HHS Inspector General Finds Medicare Drug-Billing Safeguards Gap

Medicare paid $27.6 million for outpatient drug claim lines whose billing codes did not match the codes in federal crosswalk files, according to a data brief from the Department of Health and Human Services Office of Inspector General that was posted Wednesday.

The report, number OAS-25-09-090, is dated Oct. 23, 2026. It found that the Centers for Medicare & Medicaid Services (CMS) and its contractors had no system checks to confirm that the procedure codes providers billed for certain outpatient drugs matched the codes associated with those drugs in federal crosswalk files.

The inspector general's office made no recommendations to CMS. It also did not estimate how much of the $27.6 million, if any, was paid improperly.

What the Inspector General Found in Medicare Drug Billing

The review covered Medicare Part B outpatient claims with dates of service from April 1, 2024, through March 31, 2025. On these claims, providers list a procedure code, known as a HCPCS code, and sometimes a National Drug Code (NDC) that identifies the specific product. CMS publishes crosswalk files that match each drug code to the procedure code providers should bill.

The inspector general's office analyzed about 10.5 million claim lines and identified 160,918 lines, billed by 2,944 providers under 577 procedure codes, where the procedure code did not match the one associated with the drug code in the crosswalk files. Medicare paid $27,589,634 for those lines, the report says.

Of that total, $21.7 million went to 33,617 claim lines paid under the hospital outpatient prospective payment system. The other $5.9 million covered 127,301 lines paid under different systems, such as the reasonable-cost basis used for critical access hospitals.

The report states that the office "did not determine whether any overpayments or underpayments occurred for these claim lines."

According to the report, six procedure codes accounted for 62 percent of the mismatched lines. Critical access hospitals and short-term acute-care hospitals billed 99 percent of them, and a single short-term acute-care hospital billed 7 percent.

A 30-Line Sample and $1,304 in Net Improper Payments

The inspector general's office then reviewed a nonstatistical sample of 30 claim lines, one from each of the 30 most frequently billed procedure codes in the mismatched group.

Providers used incorrect procedure codes on 24 of the 30 lines, the report found. Eleven of those 24 were paid under the outpatient prospective payment system, which "could have resulted in calculated net improper payments of $1,304." That figure combines overpayments and underpayments, according to the report. The other 13 lines were paid under different payment systems, so the incorrect codes did not change what those providers received.

Of the remaining six sampled lines, providers billed correct procedure codes and drug codes on three. On the other three, they billed the correct procedure code but listed the wrong drug code.

Providers blamed the incorrect billing on "clerical errors and billing system issues," the report says. Because the sample was not statistical, the office did not project its results to the full 160,918 lines.

Two Potential Vulnerabilities

The report identifies two "potential vulnerabilities" in oversight by CMS and the seven Medicare Administrative Contractors that processed Part B claims during the review period. First, they "did not have system edits to ensure that providers used the correct HCPCS code when billing for outpatient drugs," meaning no edits checked that the billed codes matched those associated with the drugs' NDCs in the crosswalk files. Second, their provider education "did not address billing for drugs using HCPCS codes that match those associated with the drugs' NDC(s)."

The report does not describe the findings as fraud or waste.

"This data brief does not contain any specific recommendations to CMS," the report states. "However, information in this data brief may help CMS and the MACs strengthen future oversight to ensure that providers correctly bill for outpatient drugs and protect taxpayer dollars."

How CMS Responded

The report includes no formal written response from CMS. It says the inspector general's office "issued a draft of this data brief to CMS. CMS furnished technical comments, which we addressed as appropriate."

Asked for comment, Zion Miller, a public affairs specialist with the HHS Office of Inspector General, offered one clarification to how The Digital Free Press summarized the report's two vulnerabilities: "OIG identified two potential vulnerabilities: no system edits to ensure billed correct HCPCS codes for outpatient drugs matched those associated with the NDCs in the NDC/HCPCS crosswalk files, and provider education that did not address HCPCS/NDC matching." Miller added: "There are no additional edits. Furthermore, I have no additional information to share with you regarding work on this specific topic."

CMS did not respond to a request for comment by publication time.

The Digital Free Press will update this story with any response.

Cover photo: The Hubert H. Humphrey Building, headquarters of the Department of Health and Human Services in Washington. Photo by Carol M. Highsmith, Library of Congress (public domain).

Sources: HHS Office of Inspector General, "Potential Vulnerabilities in CMS's Oversight of Medicare Providers' Billing of Selected Outpatient Drugs," data brief OAS-25-09-090, issued Oct. 23, 2026, posted Oct. 28, 2026 (report page: https://oig.hhs.gov/reports/all/2026/potential-vulnerabilities-in-cmss-oversight-of-medicare-providers-billing-of-selected-outpatient-drugs/ ; full report PDF: https://oig.hhs.gov/documents/audit/11961/OAS-25-09-090.pdf).