A physician practice, hospital or other Medicare provider that finds it was paid too much has a legal duty to report and return the money. The rule in 42 CFR 401.305 sets a clock, a lookback and consequences that tie to the False Claims Act. For the financial statement auditor, the questions are whether management has a process to find overpayments, whether known amounts are accrued, and whether the disclosures cover the exposure. The regulation was amended in December 2024.
The rule
Under 42 CFR 401.305(a)(1), a person that has received an overpayment must report and return it in the form and manner set out in the section. Under paragraph (a)(2), a person has identified an overpayment when the person knowingly receives or retains it, and "knowingly" has the meaning in 31 U.S.C. 3729(b)(1)(A), the False Claims Act definition of knowledge.
Under paragraph (b)(1), the overpayment must be reported and returned by the later of:
- the date 60 days after the date on which it was identified; or
- the date any corresponding cost report is due, if applicable.
Paragraph (f) sets a six-year lookback: an overpayment must be reported and returned if the person identifies it within 6 years of the date it was received. Retention beyond the deadline is an obligation for purposes of the False Claims Act, per the regulation.
Suspension of the deadline
The deadline is suspended in specific cases:
- The OIG acknowledges receipt of a submission to the OIG Self-Disclosure Protocol, until settlement, withdrawal or removal.
- CMS acknowledges receipt of a submission to the CMS Voluntary Self-Referral Disclosure Protocol, on similar terms.
- The person requests an extended repayment schedule, until it is rejected or the terms are not met.
- The person has identified an overpayment and conducts a timely, good-faith investigation to determine whether related overpayments arise from the same or similar cause. The deadline stays suspended until the earlier of the date the investigation concludes and the aggregate amount is calculated, or the date 180 days after the initial overpayment was identified.
Cost reports have their own rules. The applicable reconciliation occurs when a cost report is filed, and a provider is not required to return an overpayment resulting from updated SSI ratio information until final reconciliation of its cost report. See Medicare cost report audit considerations.
Reporting
A person uses the applicable claims adjustment, credit balance, self-reported refund or other process set by the Medicare contractor. If the amount was calculated by statistical sampling, the report must describe the statistically valid sampling and extrapolation method. A disclosure under the OIG Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol that results in a settlement agreement satisfies the reporting obligation.
Worked example
On October 5, 2026, a billing manager confirms that a coding error caused overpayments on Medicare claims.
- Day 60 after October 5 is December 4, 2026 (26 days left in October, 30 in November, 4 in December).
- The practice starts a good-faith review to find related claims with the same error. The deadline is suspended until the review concludes, or until April 3, 2027, whichever is earlier (180 days after October 5).
- The review finds 120 affected claims over 4 years, with a total overpayment of $38,400, an average of $320 per claim. The lookback covers claims received within 6 years of identification, so all four years are inside it.
At year end, the practice records a refund liability of $38,400 plus any related interest and costs it expects, and discloses the matter if exposure beyond the identified amount is reasonably possible. The accrual and loss contingency analysis follows healthcare practice revenue and contractual adjustments and the ASC 954 healthcare presentation guide.
Two more cases
Cost report deadline. Under paragraph (b)(1) the deadline is the later of day 60 or the due date of the corresponding cost report. A hospital identifies an overpayment on October 5, 2026, and the related cost report is due January 31, 2027. Day 60 is December 4, 2026, which is earlier, so the deadline is January 31, 2027.
Lookback edge. On October 5, 2026, a practice identifies an error that affected claims paid on September 15, 2020 and on October 20, 2020. Six years after September 15, 2020 is September 15, 2026, before the identification date, so that claim is outside the lookback under paragraph (f). Six years after October 20, 2020 is October 20, 2026, after the identification date, so that claim is inside.
Where the 60-day clock comes from
The regulation implements 42 U.S.C. 1320a-7k(d), which requires a person who receives an overpayment to return it to the Secretary, the State, an intermediary, a carrier or a contractor, and to notify that party in writing of the reason for the overpayment. The statute sets the same deadline, the later of 60 days after identification or the due date of any corresponding cost report, and treats an overpayment kept past the deadline as an obligation under the False Claims Act. An overpayment means funds a person receives or keeps under Medicare or Medicaid to which the person is not entitled after reconciliation.
The False Claims Act exposure
Under 31 U.S.C. 3729(a)(1)(G), a person who knowingly conceals or improperly avoids an obligation to pay money to the Government is liable for a civil penalty per violation, adjusted for inflation, plus three times the Government's damages. "Knowingly" under section 3729(b)(1) covers actual knowledge, deliberate ignorance and reckless disregard, and no proof of specific intent to defraud is needed. Section 3729(b)(3) defines an obligation to include the retention of an overpayment. For the engagement, this is why an identified overpayment that sits in a credit balance account past the deadline is a legal exposure and not only a receivable cleanup item.
Medicare Advantage plans
Medicare Advantage organizations follow a separate rule, 42 CFR 422.326. It requires reporting and returning an identified overpayment no later than 60 days after identification and applies a lookback of the 6 most recent completed payment years.
Common errors
- Starting the 60 days when the investigation ends instead of when the overpayment was identified. The suspension under paragraph (b)(3) requires a timely, good-faith investigation and ends no later than 180 days after the initial identification.
- Returning the money without the written reason that the statute requires.
- Applying a statistical extrapolation without describing the sampling and extrapolation method in the report.
- Leaving a Medicare credit balance in receivables after the deadline, which converts it to an obligation.
Audit steps
- Inquire of management and compliance staff about reported overpayments, credit balances and internal audits.
- Read compliance committee minutes, payer correspondence and any OIG or CMS contacts.
- Review credit balances in Medicare accounts receivable for items older than 60 days.
- Test subsequent refunds and repayments after year end for amounts that belong in the prior year.
- Obtain representations about known overpayments, and consider a legal letter on the matter. See legal letters.
Sources
- Legal Information Institute, 42 CFR 401.305, Requirements for reporting and returning of overpayments: https://www.law.cornell.edu/cfr/text/42/401.305
- Legal Information Institute, 42 U.S.C. 1320a-7k(d), Reporting and returning of overpayments: https://www.law.cornell.edu/uscode/text/42/1320a-7k
- Legal Information Institute, 31 U.S.C. 3729, False Claims Act liability and definitions: https://www.law.cornell.edu/uscode/text/31/3729
- Legal Information Institute, 42 CFR 422.326, Reporting and returning of overpayments (Medicare Advantage): https://www.law.cornell.edu/cfr/text/42/422.326
- Electronic Code of Federal Regulations, 42 CFR 401.305 (current text, as amended December 2024): https://www.ecfr.gov/current/title-42/section-401.305
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Specialized engagements: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error