Medicare Advantage plans and stand-alone Part D drug plans paid a combined $72 million over three calendar years for services tied to providers that Medicare had already revoked, according to a federal watchdog. The figure comes from a data brief by the Department of Health and Human Services Office of Inspector General, dated September 28, 2026. The brief ties the payments to weaknesses in how the Centers for Medicare & Medicaid Services keeps its list of barred providers, not to any single plan or provider.
What the HHS-OIG data brief A-02-24-01013 counted
The headline number is narrower than it first sounds. In report A-02-24-01013, the inspector general wrote: “We identified vulnerabilities in CMS’s preclusion process that contributed to plans making payments, totaling $72 million, for Medicare Part C and Part D services to 249 of the 1,017 revoked NPIs during CYs 2022 through 2024.”
Three details define the scope. First, the $72 million is a three-year total covering calendar years 2022, 2023 and 2024, not a single year and not a projection. Second, it is a count of payments the plans actually made, not a finding that the whole sum was an improper overpayment owed back to Medicare. Third, it covers 249 of 1,017 revoked National Provider Identifiers, the numbers that identify individual clinicians, pharmacies and other billers. The remaining 768 revoked identifiers did not appear in the payment total.
The report title describes the subject as services associated with excluded providers or individuals convicted of certain felonies, so the population examined spans both groups, and the brief frames the problem through CMS’s preclusion process.
How the Medicare Preclusion List is supposed to stop Part C and Part D payments
Part C is the Medicare Advantage program, run through private plans, and Part D is the prescription drug benefit, also delivered by private plans. Under the Preclusion List, plans are barred from paying certain providers. According to the inspector general’s summary, a provider can land there for three reasons: exclusion from federal health care programs, a felony conviction, or a Medicare revocation for conduct CMS deems harmful to the program.
The design depends on CMS keeping the list accurate and current, because the plans, not CMS, make the individual payment decisions. When the list is late, incomplete or wrong, a plan can pay a provider that the program meant to shut out. That dependency is the thread running through the $72 million finding.
Three gaps the inspector general found in CMS’s preclusion process
The inspector general named specific vulnerabilities rather than a general lapse. One is timing delays and administrative errors in adding providers to the list and in removing them. A provider revoked on paper can keep billing a plan while the list catches up.
A second is that the process fails to capture organizations whose owners faced exclusion or convictions. A business can continue to be paid even when the individuals behind it are the ones with the disqualifying history.
A third is a regulatory gap affecting Part D pharmacies. Pharmacies that only fill drugs, rather than prescribe them, can avoid preclusion under the current rules.
Each gap sits in federal procedure and regulation, not in the conduct of any named plan. The brief does not identify plans or pharmacies in the summary reviewed for this article.
A data brief that makes no recommendations to CMS
This brief stops short of telling the agency what to fix. The report states: “This data brief does not contain any specific recommendations to CMS.” It says only that the findings “may be beneficial in the development of future solutions, including Federal regulations and CMS guidance.”
That matters for how the number should be read. A data brief reports what the data show; it is not an audit concluding that specific payments must be recovered, and the report page names no official, spokesperson or CMS response. Nothing in the page makes the $72 million a refund, a penalty or a settlement. No beneficiary action, deadline or claim window attaches to it.
What the $72 million does and does not measure
The figure measures payments associated with a subset of revoked identifiers over a fixed window. It does not state what share of total Medicare Advantage or Part D spending that represents, and it does not say how much of the money was later recovered. The full report PDF was not available for review, so no scope detail beyond the report page is claimed here.
The inspector general’s report index lists A-02-24-01013 as issued 09/28/2026, and also lists a separate report, A-09-23-03001, covering Methodist Hospital and at least $12.4 million in Medicare overpayments. That is a different review of a different kind of problem, and it is not part of the $72 million.
The source behind every figure here is the inspector general’s own report page: $72 million, 249 of 1,017 revoked National Provider Identifiers, calendar years 2022 through 2024, and no recommendations to CMS.
A written plan for the first hour after a scam
Older adults who handle their own banking, Medicare and insurance accounts are frequent targets of impersonation and identity theft, and the first hour after a bad call or message is when most decisions get made. A written plan keeps those steps in order.
The Senior Fraud Defense & First-Hour Recovery Kit is a 9-page kit that pairs the first-hour recovery plan with a fraud evidence and report log, so the steps and the paper trail sit in one place.
Get The Senior Fraud Defense & First-Hour Recovery Kit and its fraud evidence and report log →
This article was written with AI assistance and verified line by line against the primary records linked in it.



