Medicare Drug Claims Met a Code Check With No Guard at the Door
Medicare claims can encounter many checks on their way through the system. One relevant check, it turns out, was missing: a system edit to verify that the procedure code billed alongside a drug matched the codes associated with that drug in CMS crosswalk files. The HHS Office of Inspector General has now put that gap on paper, where it sits with the stillness of a form that knows it has been noticed.
OIG reviewed Medicare Part B outpatient drug claims from April 1, 2024, through March 31, 2025. It identified 160,918 claim lines with procedure-code and drug-code mismatches when compared with the CMS crosswalk files. A mismatch is a flag for review, not proof that a provider used the wrong code or that Medicare paid incorrectly. The crosswalk is a reference; the finding says the codes did not line up with it.
Medicare paid $27.6 million for those claim lines. That figure needs its own guardrail: OIG did not determine whether the mismatches caused overpayments or underpayments across the 160,918 lines. So this is not a report establishing $27.6 million in losses, recoverable money, or improper payments. It is the amount paid on claims that met the report’s mismatch criteria. The number is large; the conclusion is narrower.
OIG also examined a nonstatistical sample of 30 claim lines. In that sample, it found incorrect procedure codes on 24 lines. Eleven of those 24 were paid under a system in which the errors could have resulted in improper payments. Those are sample findings, not a projection about all 160,918 lines. The sample shows why the mismatch deserved scrutiny; it does not calculate the overall financial effect.
The report identifies two control weaknesses. CMS and its contractors lacked system edits to check the relevant code matches, and provider education did not specifically address those mismatches. In bureaucratic terms, the paperwork could identify a pairing worth checking, but the routine gate did not perform that check—and the guidance did not put the issue plainly in front of providers. The filing coughed; the controls remained seated.
For patients and taxpayers, the useful takeaway is not that every flagged claim was wrong. It is that a national oversight system had an identified code-matching risk without a specific automated check or targeted education, while the report could not establish the payment impact across the full set. That distinction matters. Accountability begins with finding the missing check, then measuring what it actually allowed through—not turning a flagged total into a verdict the audit did not reach.