A compliance officer who discovers a Medicaid overpayment, whether through a claims reconciliation, an internal audit, or a whistleblower complaint, faces an immediate procedural choice: self-disclose the matter, or resolve it through ordinary claims adjustment. Under the federal overpayment statute, 42 U.S.C. § 1320a-7k(d), a provider that knowingly retains an identified overpayment beyond 60 days is exposed to False Claims Act liability, treble damages, and potential exclusion from federal healthcare programs. Self-disclosure, scoped correctly, can convert that exposure into a negotiated resolution with a defined credit. Handled without counsel, it can instead hand the state a roadmap for a broader investigation.
When Self-Disclosure Is the Better Option
Self-disclosure is generally the better move when an overpayment reflects a systemic billing or coding issue, when the facts could support an inference of knowing conduct, or when the provider needs to stop exposure from accruing while it investigates. It is not necessary for a routine, isolated claims error corrected through a standard void or adjustment; several states, including New York, maintain a separate abbreviated process for that kind of correction. The dividing line is whether the issue could plausibly be characterized as more than a billing mistake. If so, the credit a voluntary disclosure can provide is usually preferable to waiting for a Medicaid Fraud Control Unit referral to find the issue first.
The 60-Day Rule and the Credit for Disclosure
The federal floor for every state Medicaid overpayment obligation is the same statute that governs Medicare: 42 U.S.C. § 1320a-7k(d), enacted as Section 6402 of the Affordable Care Act and implemented at 42 CFR 401.305, requiring a provider to report and return an overpayment within 60 days of the date it is identified, meaning the date the provider knowingly receives or retains it, the same knowledge standard used in the False Claims Act. Retaining an identified overpayment past the deadline is an independent basis for False Claims Act liability, regardless of how the overpayment arose. A timely disclosure to the HHS Office of Inspector General under its Self-Disclosure Protocol suspends the 60-day clock while OIG reviews the matter, and OIG's stated practice is to resolve cooperative disclosures at a minimum multiplier of 1.5 times single damages, well below the treble damages the False Claims Act otherwise permits. State Medicaid programs generally run parallel disclosure programs of their own rather than OIG's, built on the same premise.
State Protocols Vary, Confirm Before Filing
No two state protocols are identical. New York's Office of the Medicaid Inspector General, for example, runs two disclosure tracks: a full process for matters requiring investigation and explanation, and an abbreviated process for routine, already-corrected transactional errors. Other states route disclosures through the state Medicaid agency, the Attorney General's Medicaid Fraud Control Unit, or a dedicated program integrity office, and the mitigation credit available, where one is formally offered, varies by program and is often negotiated case by case rather than published as a fixed formula. Confirm the current protocol, the correct recipient, and the state's mitigation criteria before filing. A state audit already underway does not necessarily foreclose a disclosure covering conduct outside its scope, though it changes the analysis.
Preserving Privilege While You Investigate
The internal investigation that precedes a self-disclosure decision should protect the provider's position from the outset. Retaining counsel to direct the investigation, rather than conducting it purely as a compliance department exercise, is what typically supports an attorney-client privilege and work-product claim over interview notes and the damages calculation. The scope should be defined and documented before the investigation begins, both to keep the inquiry proportionate and to avoid the appearance that the provider expanded its own exposure. Contemporaneous documentation, the claims sample, the methodology used to quantify the overpayment, and the date the issue was first identified, becomes the record the state or OIG will test if the disclosure leads to further inquiry.
Retaining an identified Medicaid overpayment beyond the 60-day deadline is an independent basis for False Claims Act liability, regardless of how the overpayment arose.
Why Early Legal Counsel Is Critical
It is critical that providers and compliance officers promptly retain experienced healthcare defense counsel before making any self-disclosure decision. Early legal intervention can protect the provider's privilege over the internal investigation, scope the disclosure appropriately, avoid inadvertent admissions that expand exposure, and allow counsel to communicate with the state Medicaid program integrity unit on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk, including loss of the 60-day safe harbor.
How Health Law Alliance Can Help
Health Law Alliance advises compliance officers on Medicaid self-disclosure decisions as part of its Medicaid audit defense practice, from the internal investigation through the filing and negotiation of the disclosure. The firm scopes each investigation to preserve privilege and quantifies the overpayment under the applicable state protocol, so the compliance office is not negotiating its own exposure alone. If your organization has identified a potential Medicaid overpayment, contact us for a free, confidential consultation.
