The statute
Enacted by § 6402(a) of the Affordable Care Act. Its core elements:1What “identified” means, the 2024 change
This matters, and it changed recently. The regulation previously provided that a person had identified an overpayment when they had, or should have through the exercise of reasonable diligence, determined that they received an overpayment and quantified it. CMS-4205-F, published December 9, 2024 and effective January 1, 2025, replaced the “reasonable diligence” standard with the False Claims Act knowledge standard. A person has identified an overpayment when they have actual knowledge or act in reckless disregard or deliberate ignorance of it.2 Practically, the trigger remains the same in operation: the clock starts when you know, or are recklessly disregarding, that you were overpaid. Discovering a billing error is the beginning of a process, not the end of one.What triggers the analysis
Any of these should route to your overpayment process:- A credit balance from a payer overpayment
- A duplicate payment
- A billing or coding error discovered internally, such as services billed under the wrong dentist’s NPI, misattributed hygiene visits, or extractions coded as surgical when the films show they were simple
- Post-transaction claims submitted under a seller’s TIN or participation without documented payer authority. Test the payer’s assignment, change-of-ownership, identifier, effective-date, and interim-billing rules rather than relying on the purchase agreement alone.
- An audit finding sustained
- A lapsed license, credential, or Medicaid enrollment discovered after billing
- A dentist found to have been excluded
- A recoupment whose root cause implies other claims are affected
- A compliance report from an employee
- A systematic error found through internal auditing
The process
1
Route the discovery to a defined owner
Immediately. The clock is running, and a discovery sitting in an inbox is the worst possible posture.
2
Engage counsel
Before quantifying, and before any communication with the payer. Counsel decides scope, privilege, and disclosure strategy.
3
Investigate and quantify
Determine: what happened, when it started, which claims are affected, and the dollar amount.The lookback period is a legal question. Confirm the applicable period with counsel under the current rule.Where the population is large, statistical sampling and extrapolation may be appropriate for quantification. Done properly this requires a statistician, and doing it properly protects you.
4
Choose the disclosure route
This choice is strategic and belongs to counsel. The routes have different consequences for penalties, for protection, and for what you are admitting. Where the claims went through a DBA, the refund mechanics run through the DBA’s provider manual, but the federal obligation is unchanged.
5
Report and return within the deadline
With the required documentation: the claims, the amounts, the reason, the period, and the corrective action taken.
6
Document everything
Discovery date, investigation steps, quantification methodology, counsel involvement, disclosure route, submission date, and remediation.The documentation is what demonstrates good faith. An organization that found a problem, investigated promptly, quantified carefully, and returned within 60 days is in a materially different position from one that cannot show when it knew.
7
Fix the underlying process
And document that too. A returned overpayment with no corrective action invites the next one, and demonstrates that the compliance program isn’t working.
Commercial payer analogues
The 60-day rule applies to Medicare and Medicaid. For Delta Dental and the other commercial dental payers, the participating provider agreement governs, typically requiring refund within a stated period, with the payer entitled to recoup by offset. Two things to note:- Some states impose statutory refund obligations reaching commercial payments
- Retaining a known commercial overpayment can raise other theories even without the federal rule
Building the process before you need it
1
Define a named owner for overpayment discoveries
2
Create a reporting channel
Give every employee a documented way to raise a concern without retaliation. An effective internal channel lets a biller, hygienist, or other worker report a problem before it grows. Insiders have played a central role in major dental FCA matters. See Billing compliance basics.
3
Run the credit balance report weekly
It is the most common detection mechanism, and weekly review preserves most of the 60-day window. See Resolve credit balances.
4
Conduct periodic internal audits
Self-identification and prompt repayment generally place the organization in a better position than an externally discovered problem. If you participate in Medicaid, include per-provider utilization for flagged procedure families in the audit scope. See the CPOD self-audit.
5
Identify counsel in advance
You do not want to be sourcing healthcare regulatory counsel on day 5 of 60.
Verify it worked
- A named owner for overpayment discoveries
- A non-retaliation reporting channel that staff know about
- Weekly credit balance review
- Counsel identified in advance
- Discovery-to-disclosure process documented
- Current identification standard and lookback confirmed with counsel
- Every discovery logged with dates
- Corrective action documented alongside the return
Common failure modes
Sources
- 42 U.S.C. § 1320a-7k(d), enacted by ACA § 6402(a); False Claims Act, 31 U.S.C. §§ 3729–3733; civil monetary penalties at 42 C.F.R. § 1003.210.
- CMS-4205-F, published December 9, 2024, effective January 1, 2025. See Foley & Lardner, CMS Issues Final Regulations Implementing Changes to 60-day Refund Rule; Morgan Lewis, Tick-Tock: CMS Overpayment Refund Final Rule and Practical Implications. HHS OIG, Self-Disclosure Information.