Medicare Overpayments in Behavioral Health: Running the 60-Day Clock and the 180-Day Investigation Window

Every behavioral health program that bills Medicare eventually finds money it should not have kept. An internal chart audit turns up group notes with no start and stop times. A clinician’s credentialing lapsed for six weeks and nobody caught it. A credit balance report has been sitting unworked since spring. The finding itself is rarely the problem. The problem is what happens next, because federal rules attach a deadline to the moment your organization knows, and most programs do not have a written process that starts that clock on purpose.

This guide walks through how the Medicare overpayment rule works after the 2024 amendments, where behavioral health programs typically lose control of the timeline, and what to put in place this month. It is operational guidance for owners, clinical directors and compliance officers, not legal advice. Any significant overpayment question should go to healthcare counsel.

What the Medicare 60-day overpayment rule requires

Under the Medicare overpayment regulation at 42 CFR 401.305, a provider that has identified a Medicare overpayment must report and return it by the later of 60 days after the overpayment was identified or the date any corresponding cost report is due. Since the CY 2025 Physician Fee Schedule final rule, an overpayment counts as “identified” when the provider knowingly receives or retains it, using the False Claims Act definition of knowingly. That 60-day deadline can be suspended for up to 180 days from identification while the provider conducts a timely, good-faith investigation into related overpayments, and the rule reaches overpayments identified within 6 years of the date they were received. Money kept past the deadline becomes an obligation under the False Claims Act. (Checked against the current regulation text on eCFR, October 1, 2026.)

The primary sources are the regulation itself on eCFR (42 CFR 401.305) and the CY 2025 Physician Fee Schedule final rule published in the Federal Register on December 9, 2024, which made the changes described above. Medicaid is a separate question: state Medicaid agencies and managed care contracts set their own refund terms and timelines, so read your state rules and every MCO provider agreement rather than assuming the Medicare mechanics carry over.

Why the clock starts earlier than most programs think

The older version of the rule tied identification to “reasonable diligence,” and many compliance teams built their habits around that language. The current standard is tied to knowledge, which includes deliberate ignorance and reckless disregard. In practice that means the clock can start the day a billing specialist flags a pattern in an email, not the day the compliance committee formally reviews it three weeks later.

Here is what we see repeatedly when we review programs after a payer audit or a whistleblower complaint. The overpayment was not hidden. Someone found it. A utilization review nurse noticed that authorizations had lapsed on four residential stays. A biller noticed that a new therapist’s claims were going out under a supervising clinician’s NPI before the payer enrollment was approved. The information sat in an inbox, a spreadsheet or a ticketing system with no owner and no date stamp. When the question later became “when did you know,” the honest answer was “earlier than we acted.”

An internal audit that finds a problem and then stalls can create more exposure than no audit at all, because it documents knowledge without documenting action.

Where behavioral health overpayments usually come from

These are the root causes that generate most of the overpayments we help programs quantify. Each one maps to a document you can pull and test.

• Time-based code drift: Psychotherapy and group codes billed at a duration the note does not support, or notes with no start and stop times at all.
• Enrollment and supervision gaps: Services billed for clinicians whose Medicare enrollment, state license or supervision arrangement did not cover the date of service.
• Missing or late signatures: Treatment plans, physician orders or progress notes unsigned, or signed well after the fact without a compliant late-entry process.
• Level-of-care mismatch: Days billed at a higher intensity than the documentation, assessment or authorization supports.
• Duplicate and crossover payments: The same service paid twice, or paid by Medicare when another payer was primary, usually visible first on a credit balance report.

If your program has seen any of these in the past year, our behavioral health compliance services team can help you scope whether it is a one-off error or a pattern that requires a lookback.

How the 180-day investigation window works in practice

The suspension is the most useful change in the 2024 amendments, and the most misunderstood. It is not an automatic extension. It applies when you have identified an overpayment but have not finished a good-faith investigation into whether related overpayments exist from the same or similar cause. The suspension ends at the earlier of two points: when the investigation concludes and you have calculated the total, or 180 days after the initial identification. After that, the 60-day reporting and return period applies, so work with counsel to confirm your exact date.

Three operational points matter here. First, the investigation has to be timely and in good faith, so a file that shows no activity for two months will be hard to defend. Second, the scope question is real: if one therapist’s group notes are missing times, you have to decide whether to look at that therapist only, the whole group program, or every time-based code across the organization, and you need to write down why. Third, if you use statistical sampling and extrapolation to calculate the amount, the regulation requires you to describe the sampling methodology in your report to the Medicare contractor, so engage a qualified statistician before you pull the sample, not after.

Building a defensible overpayment response file

The HHS-OIG General Compliance Program Guidance treats prompt response to detected problems, including overpayments, as a core element of an effective compliance program. In a payer audit or government inquiry, what protects you is a file that shows when you learned of the issue, what you did, and when you did it. A strong file contains:

• The original trigger, with the date and the name of the person who first raised it.
• A dated memo opening the investigation, with the scope and the reasoning for that scope.
• The audit sample, the reviewer’s findings and the calculation method.
• Evidence of the report and refund through the Medicare contractor’s voluntary refund or claims adjustment process.
• Corrective action: the policy fix, the training record and a follow-up audit date.
• A compliance committee or board note showing leadership was informed.

When the issue is large, crosses into potential fraud, or involves something more than a billing error, the self-disclosure protocols run by HHS-OIG and CMS are a separate path that also suspends the return deadline. That decision belongs with counsel.

What to do this week

You can tighten your overpayment process in a few hours, and every step below is something a compliance officer or administrator can start today.

1. Pull your last three credit balance reports. Any Medicare credit balance older than 60 days with no documented investigation is a priority. Assign each one an owner and a date.
2. Open your compliance policy and search for “overpayment.” If the policy still references “reasonable diligence,” lacks the 180-day investigation window or does not name who starts the clock, it was written before the current rule and needs revision.
3. Create one intake point. Set up a single log where billing, UR, clinical and HR staff report a suspected overpayment, with an automatic date stamp. Brief department heads that an email to a coworker does not count.
4. Calendar the deadlines. For every open item, enter the identification date, the 180-day investigation outer limit and the 60-day return date into the shared compliance calendar.
5. Check your MCO contracts. Pull the refund and recoupment clauses from each Medicaid managed care agreement and note any timeline that is shorter than Medicare’s.

If you would like a second set of eyes on an open finding, call Circa Behavioral at (888) 458-6619 and ask for our compliance team.

Who should own the overpayment clock

Overpayment handling fails most often because it lives between departments. Billing thinks compliance owns it. Compliance thinks billing will flag it. Clinical leadership assumes it is a finance issue. The fix is simple to describe and harder to maintain: one named owner, a written workflow and a log that leadership reviews every month. Smaller programs that cannot justify a full-time compliance hire often assign this to a fractional compliance officer who already runs the audit calendar and can carry an investigation from trigger to refund without losing the dates.

The rule is not complicated. The discipline is. Programs that treat the first email about a billing error as the start of a 60-day clock rarely end up explaining a retained overpayment to an auditor. To review your current overpayment policy or work through an open finding, reach Circa Behavioral at (888) 458-6619 or through our contact page.