CMS 60-Day Overpayment Rule
The 60-day overpayment rule, from Section 6402 of the Affordable Care Act, requires providers to report and return Medicare and Medicaid overpayments within 60 days of identifying them. An overpayment retained past that deadline becomes an "obligation" under the False Claims Act, exposing the provider to treble damages and per-claim penalties.
- Enforced by
- CMS / DOJ (via False Claims Act)
- Applies to
- Medicare and Medicaid providers
- Penalty
- FCA liability: treble damages + penalties
What is the 60-day overpayment rule?
The rule comes from Section 6402 of the Affordable Care Act and says: once you identify a Medicare or Medicaid overpayment, you have 60 days to report and return it. Keep it longer, and the retained money becomes an "obligation" under the False Claims Act. In other words, sitting on money you know you were overpaid is treated like fraud.
This is the rule that gives self-audits their teeth. Finding an error is not enough; the law imposes a deadline to fix it.
When does the clock start?
At "identification," which CMS ties to reasonable diligence. You have identified an overpayment when you have determined, or should have determined through timely good-faith investigation, that you were overpaid and by how much. A credible complaint, a OIG Work Plan match, or your own audit finding can all start the diligence obligation.
How do you return an overpayment?
- Investigate promptly and quantify the overpayment, including any extrapolation where a pattern exists.
- Refund through the Medicare Administrative Contractor\'s overpayment process for routine amounts.
- Use the CMS or OIG self-disclosure protocols for larger issues or those involving potential fraud or the Anti-Kickback Statute.
- Document the identification date, the diligence, the math, and the refund.
Why does this matter so much?
Because it converts a bookkeeping issue into potential fraud liability. A $9,000 overpayment refunded on day 45 is just a refund; the same $9,000 knowingly held past day 60 can support treble damages and per-claim penalties. Tie your self-audit process — driven by NCCI trends, denial data, and Work Plan items — directly to a documented refund workflow so identification and return are never disconnected.
Frequently asked questions
The clock starts when an overpayment is "identified" — meaning the provider has, or should have through reasonable diligence, determined that an overpayment was received and quantified its amount. Reasonable diligence includes timely, good-faith investigation of credible information. So a credible tip you sit on can start the clock even before you formally confirm the amount.
An overpayment knowingly retained beyond 60 days after identification becomes an "obligation" under the False Claims Act — a so-called reverse false claim. That exposes the provider to FCA liability: treble (triple) the damages plus per-claim civil penalties, on top of returning the money. The deadline is what converts a simple refund into potential fraud liability.
For Medicare fee-for-service, refund through the applicable Medicare Administrative Contractor's overpayment process, or use CMS/OIG self-disclosure protocols for larger or more serious issues. Document the identification date, the diligence performed, the calculation, and the return. That paper trail is your evidence that you met the 60-day obligation.
Sources & further reading
Reviewed by the ImmediCare Solutions RCM team
Certified billers and coders handling claims across 50+ specialties nationwide. This entry is reviewed against current payer policy and CMS rules. Last review: Jul 5, 2026.
Stop losing revenue to problems like this.
A free billing audit shows exactly where your practice is leaking money — no cost, no commitment.
