US Audit Finds 160,918 Medicare Outpatient Drug Claims With Mismatched Billing Codes

WASHINGTON — A federal review of Medicare outpatient drug billing has identified 160,918 claim lines with procedure codes that did not match the drug codes recorded on the same claims, exposing weaknesses in automated checks and provider guidance. The findings, issued by the Department of Health and Human Services Office of Inspector General on 23 October 2026 and made public later that month, do not establish that all the claims were overpaid, fraudulent or medically unnecessary.

The inspector general examined claims for services dated 1 April 2024 through 31 March 2025. In the underlying review, providers submitted more than 10.5 million claim lines containing both a Healthcare Common Procedure Coding System (HCPCS) code and a National Drug Code (NDC). Of these, 160,918 lines, submitted by 2,944 providers, carried HCPCS codes that differed from those associated with the drug codes in the Centers for Medicare & Medicaid Services (CMS) crosswalk files. Medicare paid $27,589,634 for those lines. That sum is the value of payments associated with coding mismatches, not a calculated loss to taxpayers.

The mismatches were concentrated. Six procedure codes accounted for 62% of the identified lines; critical access hospitals and short-term acute-care hospitals together accounted for 99%. One short-term acute-care hospital submitted 7% of the mismatched lines. These concentrations may help auditors prioritize follow-up, but do not by themselves demonstrate deliberate misconduct by any provider.

Auditors found two potential oversight vulnerabilities. CMS and its Medicare Administrative Contractors did not have system edits designed to ensure that the procedure code billed for an outpatient drug matched the code linked to its NDC in the agency's crosswalk. Their provider education also did not address this specific matching requirement. The distinction matters because a drug's NDC identifies the product while the HCPCS code determines how it is described for reimbursement; a mismatch can be an administrative mistake, a coding problem or a payment issue requiring further examination.

The OIG separately examined a nonstatistical sample of 30 claim lines. Providers had used incorrect procedure codes on 24. Eleven of those 24 were paid through the outpatient prospective payment system, with a calculated net improper-payment effect of $1,304; the other 13 were paid through systems where the coding errors did not alter the amount paid. The auditors did not extrapolate this small sample to the entire population. In the remaining six sampled lines, three had the correct codes and three had a correct procedure code paired with an incorrect drug code.

CMS publishes quarterly Part B drug payment files and NDC-HCPCS crosswalks. The crosswalk helps identify which billing procedure code corresponds to a given drug product. But a coding mismatch is not in itself a finding that a patient did not receive treatment or that the claim was ineligible for payment.

The inspector general made no formal recommendations in this data brief. Independent reporting by The Digital Free Press obtained a clarification from an OIG public-affairs official confirming the two vulnerabilities. It reported that CMS did not respond to its request for comment by publication time; the OIG report said CMS had supplied technical comments on the draft. No subsequent corrective-action outcome was established in the sources reviewed.

For public spending oversight, the unanswered question is whether CMS and its contractors can distinguish harmless coding discrepancies from payments requiring correction without imposing unjustified denials on providers. The published review identifies a testable control gap, but it does not calculate the nationwide amount of money improperly paid.