OIG finds 160,918 Medicare drug claim lines billed with HCPCS codes that didn't match the NDC crosswalk

On October 28, 2026, the HHS Office of Inspector General posted a data brief on how hospitals and other providers bill Medicare Part B for outpatient drugs. The brief, report number OAS-25-09-090, is dated October 23, 2026. OIG looked for drug lines where the HCPCS code on the claim didn't match the HCPCS code that the NDC/HCPCS crosswalk files pair with the National Drug Code (NDC) reported on the same line.

It found 160,918 of them. In a small sample, most turned out to be billed with the wrong HCPCS code.

How the crosswalk is supposed to work

Providers report HCPCS codes on outpatient claim lines to identify the drugs they gave. An NDC is the number the Food and Drug Administration assigns to identify a drug, including its strength, manufacturer, and package size. FDA says it assigns 10-digit NDCs in its current formats through March 6, 2033; claims use the separate HIPAA-standard 11-digit format for reimbursement. CMS maintains NDC/HCPCS crosswalk files for Part B drugs, and OIG says providers use them to select the HCPCS code that goes with the drug's NDC.

OIG notes that Medicare doesn't require an NDC on the claim line unless the patient is dually eligible for Medicare and Medicaid or a specific program requirement applies. Payment can still turn on the HCPCS code. CMS officials told OIG that billing the wrong HCPCS code could significantly affect payment for providers paid under the hospital outpatient prospective payment system (OPPS), but not for providers such as critical access hospitals that are paid under other systems.

What OIG found in the claims data

OIG started with about 10.5 million Part B outpatient drug lines that carried both a HCPCS code and an NDC, with dates of service from April 1, 2024 through March 31, 2025. Medicare paid $17.3 billion for those lines. OIG matched them against both CMS's Part B crosswalk files and the crosswalk files from the Pricing, Data Analysis, and Coding (PDAC) contractor.

Six HCPCS codes accounted for 62 percent of the mismatched lines. One short-term acute-care hospital billed 7 percent of them, but OIG says it was paid under the Maryland All-Payer Model, so the wrong code wouldn't have caused an improper payment there.

OIG is careful about what the 160,918 number means. It says it didn't determine whether any of those lines were overpaid or underpaid, so the figure counts mismatches, not confirmed improper payments.

What the sample showed

OIG picked 30 lines, one each from 30 of the most frequently billed HCPCS codes in the mismatch set, split between 15 providers paid under the OPPS and 15 paid under other systems. It reviewed the providers' documentation and confirmed its results with them.

• On 24 lines, providers used the wrong HCPCS code
• On 3 lines, the HCPCS code was right but the NDC was wrong
• On 3 lines, both the HCPCS code and the NDC were right

Eleven of the 24 wrong-code lines were paid under the OPPS. OIG calculated net improper payments of $1,304 on those lines, a figure that includes both overpayments and underpayments. The other 13 were paid under other systems, so OIG says the wrong code didn't cause an improper payment. OIG asked the providers to correct the 24 lines, and 7 had been adjusted by the time the brief was issued.

OIG gives one example. A provider gave a 120-milligram injection of lanreotide and billed HCPCS code J1930, but the medical record showed a version of the drug that maps to HCPCS code J1932. OIG says the Medicare Administrative Contractor (MAC) paid $4,701 when it should have paid $3,462, an overpayment of $1,239.

Why providers said it happened

Providers told OIG the errors came from clerical mistakes and from billing systems that couldn't prevent or catch the wrong code. One provider said it didn't know the NDC associated with a HCPCS code had changed, so it never updated its billing system. Some providers said they chose the HCPCS code by the drug labeler's name in the code description, rather than by the code the crosswalk pairs with the NDC.

Where OIG says oversight fell short

OIG names two weak spots in CMS and MAC oversight:

• No matching edits. CMS and some MACs had edits checking that lines billed with certain HCPCS codes carried a valid NDC, but there were no edits making sure the HCPCS code matched the crosswalk code for that NDC. OIG adds that lines billed without an NDC may be able to bypass edits.
• Education gaps. CMS and MAC materials covered other drug billing topics, such as reporting unused and discarded amounts from single-dose containers and how NDCs are reported on a claim line, but didn't go into detail about matching the HCPCS code to the NDC in the crosswalk.

The brief makes no specific recommendations to CMS. OIG says the information may help CMS and the MACs strengthen future oversight. It isn't a new billing rule, and it doesn't change any code. CMS posts the current NDC-HCPCS crosswalk files, including the October 2026 crosswalk, on its ASP Pricing Files page.