What Is the 60-Day Rule in the Medicare and Medicaid Overpayment and Refund Policy?
The Affordable Care Act included a provision requiring anyone who has received an overpayment from the Medicare or Medicaid program to “report and return” the overpayment while describing, in writing, the reason for the overpayment, within 60 days of the day on which the overpayment was identified. While an earlier statutory provision made it a felony to conceal or fail to disclose events that affect one’s initial right to payment of a federal healthcare benefit, that statute has been used very infrequently, and primarily against Medicaid beneficiaries. As a result, the so-called “60-Day Rule” became the first clear requirement on healthcare organizations to refund overpayments. When it issued regulations to document this section, the Centers for Medicare & Medicaid Services (CMS) imposed an affirmative duty to search for overpayments. The regulations deem an organization to have “identified” an overpayment even when the organization does not actually know about the overpayment if it “should have through the exercise of reasonable diligence” located the overpayment.
The key point is that once you are aware that you have been overpaid by the Medicare or Medicaid program, and you have determined the exact dollar amount of the overpayment, you must send the money back to Medicare or Medicaid within 60 days. Additionally, CMS believes that there is a duty to exercise reasonable diligence to review payments to locate overpayments, though the enforceability of that obligation is less clear.
Risk Area Governance
The 60-Day Rule is codified at section 1128J of the Social Security Act. The statute applies to both Medicare and Medicaid, defining an overpayment as “any funds that a person receives or retains under [the Medicare or Medicaid program] to which the person, after applicable reconciliation, is not entitled under such title.” The overpayment must be returned by the later of (1) 60 days of its identification or (2) the date any corresponding cost report is due.
The statute leaves several key terms undefined. The regulation issued February 12, 2016, offer CMS’s interpretation of the statute.  The regulation states that a person has “identified” an overpayment when the person has, or should have, “determined that the person has received an overpayment and quantified the amount of the overpayment.” The regulation creates a six-year lookback period, requiring refund of any overpayment identified within six years of its receipt.
Common Compliance Risks
While the basic principle of the 60-Day Rule is easily understandable, the definition (or lack of definition) of certain terms creates many areas for potential misunderstanding or disagreement. In some organizations, there is belief that even after a credible allegation of an overpayment there is no duty to review claims. In other organizations, a desire to “do the right thing” results in decisions to refund money where the 60-Day Rule does not require it. In essence, there are compliance risks associated with failing to refund and business risks created by unnecessarily refunding Medicare and Medicaid payments.
Failing to Search for Overpayments
The 60-day regulation imposes a duty to exercise reasonable diligence to locate overpayments. While it is possible to argue that this regulatory requirement exceeds the authority granted by the statute, an organization will likely prefer to have a program that affirmatively searches for overpayments.
The argument that the regulation exceeds the authority in the statute has merit. The statute requires an organization to refund overpayments that it has identified, making no mention of an obligation to look for an overpayment. Common sense suggests that if you are ignorant of an overpayment, that overpayment has not been identified. When issuing the regulations, CMS explains that it believes Congress intended to impose an affirmative duty to search for overpayments. Courts are increasingly hesitant to allow agencies to attempt to divine congressional intent. It is certainly possible that a court will ultimately invalidate the regulation. Until then, however, most organizations will want to avoid running afoul of the CMS regulation. CMS explained:
While we acknowledge that the terms ‘knowing’ and ‘knowingly’ are defined but not otherwise used in Section 1128J(d) of the Act, we believe that the Congress intended for Section 1128J(d) of the Act to apply broadly. If the requirement to report and return overpayments only applied to situations where providers or suppliers had actual knowledge of the existence of an overpayment, then these entities could easily avoid returning improperly received payments and the purpose of the section would be defeated.
In the preamble, CMS made it quite clear that it expects organizations to affirmatively look for overpayments:
We believe that undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of a provider or supplier’s Medicare claims would expose a provider or supplier to liability under the identified standard articulated in this rule based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment. We also recognize that compliance programs are not uniform in size and scope and that compliance activities in a smaller setting, such as a solo practitioner’s office, may look very different than those in larger setting, such as a multi-specialty group.
The bottom line is that CMS expects organizations to conduct internal reviews looking for overpayments.
Misunderstanding When the 60 Days Start to Run
Perhaps it is the name—60-Day Rule—that causes many people to believe that an organization only has 60 days from the date it learns of an allegation of a possible overpayment until the date the check must be written. In fact, the 60-day clock only runs once the overpayment has been quantified. In the preamble to the 60-Day Rule, CMS explains that it anticipates organizations should be able to determine whether they have an overpayment within about six months: “We choose 6 months as the benchmark for timely investigation because we believe that providers and suppliers should prioritize these investigations and also to recognize that completing these investigations may require the devotion of resources and time.” CMS explains that it expects that most investigations should be concluded within six months of the receipt of credible information about an overpayment, absent extraordinary circumstances. The timeline envisioned by CMS is that after learning of a possible problem, an entity will determine whether there is an overpayment and quantify it’s size within six months. Once the overpayment is quantified, the organization has an additional 60 days to actually write the check.
Misunderstanding the Six-Year Lookback Period
The regulation requires an organization to report and return an overpayment “if a person identifies the overpayment, as defined in paragraph (a)(2) of [  The conventional wisdom is that this means an organization must always go back six years. That conclusion fails to recognize an important caveat: the text only requires you to report and return an overpayment as it is defined in paragraph (a)(2). Remember that the regulation defines an overpayment as funds that were received or retained to which the person is not entitled under the Medicare program. A variety of statutes and regulations limit the Medicare program’s ability to recover overpayments. For example, Social Security Act § 1870 forbids Medicare from recovering an overpayment if the recovery would be contrary to equity in good conscience. That statute creates a presumption that covering the overpayment would be improper if it is five years after the year in which the payment was made. Federal regulations prevent contractors from reopening claims more than four years after the date of the initial determination, unless there is fraud or similar fault. This raises an important question: If Medicare is prohibited from recovering funds from an organization, is there an overpayment? The answer would seem to be “No, there is no overpayment” because if the government is not permitted to recoup the money, the organization is entitled to money. Therefore, there is an extremely strong argument that absent fraud or similar fault, an organization is only required to refund Medicare funds received within the last four years. The full six-year lookback period should apply only in the presence of fraud or similar fault.], within 6 years of the date the overpayment was received.”
Note that the lookback period for Medicaid is state specific. Some states have specific limits on reopening, but some states do not appear to have any temporal limits on recovery. Since the 60-day regulation only applies to Medicare, omitting Medicaid, the time period for return of Medicaid funds is more ambiguous and arguably dependent upon state law.
Private Insurance and State Law
While the 60-day statute only applies to Medicare and Medicaid, consider the issues with private insurance and state law. The 60-day statute applies to both Medicare and Medicaid claims but has no direct impact on private insurance claims. (As mentioned previously, the regulation implementing the statute only applies to Medicare claims, not referring to Medicaid.) It is important to review your contracts to determine whether they create a contractual obligation to refund. There is also the possibility that a state law could compel a refund to private insurers, though that is unlikely.
Addressing Compliance Risks
Write a Carefully Worded Refund Letter
Because the 60-Day Rule requires you to offer an explanation for the overpayment, it becomes necessary to write a letter or complete a form when refunding to the government. The wording in a disclosure can create additional risk. Carefully wording the refund letter can greatly lower the risk that your good deed is used against you. It is generally best to avoid categorical admissions of wrongdoing in the refund letter. For example, rather than stating “the services were billed incorrectly” or, worse yet, “the services were billed fraudulently,” it is better to say, “We believe it would have been more appropriate to bill the services as…” or “We would be more comfortable defending this level of service.” I would even refrain from using the term “overpayment,” instead indicating that you are electing to refund the money. This makes it possible to preserve every ability to argue that the billing was proper and that the refund is voluntary. It is possible to explain a refund without categorically admitting wrongdoing. The refund letter should also refrain from disclosing any advice from legal counsel. It can be tempting to state, “Our attorney has recommended…,” but including such a statement runs the risk of waiving attorney–client privilege. It is also tempting to promise that the mistake will never happen again. However, mistakes happen. There is little benefit to including this promise in the letter, but including it gives the government an avenue to attack you should the mistake occur again.
Understand That You Are Only Required to Refund if It Is Agreed That There Is an Overpayment
The preamble to the 60-Day Rule explicitly addresses the question of whether you need to refund if you are audited and disagree with the auditor’s decision. In the preamble’s example, an organization had claims from one year audited. CMS examines whether the organization must refund for earlier years even as it disputes the findings of the initial audit. CMS explains that if “the provider appeals the contractor identified overpayment, the provider may reasonably assess that it is premature to initiate a reasonably diligent investigation into the nearly identical conduct in an additional time period until such time as the contractor identified overpayment has worked its way through the administrative appeals process.” The preamble recognizes that if you disagree with a finding, you are not deemed to have an overpayment until there is a final, conclusive legal finding that your position is incorrect.
It’s worth emphasizing that the Federal Register uses the phrase “worked its way through the administrative appeals process.”  Even if there is an initial administrative finding accepting the government’s position on an overpayment, as long as further appeals are available, the 60-Day Rule is not triggered. The fact that you receive an overpayment assessment for some period of time does not trigger a duty to refund for other time periods or other locations as long as you disagree with the basis of the overpayment. One question is whether the same instruction applies if you opt not to appeal the initial audit finding because the money involved is too small to make an appeal cost effective. While the preamble doesn’t address that question, there is no reason to conclude filing an appeal is required.
Understand That You Can Refund and Then Appeal
For the reasons discussed previously, if you do not believe that there is an overpayment, there is no legal obligation to submit a refund. However, in a situation where you feel more comfortable refunding, but still believe that you are entitled to the money, it is possible to voluntarily refund and submit an appeal as long as the refund is for specific, identified claims:
Comment: Several commenters requested that CMS confirm that refunds based on statistical sampling will maintain appeal rights. Because individual claim adjustments may not be made when sampling is utilized to estimate an overpayment amount, CMS should confirm that providers and suppliers may still appeal such findings if necessary.
Response: To the extent that the return of any self-identified overpayment results in a revised initial determination of any specific claim or claims, a person would be afforded the appeal rights that currently exist. As is currently the case under the existing voluntary refund process, there are no appeal rights associated with the self-identified overpayments that do not involve identification of individual overpaid claims and individual claim adjustments.
When submitting a refund for a claim, that reopens the claim. Medicare appeal rights are tied to that reopening. Note that if a refund is based on a statistical sample, no individual claim is reopened. As a result, CMS takes the position that you may not appeal from a refund based on sampling.
Recognize That It Is Likely Appropriate to Offset Underpayments Against Any Overpayment
While CMS states in the preamble that it does not believe it is proper to offset underpayments against overpayments, that claim appears baseless. The analysis hinges on the definition of an overpayment, which is “any funds that a person receives or retains under title XVIII [Medicare] or XIX [Medicaid] to which the person, after applicable reconciliation, is not entitled under such title.”
The definition of overpayment includes two key terms, neither of which are defined in the statute. First, it allows “applicable reconciliation.” Common sense suggests that this is a statutory answer to the question. Presumably “reconciliation” is the act of offsetting underpayments. Second, funds are “overpaid” when you are “not entitled” to them under the terms of the Medicare program. In other words, if the Medicare program would be unable to recover the money from you, it is not an “overpayment” under the provision. It is a well-accepted principle that when determining a debt, underpayments are offset against overpayments.
Perhaps the best regulatory support for the idea that you may offset underpayments is found in the reopening regulations. Those regulations permit reopening for both overpayments and underpayments. In  The timeframes for reopening contained in are 12 months for any reason, 48 months for good cause, and indefinitely for “fraud or similar fault.” Those time periods are not limited to overpayments; the regulations authorize a contractor to reopen a claim to address either overpayments or underpayments., “reopening” is defined as “a remedial action taken to change a binding determination or decision that resulted in either an overpayment or underpayment, even though the binding determination or decision may have been correct at the time it was made based on the evidence of record.”
In the Federal Register preamble to the 60-Day Rule, CMS appears to acknowledge this point, though it did so in a backhanded manner:
Comment: A number of commenters questioned the treatment of underpayments that providers and suppliers may identify in the course of identifying overpayments. Some commenters requested an explanation of the process by which providers and suppliers may recoup underpayments. Other comments proposed that providers and suppliers should be allowed to offset identified underpayments against identified overpayments when determining the repayment amount. Finally, several commenters suggested that the lookback period for overpaid claims should be the same as the lookback period for underpaid claims. Commenters suggested that we consider allowing providers and suppliers more than the currently allowed one year period to rebill a claim to correct an identified underpayment. Underpayment lookback periods of 3 years and 10 years (to match the proposed lookback period) were recommended by commenters.
Response: This final rule implements section 1128J(d) of the Act, which concerns overpayments, not underpayments. Thus, underpayment issues are outside the scope of this rulemaking. Under existing policies, providers and suppliers can seek to address underpayments by requesting reopenings under § 405.980(c).
It seems that CMS is asserting that providers and suppliers may not offset underpayments while calculating a refund, and that instead, you are supposed to refund the entire actual overpayment and then ask the contractor to reopen the claims with underpayments. But there is little logical support for the position that a healthcare organization is not permitted to perform the offset itself, particularly given that the statute specifically refers to “applicable reconciliation.” Reconciliation is, by definition, the act of offsetting overpayments and underpayments.
In the 60-day regulation, CMS also attempts to limit “reconciliation” to the cost report process. In a somewhat convoluted discussion on page 7668, CMS claims Congress was only referring to the cost report process when it used the term “applicable reconciliation.” The flaw in CMS’s position is exposed by giving some thought to this sentence from the preamble: “However, we disagree with the commenters’ interpretation of the term ‘applicable reconciliation’ in the context of this final rule, which applies to Medicare Parts A and B.” There are no cost reports in Part B. If the law only applied to cost reports, it would only apply to “providers” paid under Part A, and not to “suppliers” under Part B. The law contains no such limitation.
The clear intent—and wording—of the statute is to ensure that providers and suppliers do not keep money to which they are not entitled. If you make mistakes, and some of those mistakes favor the government, and other mistakes favor the healthcare organization, the amount of money to which you are “not entitled” is the net of those errors. While CMS would assert you need to refund the money for overpayments, and then request reopening for underpayments, that assertion is inconsistent with the statute. I would feel absolutely comfortable standing in front of a judge and defending a decision to net overpayment and underpayments.
The failure to refund money as required by the 60-Day Rule creates a false claim under the False Claims Act. This allows the government to seek three times the amount of the unrefunded sum, plus penalties of more than $22,000 per claim.
In addition, there is the little-used provision mentioned previously that makes it a felony to fail to disclose an event that affects the initial or continued right to a benefit under a federal healthcare program.
Federal Register, Medicare Program; Reporting and Returning of Overpayments
Volume 81, Issue 29 (February 12, 2016)
The Federal Register preamble for the 60-Day Rule contains CMS views on a number of important issues and is quite easy to read. It also includes the text of the regulation.
Centers for Medicare & Medicaid Services
Medicare Learning Network, Medicare Overpayments
This MLN fact sheet discusses Medicare overpayments.
Fredrikson & Byron
Avoiding Unnecessary Refunds: How to Keep Payments to Which You Are Entitled
This free webinar by David M. Glaser discusses avoiding unnecessary refunds.
Voluntary Refunds: The 60-Day Rule and More
This free webinar by David M. Glaser discusses voluntary refunds.
Main points of interest:
The Affordable Care Act included a provision requiring anyone who has received an overpayment from the Medicare or Medicaid program to “report and return” the overpayment while describing, in writing, the reason for the overpayment within 60 days of the day on which the overpayment was identified.
The 60-Day Rule became the first clear requirement on healthcare organizations to refund overpayments.
There is an affirmative duty for organizations to search for overpayments.
Once a healthcare organization is aware that it has been overpaid by the Medicare or Medicaid program, and the organization has determined the exact dollar amount of the overpayment, it must send the money back to Medicare or Medicaid within 60 days.
Areas to watch:
Failing to search for overpayments
Misunderstanding when the 60 days start to run
The issues with private insurance and state law
Laws that apply:
Social Security Act § 1128J,
False Claims Act,
Addressing compliance risks:
Write a carefully worded refund letter.
Understand that an organization is only required to refund if it is agreed that there is an overpayment.
Understand that an organization can refund and then appeal.
Recognize that it is likely appropriate to offset underpayments against any overpayment.