What is the 60-day overpayment rule?

Under 42 U.S.C. 1320a-7k(d), a provider who identifies an overpayment must report and return it by the later of 60 days after the date it was identified, or the date any corresponding cost report is due. An overpayment retained past that deadline becomes an obligation under the False Claims Act, which carries its own penalty and treble-damages exposure separate from the original billing error.

When does the 60-day clock start running?

It starts on the date the overpayment is identified, which the implementing regulation defines as the date a person knowingly received or retained an overpayment. In practice, running a billing audit that surfaces a specific over-coded claim is the kind of event that can establish identification. That is exactly why an audit process needs a defined path for what happens next, before it runs, not after.

Why would a revenue recovery audit also need to catch over-coding?

Because a review of a chart for missed or under-billed revenue is, by construction, also a review of that same chart's coding accuracy. If the review process only asks whether more should have been billed, and never asks whether a claim was coded to a higher level than the documentation supports, it has looked at the evidence and chosen not to see half of it. That is a harder position to defend than never having looked at all.

Does finding an overpayment during an internal audit trigger the same reporting duty as an external one?

Yes. The statute does not distinguish between an overpayment found by a payer audit, a government contractor, or the provider's own internal review. Identification is identification. A practice that runs its own compliance review and finds an over-coded claim is under the same 60-day clock as one that receives an audit letter from a Medicare Administrative Contractor.

What counts as 'identifying' an overpayment for a dental claim specifically?

The regulation implementing the statute ties identification to knowing receipt or retention, using the False Claims Act's definition of knowing, which includes actual knowledge, deliberate ignorance, and reckless disregard. A billing team that runs an audit, sees a pattern of claims coded above what the chart documentation supports, and does nothing with that finding is squarely in the reckless disregard territory the statute was written to reach.

Does the 60-day rule apply to dental Medicare claims the same way it applies to medical claims?

Yes. 42 U.S.C. 1320a-7k(d) governs overpayments received under Medicare and Medicaid generally, and dental claims billed to Medicare Part B under 42 CFR 411.15(i)(3), or to Medicaid, are within its scope. There is no dental carve-out in the statute or its implementing regulation.

An Audit That Only Finds Under-Billed Money Is Not a Compliance Program. It Is a Liability Sitting Next to a Recovery Check.

A practice runs a revenue recovery review, finds a stack of missed and under-billed claims from the last year, and files the corrections. That is the whole story most billing reviews tell. It should not be. The same review, run against the same charts, was also capable of finding claims coded higher than the documentation supports, and under 42 U.S.C. 1320a-7k(d), finding that and doing nothing about it is not a neutral outcome. It starts a sixty-day clock the practice may not know is running.

What does the overpayment statute actually require?

The deadline

Under 42 U.S.C. 1320a-7k(d), a person who has received an overpayment under Medicare or Medicaid must report and return it by the later of two dates: sixty days after the overpayment was identified, or the date any corresponding cost report is due. An overpayment kept past that deadline is treated as an obligation under 31 U.S.C. 3729(b)(3), which is the False Claims Act's own definition of an obligation, carrying that statute's penalty structure.

Source: 42 U.S.C. 1320a-7k(d)

That last sentence is the one that changes the incentive. This is not a billing correction with a grace period. Once the sixty days pass, the statute stops treating this as an overpayment problem and starts treating it as a False Claims Act problem, which is a different category of exposure entirely.

When does an overpayment count as “identified,” and why does that matter for an audit?

The implementing regulation, 42 CFR 401.305, defines identification as the point a person knowingly receives or retains an overpayment, borrowing “knowing” from the False Claims Act’s own definition: actual knowledge, deliberate ignorance, or reckless disregard of the truth. That third category is the one that should concern any practice running a billing review. A team that pulls twelve months of charts looking for missed revenue and, in the course of that review, sees a pattern of claims billed at a higher level than the chart notes support, has not avoided identification by not asking about it directly. Choosing not to look at the coding-accuracy question while looking directly at the same claims is close to the textbook definition of deliberate ignorance.

Why does a one-directional audit create the exposure it should close?

An audit built to find under-billing only is not incomplete by accident. It is incomplete by design, because the recovery number is the part that gets reported and celebrated, and the over-coding question is the part nobody wanted to ask. But the statute does not grade on effort or intent to find money for the practice. It asks whether an overpayment was identified. A review process that opens every chart in a twelve-month window, reads the documentation against the code billed, and stops as soon as it finds an under-billed case without checking whether the same chart also shows an over-billed one, has functionally built a one-way filter over evidence it already possesses. That is a harder position to defend under a reckless disregard standard than simply never having audited the charts at all.

What does an audit that runs both queries actually look like?

The fix is not complicated. It is a second query run against the same pull, not a second engagement. For every chart reviewed for under-billing, the same documentation gets checked against the code that was actually submitted, asking whether the level billed is supported by the notes, the time documented, and the procedure actually performed. Where the answer is no, that finding gets logged, dated, and routed to whoever in the practice is responsible for the sixty-day reporting duty, the same day the under-billed findings get routed to whoever files the corrected claims. Both queries run on the same chart pull because they are looking at the same evidence.

Element	Under-coding review	Over-coding review
Trigger	Standard recovery audit scope	Same chart pull, same date range
What it checks	Was billable work left off the claim	Does documentation support the code billed
Governing clock	None; corrections can be filed anytime within timely filing limits	42 U.S.C. 1320a-7k(d), 60 days from identification
Outcome if skipped	Missed revenue, no legal exposure	Reckless disregard exposure under the identification standard
Where it is logged	Recovery worksheet	Compliance log, dated, routed same day as recovery findings

Who inside the practice should own the two findings, and should it be the same person?

Not necessarily, and treating them as the same job is part of how one-directional audits happen in the first place. The person best positioned to spot under-billing is usually whoever knows the fee schedule and the payer rules cold, focused on the question of what should have been billed. The person best positioned to catch over-coding is whoever can read a chart note skeptically and ask whether it actually supports the level billed, which is a documentation-review skill, not a fee-schedule skill. A solo biller wearing both hats is workable in a small practice, but only if the review checklist forces both questions explicitly. Where a practice has an office manager and a separate compliance-minded reviewer, or an outside audit partner, splitting the two questions across two sets of eyes catches more of both than one person rushing through a single pass looking mainly for the number that gets celebrated.

What should a practice do with a review that already ran one-directional?

If a recovery audit already happened and only the under-billing side was reported, the honest next step is to go back to that same chart pull and run the coding-accuracy question against it now, rather than treating the original review as finished. The sixty-day clock runs from identification, not from when the practice decides it is convenient to look. Running the second query today, on the charts already in hand, is the version of this that a compliance program can defend later. Leaving it unrun because the first pass already closed out and paid the practice is the version that cannot be defended once someone asks whether the coding side was ever checked.

Where this comes from

This piece draws on 42 U.S.C. 1320a-7k(d), the Medicare and Medicaid overpayment reporting statute, and its implementing regulation at 42 CFR 401.305, both read directly via Cornell Law School’s Legal Information Institute and the Electronic Code of Federal Regulations. If your last revenue review only ran one direction, the fifteen-minute audit that checks whether it should have run both is a free ClaimRail conversation, not a new engagement.