How far back can an insurer claw back?
When an insurer or its auditor asks for years of progress notes and then for money back, the first question is how far back it is allowed to go. Most states put a time limit on recouping a paid claim. The exceptions decide most real cases, so they're listed for every state.
Read this first. This is legal information, not legal advice. For a large demand or anything that mentions fraud, talk to a healthcare attorney before you answer.
- Self-funded employer plans usually aren't covered. State insurance law generally doesn't reach plans an employer funds itself (ERISA), even when BCBS, UnitedHealthcare, Aetna or Cigna runs them. Some statutes say so outright (Massachusetts and New York among those checked). Ask the payer in writing whether each audited claim was under a fully insured plan.
- Medicare, Medicaid, federal employee (FEHB) and TRICARE claims follow their own rules, not these.
- Fraud is an exception almost everywhere, and audits are often opened as "waste, fraud and abuse" reviews. What the payer must show differs: Illinois needs a formal finding by a court, agency or arbitrator; New York a reasonable belief; most states just say "fraud".
- Some states also exempt coding or documentation problems, which is what a note audit alleges: Maryland (improperly coded), Connecticut (billing not supported by the documentation), New Jersey (a pattern of inappropriate billing), New York (abusive billing).
- Your contract matters. Some states let the contract set a shorter period (Colorado) or require a 12-month term in it (Minnesota); Virginia lets provider and carrier agree to later offsets.
Changing from 2027
- Connecticut: 12 months instead of 18 from 1 January 2027 (PA 26-56), extended to other insurers.
- Washington: 6 months for mental health and substance use disorder services from 1 January 2027 (2025 c 227); 24 months for other services.
- Oregon: HB 4028 (2026) would set behavioral-health audit rules, including no recoupment for clerical errors; passed the House 41–1, final outcome not confirmed.
- Ohio: SB 162 would shorten 2 years to 1; status not confirmed.
- New York: A3365 would shorten 24 months to 12; status not confirmed. Pennsylvania has no statutory limit; a 12-month bill has been introduced.
Got a letter or a records request? Tell us what happened (no client details): a 10-minute form. Or ask for help with a response plan; we're testing a done-for-you checklist and cover-letter draft built from the auditor's letter, with client details removed.
State by state
Alabama
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 12 months (or the contract's claim-filing period if shorter)
- Counted from
- initial claim payment
- Exceptions
- fraud; coordination of benefits (18 months); duplicate payments
- Statute
- Ala. Code § 27-1-17(e)-(g)
- Also
- notice must give the reason; adjustments for medical necessity, level of service or coding must be reconciled to specific claims; provider may dispute within 30 days and then has 6 months to file a revised claim; FindLaw current as of 2024-12-30
Alaska
Not checked yet: from a November 2025 survey of state laws
- Limit
- 365 days
- Counted from
- original payment
- Exceptions
- fraud or other intentional misconduct (clear and documented reason)
- Statute
- 3 AAC 26.110
- Also
- regulation
Arizona
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 1 year
- Counted from
- insurer paid or denied the claim
- Exceptions
- fraud
- Statute
- A.R.S. § 20-3102(J)
- Also
- same period applies to provider adjustments; contract may set an equal period for both
Arkansas
Sources disagree; not resolved yet (source, 2026-10-17)
- Limit
- unresolved (survey: 18 months; FindLaw page: 120-day notice for verification errors)
- Counted from
- insurer paid the claim
- Exceptions
- fraud by the provider
- Statute
- Ark. Code § 23-63-1803
- Also
- written notice of intent to recoup required; recheck on arkleg.state.ar.us
California
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 365 days (written request)
- Counted from
- date of payment
- Exceptions
- fraud or misrepresentation by the provider
- Statute
- Cal. Ins. Code § 10133.66(b)
- Also
- notice must identify claim, patient, date of service and the reason; covers health insurers under the Insurance Code; Knox-Keene plans (most HMOs, Blue Shield) have their own rule, not checked; FindLaw current as of 2026-01-01
Colorado
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 12 months (contract may set less)
- Counted from
- original explanation of benefits
- Exceptions
- carrier reported provider fraud or abuse; risk-sharing reconciliation; COB with federal plans (36 months from service)
- Statute
- C.R.S. § 10-16-704(4.5)
- Also
- applies to contracted (ceiling) and non-contracted providers; FindLaw current as of 2025-01-01
Connecticut
From a secondary source; statute text not checked yet (source, 2026-10-17)
- Limit
- 18 months (administrative or eligibility error)
- Counted from
- receipt of a clean claim
- Exceptions
- fraud; billing not supported by documentation; duplicate payment; government program; COB
- Statute
- Conn. Gen. Stat. § 38a-479b
- Changing
- 12 months from 2027-01-01 (PA 26-56; also extends to other insurers)
- Also
- limit covers administrative/eligibility errors only; 'did not bill appropriately based on the documentation' is an exception, which is what a note audit alleges
Delaware
Not checked yet: from a November 2025 survey of state laws
- Limit
- 12 months
- Counted from
- original payment
- Exceptions
- none stated in the text we read
- Statute
- 18 Del. C. § 2730
- Also
- initiated = first audit report or similar communication
District of Columbia
Not checked yet: from a November 2025 survey of state laws
- Limit
- 6 months (18 for coordination of benefits)
- Counted from
- insurer paid the provider
- Exceptions
- none stated in the text we read
- Statute
- D.C. Code § 31-3133
Florida
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 30 months
- Counted from
- insurer's payment of the claim
- Exceptions
- providers convicted of fraud (s. 817.234)
- Statute
- Fla. Stat. § 627.6131(6)
- Also
- provider must pay, deny or contest within 40 days; written notice within 35 days if contesting; 2025 statutes
Georgia
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- sooner of 18 months after submission or 24 months after service
- Counted from
- claimant's initial submission / date of service
- Exceptions
- precertified claims generally can't be reopened
- Statute
- O.C.G.A. § 33-20A-62(b)
- Also
- prior written notice naming the claim and reason, no later than 12 months after first submission; FindLaw current as of 2024-03-28
Hawaii
Not checked yet: from a November 2025 survey of state laws
- Limit
- 18 months (72 for fraud or material misrepresentation)
- Counted from
- initial claim payment received
- Exceptions
- self-insured employer groups; national networks; federal programs; COB
- Statute
- HRS § 431:13-108
Idaho
No limit found yet; not researched
Illinois
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 12 months
- Counted from
- original payment
- Exceptions
- formal finding of fraud or material misrepresentation by a court, agency, tribunal or arbitrator; CHIP administration; paid in full by another payer; federal Medicaid requirement
- Statute
- 215 ILCS 5/368d(c)
- Also
- contracts can't override it; the last sentence of (c) still says '18-month', operative text says 12; FindLaw current as of 2025-01-01
Indiana
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 2 years
- Counted from
- overpayment made
- Exceptions
- fraud by the provider, the insured or the insurer
- Statute
- Ind. Code § 27-8-5.7-10
- Also
- FindLaw current as of 2026-01-01
Iowa
Not checked yet: from a November 2025 survey of state laws
- Limit
- 2 years (audit)
- Counted from
- submission of the claim
- Exceptions
- reasonable basis to suspect fraud
- Statute
- 191 IAC 15.33
- Also
- limits audits; records requests still allowed
Kansas
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 18 months
- Counted from
- end of the month of the erroneous payment
- Exceptions
- fraud (general statute of limitations applies)
- Statute
- K.S.A. 40-2442(f)
- Also
- FindLaw current as of 2025-01-01
Kentucky
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 24 months
- Counted from
- insurer paid the claim
- Exceptions
- fraud
- Statute
- KRS § 304.17A-708
- Also
- written or electronic statement of the basis required; FindLaw current as of 2025-01-01
Louisiana
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 18 months
- Counted from
- initial claim paid
- Exceptions
- Office of Group Benefits (state employees) not covered
- Statute
- La. R.S. 22:1838(F)
- Also
- services rendered in good faith; FindLaw current as of 2023-01-01
Maine
No limit found yet; not researched
Maryland
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 6 months (18 for coordination of benefits)
- Counted from
- carrier paid the provider
- Exceptions
- fraud; improperly coded (if coding guidelines were given 30+ days before the service); duplicates; Medicaid capitation withdrawal
- Statute
- Md. Ins. Code § 15-1008(c),(e)
- Also
- written statement of the basis required; 'improperly coded' exception matters for 90837 audits; FindLaw current as of 2025-01-01
Massachusetts
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 12 months (behavioral health claims)
- Counted from
- provider submitted the claim
- Exceptions
- fraud; legal action; already paid; services not delivered
- Statute
- Ch. 41 of the Acts of 2019 (c. 175 § 108; c. 176A § 8A¾; c. 176B § 7D; c. 176G § 6B)
- Also
- within 12 months: written reason and 30 days to respond; not self-insured, Medicare or federal plans
Michigan
No limit found yet; not researched
Minnesota
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 12 months (required contract term)
- Counted from
- clean claim paid
- Exceptions
- coordination of benefits; subrogation; duplicate claims; retroactive terminations; fraud and abuse
- Statute
- Minn. Stat. § 62Q.75 subd. 4
- Also
- since 2010; SF 3214 (2025–26) would change it, status unknown
Mississippi
No limit found yet; not researched
Missouri
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 12 months
- Counted from
- health carrier paid the claim
- Exceptions
- fraud or misrepresentation
- Statute
- RSMo § 376.384.1(3)
- Also
- FindLaw current as of 2025-01-01
Montana
Not checked yet: from a November 2025 survey of state laws
- Limit
- 12 months (if the issuer sets no claim-filing deadline)
- Counted from
- payment
- Exceptions
- none stated in the text we read
- Statute
- MCA § 33-22-150
Nebraska
Not checked yet: from a November 2025 survey of state laws
- Limit
- 6 months (notice)
- Counted from
- date of the error
- Exceptions
- none stated in the text we read
- Statute
- 210 NAC ch. 60 § 011
- Also
- regulation
Nevada
No limit found yet; not researched
New Hampshire
Not checked yet: from a November 2025 survey of state laws
- Limit
- 12 months
- Counted from
- date of payment
- Exceptions
- none stated in the text we read
- Statute
- RSA 420-J:8-b
- Also
- written reason required
New Jersey
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 18 months
- Counted from
- first payment on the claim
- Exceptions
- fraud; pattern of inappropriate billing; COB
- Statute
- N.J. Stat. § 17B:27-44.2(d)(10)
- Also
- no collection before the 45th day after the request or while a timely appeal is pending; FindLaw current as of 2024-01-01 and flags a version effective 2025-01-01, so recheck
New Mexico
No limit found yet; not researched
New York
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 24 months
- Counted from
- original payment received by the provider
- Exceptions
- reasonable belief of fraud, intentional misconduct or abusive billing; self-insured plans; government programs and public-employee coverage
- Statute
- N.Y. Ins. Law § 3224-b(b)
- Changing
- A3365 (2025) would cut to 12 months, status unknown
- Also
- 30 days' written notice before recovery (except duplicates); text revised 2014-09-22
North Carolina
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 2 years
- Counted from
- original claim payment
- Exceptions
- reasonable belief of fraud or other intentional misconduct; same service paid by a government payor
- Statute
- N.C. Gen. Stat. § 58-3-225(h)
- Also
- 30 calendar days' written notice identifying the claim and reason; FindLaw copy current as of 2023-01-01 (ncleg.gov blocks automated access)
North Dakota
No limit found yet; not researched
Ohio
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- 2 years
- Counted from
- payment made to the provider
- Exceptions
- none stated in the text we read
- Statute
- Ohio Rev. Code § 3901.388(B)
- Changing
- SB 162 (2025–26) would cut to 1 year, status to confirm
- Also
- written notice with claim details; provider may appeal within 30 days; FindLaw current as of 2026-01-01 (codes.ohio.gov unreachable from here)
Oklahoma
Not checked yet: from a November 2025 survey of state laws
- Limit
- 18 months
- Counted from
- payment made
- Exceptions
- fraud; provider agreed to refund
- Statute
- 36 Okla. Stat. § 1250.5
Oregon
No limit found yet; not researched
- Changing
- HB 4028 (2026): behavioral-health audit rules incl. no recoupment for clerical errors; passed House 41-1, Senate outcome not found
Pennsylvania
From a secondary source; statute text not checked yet (source, 2026-10-17)
- Limit
- no statutory limit
- Exceptions
- none stated in the text we read
- Statute
- none found
- Changing
- Sen. Argall bill for a 12-month limit (status unknown)
- Also
- contract terms govern
Rhode Island
No limit found yet; not researched
South Carolina
Not checked yet: from a November 2025 survey of state laws
- Limit
- 18 months
- Counted from
- initial payment received
- Exceptions
- fraud or intentional misconduct; self-insured plans; government programs
- Statute
- S.C. Code § 38-59-250
South Dakota
No limit found yet; not researched
Tennessee
Sources disagree; not resolved yet (source, 2026-10-17)
- Limit
- unresolved: 15 months (18 for state employee plans) in FindLaw's copy; the 2025 survey quotes 18 months
- Counted from
- entity paid the claim
- Exceptions
- fraud or suspected fraud by the provider; tolling by agreement
- Statute
- Tenn. Code § 56-7-110(c)
- Also
- FindLaw current as of 2024-01-02; the survey may reflect a later amendment; recheck the official code
Texas
Checked against FindLaw's copy of the statute (source, 2026-10-17)
- Limit
- written notice within 180 days
- Counted from
- provider receives the payment
- Exceptions
- none stated in the text we read
- Statute
- Tex. Ins. Code § 1301.132
- Also
- PPO plans (ch. 1301); provider may arrange repayment within 45 days or appeal, and no recovery until appeal rights are exhausted; HMOs under ch. 843 not checked; FindLaw current as of 2026-01-01
Utah
Not checked yet: from a November 2025 survey of state laws
- Limit
- 12 months (24 for COB; 36 for Medicaid/Medicare recovery)
- Counted from
- amount improperly paid
- Exceptions
- none stated in the text we read
- Statute
- Utah Code § 31A-26-301.6(14)
Vermont
Not checked yet: from a November 2025 survey of state laws
- Limit
- 12 months
- Counted from
- date of payment
- Exceptions
- fraud or intentional misconduct; already paid; services not delivered; COB; legal action
- Statute
- 18 V.S.A. § 9418
Virginia
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 12 months
- Counted from
- payment of the original claim
- Exceptions
- fraud; already paid; services not delivered
- Statute
- Va. Code § 38.2-3407.15(B)(8)
- Also
- 30 days' notice; contract may allow offset later
Washington
Checked against the statute on the state's official site (source, 2026-10-17)
- Limit
- 24 months
- Counted from
- payment made
- Exceptions
- fraud
- Statute
- RCW 48.43.600(1)
- Changing
- 6 months for mental health and SUD services from 2027-01-01 (2025 c 227)
- Also
- provider must contest in writing within 30 days or the request is deemed accepted
West Virginia
Not checked yet: from a November 2025 survey of state laws
- Limit
- 1 year (some reasons: no limit)
- Counted from
- date originally paid
- Exceptions
- none stated in the text we read
- Statute
- W. Va. Code § 33-45-2
Wisconsin
No limit found yet; not researched
Wyoming
Not checked yet: from a November 2025 survey of state laws
- Limit
- 2 years
- Counted from
- claim paid
- Exceptions
- fraud
- Statute
- Wyo. Stat. § 26-15-137
How this was made
We started from a November 2025 survey of state lookback laws (PDF) and are checking every row against the statute text: the state's official code site where it can be read, otherwise FindLaw's copy, whose "current as of" date is in each row. So far 7 rows are checked on official sites, 15 on FindLaw, 2 come from secondary sources, 14 are still the survey's text, 2 has sources that disagree, and 11 states have no limit found yet. Where a source disagrees with the survey (Arkansas, Tennessee), the row says so until the current official text is read.
Counts: 39 of 51 entries show some limit in the sources read so far; Pennsylvania has none.
How it's made. AI agents read the statutes and built this table; every row links to the text it was checked against, and rows not yet checked say so. Spotted an error or a newer law? Reply through the form.