On February 12, 2016, the Centers for Medicare & Medicaid Services (CMS) released its final rule governing the requirement that Medicare Part A and B providers and suppliers refund overpayments within 60 days.  As detailed below, while the final rule relaxes somewhat the overpayment standards first promulgated in the proposed rule, Medicare providers and suppliers nonetheless can face significant monetary penalties if they fail to adequately identify and return overpayments in a timely manner.


In March 2010, the Affordable Care Act (ACA) amended the Social Security Act to require any person who receives an overpayment from Medicare or Medicaid to report and return the overpayment, and to explain the reason for it, within 60 days after the overpayment is identified.  42 U.S.C. § 1320a­7k(d).  Failure to refund the overpayment within the prescribed time creates an “obligation” under the False Claim Act, which holds a person liable for knowingly and improperly avoiding paying an obligation to the government, 31 U.S.C. § 3729(a)(1)(G). Notably, the ACA amendment did not define when an overpayment is “identified,” such that the 60­day clock on returning the funds begins to run.

In February 2012, CMS issued a proposed rule governing the requirement that Medicare Part A and B providers and suppliers refund overpayments.  77 Fed. Reg. 9179 (Feb. 16, 2012).  The proposed rule defined an “identified” overpayment as existing when a person has actual knowledge of the existence of an overpayment, or acts in reckless disregard or deliberate ignorance of the existence of an overpayment.  77 Fed. Reg. at 9187. CMS explained:

In some cases, a provider or supplier may receive information concerning a potential overpayment that creates an obligation to make a reasonable inquiry to determine whether an overpayment exists.  If the reasonable inquiry reveals an overpayment, the provider then has 60 days to report and return the overpayment.  On the other hand, failure to make a reasonable inquiry, including failure to conduct such inquiry with all deliberate speed after obtaining the information, could result in the provider knowingly retaining an overpayment because it acted in reckless disregard or deliberate ignorance of whether it received such an overpayment.

Id. at 9182.  CMS said that the definition of “identified” was meant to act as an incentive for providers to exercise reasonable diligence in determining whether an overpayment exists.  Moreover, the proposed definition was  meant to mirror the definition of knowledge as used in the False Claims Act.

The proposed rule also suggested a 10­year look­back period, meaning that once an overpayment is identified, a provider must look for and return any other overpayments made within the preceding 10 years.  77 Fed. Reg. at 9179.  The 10­year period was meant to coincide with the outer limit of the False Claim Act statute of limitations. Id. at 9184.

The proposed rule garnered much attention from the health care community, and CMS announced in February 2015 that it would be delaying its issuance of a final rule for an additional year.  80 Fed. Reg. 8247 (Feb. 17, 2015).

Meanwhile, in May 2014, CMS issued a final rule governing identifying and returning overpayments for Medicare Part C and D providers.  79 Fed. Reg. 29844 (May 23, 2014).  At the time, many thought the Part C and D final rule gave insight into the final rule Part A and B providers could expect.  The Part C and D final rule adopted a definition of when an overpayment is identified similar to the 2012 proposed rule: “when the [entity] has determined, or should have determined through the exercise of reasonable diligence, that [it] has received an overpayment.”  42 C.F.R. §§ 422.326(c), 423.360(c).  Unlike the proposed Parts A and B rule, however, the May 2014 final rule adopted a 6­year look­back period.  42 C.F.R. §§ 422.326(f), 423.360(f).  CMS explained that it chose the 6­year period because it “best balances government’s interest in having overpayments returned with entities’ interest in finality.”  79 Fed. Reg. at 29924.

There has been little case law addressing the 60­day overpayment rule since the publication of the 2012  proposed rule.  In August 2015, a federal court first addressed what constitutes an identified overpayment,  thereby starting the 60­day clock.  Kane v. Healthfirst, Inc., ­­ F. Supp. 3d ­­, 2015 WL 4619686 (S.D.N.Y.  2015).  In Kane, the government alleged that a hospital system and its insurer overbilled the government and failed to timely return the overpayments in violation of the False Claims Act.  Not long after discovering the software glitch that caused the overbilling, the insurer’s employee circulated a spreadsheet listing 900 potential claims involving overpayments.  In denying the defendants’ motion to dismiss, the court ruled that the claims were “identified” for purposes of creating a False Claims Act obligation, and the 60­day clock began to run, when the employee circulated his spreadsheet with the potential overpayments, “even if the precise amount due ha[d] yet to be determined.”  Id. at *12.  The court acknowledged that its definition of when a claim is identified could “impose a demanding standard of compliance in particular cases, especially in light of the penalties and  damages available under the [False Claims Act].”  Id. at *13.  That harshness was tempered, the court said, because “prosecutorial discretion would counsel against the institution of enforcement actions aimed at well­ intentioned healthcare providers working with reasonable haste to address erroneous overpayments.”  Id. at *13.

Final Rule

On February 12, 2016, CMS published the final rule governing refunds of overpayments for Medicare Part A and B providers.  The final rule included several notable changes from the 2012 proposed rule:

When an Overpayment is Identified.  The proposed rule provided that an overpayment was identified “if the person has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the existence of the overpayment.”  77 Fed. Reg. at 9187.  In comments accompanying the final rule, CMS recognized that the proposed definition of “identified” created confusion and therefore amended it in response to the numerous comments received.  Under the final rule, an overpayment is identified:

when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.  A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.

42 C.F.R. § 401.305(a)(2).  The definition of when an overpayment is identified in the final rule is different than the definition applicable to Medicare Part C and D providers.  Under the Parts C and D rule, a claim is identified  “when the [entity] has determined, or should have determined through the exercise of reasonable diligence, that [it] has received an overpayment.”  42 C.F.R. §§ 422.326(c), 423.360(c).

While the Parts A and B final rule removes express references to “actual knowledge” and “reckless disregard,” it nonetheless incorporates both an actual knowledge and recklessness standard.  The final rule makes clear that the 60­day clock to refund an overpayment begins to run either (1) when the person has actual knowledge of an overpayment and quantified the amount of the overpayment, or (2) when the provider should have known, through the exercise of reasonable diligence, that an overpayment occurred.

Providers are required to investigate any potential overpayments once they have credible information that an overpayment may have been made.  CMS explained that credible information is “information that supports a reasonable belief that an overpayment may have been received.”  81 Fed. Reg. at 7662.  Whether information is credible is a factual question and will depend on the circumstances of each case.  The comments  accompanying the final rule identify a number of examples of credible information, including hotline complaints and governmental audits.  Id. at 7662, 7665­67.

Reasonable Diligence Required.  Providers are required to proceed with reasonable diligence to determine whether an overpayment was made.  CMS made clear that reasonable diligence includes not only an investigation upon receiving credible information of a potential overpayment, but also proactive compliance measures.  CMS explained “that undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of a provider's or supplier’s Medicare claims would expose a provider or supplier to liability… based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment.”  81 Fed. Reg. at 7661.  CMS noted that the failure to maintain active compliance activities is not itself a violation of the Act.  However, a provider’s failure to have an adequate compliance system does violate the Act when the provider received an overpayment that it should have identified through reasonable compliance efforts.

The final rule omits any express requirement for providers to investigate potential overpayments “with all deliberate speed,” instead adopting the reasonable diligence standard.  However, CMS explained that it expects investigations of potential overpayments should generally take no longer than 6 months.  CMS stated that reasonable diligence “is demonstrated through the timely, good faith investigation of credible information, which is at most 6 months from receipt of the credible information, except in extraordinary circumstances.”  81 Fed. Reg. at 7662.

Liability for Agents and Vendors.  The comments accompanying the final rule clarified that providers and suppliers are responsible not only for their own reasonable diligence in identifying and returning overpayments, but also those of their agents.  Although not expressly incorporated in the final rule, in response to comments suggesting that the rule incorporate an exception for innocent errors made by third party vendors, CMS stated that “[p]roviders and suppliers are responsible for the actions of their agents, including third­party billing   services.”  81 Fed. Reg. at 7666.  Notably, both the insurer and the hospital systems were named defendants in Kane v. Healthfirst, where the hospitals’ overbilling of Medicare was caused by a glitch in the insurer’s software system.  2015 WL 4619686.

Refund Clock Does Not Start Until the Amount of the Overpayment is Quantified.  The 2012 proposed rule did  not expressly address whether or not a provider had to determine the amount of an overpayment before an overpayment was “identified” for purposes of triggering the 60­day clock to make a refund.  Unlike the proposed rule, the final rule mandates that the 60­day clock does not begin to run until a provider identifies an overpayment and quantifies the amount of the overpayment, provided that the provider exercised reasonable diligence in investigating upon receipt of credible information of a possible overpayment.  Delaying the start of the 60­day  clock until after the overpayment has been quantified is in direct contrast to Kane v. Healthfirst, where the court ruled that the 60­day clock started when the provider had credible information of a potential overpayment, regardless of whether it had been able to quantify the specific amount of the overpayment.  2015 WL 4619686 at *12.

Six­Year Look­Back Period.  The final rule mandates that providers and suppliers must return any overpayments made within the preceding six years, a significantly narrower timeframe than the 10­year period in the proposed rule.  Once one overpayment has been identified, providers are obligated to investigate whether any additional overpayments were made as a result of the same issue.  CMS did not provide guidance regarding the extent of investigation providers must undertake after identifying an overpayment, but suggested that audits and statistical sampling were potentially appropriate methods by which to identify other overpayments.  It appears that CMS intends that the scope of the historical investigation would likewise be determined under the reasonable diligence standard.

CMS explained that the six­year period was meant to balance providers’ concerns about burden and costs in complying with the rule with the government’s need to obtain refunds of overpayments.  Moreover, the six­year period is in line with most state and federal record­keeping requirements, thereby not imposing additional obligations on providers.

Additional Ways to Refund Overpayments.  The proposed rule sought to require providers and suppliers to make refunds through the existing voluntary refund process.  77 Fed. Reg. at 9187.  The final rule expands the  methods to effect a refund to include claims adjustment, credit balance, self­reported refund, or other process established by the Medicare contractor to report overpayments.  42 C.F.R. § 401.305(d).


Providers and suppliers should consider the following tips to reduce potential liability:

  • The final rule does not expressly establish when a Medicare Part A or B provider is sufficiently on notice of a potential overpayment, thereby triggering its duty to investigate. Therefore providers should carefully analyze any reports of potential overpayments to determine whether they raise a sufficient question of whether an overpayment may exist.
  • Reasonable diligence in response to credible information of an overpayment is not limited to the investigation taken after receiving such information. Instead, providers need to adopt and maintain reasonable compliance programs that, among other things, seek to preemptively identify instances where overpayments might occur.
  • Once on notice of a potential overpayment, providers’ investigations must be broader than simply examining the specific overpayment. Instead, providers should investigate the root cause leading to the overpayment and also whether that issue may have led to other overpayments in the preceding six years. Investigations must be undertaken promptly, given CMS’ statement that they should take no longer than six months absent extraordinary circumstances.
  • Providers can be held liable for the actions (or inactions) of its vendors, including third party billing services.Thus, providers should require vendors to have adequately designed and implemented compliance programs of their own.
  • Providers should keep detailed documentation and records of all compliance efforts, as well as any investigations based on credible information, should there ever be questions as to whether the reasonable diligence standard has been satisfied.