Understanding Medicare Overpayment Risk

TL;DR: Medicare overpayments—money paid that shouldn't have been—total billions a year, and once identified, a provider has 60 days to repay or risk False Claims Act exposure. In Medicare Advantage risk arrangements, the same errors flow two ways: overpayments pull money out of a provider org, contestations get misallocated money back. This post is mainly about the first — a follow-up will dig into building a defensible contestation filing.

---

Something as simple as a claim missing one required value can be enough to make it invalid in CMS's eyes. And... it's a pretty big problem.

The scale of the problem: CMS estimated $28.8 billion in Medicare fee-for-service improper payments for FY2025 (a 6.55% improper payment rate)—down from $31.7 billion the year before, according to CMS's Fiscal Year 2025 Improper Payments Fact Sheet. Separately, DOJ-reported federal False Claims Act recoveries hit a record $6.8 billion in FY2025, with healthcare accounting for $5.7 billion of that total, as reported by Medical Economics.

Though it's worth flipping that around, too: that same scale is exactly what creates some pretty good upside for MA plans and risk-bearing provider organizations willing to go looking for it.

Numbers that size are not rare. They're a routine, large-scale feature of how Medicare runs. Yet overpayment gets remarkably little attention next to fraud. It lacks fraud's drama, and it never shows up as its own line item in anyone's budget. That's why it stays overlooked and undervalued as a problem worth solving on purpose, instead of something you only react to when an audit letter shows up.

Part of why it's easy to overlook is that "overpayment" sounds like a small accounting problem—money moved, then moved back. In Medicare, it's closer to a legal trigger. The moment an overpayment is identified, a clock starts, and how the parties involved respond decides whether the episode ends as a routine correction or turns into a False Claims Act exposure.

Two Directions of the Same Allocation Error

More MA plans and provider organizations are entering risk-sharing arrangements via capitation, where the health plan pays the provider org a fixed amount per patient, per month, to cover that patient's care—often called "global risk." The provider org is betting it can deliver that care for less than the fixed amount and keep the difference, so who's responsible for each dollar charged against that budget matters a lot.

Overpayment, in plain terms, is money flowing from the provider org back to the health plan. Either side can be the one who catches it:

• The health plan, auditing its own claims: "Provider, you submitted a claim or diagnosis code that doesn't align with Medicare's rules. Give that money back."
• The provider org, catching its own mistake first: "We realized we submitted a claim or diagnosis code that doesn't perfectly align with Medicare's rules. We need to proactively retract it and return the funds to the health plan so this mistake doesn't trigger future audits or artificially skew our Per Member Per Month (PMPM) benchmarks and budgets."

Contestation is the mirror image—money flowing from the health plan back to the provider org. Again, either side can catch it:

• The provider org, reviewing what it was paid: "We realized the health plan underpaid a claim or denied valid care we provided. We need to proactively appeal and correct this mistake with the plan to ensure our PMPM revenue is fully captured and our budget accurately reflects the actual care we delivered."
• The health plan, catching its own processing error: "We realized we underpaid or wrongly denied a valid claim. We're correcting the payment and returning the difference to the provider."

Filing a contestation isn't a one-step ask, though—it follows its own multi-stage review process on the health plan's side, similar in shape to how an overpayment gets processed, just run by the other party:

The day ranges above are an example from one health plan—every payer runs this on its own clock—but the shape holds across payers: it can take 3 to 6 months to review and respond to a contestation, versus the 60 days CMS gives providers to report and return an overpayment once it's identified. No regulation forces a health plan to move faster, so filing contestations promptly and consistently is the main lever a provider org has for getting back money it was never rightfully charged.

With those two terms defined, the rest of this post focuses on the overpayment side: where it comes from, and what a provider org is actually on the hook for once one turns up.

What Counts as an Overpayment

An overpayment is any payment a provider receives that's more than what they were entitled to under the program's rules. That's a broad definition on purpose. It doesn't require intent, and it doesn't require the payer to have done anything wrong. Overpayments build up from a few distinct sources:

• Coding errors — the wrong CPT/HCPCS code, an upcoded severity level, a modifier applied incorrectly.
• Insufficient documentation — the claim was billed correctly, but the medical record doesn't support what was billed.
• Lack of medical necessity — the service was documented and coded correctly, but shouldn't have been performed or billed under the payer's coverage criteria.
• Duplicate billing — the same service billed more than once, often across different claim submissions or provider systems.
• Admin/system errors — eligibility lapses, incorrect fee schedules, claims processing glitches on the payer side.

Notice that the first four sources sit with the provider, and the last sits with the payer. But in every case, the same thing happens next: the provider holds funds it wasn't entitled to, and the payer paid out funds it shouldn't have. Both sides now have exposure, just different kinds.

How We're Thinking About This

Systematic detection is easier to describe than to build. Each rule encodes a specific regulatory or contractual requirement—TCM billing timelines, SNF consolidated billing exclusions, assistant surgery modifier restrictions—and each of those requirements has edge cases that aren't obvious until they've already cost someone money. A duplicate-TCM rule, for example, has to account for the fact that practices record the claim date two different ways: the actual visit date, or the 30th day after discharge. Get that wrong, and you either miss real violations or flag nearly every legitimate claim. Multiply that kind of nuance across a dozen-plus rules, each payer's own claims schema, and rules that shift whenever CMS guidance changes, and "query the claims data" turns into an ongoing maintenance job most organizations can't keep up with. That's a big reason detection tends to stay reactive instead of continuous.

A few things we've learned building this out, the hard way in some cases:

• Data has to stay linked to CMS's own reference tables, and those tables move. Fee schedules, NCCI edits, code sets—CMS updates them on its own schedule, and a rule that's correct today can quietly go stale if the underlying table isn't refreshed with it. We treat keeping those links current as an ongoing job, not a one-time setup step.
• AI can help you explore the data, but we don't let it write the SQL that runs the rules. It's tempting to hand a model the regulatory language and let it generate the query. We don't do that for anything that determines whether a claim gets flagged—the edge cases described above are exactly the kind of thing that gets confidently gotten wrong.
• Every rule gets QA'd thoroughly before it ships, and again whenever the underlying guidance changes. A rule that's slightly off doesn't fail loudly—it just quietly misses real overpayments or flags claims that were fine, and either one erodes trust in the whole system.
• The output has to be something a client can actually act on, not just a number. An exposure estimate on its own doesn't get money recovered. It has to come with the claim-level detail and the documentation a team needs to actually work the case.

That's the problem Falcon's detection module solves. It runs overpayment and contestation rules side by side, configured per payer since contestation categories are specific to each contract. Each run reports claims flagged, members affected, and estimated exposure. Flagged claims export directly, too: one file for claim-level review, and one payer-specific contestation filing template that's ready to submit.

This is a real, underexploited opportunity. Running this suite across our client base, Falcon has already surfaced more than $15 million in overpayment and contestation exposure that would otherwise have gone unrecovered—the majority from overpayment detection, with contestation filings adding incremental recovery on top. MA plans get a systematic way to recover overpayments they'd otherwise write off as too costly to chase one by one. Risk-bearing provider organizations get that same rigor applied to the contestation side. That $15 million didn't require new data—just someone running both queries on time.