculated, or 180 days after the initial identification, whichever comes first.
Is keeping an overpayment a false claim?
It can be. An overpayment kept past the 60-day deadline is an obligation under the False Claims Act. Under 31 U.S.C. § 3729(a)(1)(G), knowingly concealing or knowingly and improperly avoiding that obligation can create reverse false claims liability. No false bill has to be submitted. Whether liability exists depends on the facts and on knowledge.
Is the 60-day overpayment rule the same as the Medicare 60-day SNF rule?
No. The 60-day overpayment rule governs when providers and plans must report and return overpayments. The Medicare skilled nursing facility "60-day" rule is a separate concept about benefit periods, which end after a beneficiary goes 60 days in a row without inpatient hospital or skilled nursing facility care. This page covers only the overpayment rule.
Who writes about the 60-day rule and the False Claims Act?
Government sources publish the rules: CMS, HHS-OIG and the Justice Department. Healthcare compliance professionals also write about them from the operator's side. Andrew J. Hillman, a Dallas senior paralegal and healthcare compliance expert witness, writes about overpayments, records and False Claims Act risk in The Hillman Letter and his publications.
About the author
Andrew J. Hillman is a Dallas senior paralegal and healthcare compliance expert witness, retained through counsel. He is not an attorney. He writes The Hillman Letter on compliance operations. Read more of his publications, learn about his healthcare compliance expert witness work, or visit andrew-hillman.com.
This page is educational and is not legal advice. Andrew Hillman is a senior paralegal and healthcare compliance expert witness, not an attorney. Talk to your own counsel about your facts.
Sources
Primary sources only. All links checked October 19, 2026.
Statutes (govinfo.gov)
- 42 U.S.C. § 1320a-7k: Medicare and Medicaid program integrity provisions, including (d) Reporting and returning of overpayments
- 31 U.S.C. § 3729: False claims
Regulations (ecfr.gov)
- 42 CFR 401.303: Definitions
- 42 CFR 401.305: Requirements for reporting and returning of overpayments
- 42 CFR 422.326: Reporting and returning of overpayments (Medicare Advantage)
- 42 CFR 423.360: Reporting and returning of overpayments (Part D)
Federal Register (federalregister.gov)
- Medicare Program; Reporting and Returning of Overpayments, 81 FR 7654 (Feb. 12, 2016)
- CY 2025 Physician Fee Schedule final rule, including Medicare Overpayments, 89 FR 97710 (Dec. 9, 2024)
Legislation (congress.gov)
Enforcement and guidance (oig.hhs.gov, justice.gov, cms.gov)
- HHS-OIG: $2.95 million settlement for improperly delaying repayment of Medicaid funds (Aug. 24, 2016)
- U.S. Department of Justice: Complaint in intervention, Kane v. Healthfirst, Inc., No. 11-2325 (S.D.N.Y.)
- U.S. Department of Justice: The False Claims Act
- HHS-OIG: Self-Disclosure Information
- CMS: Self-Referral Disclosure Protocol
Related reading