The Centers for Medicare & Medicaid Services (CMS) 60-day rule has existed for many years and was most recently revised effective January 1, 2025. Under the current version of the rule, Medicare providers are required to return an overpayment within 60 days of identifying the overpayment. Failure to return an overpayment under the 60-day rule results in liability under the False Claims Act, which could result also in civil penalties and potential exclusion from the Medicare and Medicaid programs.
In this HealthcareLINC Attorney Q&A, McAfee & Taft healthcare lawyer Cori Loomis is joined by healthcare lawyer Carly Kirkland to discuss how Medicare overpayments happen and how providers typically learn of them; what providers should do if they learn of a potential overpayment; and what providers can do to catch these overpayments before they become a substantial problem.
..
Q&A Transcript
.
What is a ‘Medicare overpayment’ and how does it occur?
.
[Carly Kirkland] An overpayment occurs when a provider receives an amount payable by CMS that’s in excess of the amount that’s due improperly payable under the CMS regulations. And so that overpayment is viewed as a debt to the federal government that must be repaid by the provider.
[Cori Loomis] It seems so simple. If you get money that you weren’t entitled to, you return it. But in the health care world, these things get so complicated because, for example, I just read this week that there are 9000 CPT codes for specialty care alone. You can misapplied one of those codes. An overpayment can occur for lack or insufficient documentation in the record to support the code. It can occur just due to software errors in the system. Or it could be programed wrong or a mistake, and it can occur just administrative human error sort of things.
For example, one time I had a client who 1 or 2 words in the definition of the CPT code. There’s the code. And then you have this narrative description of what that code means. 1 or 2 words changed one year and they didn’t notice it and there was no alert. They don’t tell you, hey, these are the ones we change this year. It’s up to the health care industry and the people to go look every year and look at their chargemaster and things like that. So those two words didn’t get caught. Change the meaning of the code. They were mis applying this code for quite a while until it was discovered. And that was caused them to have received an overpayment totally inadvertently. So most of these overpayments occur. Just an error. Mistake? Totally unintentionally. Not intentionally, but the consequences can be severe.
.
What is the CMS 60-day rule regarding overpayments?
.
[Carly Kirkland] The 60-day rule has been in existence for many years, and was most recently revised effective January 1st, 2025. So under the current version of the rule, Medicare providers are required to return an overpayment within 60 days of identifying the overpayment. It’s deemed identified whenever the provider knows or should have known about the overpayment through the exercise of reasonable diligence.
There is now an exception, that allows providers, 180 additional days to conduct a good faith investigation after they’ve identified the overpayment. In other words, to the counting of the 60 day clock, it can be suspended for 180 days to allow the provider to conduct that good faith investigation. So 180 plus 60 is a total of 240 days to investigate and return the overpayment.
Failing to return an overpayment under the 60 day rule results in liability under the False Claims Act, which, could result also in civil penalties and potential exclusion from the Medicare and Medicaid programs.
.
How do providers typically become aware of overpayments?
.
[Cori Loomis] There’s several ways that providers can become aware that they have received or retaining an overpayment. Hospitals, nursing homes, large institutions are supposed to have compliance programs. So during one of the requirements of a compliance program is that you routinely audit and monitor yourself and do those type of checks. So it may come up during your routine auditing and monitoring process. You could have an employee that brings it to your attention. They go to a seminar. They read something online that says, “uh oh,” and they bring it through the channels of compliance. You can have it — I mean, more — some of the more unfortunate ways is if you’re looking to sell the hospital, the provider, the physician practice, and the buyer does due diligence to see what they’re buying and making sure they’re not buying liabilities, and they over and bring it to your attention and say, well, we need to correct this before we proceed or something of that nature. So there’s a myriad of ways that they can become identified to you.
The important thing is, once they do become identified that you act and, and start the investigation that Carly was referring to. Sometimes these come up because the payers identify them. They either. And it could be private pay or CMS. And you start getting either notices that we’ve identified. They have what they call RAC auditors and different auditors who are paid by the government to look at claims so they can identify a trend or, or, you know, claims that they see same with private payers. And a lot of times, again, unfortunately, I’ve had been involved with clients who were being notified that they that there was a problem. And on their remittances, there’s a code like an error code, and they just weren’t reviewing carefully their remittances to notice that. And then that becomes problematic, because the longer that goes with no one, it looks very negligent that you’re not reading your own remittances and identifying a problem. So that’s another way that they can come up there.
It can be identified by the payers themselves. The government does routine audits and of course they’re data mining. I mean, they used computers and all that stuff to say, look for trends and, all of a sudden if one code is being used this often and it just explodes and it’s being used twice, three times as much, well, they’ll dig into that. Or if one provider is aberrant, like everybody else uses this code or submits this claim, this amount of time and you are way up here, then they want to know why. Is it because maybe your patients are a different population or different acuity level. So there could be a reason for it. But they’re looking for trends and spotting trends. And then the auditors will act on that. A lot of times.
.
What should providers do if they think they have received an overpayment?
.
[Cori Loomis] Receiving overpayments or finding out you have received an overpayment is not uncommon. And it’s going to happen. I think mostly if you don’t ever see, then you may need to reevaluate whether your compliance program is as effective as it should be because like we said, this is a very complicated system and you’re going to have situations where these things come up. So if it does, you need to initiate the investigation. That’s the whole, you know, 180 days. They don’t want you dilly dallying and dragging your feet and saying, you know, the never ending investigation. They want you to dive into it and see how broad — Is it, just one claim, which is much easier, or is this a pervasive issue that has gone on for some time? Is it just completely unintentional? Software glitch? The two word code changed? or is there something more serious going on?
So starting the investigation, getting the understanding the full scope of the issue. If you’re an entity that has compliance officer, you’re going to involve the compliance officer and your compliance committee. You also need to check with your in-house or outside counsel on helping identify — getting your arms around how big the problem is, because there’s also different ways to return it depending on the nature of the problem. If it’s just one claim or just a handful of claims, there’s a process with Medicare administrative contractors, — the MACs — that you can just go through, that’s much easier. Basically, just unwind the claim and send it back. But if you have a true problem that has been going on for a long time and it’s a big chunk of money, then it may be kind of impossible to pay it back all at once. And you need to look at your options of how to self disclose. And it gets even more complicated in that instance.
.
What can providers do to ensure compliance with CMS’s 60-day rule?
.
[Cori Loomis] If you don’t have a compliance program or certain auditing, you need to think about implementing one so that you aren’t in a position where you have these long periods of time that you hopefully catch the overpayments before they become a really big problem, or you’re catching them and and not retaining them because it’s the retention of the overpayment beyond the total of 240 days, that becomes a problem when they’re unintentional. So do a more robust auditing and monitoring program. When you do detect something, act on it quickly and expeditiously to get your, you know, scope around it, involve your compliance committee and your inside and outside counsel. There may be need to do it under the attorney-client privilege. You may need to hire an outside coding, an auditing consultant to come in and help you. So getting that team together and acting quickly. And we do this all the time and assist clients with these types. And we would be happy to assist clients to do that.
.
For information:
healthcarelinc.com
mcafeetaft.com/healthcare-industry
