The Overpayment Clock Nobody Watched
During a routine internal audit in February, a hospital's compliance team identifies that a coding error caused $480,000 in overpayments on Medicare claims over the prior 18 months. The error was caused by a software configuration mistake that mapped a nonsurgical code to a surgical DRG. The vendor has been notified and a fix is scheduled for April. The compliance director drafts a memo to the CFO recommending repayment 'after we finish validating the full scope, likely Q3.' The CFO wants to 'net it against underpayments we think exist elsewhere' and 'wait for the vendor's root-cause report.' The audit committee meets in three weeks.
1. Analyze the legal obligations triggered by the identification of the overpayment.
Read the worked answer
Identification of a Medicare overpayment triggers the 60-day repayment rule under the False Claims Act (42 U.S.C. §1320a-7k(d)): an overpayment must be reported and returned by the later of 60 days after identification or the date a corresponding cost report is due. An overpayment 'identified' when the entity has determined, or should have determined through reasonable diligence, that it received one. Knowing retention past the deadline can convert the claims into reverse false claims and create FCA liability. 'Validation of full scope' and 'waiting for the vendor report' do not toll the clock - reasonable diligence has a defined, bounded meaning, and the entity must act on what it knows.
Other obligations: report and explain the overpayment on the cost report; consider the OIG Self-Disclosure Protocol or CMS Self-Referral Disclosure Protocol depending on whether Stark is implicated (a DRG mapping error is a coding/billing issue, not necessarily Stark); and preserve documents. Netting against suspected underpayments elsewhere is not a lawful offset without a documented, supportable basis - you cannot self-help net unidentified amounts.
2. Recommend the actions and timeline the compliance director should present to the audit committee.
Read the worked answer
Timeline anchored to the 60-day clock:
- Now (week 1): Treat February as the identification date and start the 60-day clock. Preserve records; confirm the fix date (April) does not delay repayment. Quantify the known $480,000; do not let 'full scope' validation delay returning what is confirmed.
- Week 1–2: With counsel, determine the repayment mechanism (e.g., voluntary refund via the appropriate CMS process) and whether self-disclosure adds value. Separate confirmed overpayments from the still-being-scoped population.
- Week 2–3: Prepare the audit committee package: amount, root cause, timeline, disclosure decision, and corrective action.
- Before the deadline: Submit repayment for confirmed amounts; continue diligence on the remainder and repay as identified.
On the CFO's requests: Do not net against unquantified 'suspected' underpayments - document any offset only if supported and approved by counsel. Do not wait for the vendor's root-cause report to repay; the report informs corrective action, not the repayment obligation. Corrective action: validate the configuration fix, add a pre/post-implementation edit check for DRG mapping, and add a coding-configuration change-control step. Report completion to the committee.