A New Year, A New Overpayment Rule: CMS Revises the 60-Day Rule

Firm Publication

On December 9, the Centers for Medicare & Medicaid Services (CMS) published revised regulations implementing the so-called 60-day rule, under which healthcare providers and other parties generally must report and return any overpayment within 60 days after they have identified it.

The final rule makes two key changes to the overpayment regulations:

  • The rule changes when an overpayment is “identified,” replacing the “reasonable diligence” standard with the False Claims Act definition of “knowingly,” and removing the quantification construct from the regulations that apply to Parts A and B providers and suppliers.
  • For the Parts A and B regulations, a new provision suspends the obligation to report and return overpayments for up to 180 days if, after identifying an overpayment, the provider conducts a timely, good-faith investigation to determine whether related overpayments exist.

The final rule was published as part of the 2025 Medicare Physician Fee Schedule Final Rule and takes effect January 1, 2025.

Background

The Affordable Care Act added a provision of the Social Security Act that requires a person who has received an overpayment—that is, funds received under the Medicare or Medicaid program to which the person is not entitled—to report and return the overpayment by the later of the date that is 60 days after the overpayment is identified and the date any corresponding cost report is due, if applicable. Failure to timely report and return an overpayment can give rise to liability under the False Claims Act.

Before the 2025 MPFS final rule, CMS published two final rules to implement these statutory provisions: one in 2014 for Medicare Part C Medicare Advantage organizations and Part D prescription drug plan (PDP) sponsors, and another in 2016 for Medicare Part A providers and Part B suppliers. Under those final rules, an overpayment is “identified” when a person has determined or should have determined through the exercise of reasonable diligence, that it has received an overpayment. In the case of the Medicare Parts A and B final rule, the person must also have quantified the amount of the overpayment before it can be said to have been identified.

Following the publication of the Parts C and D final rule, a group of Medicare Advantage plans sued to challenge the validity of the rule. The plaintiffs argued, among other things, that CMS’s interpretation of “identified” was unlawful: By construing the term to mean not only when a plan has determined that it has received an overpayment but also when it should have determined through the exercise of reasonable diligence that it has received an overpayment, CMS impermissibly imposes potential False Claims Act liability for mere negligence. The district court agreed and, in 2018, found that CMS lacked the authority to interpret the statute as it did.

Over four years later, in late 2022, CMS published a proposed rule to change the definition of “identified.” Under the rule, which would apply to both Medicare Parts C and D regulations and the Parts A and B regulations, CMS proposed to replace the “reasonable diligence” standard (which is not used in the statute) with the False Claims Act definition of “knowingly” (which is defined but not used in the statute). Under this proposed rule, an entity would have identified an overpayment when it knowingly receives or retains an overpayment—not when it has, or should have through the exercise of reasonable diligence, determined that it received an overpayment (and, in the case of a Part A or B provider or supplier, quantified the amount of the overpayment).

Final Rule

The final rule adopts the change that CMS proposed in 2022: An entity identifies an overpayment when it knowingly, within the meaning of the False Claims Act, receives or retains the overpayment. Thus, the 60-day clock starts ticking when the entity has actual knowledge of the overpayment or acts in reckless disregard or deliberate ignorance of it. In the case of the Medicare Parts A and B regulations, the text will no longer state that an overpayment has not been identified until it has been quantified.

In an effort to address stakeholder concerns regarding the removal of the quantification construct for Parts A and B, the rule adds a new provision to “allow[] time to investigate and calculate overpayments.” Specifically, the 60-day deadline for “related overpayments” is suspended for up to 180 days when two conditions are met:

  1. The provider has identified an overpayment but has not yet completed a good-faith investigation to determine the existence of “related overpayments that may arise from the same or similar cause or reason as the initially identified overpayment”; and
  2. The provider conducts a timely, good-faith investigation to determine whether related overpayments exist.

So long as these conditions are met, the deadline for reporting and returning both the initially identified overpayment and the “related overpayments” would remain suspended until either the date the investigation of related overpayments has concluded and the aggregate amount of the overpayments is calculated or 180 days after the date on which the initially identified overpayment was identified, whichever is earlier.

Takeaways

The first change—replacing the “reasonable diligence” standard with False Claims Act knowledge—is the product of the Medicare Advantage organizations’ litigation challenging CMS’s 2014 rule. It is intended to remove (for both the 2014 Parts C and D rule and the 2016 Parts A and B rule) the possibility of False Claims Act liability for mere negligence. Rather than requiring reasonable diligence, the obligation to report and return an overpayment is triggered only when an entity has actual knowledge or acts in reckless disregard or deliberate ignorance that it has received or retained an overpayment.

This change is positive, although it is unlikely to make a difference in most instances. Under the current rule, an entity’s receipt of “credible evidence” of a potential overpayment triggers the duty to exercise reasonable diligence to determine whether it has received an overpayment. Failure to exercise reasonable diligence can result in the entity being deemed to have identified the overpayment.

Come January 1, 2025, instead of asking whether there is credible evidence of a potential overpayment, the question will be whether failure to investigate would constitute reckless disregard or deliberate ignorance within the meaning of the False Claims Act. If it would, the entity must investigate the possibility that it has received an overpayment. So long as the entity is “actively investigating” the potential overpayment, it has not yet knowingly identified it. Only when the entity has actual knowledge of an overpayment or is not actively investigating the possibility of one (when the failure to investigate would be reckless disregard or deliberate ignorance) could it be considered to have knowingly identified the overpayment.

In the context of defending against a False Claims Act allegation, this distinction could be powerful. But, in the ordinary course of compliance activities, it may not make much of a difference. There may be few instances where an entity would be obligated to exercise reasonable diligence under the old rule but not obligated to investigate to avoid acting in reckless disregard or deliberate ignorance under the new rule. Rather than attempting to differentiate between these standards, it seems likely that most regulated entities will continue to do what they have been doing: when confronted with a potential overpayment, compliance teams will investigate the circumstances and determine whether there has been an overpayment.

The second change—suspending the 60-day clock for up to 180 days, after an entity identifies an overpayment, to allow it to conduct a “timely, good faith” investigation for “related overpayments”—is well intentioned but needlessly rigid and a potentially confusing substitute for the quantification construct.

Rather than quantification on a timeline that is shaped by the circumstances, the 60-day clock will now start ticking as soon as the entity has knowledge of an overpayment, even if it has not been quantified. Recognizing that entities need time to quantify overpayments, CMS added a new provision to suspend the 60-day clock if the entity is actively investigating in good faith “related overpayments.” But the outer limit of the suspension is 180 days, and it applies only when an entity is actively investigating in good faith the possibility of “related overpayments,” which CMS does not define but describes as overpayments “that may arise from the same or similar cause or reason as the initially identified overpayment.”

The 180-day suspension has also confused stakeholders and commentators. Some have interpreted it to mean that entities have no more than 180 days to identify the “initially identified overpayment” and all “related overpayments.” But, of course, there is no obligation to report and return an overpayment (related or not)—and the 60-day clock does not start ticking—unless and until an overpayment has been identified. In many instances the identification of a single overpayment means there will be others for which it would constitute reckless disregard or deliberate ignorance to not actively investigate. Yet that is not inevitable, and the suspension provision does not impose an additional, affirmative obligation to identify related overpayments. Rather, the 180-day suspension works to suspend the 60-day clock when it would otherwise be ticking.

Indeed, the 180-day suspension has nothing to do with whether a person has “identified” an overpayment or what actions they must take if there is evidence of a potential overpayment. The obligation to investigate a potential overpayment, where it exists, stems from “knowingly.” It is the “reckless disregard” and “deliberate ignorance” prongs of “knowledge” that impose the affirmative obligation to suss out overpayments, not the 180-day suspension period.

On balance, the revised 60-day rule regulations bring some favorable changes to regulated entities. Still, the revisions are unlikely to change how entities approach overpayment analyses in the mine-run of cases. Providers and suppliers must still actively investigate the possibility of overpayments when confronted with evidence of a potential overpayment. Circumstances where they would have needed to exercise reasonable diligence under the current rule but need not actively investigate under the revised rule are likely to be few and far between.

If you have any questions about the overpayment rule, please contact the authors.

Related Professionals
Related Services
Firm Publication

On December 9, the Centers for Medicare & Medicaid Services (CMS) published revised regulations implementing the so-called 60-day rule, under which healthcare providers and other parties generally must report and return any overpayment within 60 days after they have identified it.

The final rule makes two key changes to the overpayment regulations:

  • The rule changes when an overpayment is “identified,” replacing the “reasonable diligence” standard with the False Claims Act definition of “knowingly,” and removing the quantification construct from the regulations that apply to Parts A and B providers and suppliers.
  • For the Parts A and B regulations, a new provision suspends the obligation to report and return overpayments for up to 180 days if, after identifying an overpayment, the provider conducts a timely, good-faith investigation to determine whether related overpayments exist.

The final rule was published as part of the 2025 Medicare Physician Fee Schedule Final Rule and takes effect January 1, 2025.

Background

The Affordable Care Act added a provision of the Social Security Act that requires a person who has received an overpayment—that is, funds received under the Medicare or Medicaid program to which the person is not entitled—to report and return the overpayment by the later of the date that is 60 days after the overpayment is identified and the date any corresponding cost report is due, if applicable. Failure to timely report and return an overpayment can give rise to liability under the False Claims Act.

Before the 2025 MPFS final rule, CMS published two final rules to implement these statutory provisions: one in 2014 for Medicare Part C Medicare Advantage organizations and Part D prescription drug plan (PDP) sponsors, and another in 2016 for Medicare Part A providers and Part B suppliers. Under those final rules, an overpayment is “identified” when a person has determined or should have determined through the exercise of reasonable diligence, that it has received an overpayment. In the case of the Medicare Parts A and B final rule, the person must also have quantified the amount of the overpayment before it can be said to have been identified.

Following the publication of the Parts C and D final rule, a group of Medicare Advantage plans sued to challenge the validity of the rule. The plaintiffs argued, among other things, that CMS’s interpretation of “identified” was unlawful: By construing the term to mean not only when a plan has determined that it has received an overpayment but also when it should have determined through the exercise of reasonable diligence that it has received an overpayment, CMS impermissibly imposes potential False Claims Act liability for mere negligence. The district court agreed and, in 2018, found that CMS lacked the authority to interpret the statute as it did.

Over four years later, in late 2022, CMS published a proposed rule to change the definition of “identified.” Under the rule, which would apply to both Medicare Parts C and D regulations and the Parts A and B regulations, CMS proposed to replace the “reasonable diligence” standard (which is not used in the statute) with the False Claims Act definition of “knowingly” (which is defined but not used in the statute). Under this proposed rule, an entity would have identified an overpayment when it knowingly receives or retains an overpayment—not when it has, or should have through the exercise of reasonable diligence, determined that it received an overpayment (and, in the case of a Part A or B provider or supplier, quantified the amount of the overpayment).

Final Rule

The final rule adopts the change that CMS proposed in 2022: An entity identifies an overpayment when it knowingly, within the meaning of the False Claims Act, receives or retains the overpayment. Thus, the 60-day clock starts ticking when the entity has actual knowledge of the overpayment or acts in reckless disregard or deliberate ignorance of it. In the case of the Medicare Parts A and B regulations, the text will no longer state that an overpayment has not been identified until it has been quantified.

In an effort to address stakeholder concerns regarding the removal of the quantification construct for Parts A and B, the rule adds a new provision to “allow[] time to investigate and calculate overpayments.” Specifically, the 60-day deadline for “related overpayments” is suspended for up to 180 days when two conditions are met:

  1. The provider has identified an overpayment but has not yet completed a good-faith investigation to determine the existence of “related overpayments that may arise from the same or similar cause or reason as the initially identified overpayment”; and
  2. The provider conducts a timely, good-faith investigation to determine whether related overpayments exist.

So long as these conditions are met, the deadline for reporting and returning both the initially identified overpayment and the “related overpayments” would remain suspended until either the date the investigation of related overpayments has concluded and the aggregate amount of the overpayments is calculated or 180 days after the date on which the initially identified overpayment was identified, whichever is earlier.

Takeaways

The first change—replacing the “reasonable diligence” standard with False Claims Act knowledge—is the product of the Medicare Advantage organizations’ litigation challenging CMS’s 2014 rule. It is intended to remove (for both the 2014 Parts C and D rule and the 2016 Parts A and B rule) the possibility of False Claims Act liability for mere negligence. Rather than requiring reasonable diligence, the obligation to report and return an overpayment is triggered only when an entity has actual knowledge or acts in reckless disregard or deliberate ignorance that it has received or retained an overpayment.

This change is positive, although it is unlikely to make a difference in most instances. Under the current rule, an entity’s receipt of “credible evidence” of a potential overpayment triggers the duty to exercise reasonable diligence to determine whether it has received an overpayment. Failure to exercise reasonable diligence can result in the entity being deemed to have identified the overpayment.

Come January 1, 2025, instead of asking whether there is credible evidence of a potential overpayment, the question will be whether failure to investigate would constitute reckless disregard or deliberate ignorance within the meaning of the False Claims Act. If it would, the entity must investigate the possibility that it has received an overpayment. So long as the entity is “actively investigating” the potential overpayment, it has not yet knowingly identified it. Only when the entity has actual knowledge of an overpayment or is not actively investigating the possibility of one (when the failure to investigate would be reckless disregard or deliberate ignorance) could it be considered to have knowingly identified the overpayment.

In the context of defending against a False Claims Act allegation, this distinction could be powerful. But, in the ordinary course of compliance activities, it may not make much of a difference. There may be few instances where an entity would be obligated to exercise reasonable diligence under the old rule but not obligated to investigate to avoid acting in reckless disregard or deliberate ignorance under the new rule. Rather than attempting to differentiate between these standards, it seems likely that most regulated entities will continue to do what they have been doing: when confronted with a potential overpayment, compliance teams will investigate the circumstances and determine whether there has been an overpayment.

The second change—suspending the 60-day clock for up to 180 days, after an entity identifies an overpayment, to allow it to conduct a “timely, good faith” investigation for “related overpayments”—is well intentioned but needlessly rigid and a potentially confusing substitute for the quantification construct.

Rather than quantification on a timeline that is shaped by the circumstances, the 60-day clock will now start ticking as soon as the entity has knowledge of an overpayment, even if it has not been quantified. Recognizing that entities need time to quantify overpayments, CMS added a new provision to suspend the 60-day clock if the entity is actively investigating in good faith “related overpayments.” But the outer limit of the suspension is 180 days, and it applies only when an entity is actively investigating in good faith the possibility of “related overpayments,” which CMS does not define but describes as overpayments “that may arise from the same or similar cause or reason as the initially identified overpayment.”

The 180-day suspension has also confused stakeholders and commentators. Some have interpreted it to mean that entities have no more than 180 days to identify the “initially identified overpayment” and all “related overpayments.” But, of course, there is no obligation to report and return an overpayment (related or not)—and the 60-day clock does not start ticking—unless and until an overpayment has been identified. In many instances the identification of a single overpayment means there will be others for which it would constitute reckless disregard or deliberate ignorance to not actively investigate. Yet that is not inevitable, and the suspension provision does not impose an additional, affirmative obligation to identify related overpayments. Rather, the 180-day suspension works to suspend the 60-day clock when it would otherwise be ticking.

Indeed, the 180-day suspension has nothing to do with whether a person has “identified” an overpayment or what actions they must take if there is evidence of a potential overpayment. The obligation to investigate a potential overpayment, where it exists, stems from “knowingly.” It is the “reckless disregard” and “deliberate ignorance” prongs of “knowledge” that impose the affirmative obligation to suss out overpayments, not the 180-day suspension period.

On balance, the revised 60-day rule regulations bring some favorable changes to regulated entities. Still, the revisions are unlikely to change how entities approach overpayment analyses in the mine-run of cases. Providers and suppliers must still actively investigate the possibility of overpayments when confronted with evidence of a potential overpayment. Circumstances where they would have needed to exercise reasonable diligence under the current rule but need not actively investigate under the revised rule are likely to be few and far between.

If you have any questions about the overpayment rule, please contact the authors.

In Case You Missed It: