Voluntary repayments and false claims liability

By Daniel F. Shay, Esq., March 1, 2026

Every month, DermWorld covers legal issues in “Legally Speaking.” This month’s author Daniel F. Shay, Esq., is a health care attorney at Alice G. Gosfield and Associates, P.C.

When a dermatology practice improperly bills the federal government, any amounts paid in excess of what was actually due to the practice can be considered “overpayments.” If the practice retains that money for too long, the overpayment will be considered a “false claim” under the Federal False Claims Act (FCA), which could subject the practice to between $14,308 and $28,619 in civil money penalties per claim, plus up to three times the amount of each claim itself. Thus, a $50 overpayment can turn into as much as a $28,769 penalty. In December 2024, the federal government published updates to the regulations that govern the conversion of overpayments into false claims, imposing new requirements on dermatology practices and tightening the timeframes within which practices have to respond.

The obligation to repay and how it has changed

In 2009, the government passed the Fraud Enforcement Recovery Act (FERA), which modified provisions of the FCA to create an obligation to return any overpayment to the government. In 2010 as part of the Affordable Care Act, this obligation was clarified to apply to any overpayment retained more than 60 days after the date on which the overpayment was identified. This left open several questions as to what would trigger the 60-day timer, and what constituted an “overpayment” itself. In 2016, the Centers for Medicare and Medicaid Services (CMS) first published regulations clarifying the statutory language.

An overpayment is defined as “any funds that a person has received or retained” under Medicare, to which the person is not entitled (42 CFR § 401.303). The definition is broad and has not changed since its implementation. As the language states, it applies to any funds received or retained. Because of the breadth of the definition of “overpayment,” a specific intent to defraud the government is not actually required for the claim to become an overpayment. Put another way, one need not be a mustache-twirling villain determined to bilk the government of taxpayer dollars; a simple mistaken payment by CMS (including one not even initiated by the practice itself) can be considered an “overpayment.” All that is required is that (1) the practice was not entitled to the money for any reason, and (2) the practice received or retained it.

The regulations made clear that anyone who receives such an overpayment must return the overpayment by 60 days after the date on which the overpayment was identified. However, the concept of “identified” has changed in recent years. In prior years, an overpayment was considered to have been “identified” when the person had or should have through the exercise of “reasonable diligence,” determined that it received an overpayment and quantified the amount. At the time, CMS did not impose any specific time limit on how long an investigation to quantify the overpayment could take, but issued informal guidance that it would normally not be expected to take longer than six months. Still, this left a great deal of flexibility, and CMS also stated that “extraordinary circumstances” might extend that timeframe. Moreover, one could argue that additional overpayments related to the first identified overpayment, might complicate quantifying the amount. In other words, after discovering one overpayment, an investigation might discover others, which could further stretch the timeframe or lead to “extraordinary circumstances.”

In December 2024, however, CMS revised the regulations to tighten reporting obligations and eliminate some of the vagueness (and flexibility) offered by the previous regulatory language. The new requirements allow the 60-day deadline to be suspended when two specific things occurred: (1) when an overpayment is identified, but a good-faith investigation to determine the existence of related overpayments is ongoing; and (2) that a good-faith, timely investigation was conducted to determine whether related overpayments actually existed. Quantification of each overpayment was no longer the determining factor in when the overpayment had been identified. Now, the obligation is suspended until either the date when the investigation is concluded and the aggregate amount of all the related overpayments (both the initially discovered one, and any related ones) is determined, or 180 days after the date on which the initial overpayment was identified.

On its face, this seems to merely reduce regulation from prior CMS guidance: Investigations should be finished within 180 days to avoid penalties. Moreover, there is no longer any question of whether discovering additional related investigations pauses the clock, or if it continues running. Now, all related investigations must be concluded within 180 days. The change, while not enormous, is still impactful on dermatology practices.

What it means in practice

With the publication of the initial regulations in 2016, CMS made it clear that an “ostrich defense” of just ignoring the problem was no longer sufficient. Dermatology practices had an obligation to diligently investigate and return overpayments.

As a practical matter, this meant that the smart move was to establish solid compliance protocols and to periodically audit one’s billing to check for overpayments, quantify any discovered, and return them as soon as possible.

Still, the prior version of the regulations did allow for some degree of flexibility. Arguably, each individual overpayment discovered had its own “when-quantified” clock ticking, with the possibility for “extraordinary circumstances” to further extend that timeframe. Now, all related investigations fall under the same 180-day umbrella and must be concluded within that timeframe. This, in turn, places an even greater obligation on dermatology practices to audit their own Medicare payments periodically, and ensure that they have not received overpayments, or if they have, that they quantify and return them quickly. Failure to do so will result in the imposition of harsh monetary penalties. Given that the government has already taken the position that even a single denied payment is reason to investigate further, dermatology practices must maintain constant vigilance and regularly audit their claims and supporting documentation.

In addition to ongoing audits and compliance efforts, dermatology practices should consider including in their employment contracts for employed clinicians language that permits the practice to “claw back” payments made to the clinician in the event that the clinician’s own mistakes lead to an overpayment. Of course, it is fair for the clinician to avoid such clawbacks if the mistakes lie with the practice, for example if the billing staff erroneously coded certain encounters in a manner that produced the overpayments. Nevertheless, if the clinician’s documentation is insufficient and CMS demands repayments, or if the clinician erroneously recorded information that results in an overpayment, the practice may want to claw back money paid to the clinician to offset the amount of the overpayment.

These types of clauses can be added to contracts, but local counsel should be consulted to ensure that such provisions are added properly, to ensure their validity if challenged in court. For example, Pennsylvania does not permit the imposition of new duties on an existing employee without sufficient “consideration” (i.e., the employee must be given something of value by the employer in exchange for the new obligation). Adding such provisions outside of a normal contract renewal period could prove problematic unless the employer also provides the employee with something of value like an extra vacation day, a raise, or some other benefit.

Overpayments can be devastating to a dermatology practice if they convert to false claims. As noted above, the monetary penalties are high. Moreover, when an overpayment is discovered, it is rarely an isolated incident. Like rodents, if you can find one, there are likely more lurking beneath the surface. One overpayment becomes multiple overpayments, all of which must be investigated, quantified, and returned swiftly. While the Medicare administrative contractors maintain forms that can be used to return smaller overpayments, rather than try to go it alone when returning overpayments resulting from a larger investigation, having legal counsel available to assist can help minimize exposure and ensure that the process goes smoothly.

This article is provided for informational and educational purposes and is not intended to provide legal advice and should not be relied upon as such. Readers should consult with their personal attorneys for legal advice regarding the subject matter of this article.

Additional DermWorld Resources