The Short Answer

The violation is the knowing retention of an identified overpayment, which federal law treats as "reverse false claims" liability under the civil False Claims Act (31 U.S.C. § 3729(a)(1)(G)), and which also triggers obligations under the Affordable Care Act's 60-day repayment rule. Secondary exposure includes criminal False Claims Act and Anti-Kickback Statute exposure. The key boundary: liability attaches only once the facility identifies the overpayment—an honest billing error discovered and retained is treated very differently from an error never noticed.

What "Identification" Means Under the 60-Day Rule

The 60-day clock starts when the facility identifies an overpayment—not when it receives the money. The Affordable Care Act (Section 6402(a)) requires a provider to report and return identified Medicare overpayments by the later of 60 days after identification or the date a corresponding cost report is due. A facility that discovers the error in an internal audit has identified it under the regulation, even if no government notice has arrived. That's the boundary most people miss: the legal trigger is the facility's own knowledge, not CMS's.

In practice, identification can occur through internal compliance audits, contractor billing reviews, whistleblower reports, or routine reconciliation. The Centers for Medicare & Medicaid Services has stated that a provider "identifies" an overpayment when it has "actual knowledge" of the overpayment or acts in "reckless disregard" or "deliberate ignorance" of it. A billing manager who notices a duplicate claim during a routine review is enough, in the government's view, to start the clock.

The 60-day timeline doesn't wait for the facility to decide whether it agrees. If a facility identifies the overpayment on March 1, it must report and return it by approximately April 30 (60 calendar days), unless a corresponding cost report is due later. The Department of Health and Human Services Office of Inspector General has enforced this timeline strictly—$500,000 settlements have been announced by DOJ for cases involving uncorrected self-identified overpayments.

The Civil False Claims Act's Reverse False Claims Theory

The 2010 Fraud Enforcement and Recovery Act (FERA) amended the civil False Claims Act to explicitly reach reverse false claims. Before FERA, the government had to show that the facility had an obligation to pay the United States and made a false record to avoid that obligation. FERA's 2009 amendment and the 2010 expansion made it much easier for DOJ to pursue retention of overpayments as a false claim.

In a 2015 ruling, United States ex rel. Kane v. Healthfirst, Inc. (S.D.N.Y.), the court held that an identified overpayment represents an "obligation" under the FCA, and retention past the 60-day deadline can support reverse false claims liability. A facility that keeps the money after identifying the error is treated as having an obligation to repay and then avoiding or decreasing that obligation through inaction. The court reasoned that the "obligation" arises from the ACA's repayment requirement itself—no separate contract or prior bad act is needed.

The penalty math is what makes retention so expensive. Each "claim" retained past the deadline can incur a civil penalty plus treble damages. For a duplicate Medicare payment of $12,000 that a facility identifies and keeps, treble damages would be $36,000 plus per-claim penalties. If the overpayment spans dozens of claims over multiple billing cycles, the total exposure can quickly exceed the original dollar amount by an order of magnitude. There is no "de minimis" safe harbor in the statute for keeping identified overpayments—even a few hundred dollars triggers the obligation.

FERA's 2009 version applied retroactively to conduct occurring on or after June 7, 2008. Facilities that identify overpayments from earlier billing periods face a murkier analysis, though the 60-day rule and the underlying FCA obligation both apply to claims submitted or payments received during periods the statute covers. Facilities should check the specific claim submission dates before assuming an old overpayment is "safe."

Criminal Exposure Under 18 U.S.C. § 1035 and § 1001

Retaining an identified Medicare overpayment can support criminal exposure under 18 U.S.C. § 1035 (false statements relating to health care matters) and 18 U.S.C. § 1001 (false statements generally). The theory is that by submitting claims that the facility knew to be false—or by retaining funds it knew it wasn't entitled to and failing to disclose—the facility made a material false statement or omission. The DOJ has used § 1035 in several Medicare fraud cases involving retained overpayments, though it typically piggybacks on a broader billing fraud charge.

A conviction under § 1035 carries up to 5 years in federal prison per count; § 1001 carries the same maximum. Fines under 18 U.S.C. § 3571 can reach $250,000 for an individual and $500,000 for an organization per felony count. The DOJ's 2023 criminal enforcement trend shows a preference for pursuing retained overpayments as part of larger fraud investigations rather than as standalone prosecutions. But that's a policy, not a statutory limit—nothing prevents a standalone § 1035 charge.

The critical distinction in criminal cases is "intent." A facility that discovers an overpayment, puts it in a suspense account, and sends a refund check 61 days later may face a civil violation but usually not a criminal one. A facility that discovers the overpayment and affirmatively moves it into operating revenue, then fails to disclose it, crosses into the intent-to-defraud territory that criminal prosecutors look for. This is what the government calls the "knowledge" element—and it's why internal whistleblower reports matter.

Anti-Kickback Statute Exposure When the Overpayment Flows to Referral Sources

If the overpayment ends up in the hands of a referral source—a physician who receives a "referral fee," a group practice that receives a "management fee," or a DME supplier that receives funds for equipment never delivered—the Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) can apply independently. The AKS prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce referrals of items or services payable by Medicare. The overpayment's retained funds become the remuneration if the facility knows the funds are being used to reward referrals.

The AKS is a "one purpose" statute: if one purpose of the payment is to induce referrals, the statute is violated even if other legitimate purposes exist. Facilities that retain overpayments and later distribute the funds to referral sources as "bonuses" or "consulting fees" face AKS exposure regardless of whether the original overpayment was the facility's error. The 2010 amendments to the AKS and its accompanying "safe harbor" regulations (42 C.F.R. § 1001.952) do not have a safe harbor for "retained overpayments," which means there's no structured way to launder an identified overpayment into a physician payment.

AKS violations are felonies—up to 5 years in prison per count, plus a $25,000 fine. The 2023 OIG Work Plan has consistently listed "Medicare Overpayments" as an audit priority, meaning even a modest overpayment that gets redistributed to referral sources will likely come under scrutiny. Facilities should also check whether the overpayment triggers a Physician Self-Referral (Stark Law) issue if the funds flow to referring physicians who have a financial relationship with the facility.

Whistleblower (Qui Tam) Exposure Under the FCA

Retained overpayments are a frequent subject of qui tam suits. A whistleblower—typically a billing manager, compliance officer, or former employee—can sue on behalf of the United States under 31 U.S.C. § 3730(b) and receive 15-30% of any recovery. The FCA's qui tam provisions allow a private party to bring an action even when DOJ declines to intervene, which means a facility that retains an overpayment faces litigation risk from internal sources even if the government doesn't pursue a case.

Two structural facts matter here. First, FCA qui tam actions have a statute of limitations—the later of 6 years after the violation or 3 years after the government knew or should have known, capped at 10 years after the violation. A facility that identifies an overpayment in 2020 and keeps it faces whistleblower exposure through roughly 2026 or 2030, depending on when the government had notice. Second, FCA settlements involving retained overpayments frequently include corporate integrity agreements—5-year compliance monitoring arrangements with independent review organizations. Those CIAs cost facilities $250,000-$2 million over their term depending on size, even if the original overpayment was small.

The DOJ's 2022-2024 enforcement posture has prioritized self-identified overpayments. Its publicly reported settlements of $500,000+ for facilities that self-identified overpayments and failed to timely refund them reflect the baseline enforcement expectations. Facilities that voluntarily disclose under the OIG's Self-Disclosure Protocol may receive cooperation credit and reduced penalties, but that credit is only available if the disclosure comes before a whistleblower does.

The Sarbanes-Oxley and SEC Angle for Public Facilities

Publicly traded facilities face additional exposure. Sarbanes-Oxley Section 302 (15 U.S.C. § 7241) requires CEO and CFO certification of financial reports. Retaining an identified overpayment without accruing a liability or making a reserve in the financial statements can support a material misstatement claim if the amount is material. The SEC's 2023 enforcement actions have included accounting fraud cases tied to unrecorded liabilities, and retained Medicare overpayments are a classic "unrecorded liability" issue. Facilities that identify an overpayment, don't refund it, and don't record a liability may be misstating their financial statements.

The Sarbanes-Oxley Act's Section 806 whistleblower provision (18 U.S.C. § 1514A) protects employees who report suspected fraud against shareholders or the government. A billing manager who reports an unrecovered overpayment internally and gets terminated can bring a SOX Section 806 retaliation claim. The 2023 OSHA investigative statistics show retaliation claims are increasingly being used in health care compliance, and the burden-shifting framework under § 1514A is favorable to whistleblowers. Facilities should treat internal reports of retained overpayments as protected activity—retaliation is a separate violation with its own penalties.

Medicaid and Commercial Payer Variations

The 60-day rule under the ACA applies specifically to Medicare and Medicaid. Medicaid overpayments are subject to the same identification/repayment timeline (42 C.F.R. § 401.305 and § 447.301(c)), enforced by state Medicaid agencies and the HHS OIG. States can impose additional penalties—California's Welfare & Institutions Code § 14124.72, for example, allows treble damages for Medicaid overpayments, and New York's Public Health Law § 32 imposes its own penalty structure. Facilities operating in multiple states face the possibility of stacked state penalties for the same retained overpayment.

Commercial payers are governed differently. Most commercial contracts include "overpayment recovery" clauses, and some states (Florida, Texas, Pennsylvania) have enacted prompt-payment and overpayment-recovery statutes. But the False Claims Act doesn't directly reach commercial overpayments—that's a breach of contract issue unless the facility receives federal funds that obligate repayment. Facilities that mix Medicare and commercial billing must trace which payer the overpayment came from before applying the 60-day rule. A common audit finding is a facility that treats a commercial overpayment as if it were under the FCA and over-reports to HHS, or a facility that treats a Medicare overpayment as commercial and skips the 60-day timeline entirely.

Conducting an Internal Overpayment Investigation Before Reporting

Facilities should investigate before they refund. The standard process, per HHS-OIG Compliance Program Guidance for hospitals and the 2023 OIG General Compliance Program Guidance, includes: scoping the overpayment (how much, which claims, which dates), reviewing the root cause (coding error, eligibility error, duplicate claim, bundling issue), and documenting the determination. The investigation timeline shouldn't exceed the 60-day window—facilities that investigate past the 60-day mark have a "reasonable diligence" defense under the 2016 HHS Advisory Opinion and the DOJ's 2018 guidance, but the defense requires documented diligence.

The refund mechanism matters. Facilities should use the CMS overpayment refund process (the "Overpayment Recovery" process through the MAC) and keep contemporaneous documentation of the refund submission. Facilities that send refunds by check without proper documentation that the MAC received it face a risk that the government doesn't credit the payment. The CMS "Self-Reported Overpayment" process via the Medicare Administrative Contractor is the structured mechanism; refunds outside that process are harder to validate if a dispute arises.

A third structural point: the OIG's 2023 CMP (Civil Monetary Penalties) regulations at 42 C.F.R. § 1003.210 implement penalties for false claims and overpayment retention. The per-claim penalty under the CMP rules, updated annually by the Federal Civil Penalties Inflation Adjustment Act, was $29,740 per false claim as of the 2025 adjustment (the 2026 inflation figure should be confirmed on the OIG's Civil Monetary Penalties page). Facilities that retain overpayments across hundreds of line items face per-claim exposure, not just the total dollar amount retained.

FAQ

What's the difference between a billing error I never noticed and an overpayment I identified?

A billing error the facility never knew about carries no 60-day clock—identification is the trigger, not receipt. Once the facility learns of the overpayment (through an internal audit, a MAC notice, or even a staff tip that's plausible enough to warrant investigation), the clock starts, and retention beyond the deadline becomes the violation. The distinction is "knowledge," which courts have interpreted as actual knowledge, reckless disregard, or deliberate ignorance.

Can I keep the money in a "suspense account" while I investigate and still be safe?

Not automatically. HHS-OIG guidance states that a "suspense account" is not a defense to the 60-day rule if the facility could have refunded the overpayment and continued investigating separately. Facilities are expected to refund first and investigate later. A facility that warehouses the funds for 90 days has missed the deadline regardless of whether it intended to eventually refund, unless the investigation itself is documented under the "reasonable diligence" standard and the timeline is defensible.

Is holding an overpayment a criminal offense?

Not always. The 60-day retention is civilly actionable under the False Claims Act, and criminal exposure under 18 U.S.C. § 1035 or § 1001 typically requires intent to defraud or a false statement. A facility that identifies the overpayment, moves it into operating revenue, and doesn't disclose it is in the zone of criminal risk. A facility that identifies it and delays refund while documenting the investigation usually faces civil exposure, not criminal.

How much can I expect to pay in a settlement for retained overpayments?

The reported settlements in the DOJ's publicly announced cases reflect a range, with the smallest around $50,000-$100,000 for single-issue self-identified overpayments and larger ones in the $500,000-$2 million range for facilities that retained funds across multiple billing periods. The baseline includes the original overpayment plus treble damages and per-claim penalties, with the settlement number usually reflecting cooperation credit. A $12,000 overpayment retained across 5 claims typically settles for less than a $1.2 million overpayment across 200 claims.

Does the 60-day rule apply if the overpayment was my own billing error, not CMS's mistake?

The rule applies regardless of whose error caused the overpayment. The ACA's wording covers any "overpayment," and HHS-OIG has enforced it against facilities whose billing errors created the overpayment. The only distinction is that facilities that identify and report their own errors may receive cooperation credit, while facilities that discover overpayments through government audit or a whistleblower usually don't.

Can I return the overpayment after 60 days and avoid the violation?

NO—late payment of the identified overpayment does not cure the violation. It mitigates damages, but the FCA's violation is the "knowing" retention, not the failure to repay at all. Facilities that refund after 60 days typically face reduced recoveries but still face potential penalties and, in some districts, a 60-day-line settlement baseline. This is why voluntary self-disclosures under the OIG's Self-Disclosure Protocol must occur before the 60-day mark to preserve cooperation credit.

What about overpayments from Medicare Advantage plans?

Medicare Advantage plans are subject to the same 60-day rule through 42 C.F.R. § 422.326. Facilities that identify an overpayment from an MA plan must return it within 60 days of identification, and the CMS Final Rule on MA overpayment reporting (2024) clarified that the timelines apply to MA organizations and their contracted providers. Facilities that retain MA plan overpayments face the same FCA exposure as those retaining original Medicare overpayments, and the MA plan's own internal reviews may identify the overpayment before the facility does.

This article is general educational information about compliance obligations, not legal advice. Retained Medicare overpayments carry civil and potentially criminal exposure, and the specific obligations depend on your facility's state, payer mix, and the facts of identification. Consult qualified health care counsel licensed in your jurisdiction before making repayment decisions. If a whistleblower has already reported an overpayment or a government notice has arrived, the timeline and the exposure differ materially—and if you're facing an immediate retaliation or employment threat, seek counsel before responding.