Skip to Content

CMS Releases Final 60-Day Overpayment Rule

on Friday, 4 March 2016 in Health Law Alert: Erin E. Busch, Editor

On February 12, 2016, nearly four years after publishing a proposed rule, the Centers for Medicare and Medicaid Services (CMS) released a final rule implementing Section 6402(a) of the Affordable Care Act (the “Final Rule”) which provides for a 60-day timeline for reporting and returning overpayments. The Final Rule requires providers to report and return overpayments by: (1) 60 days after the overpayment is identified; or (2) the date on which the corresponding cost report is due, whichever is later. There are several notable differences from the proposed rule, including a revised lookback period and clarification of “identification” of an overpayment. The Final Rule is effective March 14, 2016.


The proposed rule stated that an overpayment was “identified” if a person has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment. CMS received many comments about this standard and, in particular, questions regarding the types of actions that must be taken in order for an overpayment to be “identified.” For example, many commenters questioned whether an overpayment could be “identified” if it was not yet quantified.

The Final Rule states that an overpayment is “identified” when the person has or should have, through the exercise of “reasonable diligence,” determined that the person has received an overpayment and quantified the amount of the overpayment. If a person does not exercise reasonable diligence, the 60-day timeline begins on the date the person received credible information about the overpayment. Reasonable diligence means proactive compliance activities to monitor claims and reactive investigative activities undertaken in response to receiving credible information about a potential overpayment.

The Final Rule also clarified that part of the identification process includes quantification of the overpayment. Quantification could include statistical sampling, extrapolation, and other appropriate methodologies.

CMS included a six-month benchmark for the reasonable diligence period. This means, absent extraordinary circumstances, providers must complete an investigation of a potential overpayment within six months after receiving information about the potential overpayment. CMS believes a total of eight months (six months for the investigation and 60 days to report and return the overpayment) is a reasonable amount of time to determine and repay known overpayments.

Lookback Period.

CMS originally proposed a 10-year lookback period, to be consistent with the False Claims Act statute of limitations. CMS received many comments from the health care industry stating that a 10-year lookback period would be costly and burdensome. The Final Rule provides for a six year lookback period – meaning that overpayments must be reported and returned if they have been identified within six years of the date the overpayment was received.

In the comments to the Final Rule, CMS noted that, under the Self-Referral Disclosure Protocol (SRDP) used to self-report Stark law violations, CMS is currently authorized to receive four years of financial analysis. CMS intends to seek authorization from the Office of Management and Budget to collect information for a six year period. Until then, when self-reporting under the SRDP, there is no obligation to disclose analysis for the fifth and sixth years.

How to Report and Return Overpayments.

Under the Final Rule, overpayments must be reported and returned to the Secretary of Health and Human Services, an intermediary, a carrier, or a Medicare contractor. Overpayments may be reported and returned using a voluntary refund process (for example, the Office of Inspector General’s (“OIG”) Self-Disclosure Protocol or the SRDP). Alternatively, there are contractor-specific processes for reporting refunds, claims adjustments, and credit balances. Providers should become familiar with such processes and contractor-specific instructions.

For providers reporting an overpayment under the OIG Self-Disclosure Protocol or the SRDP, the deadline to return the overpayment will be suspended when the OIG or CMS acknowledges receipt of the protocol submission. The repayment obligation will then be suspended until a settlement is reached, the provider withdraws from the protocol, or the provider is removed from the protocol by the OIG or CMS.


Failure to monitor for or investigate potential overpayments could result in significant liability under the False Claims Act, potential civil monetary penalties, and exclusion. Therefore, as part of a robust compliance program, health care providers should continue to undertake timely, good faith efforts to monitor and investigate the receipt of potential overpayments. Upon receipt of credible information about a potential overpayment, providers must work diligently, and without unreasonable delay, to investigate and refund the potential overpayment.


Michael W. Chase

1700 Farnam Street | Suite 1500 | Omaha, NE 68102 | 402.344.0500

Law Firm Website Design