What Is the 60-Day Rule in the Medicare and Medicaid Overpayment and Refund Policy?
The Affordable Care Act included a provision requiring anyone who has received an overpayment from the Medicare or Medicaid program to “report and return” the overpayment while describing, in writing, the reason for the overpayment, within 60 days of the day on which the overpayment was identified. While an earlier statutory provision made it a felony to conceal or fail to disclose events that affect one’s initial right to payment of a federal healthcare benefit, that statute has been used very infrequently, and primarily against Medicaid beneficiaries. As a result, the so-called “60-Day Rule” became the first clear requirement on healthcare organizations to refund overpayments. When it issued regulations to document this section, the Centers for Medicare & Medicaid Services (CMS) imposed an affirmative duty to search for overpayments. The regulations deem an organization to have “identified” an overpayment even when the organization does not actually know about the overpayment if it “should have through the exercise of reasonable diligence” located the overpayment.
The key point is that once you are aware that you have been overpaid by the Medicare or Medicaid program, and you have determined the exact dollar amount of the overpayment, you must send the money back to Medicare or Medicaid within 60 days. Additionally, CMS believes that there is a duty to exercise reasonable diligence to review payments to locate overpayments, though the enforceability of that obligation is less clear.
Risk Area Governance
The 60-Day Rule is codified at section 1128J of the Social Security Act. The statute applies to both Medicare and Medicaid, defining an overpayment as “any funds that a person receives or retains under [the Medicare or Medicaid program] to which the person, after applicable reconciliation, is not entitled under such title.” The overpayment must be returned by the later of (1) 60 days of its identification or (2) the date any corresponding cost report is due.
The statute leaves several key terms undefined. The regulation issued February 12, 2016, offer CMS’s interpretation of the statute.  The regulation states that a person has “identified” an overpayment when the person has, or should have, “determined that the person has received an overpayment and quantified the amount of the overpayment.” The regulation creates a six-year lookback period, requiring refund of any overpayment identified within six years of its receipt.
Common Compliance Risks
While the basic principle of the 60-Day Rule is easily understandable, the definition (or lack of definition) of certain terms creates many areas for potential misunderstanding or disagreement. In some organizations, there is belief that even after a credible allegation of an overpayment there is no duty to review claims. In other organizations, a desire to “do the right thing” results in decisions to refund money where the 60-Day Rule does not require it. In essence, there are compliance risks associated with failing to refund and business risks created by unnecessarily refunding Medicare and Medicaid payments.
Failing to Search for Overpayments
The 60-day regulation imposes a duty to exercise reasonable diligence to locate overpayments. While it is possible to argue that this regulatory requirement exceeds the authority granted by the statute, an organization will likely prefer to have a program that affirmatively searches for overpayments.
The argument that the regulation exceeds the authority in the statute has merit. The statute requires an organization to refund overpayments that it has identified, making no mention of an obligation to look for an overpayment. Common sense suggests that if you are ignorant of an overpayment, that overpayment has not been identified. When issuing the regulations, CMS explains that it believes Congress intended to impose an affirmative duty to search for overpayments. Courts are increasingly hesitant to allow agencies to attempt to divine congressional intent. It is certainly possible that a court will ultimately invalidate the regulation. Until then, however, most organizations will want to avoid running afoul of the CMS regulation. CMS explained:
While we acknowledge that the terms ‘knowing’ and ‘knowingly’ are defined but not otherwise used in Section 1128J(d) of the Act, we believe that the Congress intended for Section 1128J(d) of the Act to apply broadly. If the requirement to report and return overpayments only applied to situations where providers or suppliers had actual knowledge of the existence of an overpayment, then these entities could easily avoid returning improperly received payments and the purpose of the section would be defeated.
In the preamble, CMS made it quite clear that it expects organizations to affirmatively look for overpayments:
We believe that undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of a provider or supplier’s Medicare claims would expose a provider or supplier to liability under the identified standard articulated in this rule based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment. We also recognize that compliance programs are not uniform in size and scope and that compliance activities in a smaller setting, such as a solo practitioner’s office, may look very different than those in larger setting, such as a multi-specialty group.
The bottom line is that CMS expects organizations to conduct internal reviews looking for overpayments.
Misunderstanding When the 60 Days Start to Run
Perhaps it is the name—60-Day Rule—that causes many people to believe that an organization only has 60 days from the date it learns of an allegation of a possible overpayment until the date the check must be written. In fact, the 60-day clock only runs once the overpayment has been quantified. In the preamble to the 60-Day Rule, CMS explains that it anticipates organizations should be able to determine whether they have an overpayment within about six months: “We choose 6 months as the benchmark for timely investigation because we believe that providers and suppliers should prioritize these investigations and also to recognize that completing these investigations may require the devotion of resources and time.” CMS explains that it expects that most investigations should be concluded within six months of the receipt of credible information about an overpayment, absent extraordinary circumstances. The timeline envisioned by CMS is that after learning of a possible problem, an entity will determine whether there is an overpayment and quantify it’s size within six months. Once the overpayment is quantified, the organization has an additional 60 days to actually write the check.
Misunderstanding the Six-Year Lookback Period
The regulation requires an organization to report and return an overpayment “if a person identifies the overpayment, as defined in paragraph (a)(2) of [  The conventional wisdom is that this means an organization must always go back six years. That conclusion fails to recognize an important caveat: the text only requires you to report and return an overpayment as it is defined in paragraph (a)(2). Remember that the regulation defines an overpayment as funds that were received or retained to which the person is not entitled under the Medicare program. A variety of statutes and regulations limit the Medicare program’s ability to recover overpayments. For example, Social Security Act § 1870 forbids Medicare from recovering an overpayment if the recovery would be contrary to equity in good conscience. That statute creates a presumption that covering the overpayment would be improper if it is five years after the year in which the payment was made. Federal regulations prevent contractors from reopening claims more than four years after the date of the initial determination, unless there is fraud or similar fault. This raises an important question: If Medicare is prohibited from recovering funds from an organization, is there an overpayment? The answer would seem to be “No, there is no overpayment” because if the government is not permitted to recoup the money, the organization is entitled to money. Therefore, there is an extremely strong argument that absent fraud or similar fault, an organization is only required to refund Medicare funds received within the last four years. The full six-year lookback period should apply only in the presence of fraud or similar fault.], within 6 years of the date the overpayment was received.”
Note that the lookback period for Medicaid is state specific. Some states have specific limits on reopening, but some states do not appear to have any temporal limits on recovery. Since the 60-day regulation only applies to Medicare, omitting Medicaid, the time period for return of Medicaid funds is more ambiguous and arguably dependent upon state law.
Private Insurance and State Law
While the 60-day statute only applies to Medicare and Medicaid, consider the issues with private insurance and state law. The 60-day statute applies to both Medicare and Medicaid claims but has no direct impact on private insurance claims. (As mentioned previously, the regulation implementing the statute only applies to Medicare claims, not referring to Medicaid.) It is important to review your contracts to determine whether they create a contractual obligation to refund. There is also the possibility that a state law could compel a refund to private insurers, though that is unlikely.