You Found You Were Overpaid. The 60-Day Clock Started the Moment You Knew, Not the Moment You Act.

A revenue audit almost always runs one direction. Find the unbilled work, find the underpaid claims, find the money the practice is owed. The regulation that makes that number defensible is the same regulation that runs the other way, and most audits are never built to look.

What does 42 CFR 401.305 actually require?

42 CFR 401.305(b)(1) requires a person who has received an overpayment to report and return it by the later of two dates: 60 days after the date the overpayment was identified, or the date any corresponding cost report is due, if one applies. The same deadline is set at the statutory level, in 42 U.S.C. 1320a-7k(d), which the CFR provision implements. This is not a guideline or a best practice. It is a federal reporting deadline with a defined trigger date.

When does the clock actually start?

This is the clause most practices get wrong, because it feels intuitive to assume the clock starts once the practice has confirmed the number, reconciled the records, and decided the overpayment is real. That is not what the rule says.

42 CFR 401.305(a) defines identification as the point when a person knowingly receives or retains an overpayment. The word knowingly is not left to plain-English interpretation; the regulation ties it directly to 31 U.S.C. 3729(b)(1)(A), the False Claims Act’s own knowledge standard, which covers actual knowledge, deliberate ignorance, and reckless disregard, not only a fully confirmed finding. The practical effect is that the clock can start at the point a practice has reason to know something is wrong, not the later point when it finishes checking.

A practice that notices a pattern suggestive of overpayment and sits on it while deciding whether to look closer is not pausing the clock. It may already be running.

What happens if the 60 days pass without repayment?

42 U.S.C. 1320a-7k(d)(3) states plainly that any overpayment retained past the reporting deadline becomes an obligation, as defined in 31 U.S.C. 3729(b)(3), for purposes of the False Claims Act. That is the mechanism by which a missed administrative deadline turns into potential False Claims Act liability. The False Claims Act carries per-claim civil penalties and treble damages, a different order of exposure than simply owing back the original overpaid amount.

Trigger	Deadline	Consequence of missing it
Overpayment identified (401.305(a))	60 days from identification, or cost report due date, whichever is later	Retained amount becomes an FCA obligation under 1320a-7k(d)(3)
OIG Self-Disclosure Protocol submission	Deadline suspended until settlement	N/A while suspended
CMS Voluntary Self-Referral Disclosure Protocol submission	Deadline suspended until settlement	N/A while suspended
Extended repayment schedule request	Deadline suspended until CMS or contractor decision	N/A while suspended
Good-faith investigation of related overpayments	Deadline suspended up to 180 days from initial identification	Clock resumes at 180 days or investigation conclusion, whichever is earlier

What can pause the clock, and what cannot?

42 CFR 401.305(b)(2) and (b)(3) set out specific, narrow suspension paths. Submitting to the OIG Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol suspends the deadline until a settlement agreement is reached. Requesting an extended repayment schedule under section 401.603 suspends it until CMS or its contractor decides the request. And where a person has identified an overpayment but has not yet completed a good-faith investigation into related overpayments, the deadline is suspended until the earlier of the investigation concluding or 180 days after the initial overpayment was identified.

What does not pause the clock: deciding informally to look into a concern without formally entering one of those protocols, or simply not getting to it. The suspension mechanisms are specific and require an affirmative step, not an internal decision to defer.

How far back does this reach?

42 CFR 401.305 applies within a six-year lookback: the reporting obligation covers an overpayment identified within six years of the date it was received. An overpayment identified outside that window falls outside this specific rule’s reporting requirement, though that does not mean older overpayments carry no other recovery exposure under separate mechanisms.

Why does an audit that only looks for underbilling create a blind spot?

An audit designed to find unbilled or underpaid work is looking at one side of a data set built from the same claims history. If that same review surfaces a case where the practice was paid for something it was not entitled to, whether from a coding error, a duplicate payment, or a claim that should have been denied, that discovery is itself the identification event under 401.305(a). The 60-day clock does not wait for the audit’s original purpose to catch up to what it actually found.

A revenue-integrity review built to run in only one direction can, without intending to, create the exact identification moment the regulation is timing, at the same instant it is trying to locate money owed to the practice. The honest version of this kind of audit looks both ways, because the regulation does not distinguish between a finding you were hoping for and one you were not.

What does an overpayment actually look like in a dental practice?

It is rarely a dramatic fraud scenario. A duplicate claim submitted after a resubmission was already paid. A coordination-of-benefits error where the secondary payer paid as though it were primary. A procedure billed at a code level the documentation does not support, caught months later during an unrelated chart review. A patient refund owed after insurance and patient payment together exceeded the fee, sitting uncollected because nobody flagged the credit balance. Each of these produces a real overpayment under 401.305(a) the moment someone at the practice has reason to know it happened, whether that is the billing manager, the office owner, or an outside reviewer running an audit for an entirely different purpose.

What should a practice do once an overpayment is identified?

The rule gives a practice options beyond a bare 60-day scramble, but each option requires an affirmative step, not silence. If the amount or scope is uncertain and related overpayments might exist, opening a documented good-faith investigation preserves up to 180 days under 401.305(b)(3), which is materially more room than the default 60 days. If the overpayment is significant or raises questions about how it happened, the OIG Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol suspends the clock entirely until a settlement is reached, at the cost of formally engaging a federal disclosure process. What the rule does not offer is a safe way to simply notice an overpayment and set it aside for later without formally entering one of these paths. Silence is not a suspension.

Where this comes from

The 60-day deadline, the definition of identification, the suspension conditions, and the six-year lookback are drawn directly from 42 CFR 401.305, and the statutory overpayment provision and False Claims Act obligation language are drawn directly from 42 U.S.C. 1320a-7k(d). Both were read at the source for this piece. No dollar figure, penalty amount, or settlement example is stated here beyond what these provisions themselves establish; the False Claims Act’s specific per-claim penalty range is not quoted because it was not verified against a source opened for this piece.

If a review of your own claims history needs to look both directions at once, ClaimRail runs a free audit against your own data. No fee, no pitch.