The Medicare 60-day overpayment rule is the federal requirement, in 42 CFR 401.305 and 42 U.S.C. 1320a-7k(d), that a Medicare Part A or Part B provider or supplier report and return an overpayment by the later of 60 days after the overpayment was identified or the date any corresponding cost report is due, if applicable. Integral Healthcare Solutions (IHS) drafts the identification procedure, investigation record, deadline calendar and reporting log that show a compliance team what it knew and when.
Counsel decides what is reportable, and your team reports and returns. IHS is a consulting firm, not a law firm.
Last updated: November 2026
What does the 60-day overpayment rule require?
42 CFR 401.305 requires a provider or supplier that has received a Medicare Part A or Part B overpayment to report and return it by a deadline that runs from identification. The statute behind it is 42 U.S.C. 1320a-7k(d) (U.S. Code, 2024 edition on govinfo, opened November 6, 2026). The regulation was amended on December 9, 2024 (89 FR 98553), which revised paragraph (a)(2), the introductory text of paragraphs (b)(1) and (b)(2), and added paragraph (b)(3). IHS opened the current eCFR text on November 6, 2026 (Title 42 last amended October 8, 2026).
- Scope. Providers and suppliers under Parts A and B (42 CFR 401.301, 401.303).
- Identification. A person has identified an overpayment when the person knowingly receives or retains it (paragraph (a)(2)).
- Deadline. The later of 60 days after identification or the date any corresponding cost report is due, if applicable, except as paragraphs (b)(2) and (b)(3) provide (paragraph (b)(1)).
When does the 60-day clock start, and when does it pause?
The 60 days run from the date of identification, which turns on what the person knew. Paragraph (a)(2) uses the False Claims Act meaning of “knowingly”: actual knowledge, deliberate ignorance, or reckless disregard of the truth or falsity of the information, with no proof of specific intent to defraud required (31 U.S.C. 3729(b)(1)).
The later of two dates governs: 60 days after identification, or the date any corresponding cost report is due, if applicable (paragraph (b)(1)). Paragraph (c) adds that a provider that receives more recent CMS information on the SSI ratio, or knows an outlier reconciliation will be performed, is not required to return the resulting amount until final reconciliation of the cost report.
Paragraph (b)(2) suspends the deadline when OIG or CMS acknowledges a disclosure-protocol submission, or a person requests an extended repayment schedule, until the end events it lists. Paragraph (b)(3) covers related overpayments. The deadline is suspended when a person has identified an overpayment but has not yet completed a good-faith investigation into related overpayments from the same or similar cause or reason, and the person conducts a timely, good-faith investigation. The suspension then lasts until the earlier of two dates: the date the investigation has concluded and the aggregate amount of the initial and related overpayments is calculated, or the date 180 days after the initial overpayment was identified.
Who needs a program, and what triggers it?
Any organization paid under Medicare Part A or Part B needs a written way to move from a suspected payment error to a documented decision. The statute’s definition of “person” is wider and includes Medicare Advantage organizations and PDP sponsors (42 U.S.C. 1320a-7k(d)(4)(C)), which read 42 CFR 422.326 or 42 CFR 423.360.
- A billing error is found and the team needs to know who decides, who dates it and who calculates it.
- A cost report is due or being reconciled (paragraphs (b)(1)(ii) and (c)).
- A related-overpayment review is open (paragraph (b)(3)).
How IHS helps
IHS turns the deadline mechanics of 42 CFR 401.305 into a procedure, a calendar and a log. Thomas G. Goddard, JD, PhD, IHS founder and former URAC Chief Operating Officer and General Counsel, leads the work. IHS runs three practice lines, Accreditation Consulting, Compliance Services and Program Development, and this program sits in Compliance Services.
What IHS drafts
- An identification and escalation procedure that records who knew what, and on what date.
- An investigation record that holds the root-cause notes, the related-overpayment review start date and the 180-day date.
- A sampling documentation template for the methodology description paragraph (d)(1) requires.
- A deadline calculator for the 60-day date, the cost-report date and each suspension event, with a lookback worksheet for the 6-year period.
- A return and reporting log keyed to your Medicare contractor’s process, including the written reason for each overpayment.
What you supply
You supply the facts of each case, your qualified claims reviewers, counsel’s decisions on reportability and route, the contractor’s reporting steps, and the money.
The real limit
IHS drafts the procedure and the log. Your qualified reviewers calculate the amount, and counsel decides what is reportable. IHS gives no False Claims Act opinion.
What to have ready
- Your current overpayment policy and billing-error review process (paragraph (a)(2)).
- A dated record of when each suspected overpayment was first known (paragraph (a)(2)).
- The due dates of any corresponding cost reports and the status of reconciliation (paragraphs (b)(1)(ii) and (c)).
- Notes on any related-overpayment review, with the start date and the stated cause (paragraph (b)(3)).
- Sampling method documents for any extrapolated amount (paragraph (d)(1)).
- Your Medicare contractor’s reporting and refund instructions (paragraph (d)(1)).
- Any disclosure, refund or extended repayment schedule already in progress (paragraphs (b)(2) and (d)(2)).
- The received dates of claims inside the 6-year lookback (paragraph (f)).
With the list in hand, the free introductory call is where IHS walks through it with you.
How do the reporting and disclosure routes compare?
IHS lists the routes without ranking them; counsel chooses.
| Route | What the sources say | Source |
|---|---|---|
| Contractor reporting process | The default: a claims adjustment, credit balance, self-reported refund or other process set by the Medicare contractor. | 42 CFR 401.305(d)(1) |
| OIG Health Care Fraud Self-Disclosure Protocol | For potential violations of federal law with civil monetary penalty authority. OIG says a matter exclusively involving overpayments or errors is not available and goes to the contractor. OIG’s general practice is a minimum multiplier of 1.5 times single damages. A sample used to estimate damages must be at least 100 items. Acknowledgment of a timely submission suspends the deadline. | OIG Health Care Fraud Self-Disclosure Protocol, notice issued October 15, 2026, opened November 6, 2026; 42 CFR 401.305(b)(2)(i), (d)(2) |
| CMS Voluntary Self-Referral Disclosure Protocol | OIG lists it for conduct that implicates the physician self-referral law but not the False Claims Act. CMS’s acknowledgment of receipt suspends the deadline. | OIG self-disclosure page, opened November 6, 2026; 42 CFR 401.305(b)(2)(ii), (d)(2) |
| FCA Self-Disclosure Pilot Program | OIG lists it for conduct that implicates the False Claims Act, OIG administrative authorities and CMS administrative authorities. IHS did not open the pilot’s terms and states none. | OIG self-disclosure page |
| Extended repayment schedule | A request suspends the deadline until CMS or its contractor rejects it or the schedule is not followed. CMS or its contractor may grant at least 6 months for hardship, and 36 to 60 months for extreme hardship, as 42 CFR 401.607(c)(2) defines those terms, and may not grant one where there is reason to suspect bankruptcy, closing the business, leaving Medicare, or fraud or abuse. | 42 CFR 401.305(b)(2)(iii); 42 CFR 401.607 |
For related programs, see physician arrangement tracking and the Compliance Services practice line.
What does it cost?
42 CFR 401.305 names no fee for reporting. The route changes the amount paid to the Government: a contractor refund returns the overpayment, while OIG’s general practice under its protocol adds a multiplier of at least 1.5 times single damages. Interest and other collection terms are set by CMS and the contractor, and this page states none. Verify current terms with OIG.
IHS scopes each engagement after a free introductory call.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm, and gives no False Claims Act opinion.
- It is not a determination that any payment is an overpayment, and it is not a guarantee of any outcome.
- IHS does not contact the Medicare contractor, CMS or the Office of Inspector General, and does not submit or return anything for you.
- This page does not describe state Medicaid overpayment rules.
Frequently asked questions
What is the Medicare 60-day overpayment rule?
It is the requirement in section 1128J(d) of the Social Security Act (42 U.S.C. 1320a-7k(d)) and 42 CFR 401.305 that a person who has received a Medicare overpayment report and return it. For Part A and Part B providers and suppliers, the regulation sets the deadline at the later of 60 days after the date the overpayment was identified or the date any corresponding cost report is due, if applicable.
When is an overpayment identified?
Paragraph (a)(2) says a person has identified an overpayment when the person knowingly receives or retains an overpayment, and it takes the meaning of “knowingly” from 31 U.S.C. 3729(b)(1)(A). That definition covers actual knowledge, deliberate ignorance and reckless disregard, and requires no proof of specific intent to defraud. Counsel decides whether an event meets that standard.
Is the deadline always 60 days?
No. Paragraph (b)(1) sets the later of two dates, 60 days after identification or the date any corresponding cost report is due, if applicable, except as paragraphs (b)(2) and (b)(3) provide. Paragraph (b)(2) suspends it for a disclosure-protocol submission OIG or CMS has acknowledged, or for an extended repayment schedule request. Paragraph (b)(3) suspends it during a timely, good-faith investigation of related overpayments, until the earlier of the date the investigation concludes and the aggregate amount is calculated or 180 days after the initial overpayment was identified.
How do we report and return an overpayment?
Paragraph (d)(1) says a person must use an applicable claims adjustment, credit balance, self-reported refund or other reporting process set forth by the applicable Medicare contractor, except as paragraph (d)(2) provides. If the person calculates the amount with a statistical sampling methodology, the report must describe the statistically valid sampling and extrapolation methodology. The statute also requires written notice of the reason for the overpayment (42 U.S.C. 1320a-7k(d)(1)(B)).
How far back must we look?
For Part A and Part B providers and suppliers, paragraph (f) applies if a person identifies the overpayment within 6 years of the date it was received. Medicare Advantage and Part D use a different measure: 42 CFR 422.326(f) and 42 CFR 423.360(f) refer to the 6 most recent completed payment years.
Does the rule reach Medicare Advantage, Part D and Medicaid?
The statute’s definition of “person” includes Medicare Advantage organizations, PDP sponsors and Medicaid managed care organizations. 42 CFR 401.305 applies to Part A and Part B providers and suppliers. Medicare Advantage organizations report under 42 CFR 422.326 and Part D sponsors under 42 CFR 423.360, each with a 60-day period (the Medicare Advantage text adds “unless otherwise directed by CMS for purposes of § 422.311”), and neither names a cost-report date.
What happens if we keep an overpayment past the deadline?
Paragraph (e) says an overpayment retained after the deadline specified in paragraph (b) is an obligation for purposes of 31 U.S.C. 3729. Subparagraph (a)(1)(G) of that statute reaches a person who knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay money to the Government; the liability is a civil penalty, as adjusted for inflation, plus 3 times the Government’s damages, subject to the reduced-damages conditions in paragraph (a)(2) of that section.
When is the OIG Self-Disclosure Protocol available for a billing error?
The OIG Health Care Fraud Self-Disclosure Protocol, in its notice issued October 15, 2026, says the protocol is not available for a matter that does not involve potential violations of federal law for which civil monetary penalties are authorized, such as one exclusively involving overpayments or errors, and that such a matter goes to the Medicare contractor under the voluntary refund process. Counsel chooses the route.