Guide

Lookback limits: the state statutes that cap takebacks

Summary

How far a payer can reach back to recoup a payment depends entirely on which payer and which law governs the claim. Medicare's recovery-audit lookback runs three years from the paid date; commercial recoupment windows are set by your state's insurance code and vary widely; and self-funded ERISA plans often sit outside state limits altogether. Identify the payer type first, then find the statute or contract clause that actually controls before you refund a dollar.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

Start with which payer and which law

There is no single answer to how far a payer can reach back, because the limit is set by a different authority for each kind of payer. A Medicare takeback, a fully-insured commercial takeback, a self-funded employer plan, and a state Medicaid recoupment each run on their own clock. Sort the demand letter into one of those four buckets before you do anything else, because the rest of your response depends on which one it is.

Payer type	Who sets the lookback	Where the limit lives
Medicare fee-for-service	Federal (CMS)	Recovery-audit rules — three years from the paid date
Commercial / fully-insured	Your state	The state insurance code and prompt-pay statute
Self-funded employer plan	Federal (ERISA)	The plan document and federal law, often outside state caps
State Medicaid	Your state Medicaid agency	The provider manual and state regulations

The recoupment window is not one national number; it is four different answers wearing the same name.

Medicare: the three-year recovery-audit lookback

For Medicare fee-for-service, a Recovery Audit Contractor conducts post-payment review and generally looks back three years from the date the claim was paid, then issues a demand for anything it deems overpaid; any recoupment carries defined appeal rights that run through the five-level Medicare appeals process, beginning with redetermination 1Ref 1Centers for Medicare & Medicaid Services (2026).Medicare Fee for Service Recovery Audit Program.The Medicare recovery-audit lookback of three years from the paid date and the five-level Medicare appeals process available against a recoupment.. Calendar every appeal deadline the day the demand letter arrives — the window to stop the money from sliding into automatic offset is short.

Before anything ever reaches recoupment, Medicare often routes an outlier biller through Targeted Probe and Educate, which reviews 20 to 40 claims per round with education between rounds and escalates only after three failed rounds 2Ref 2Centers for Medicare & Medicaid Services (2026).Targeted Probe and Educate (TPE).That Medicare's Targeted Probe and Educate reviews 20-40 claims per round with education between rounds and escalates only after three failed rounds, ahead of recoupment.. Treat a TPE round as the cheap chance to correct the pattern before it becomes an extrapolated demand spanning years of claims.

Commercial plans: your state sets the clock

For a fully-insured commercial plan, the recoupment lookback is a matter of state law, and it varies widely from one state to the next. State insurance departments regulate these plans, and the National Association of Insurance Commissioners coordinates the model laws that states adapt into their own insurance codes 3Ref 3National Association of Insurance Commissioners (2026).National Association of Insurance Commissioners.That state insurance departments regulate fully-insured plans and the NAIC coordinates model laws states adapt, so commercial recoupment windows are set and varied by state insurance law.. Some states cap commercial takebacks at a year, others at two or more; your state's statute is the one that controls, not the payer's assertion.

Find the number in your state's insurance code or its prompt-pay statutes, not in the takeback letter — a payer's letter routinely claims a longer reach than state law actually allows. When a recoupment doubles as a coverage dispute, your state's external review process may reach it. Read overpayments demands against the statute first, then respond in writing and on the record.

The ERISA exception that undoes most assumptions

The exception that undoes most assumptions is the self-funded employer plan. These are governed by ERISA, a federal law, rather than state insurance law — which is precisely why state prompt-pay and recoupment limits often do not reach them. A plan carrying a familiar carrier's logo may in fact be self-funded, with the carrier only administering it, and its lookback lives in the plan document and ERISA's claims-and-appeals framework rather than your state code 4Ref 4U.S. Department of Labor (2026).ERISA.That self-funded employer plans are governed by ERISA rather than state insurance law, so state recoupment and prompt-pay limits often do not reach them, and ERISA sets the plan's claims-and-appeals framework..

Ask whether the plan is self-funded before you assume a state cap protects you. This is the state layer against the federal layer, and which one applies decides both how far back the payer can go and which appeal path you owe the claim.

State Medicaid runs on its own recoupment rules

State Medicaid programs recoup under their own regulations and provider manuals, separate from both Medicare and commercial rules. Each state's Medicaid agency publishes its audit and overpayment-recovery rules through its provider portal — New York's Medicaid program, for instance, documents its billing and recovery rules through its provider portal 5Ref 5New York State Department of Health (2026).eMedNY.That a state Medicaid program publishes its billing, audit, and recovery rules through its provider portal, using New York's Medicaid provider portal as the concrete example.. Find your own state agency's manual and read its recoupment and appeal sections before you concede a single Medicaid dollar.

Because Medicaid recoupment rules are state-built, a rule that is true in one state is frequently wrong one border over. Never assume a neighboring state's window applies to yours; look up your own agency's published rule every time.

You can only defend a lookback you kept records for

The practical ceiling on any lookback is your own retention: you can only rebut a takeback for claims whose records you still hold. Professional record-keeping guidance suggests retaining records for a defined period after the last service — a common example is seven years for adults and longer for minors — while always deferring to your state's longer requirement 6Ref 6American Psychological Association (2007).Record Keeping Guidelines.Record retention as the practical limit on defending a lookback — the guideline example of seven years after last service for adults and longer for minors, always deferring to state law.. Match your retention to the longest lookback any payer can assert against you, never the shortest.

Set retention to your state's rule or the longest payer lookback, whichever runs longer, so a payer-audits demand never catches you without the note that would have answered it.

Read the demand before you refund a dollar

The most expensive mistake is refunding on receipt. A recoupment demand is a claim, not a judgment: it can name the wrong dates, misread a modifier, apply a lookback longer than the law allows, or simply be arithmetically wrong. Before any money moves, verify three things — that the payer type and governing law are what you think, that each claim named actually falls within the lawful lookback, and that the dollar figure matches the claims cited.

Calendar the response and appeal deadlines the day the demand letter arrives, then answer in writing with the specific basis for any disagreement. If part of the demand is genuinely valid, you can concede that portion while contesting the rest — a recoupment is rarely all-or-nothing. Paying fast to make the letter disappear forfeits both the money and the record you would need if the takeback later proves wrong.

When the lookback is not the real problem

Sometimes the records you pull to answer a lookback reveal something larger than a coding slip — a pattern of claims that should not have been paid at all. At that point the question stops being how far back the payer can reach and becomes whether you have identified an overpayment you are obligated to return. Federal law requires the return of identified overpayments, and OIG maintains a self-disclosure protocol for conduct that implicates federal health-program fraud laws 7Ref 7HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That OIG maintains a self-disclosure protocol for conduct implicating federal health-program fraud laws, the escalation path when a lookback surfaces a real overpayment rather than a coding error..

That is the moment to bring in healthcare counsel before you write to anyone, and to weigh self-disclosure against a routine refund. Adjacent edge cases shift the playbook further: a payer insolvency that strands your receivables, or a takeback letter whose language reads less like a billing error and more like a fraud allegation.

Common questions

Medicare's Recovery Audit Contractors generally look back three years from the date a claim was paid, and any recoupment carries defined appeal rights through the five-level Medicare appeals process. Other Medicare integrity reviews can reach on different terms, and a confirmed overpayment triggers a separate return obligation regardless of the audit lookback. Sort out which review type you are facing first.

No. State insurance codes and prompt-pay statutes cap recoupment only for the fully-insured plans a state regulates. Self-funded employer plans are governed by ERISA, a federal law, so state lookback caps frequently do not reach them. Before you rely on a state limit, confirm whether the plan is fully insured or self-funded, because that answer decides which clock actually runs.

It depends on the payer and the governing law. A commercial plan is bound by your state's recoupment window; a self-funded ERISA plan may reach further; Medicare's recovery-audit lookback is three years from the paid date. A payer's demand letter often asserts a longer reach than the law allows, so measure the request against the actual statute or contract clause before refunding anything.

Identify the payer type and the governing law, calendar every response and appeal deadline immediately, and pull the records for the claims named. Do not refund before you confirm the lookback is valid and the amount is correct. If the letter uses fraud language or projects a sample error rate across many claims, treat that as the trigger to involve healthcare counsel.

Keep records at least as long as the longest lookback any payer can assert against you, and never shorter than your state's retention rule. Professional guidance often cites a multi-year retention baseline for adults and longer for minors, always deferring to state law. Aligning retention to the longest possible reach means an audit never finds you without the note.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Centers for Medicare & Medicaid Services (2026). Medicare Fee for Service Recovery Audit Program. Centers for Medicare & Medicaid Services (CMS). link ✓The Medicare recovery-audit lookback of three years from the paid date and the five-level Medicare appeals process available against a recoupment.
2.Centers for Medicare & Medicaid Services (2026). Targeted Probe and Educate (TPE). Centers for Medicare & Medicaid Services (CMS). link ✓That Medicare's Targeted Probe and Educate reviews 20-40 claims per round with education between rounds and escalates only after three failed rounds, ahead of recoupment.
3.National Association of Insurance Commissioners (2026). National Association of Insurance Commissioners. NAIC. linkThat state insurance departments regulate fully-insured plans and the NAIC coordinates model laws states adapt, so commercial recoupment windows are set and varied by state insurance law.
4.U.S. Department of Labor (2026). ERISA. U.S. Department of Labor. linkThat self-funded employer plans are governed by ERISA rather than state insurance law, so state recoupment and prompt-pay limits often do not reach them, and ERISA sets the plan's claims-and-appeals framework.
5.New York State Department of Health (2026). eMedNY. New York State Department of Health. link ✓That a state Medicaid program publishes its billing, audit, and recovery rules through its provider portal, using New York's Medicaid provider portal as the concrete example.
6.American Psychological Association (2007). Record Keeping Guidelines. American Psychological Association. link ✓Record retention as the practical limit on defending a lookback — the guideline example of seven years after last service for adults and longer for minors, always deferring to state law.
7.HHS Office of Inspector General (2026). Health Care Fraud Self-Disclosure Protocol. HHS Office of Inspector General (OIG). link ✓That OIG maintains a self-disclosure protocol for conduct implicating federal health-program fraud laws, the escalation path when a lookback surfaces a real overpayment rather than a coding error.

https://www.gale.care/for-providers/eca-recoupment-lookback-limits · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers