How CMS Identifies Outlier Providers in 2026: Check Your Own Billing Data Before an Auditor Does

In Medicare program integrity, an "outlier" is a provider whose billing patterns differ significantly from those of similar providers. Being an outlier is not proof of wrongdoing. Many outliers have legitimate explanations, such as a specialized patient population, a unique service mix, or a new service line. But outlier status is one of the most common reasons a provider is selected for medical review, targeted probe and educate, pre-payment review, payment suspension, or further investigation.

In 2026, the tools used to identify outliers are more powerful than ever. The Centers for Medicare & Medicaid Services (CMS) uses its Fraud Prevention System, its Fraud Defense Operations Center, artificial intelligence and machine learning, and linked Medicare and Medicaid data to spot unusual billing in near real time. The Department of Justice has also gained access to CMS's data environment for advanced analytics, and has described prosecutions that began when its data analytics team identified a provider as a statistical extreme compared with peers.

The good news is that providers can use many of the same concepts to review their own data. CMS offers comparative tools such as the Program for Evaluating Payment Patterns Electronic Report (PEPPER), which CMS is relaunching for all Medicare facility types in 2026, and Comparative Billing Reports (CBRs). This article explains how CMS identifies outlier providers, what kinds of patterns attract attention, which tools providers can use, and how to build an internal process to check your billing data before an auditor does.

What Makes a Provider an Outlier?

An outlier is generally a provider whose billing for a particular service, code, or patient population falls far outside the range of a well-defined peer group. Peer groups are typically defined by factors such as specialty, provider type, geographic area, and patient characteristics.

Common outlier measures include:

• Volume of a specific service or code per beneficiary.

• Percentage of claims using high-level codes, such as the highest evaluation and management levels.

• Average payment per beneficiary or per claim.

• Length of stay or length of service, such as hospice length of stay.

• Frequency of services that are normally provided once or rarely.

• Growth in billing over a short period.

• Concentration of referrals from a small number of ordering practitioners.

How CMS and Its Contractors Identify Outliers

Contractor Data Analysis

The Medicare Program Integrity Manual, Chapter 2, describes data analysis as an essential first step in determining whether patterns of claims submissions and payments indicate potential problems. The manual states that data analysis should include identification of statistical outliers in billing patterns within a well-defined group, as well as more sophisticated detection of patterns that might suggest improper billing or payment.

The manual also instructs Medicare Administrative Contractors (MACs) to maintain at least 18 months of data, and encourages 36 months, and to compare at minimum the current six-month period with the previous six-month period to detect changes in billing patterns and identify trends in new services. Importantly, it also directs contractors to identify high-volume or high-cost services that are widely overutilized, noting that these services may not appear as outliers but can pose the greatest financial risk.

Data sources listed in the manual include CMS's Integrated Data Repository and related reports, comparative utilization reports by code and specialty, PEPPER, Comparative Billing Reports, cost reports, enrollment data, and complaint information.

The Fraud Prevention System

CMS operates the Fraud Prevention System (FPS), which CMS describes as using hundreds of models to monitor provider and supplier outlier billing, along with automated edits that proactively deny inappropriate billing. In March 2026 congressional testimony, CMS explained that the FPS uses advanced data analytics and predictive modeling to identify aberrant billing patterns in real time.

The Fraud Defense Operations Center

CMS launched the Fraud Defense Operations Center (FDOC) in March 2025 and later made it permanent. CMS describes it as a cross-functional team of data analysts, investigators, policy experts, legal advisors, and law enforcement that uses data-driven intelligence to detect threats in real time and stop inappropriate billing before claims are paid. CMS reported that FDOC efforts resulted in more than $1.8 billion in suspended payments in 2025 and more than $371 million in the first half of 2026, with major focus areas including durable medical equipment, skin substitutes, laboratories, and hospice.

Linked Data and Artificial Intelligence

CMS has explained that it links Medicare and Medicaid claims data, provider ownership information, pharmacy records, and external data sources to identify patterns that might otherwise go undetected, and that artificial intelligence and machine learning tools improve anomaly detection. CMS's Advanced Provider Screening system also monitors enrollment-related information such as licensure and criminal history.

Law Enforcement Analytics

The Department of Justice's Health Care Fraud Section works with dedicated data analysts to identify cases. In 2026, DOJ announced an agreement under which its Fraud Division receives cloud computing space in the CMS Integrated Data Repository environment to deploy advanced analytics and artificial intelligence tools. DOJ has also described a case in which its Data Analytics Team identified a physician as a statistical extreme, having been paid more by Medicare for a particular injectable drug than any other physician in the country, roughly six times the next-highest provider group.

HHS-OIG also uses data analytics in its audits, evaluations, and investigations, and the Health Care Fraud Data Fusion Center brings together analysts from DOJ, HHS-OIG, the FBI, and other agencies.

Beneficiary Complaints

Data is not the only source. CMS reported that 1-800-MEDICARE received fraud-related complaints from more than 307,000 beneficiaries in 2025. CMS has also sent outreach letters to providers that received a significant number of beneficiary complaints.

Patterns That Commonly Attract Attention

CMS does not publish its models, but its published examples and manual instructions point to patterns that commonly lead to review:

• Rapid growth. A sudden increase in claims or payments, especially from a newly enrolled or previously inactive provider.

• Billing beyond capacity. Claims that exceed what the provider's staff, equipment, or hours could realistically support.

• Extreme service intensity. Unusually high service volume for individual beneficiaries.

• Services inconsistent with diagnoses. Tests or treatments that do not match beneficiaries' documented conditions.

• Repeated once-in-a-lifetime services. Repetition of tests or items normally provided only once.

• High-level coding. A distribution of codes skewed toward the highest-paying levels compared with peers.

• Unusual length of service. For example, long hospice lengths of stay or high live discharge rates.

• Geographic anomalies. Beneficiaries located far from the provider's service area.

• Concentrated ordering. A large share of orders from a few practitioners, especially those without an established relationship with the patients.

• Services to deceased or hospitalized beneficiaries. Claims for dates when beneficiaries could not have received the service.

What Happens When You Are Identified as an Outlier

Outlier status typically leads to one or more of the following:

• Education. CMS may send educational letters or Comparative Billing Reports. CMS has reported using outreach letters to outlier providers, including a skin substitute letter campaign that resulted in substantial decreases in suspect claims.

• Targeted Probe and Educate. MACs review a sample of claims, provide education, and may repeat the review if errors continue.

• Additional Documentation Requests. Contractors request medical records to support specific claims.

• Pre-payment review. Claims are reviewed before payment.

• Post-payment review and overpayment determinations. Contractors such as Recovery Audit Contractors or Unified Program Integrity Contractors (UPICs) may review paid claims and, in certain circumstances, use statistical sampling to estimate overpayments.

• Payment suspension. CMS may suspend payments under 42 CFR 405.371.

• Revocation. A pattern of claims that fail to meet Medicare requirements can support revocation under 42 CFR 424.535(a)(8).

• Referral to law enforcement. CMS reported that law enforcement accepted 372 CMS fraud referrals in 2025.

Tools Providers Can Use to Check Their Own Data

PEPPER

PEPPER provides provider-specific Medicare data statistics for target areas that may be at risk for improper payments, compared with other providers in the nation, the MAC jurisdiction, and the state. CMS states that facilities can use PEPPER to identify areas where they need to modify billing practices, pinpoint areas requiring auditing and monitoring, identify diagnosis-related groups at risk for under-coding or over-coding, and target areas where length of stay is increasing.

In 2026, CMS announced it would relaunch PEPPER for all Medicare facility types, including hospitals, post-acute care providers, and specialty facilities. CMS has released 2026 PEPPER reports for facility types including short-term acute care hospitals, critical access hospitals, long-term acute care hospitals, inpatient rehabilitation facilities, inpatient psychiatric facilities, home health agencies, and partial hospitalization programs.

Authorized officials, access managers, and staff end users can access PEPPER through the PEPPER Portal by signing in to the CMS Identity and Access Management System, requesting the PEPPER business function for their organization, and obtaining approval.

Comparative Billing Reports

CBRs provide data on Medicare billing trends so that providers can compare their billing practices with peers in the same state and across the nation. CMS describes CBRs as educational tools that explain Medicare coverage, coding, and billing rules and act as self-audit tools. CMS has stated that CBRs are in development, with an anticipated release in late 2026 or early 2027. The Comparative Billing Report business function can be requested through the same portal as PEPPER.

Public Medicare Data

CMS publishes a range of Medicare utilization and payment data on data.cms.gov. While public data is often aggregated and may lag, it can help providers understand general billing patterns in their specialty and region.

Your Own Claims and Remittance Data

The most important data source is your own. Practice management systems, billing systems, electronic health records, and remittance advice contain the information needed to build internal benchmarks and track trends.

Building an Internal Outlier Monitoring Program

Step 1: Define Your Peer Comparisons

Identify the specialty, provider type, and geographic area that best match your organization. Use PEPPER, CBRs, and public data where available, and recognize the limits of each comparison.

Step 2: Choose Key Metrics

Select metrics relevant to your services, such as:

• Top codes by volume and payment.

• Distribution of evaluation and management levels.

• Services per beneficiary and per encounter.

• Average length of stay or episode.

• Denial rates and reasons.

• Share of orders by referring practitioner.

• Beneficiary geography.

• Month-over-month and year-over-year growth.

Step 3: Compare Time Periods

Following the approach in the Program Integrity Manual, compare at least the current six months with the previous six months, and track longer trends using 18 to 36 months of data.

Step 4: Investigate Significant Differences

When a metric stands out, determine why. Possible explanations include:

• A specialized patient population, such as higher acuity patients.

• A new service line, location, or clinician.

• Changes in coding guidance or coverage policy.

• Documentation or coding errors.

• Inappropriate practices that need correction.

Step 5: Audit the Records Behind the Numbers

Data identifies questions, but medical records answer them. Conduct focused internal audits of claims in areas where you appear to be an outlier, checking medical necessity, orders, documentation, signatures, and coding accuracy.

Step 6: Document Legitimate Explanations

If your outlier status is legitimate, document the reasons with supporting data and records. A clear, documented explanation can be very helpful if a contractor asks questions later.

Step 7: Correct Problems and Return Overpayments

If the review identifies errors, correct the underlying process, retrain staff, and evaluate whether overpayments must be reported and returned under 42 CFR 401.305. CMS amended the rule effective January 1, 2025, to allow the 60-day deadline to be suspended for up to 180 days while a provider conducts a timely, good-faith investigation of related overpayments.

Step 8: Monitor Continuously

Make outlier monitoring a routine part of your compliance program, with regular reporting to leadership and the compliance committee.

Questions to Ask When Reviewing Your PEPPER or Comparative Data

When your organization receives a PEPPER or other comparative report, a structured review helps turn the data into action. Useful questions include:

• In which target areas does our organization fall at or above the 80th percentile compared with the nation, the MAC jurisdiction, or the state?

• Which target areas fall at or below the 20th percentile, which could indicate under-coding or missed documentation of services provided?

• How have our percentiles changed over the past several reporting periods, and what explains the trend?

• Do the target areas where we appear high align with known characteristics of our patient population or services?

• Have we audited a sample of claims in each high-percentile target area, and what did the audits show?

• Are there changes in staffing, physician relationships, documentation templates, or coding practices that coincide with changes in the data?

• Has the compliance committee reviewed the results and documented its conclusions and any corrective actions?

Answering these questions in writing creates a record showing that the organization reviewed its data, investigated outliers, and took appropriate action.

Example: Walking Through an Internal Outlier Review

The following hypothetical example illustrates how a provider might use its own data.

A home health agency reviews its 2025 PEPPER and its internal billing reports. It notices that its average number of periods of care per beneficiary is higher than most agencies in its state and that this metric has risen over the last three reporting periods.

The compliance officer forms a small review team, including a clinical manager and a billing specialist. The team pulls a random sample of beneficiaries with multiple periods of care and reviews the records for homebound status, the face-to-face encounter, the plan of care, physician or allowed practitioner certification, and visit documentation.

The review finds that most cases are well supported and involve patients with complex chronic conditions, which reflects the agency's partnership with a regional heart failure program. However, the team also finds several recertifications where documentation of continued homebound status is weak.

The agency documents the legitimate reason for its higher utilization, retrains clinicians on homebound documentation, updates its recertification checklist, and conducts a follow-up audit three months later. It also evaluates, with counsel, whether any claims involve overpayments that must be reported and returned.

If a contractor later asks about the agency's utilization, the agency can provide a clear explanation supported by data, audit results, and evidence of corrective action.

Special Considerations for High-Risk Service Areas

CMS and law enforcement have identified certain service areas as higher risk. Providers in these areas should monitor their data especially closely:

• Durable medical equipment, prosthetics, orthotics, and supplies.

• Clinical laboratories, including genetic and molecular testing.

• Wound care and skin substitutes.

• Hospice.

• Home health.

• Telehealth-enabled ordering.

• Behavioral health.

In these areas, even legitimate growth may attract attention, so documentation of the reasons for changes is especially valuable.

Who Should Be Involved in Data Review

Effective outlier monitoring is a team effort. Organizations commonly involve:

• The compliance officer, who leads the review and reports to leadership.

• Billing and coding staff, who understand how claims are built and submitted.

• Clinical leaders, who can explain whether patterns reflect patient needs.

• Finance staff, who can connect billing trends to revenue and operational changes.

• Data or information technology staff, who can extract and organize claims data.

• Legal counsel, when the review identifies potential overpayments or legal risk.

Assigning clear responsibilities and a regular review schedule, such as quarterly, helps make data review a routine part of operations rather than a reaction to an audit letter.

Common Mistakes in Self-Monitoring

• Looking only at denials and not at patterns in paid claims.

• Comparing against the wrong peer group.

• Ignoring high-volume services that are not statistical outliers but represent significant financial risk.

• Running reports without reviewing the underlying medical records.

• Identifying problems but failing to correct them or return overpayments.

• Failing to document legitimate explanations.

• Treating PEPPER or CBR data as a one-time exercise rather than an ongoing process.

Frequently Asked Questions

Does being an outlier mean I will be audited?

Not necessarily, but outlier status increases the likelihood of review. Many outliers have legitimate explanations, and documentation of those reasons is important.

What is PEPPER, and who can get it?

PEPPER is a free CMS report that provides provider-specific Medicare billing statistics compared with peers. In 2026, CMS is relaunching PEPPER for all Medicare facility types. Access is through the PEPPER Portal using CMS Identity and Access Management credentials.

When will Comparative Billing Reports be available again?

CMS has stated that CBRs are in development, with an anticipated release in late 2026 or early 2027.

Can high-volume services draw attention even if I am not an outlier?

Yes. CMS's Program Integrity Manual directs contractors to identify high-volume or high-cost services that are widely overutilized, because these may pose significant financial risk even when they do not appear as outliers.

What should I do if I find a problem in my data?

Investigate the cause, audit the related records, correct the process, and evaluate whether any overpayments must be reported and returned. For significant issues, consult legal counsel.

Conclusion

CMS and its partners identify outlier providers through a combination of contractor data analysis, the Fraud Prevention System, the Fraud Defense Operations Center, linked data, artificial intelligence, law enforcement analytics, and beneficiary complaints. In 2026, these tools are faster and more connected than ever, and outlier status can lead quickly to education, medical review, payment suspension, or further action.

Providers do not have to wait for an auditor to find patterns in their data. By using PEPPER, Comparative Billing Reports when available, public data, and their own claims data, providers can identify outlier patterns early, investigate the reasons, document legitimate explanations, correct problems, and return overpayments when required. A regular, well-documented self-monitoring process is one of the most effective ways to reduce audit risk.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in billing data analysis, compliance, and audit readiness. We help providers interpret PEPPER and comparative billing data, build internal outlier monitoring dashboards, conduct focused claims audits, document legitimate billing patterns, and strengthen documentation and coding practices. If you would like help reviewing your billing data before an auditor does, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 2. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c02.pdf

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for May 28, 2026 (PEPPER Relaunch for All Facility Types). https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-may-28-2026

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for June 18, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-june-18-2026

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for July 9, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-july-9-2026

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for August 6, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-august-6-2026

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for September 10, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-september-10-2026

• Centers for Medicare & Medicaid Services, Center for Program Integrity. Crushing Fraud: Annual Report 2025. https://www.cms.gov/files/document/crushing-fraud-annual-report.pdf

• Centers for Medicare & Medicaid Services. CMS Accomplishments, January 1 to December 31, 2025. https://www.cms.gov/files/document/cpi-data-dashboard-january-update.pdf

• Centers for Medicare & Medicaid Services. Fraud Defense Operations Center Fast Facts. https://www.cms.gov/files/document/fdoc-fact-sheet-updated.pdf

• Centers for Medicare & Medicaid Services. Crushing Fraud through the Fraud Defense Operations Center, Fast Facts (CY 2026 update). https://www.cms.gov/files/document/cpi-fdoc-fact-sheet-updated-first-year.pdf

• U.S. Department of Health and Human Services. CMS Testimony on Combatting Medicare and Medicaid Fraud (March 17, 2026). https://www.hhs.gov/about/agencies/asl/testimony/2026/03/17/cms-testimony-on-combatting-medicare-and-medicaid-fraud.html

• U.S. Department of Justice, Office of Public Affairs. National Health Care Fraud Takedown Results in 455 Defendants Charged in Connection with Over $6.5 Billion in Alleged Fraud (June 23, 2026). https://www.justice.gov/opa/pr/national-health-care-fraud-takedown-results-455-defendants-charged-connection-over-65

• U.S. Department of Justice, Office of Public Affairs. National Fraud Enforcement Division's Healthcare Fraud Unit Secures Six Trial Convictions Involving over $1.1 Billion in Fraud. https://www.justice.gov/opa/pr/national-fraud-enforcement-divisions-healthcare-fraud-unit-secures-six-trial-convictions

• U.S. Department of Justice, National Fraud Enforcement Division. Health Care Fraud Section. https://www.justice.gov/fraud/health-care-fraud-section

• Centers for Medicare & Medicaid Services. Data.CMS.gov. https://data.cms.gov/

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/section-401.305

• Electronic Code of Federal Regulations. 42 CFR 405.371, Suspension, Offset, and Recoupment of Medicare Payments. https://www.ecfr.gov/current/title-42/section-405.371

• Electronic Code of Federal Regulations. 42 CFR 424.535, Revocation of Enrollment in the Medicare Program. https://www.ecfr.gov/current/title-42/section-424.535

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/