PEPPER Reports Explained: Find Your Outlier Risk Areas Before an Auditor Does

Medicare contractors and federal oversight agencies increasingly rely on data analytics to decide which providers to review. They compare billing patterns across providers and look for organizations whose numbers stand out. The good news is that CMS gives many facility types a free report built on the same idea: the Program for Evaluating Payment Patterns Electronic Report, or PEPPER.

PEPPER shows a facility's own Medicare claims statistics for services that CMS considers vulnerable to improper payments and compares those statistics with other facilities nationally, in the same MAC jurisdiction, and in the same state. Used well, PEPPER helps providers spot outlier risk areas and audit them internally before a contractor or auditor does.

After a pause that began in 2023 and 2024, CMS relaunched PEPPER, starting with short-term acute care hospitals in December 2025 and continuing through 2026 for other facility types. This article explains what PEPPER is, which providers receive it, how to access it, how to read it, how to interpret outliers, and how to build PEPPER into a compliance program. It is educational and does not replace professional advice.

What Is PEPPER?

CMS describes PEPPER as a free tool that helps providers review their Medicare billing data to catch issues early and support accurate claims. According to CMS, PEPPER provides provider-specific Medicare data for services vulnerable to improper payments and can be used as a guide for auditing and monitoring efforts to help providers identify and prevent payment errors.

CMS explains that providers can use PEPPER to:

• Spot billing patterns that need review.

• Find areas that may need closer monitoring or internal audits.

• Identify services that may be under-coded or over-coded.

• Track trends, such as longer patient stays.

• Take action before problems arise.

What PEPPER Is Not

PEPPER is an educational and self-monitoring tool. HHS guidance states that PEPPER cannot be used to identify the presence of payment errors, but it can be used as a guide for auditing and monitoring efforts. In other words, being an outlier in PEPPER does not mean claims were paid improperly. Only a review of the underlying medical records and claims can determine whether services were medically necessary, properly documented, and correctly billed.

PEPPER and Comparative Billing Reports

PEPPER is related to, but different from, the Comparative Billing Report (CBR). CBRs are typically provided to individual practitioners and suppliers and compare their billing to peers for specific services. PEPPERs are generally provided to institutional providers such as hospitals and post-acute care facilities. CMS uses the same access system for both, and CMS has noted that staff can request the CBR business function at the same time as the PEPPER business function.

The PEPPER Pause and Relaunch

CMS paused distribution of CBRs and PEPPERs to improve and update the program and its reporting system. In July 2024, CMS issued a request for information seeking feedback on how providers use CBRs and PEPPERs and how they could be improved.

CMS then began relaunching PEPPER:

• CMS relaunched PEPPER for short-term acute care hospitals in December 2025.

• In February 2026, CMS announced that staff end users at short-term acute care hospitals could access PEPPERs through the Identity & Access Management System.

• In May 2026, CMS announced that it would relaunch PEPPER for all Medicare facility types, including hospitals, post-acute care providers, and specialty facilities.

• During 2026, CMS and its MACs announced releases for additional facility types, including critical access hospitals, hospices, long-term acute care hospitals, inpatient rehabilitation facilities, home health agencies, inpatient psychiatric facilities, partial hospitalization programs, and skilled nursing facilities.

• CMS released quarterly PEPPERs for short-term acute care hospitals during 2026, including Q1 FY 2026 in June 2026.

Because the program has changed, providers should review the current user guide for their facility type, which explains the target areas and methodology for that version of the report.

Who Receives PEPPER?

PEPPER is produced for institutional provider types. Based on CMS announcements during the relaunch, these include:

• Short-term acute care hospitals.

• Critical access hospitals.

• Long-term acute care hospitals.

• Inpatient rehabilitation facilities.

• Inpatient psychiatric facilities.

• Partial hospitalization programs.

• Skilled nursing facilities.

• Home health agencies.

• Hospices.

Release frequency varies by provider type. CMS has released short-term acute care hospital PEPPERs on a quarterly basis, while many other facility types receive annual reports that typically display data for the most recent three federal fiscal years.

How to Access Your PEPPER

CMS has explained that authorized officials (AOs), access managers (AMs), and staff end users (SEUs) access PEPPER through the PEPPER Portal. According to CMS, to become an SEU and access your organization's PEPPER:

1. Sign in to the CMS Identity & Access (I&A) System using your existing NPPES or PECOS credentials.

2. Request the PEPPER business function for your organization. You can request the CBR business function at the same time.

3. Have your request approved by your organization's AO or AM.

4. After approval, log in to the PEPPER Portal and download your organization's report.

CMS encourages providers to set up access in advance so they can retrieve their PEPPER as soon as it is released. CMS provides an I&A Quick Reference Guide, I&A frequently asked questions, and the External User Services Help Desk for assistance.

Practical Access Tips

• Confirm who your organization's AO and AMs are in the I&A system.

• Make sure at least two people, such as the compliance officer and a revenue integrity leader, have PEPPER access.

• Update access when staff leave or change roles.

• Calendar expected release periods so reports are downloaded and reviewed promptly.

How PEPPER Is Organized

While the details differ by facility type, PEPPER generally includes:

• Target areas. These are specific measures that CMS has identified as potentially at risk for improper payment, such as certain diagnosis-related groups, short stays, readmissions, long lengths of stay, or specific types of services.

• Target area percents. For each target area, PEPPER calculates the facility's percentage, usually expressed as a ratio. The numerator represents the discharges, episodes, or services that may be at risk, and the denominator represents a larger reference group.

• Comparison percentiles. PEPPER compares the facility's percent with other facilities at the national, MAC jurisdiction, and state levels.

• Trend data. PEPPER shows results over several time periods so providers can see whether a measure is rising or falling.

• Supporting reports. Depending on facility type, PEPPER may include additional tables, such as top diagnoses or procedures, to help explain results.

Understanding Percent Versus Percentile

One of the most common points of confusion is the difference between percent and percentile.

• The target area percent is your facility's own number for that measure. For example, the percentage of your discharges or episodes that meet the target area definition.

• The percentile shows where your percent ranks compared with other facilities. If your facility is at the 85th percentile nationally, your percent is higher than that of 85 percent of facilities in the national comparison group.

A high percent is not automatically a problem, and a low percent is not automatically safe. What matters is how your facility compares with others and whether there is a legitimate explanation.

How PEPPER Identifies Outliers

PEPPER user guides explain that outliers are identified using preset control limits. Under the long-standing methodology:

• The upper control limit for target areas is the 80th percentile. A facility at or above the 80th percentile is considered a high outlier for that target area.

• Coding-focused target areas also have a lower control limit at the 20th percentile. A facility at or below the 20th percentile may be a low outlier, which may suggest potential under-coding.

High outliers may suggest risks such as over-coding, unnecessary services, unnecessary admissions, or lengths of stay that are longer than necessary, depending on the target area. Low outliers in coding-focused areas may suggest under-coding, which can mean the facility is not capturing documentation that supports the correct code. Providers should check the current user guide for their facility type to confirm the control limits and interpretations that apply.

Why Comparison Groups Matter

PEPPER compares facilities at the national, jurisdiction, and state levels. A facility might be an outlier nationally but not in its state, or the reverse. Differences in local practice patterns, patient populations, and service mix can affect results. Reviewing all three comparison levels helps put results in context.

Interpreting Outlier Results: A Step-by-Step Approach

Step 1: Download and Distribute

Download the report as soon as it is available and share it with the compliance officer, revenue integrity, health information management, clinical leaders, and finance.

Step 2: Identify Outliers

List every target area where your facility is a high outlier or, for coding-focused areas, a low outlier. Note whether the outlier status applies nationally, in the jurisdiction, in the state, or in all three.

Step 3: Look at Trends

Look at results over several periods. A single period above the 80th percentile may reflect a temporary change, while a consistent or rising trend is a stronger signal.

Step 4: Consider Legitimate Explanations

Ask whether there is a reasonable explanation, such as a specialized service line, a unique patient population, a new program, a change in referral sources, or a small number of cases that makes the percentage unstable.

Step 5: Select Records for Review

For priority target areas, select a sample of claims or medical records for internal review. Focus on whether documentation supports medical necessity, the level of care, coding, and other payment requirements.

Step 6: Conduct the Review

Use qualified reviewers, such as certified coders and clinicians, and apply the same Medicare coverage, coding, and documentation rules that an external reviewer would use.

Step 7: Act on the Findings

If the review confirms that claims were billed correctly, document the results and the explanation for the outlier status. If the review finds errors, correct the underlying process, provide education, and evaluate whether overpayments must be reported and returned.

Step 8: Monitor Over Time

Compare future PEPPERs with the current one to confirm that corrective actions are working.

Examples of PEPPER Target Areas by Facility Type

Target areas vary by facility type and may change as CMS updates the program. The following examples illustrate the types of measures that have historically appeared in PEPPER. Providers should consult the current user guide for their facility type.

Short-Term Acute Care Hospitals

Hospital target areas have historically focused on coding and admission patterns, such as certain DRGs with complications or major complications, specific diagnoses prone to over-coding such as septicemia, one-day stays, readmissions, and medical DRGs that may be at risk for unnecessary admission.

Skilled Nursing Facilities

SNF target areas have historically focused on areas such as the use of certain payment categories, length of stay patterns, and readmission patterns.

Home Health Agencies

Home health target areas have historically included measures related to episode patterns, length of service, and outlier payments.

Hospices

Hospice target areas have historically included measures such as live discharges, long lengths of stay, and patterns of care in certain settings.

Inpatient Rehabilitation and Psychiatric Facilities

These reports have historically included measures related to specific case types, outlier payments, and length of stay.

Using PEPPER Before an Auditor Does

Medicare program integrity contractors use data analysis to select providers and topics for review. PEPPER target areas reflect services CMS considers vulnerable to improper payments, so outlier status in PEPPER may correspond to areas of interest for external reviewers. Using PEPPER proactively allows providers to:

• Identify risk areas early and review them internally.

• Fix documentation and coding problems before claims are selected for external review.

• Prepare explanations for legitimate outlier status.

• Demonstrate that the compliance program monitors data and acts on findings.

• Reduce the likelihood of large overpayments and extrapolated findings.

Connecting PEPPER to Other Audit Risks

PEPPER outlier status can relate to several types of external reviews:

• MAC medical review, including Targeted Probe and Educate, which focuses on providers with high error rates or unusual billing practices.

• Recovery Audit Contractor reviews of approved topics.

• UPIC data analysis and investigations of potential fraud, waste, and abuse.

• HHS-OIG audits, which often focus on services with high risk of improper payment.

Building PEPPER Into Your Compliance Program

HHS-OIG's General Compliance Program Guidance emphasizes risk assessment, auditing, and monitoring as elements of an effective compliance program. PEPPER can support those elements:

• Risk assessment. Use PEPPER outlier results as an input to your annual risk assessment.

• Audit planning. Include PEPPER target areas with outlier status in your annual audit plan.

• Monitoring. Track target area results over time and report trends to the compliance committee.

• Education. Use findings to educate clinicians, coders, and billing staff.

• Documentation. Keep records of your PEPPER reviews, audits, findings, and corrective actions.

Sample PEPPER Review Workflow

1. Release date identified and calendar reminder set.

2. Report downloaded by an authorized user.

3. Compliance officer distributes the report to the review team.

4. Team identifies outliers and trends within two weeks.

5. Priority target areas selected for record review.

6. Internal audits completed and findings documented.

7. Corrective actions assigned and tracked.

8. Summary reported to the compliance committee and governing body.

9. Results compared with the next release.

A Hypothetical Example

Consider a hypothetical hospice that downloads its PEPPER and finds that it is above the 80th percentile nationally, in its jurisdiction, and in its state for a target area related to long lengths of stay, and that the percentile has risen in each of the last three years.

The compliance team first asks whether there is a legitimate explanation. The hospice serves a large number of patients with dementia and other non-cancer diagnoses, which can be associated with longer stays. That context helps, but it does not by itself explain the trend.

Next, the team selects a sample of patients with long stays and asks an independent clinical reviewer to evaluate whether each certification and recertification was supported by documentation of a terminal prognosis, whether face-to-face encounters were timely and complete, and whether the plan of care reflected the patient's condition. The review finds that most records were well supported, but several recertifications relied on copied narratives that did not describe decline.

The hospice then educates its physicians and clinical staff on documenting decline, updates its recertification templates, adds an interdisciplinary review step for long-stay patients, and evaluates whether any claims must be repaid. It documents the entire process and reports results to its compliance committee. When the next PEPPER is released, the team compares results to confirm whether the changes are having an effect.

This example shows how PEPPER can lead to targeted, efficient internal review that strengthens documentation before an external reviewer selects the same patients.

Who Should Be on the PEPPER Review Team?

• Compliance officer, who coordinates the review and reports to leadership.

• Revenue integrity or billing leader, who understands claims data and billing processes.

• Health information management and coding staff, who review coding-focused target areas.

• Clinical leaders, such as the medical director or director of nursing, who review medical necessity and level-of-care questions.

• Finance, which evaluates the financial impact of findings and any repayments.

• Legal counsel, when internal reviews suggest significant overpayments or potential compliance concerns.

Common Mistakes With PEPPER

• Not setting up access and missing report releases.

• Treating PEPPER as proof of errors rather than a guide for auditing.

• Ignoring outliers because the facility believes its practices are correct.

• Reviewing only national comparisons and ignoring jurisdiction and state data.

• Reacting to a single data point instead of evaluating trends.

• Failing to document reviews and explanations.

• Not involving clinical leaders in reviewing medical necessity and level-of-care findings.

• Failing to evaluate overpayment obligations when internal review finds errors.

When Internal Review Finds Errors

If an internal audit prompted by PEPPER identifies claims that were paid incorrectly, providers should:

• Quantify the overpayment, considering whether a broader look-back is needed.

• Report and return overpayments as required by the 60-day overpayment rule at 42 CFR 401.305, which allows a period for a timely, good-faith investigation of related overpayments.

• Correct the root cause through process changes and education.

• Consider whether self-disclosure to the OIG or CMS is appropriate in more serious situations, ideally with legal counsel.

• Document all actions taken.

Frequently Asked Questions

Is PEPPER free?

Yes. CMS describes PEPPER as a free tool for providers.

Does being an outlier mean I will be audited?

Not necessarily. PEPPER does not identify payment errors and is not an audit. However, outlier status indicates areas where your billing patterns differ from peers and that deserve internal review.

Who can download my organization's PEPPER?

Authorized officials, access managers, and approved staff end users can access PEPPER through the PEPPER Portal using the CMS Identity & Access System.

How often is PEPPER released?

It depends on facility type. CMS has released short-term acute care hospital PEPPERs quarterly, while many other facility types receive annual reports.

What should I do if I am a high outlier?

Review trends and comparison groups, consider legitimate explanations, audit a sample of records, correct any problems found, document your work, and monitor future reports.

Conclusion

PEPPER gives providers something valuable: a view of their own billing data compared with peers, focused on areas CMS considers vulnerable to improper payment. With the 2025 and 2026 relaunch, PEPPER is once again available across many facility types. Providers that set up access, download reports promptly, identify outliers, audit priority areas, act on findings, and document their work can find and fix risk areas before an auditor does, while strengthening their compliance programs.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that helps providers access and interpret PEPPER, identify outlier risk areas, design and conduct targeted internal audits, evaluate overpayment obligations, and integrate data monitoring into their compliance programs. If you would like help reviewing your PEPPER or building a proactive audit plan, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for May 28, 2026 (PEPPER Relaunch for All Facility Types). https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-may-28-2026

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for February 12, 2026 (Short-Term Acute Care Hospitals: Staff End Users Can Now Access PEPPERs). https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-february-12-2026

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for June 18, 2026 (Short-Term Acute Care Hospitals: Download Your Q1 FY 2026 PEPPER). https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-june-18-2026

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-Research/monitoring-Programs/medicare-Fee-Service-Compliance-Programs

• Centers for Medicare & Medicaid Services. CBR and PEPPER Request for Information (July 2024). https://cms.gov/files/document/cbr-pepper-rfi-final-july-2024.pdf

• U.S. Department of Health and Human Services. Data Analysis Support and Tracking (Guidance). https://www.hhs.gov/guidance/document/data-analysis-support-and-tracking

• PaymentAccuracy.gov. Centers for Medicare & Medicaid Services, Medicare Fee-for-Service Scorecard, Q3 2026. https://paymentaccuracy.gov/assets/scorecards/Q3%202026/Centers%20for%20Medicare%20&%20Medicaid%20Services%20(CMS)%20-%20Medicare%20Fee-for-Service%20(FFS).pdf

• Centers for Medicare & Medicaid Services. Identity & Access Management System Login. https://nppes.cms.hhs.gov/IAWeb/login.do

• Centers for Medicare & Medicaid Services. I&A Quick Reference Guide. https://nppes.cms.hhs.gov/IAWebContent/Quick_Reference_Guide.pdf

• Centers for Medicare & Medicaid Services. External User Services Help Desk. https://eus.cms.gov/home

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305