OIG Audit Risk and PEPPER Reports: What Post-Acute Care Providers Need to Know

If a skilled nursing facility, home health agency, or hospice provider has never heard of PEPPER, that is worth fixing before an auditor brings it up first. PEPPER — the Program for Evaluating Payment Patterns Electronic Report — is a free CMS-funded report that shows a provider exactly how its billing patterns compare with national, state, and Medicare Administrative Contractor (MAC) jurisdiction peers. It will not tell a facility whether it has done anything wrong. What it does is show where a facility's numbers sit relative to everyone else's, which is precisely the kind of signal that shapes who gets picked for review.

For post-acute providers operating on thin margins and stretched compliance teams, understanding PEPPER is one of the more practical, low-cost steps toward managing audit risk. Here is what the report actually is, how it connects to the broader Medicare program-integrity landscape, and what providers can do with the data once they have it.

What PEPPER Actually Is

PEPPER is produced under contract with the Centers for Medicare & Medicaid Services (CMS) by Index Analytics LLC, working with Integrity Management Services and GovCon Growth Solutions. It draws on the most recent 12 quarters of Medicare fee-for-service claims data and turns that data into facility-specific statistics for a set of "target areas" — categories of discharges or services that are considered vulnerable to improper payments, such as certain diagnosis codes, length-of-stay patterns, or therapy utilisation levels.

Distribution varies by provider type. Short-term acute care hospitals receive PEPPER quarterly. Skilled nursing facilities, home health agencies, hospices, long-term acute care hospitals, critical access hospitals, inpatient rehabilitation facilities, inpatient psychiatric facilities, and partial hospitalization programs receive it annually. Each report benchmarks the facility against national, MAC-jurisdiction, and state percentiles for every target area it covers.

How PEPPER Connects to Audit Risk

PEPPER itself does not accuse anyone of anything, and CMS is explicit that the report "does not identify the presence of payment errors." What it flags is statistical outlier status — typically, facilities scoring at or above the 80th percentile on a given target area are considered to warrant a closer look. Being an outlier is not proof of a problem, but it is exactly the kind of pattern that Medicare Administrative Contractors, Recovery Audit Contractors, and the HHS Office of Inspector General (OIG) use, alongside their own claims analytics, to prioritise where to focus limited audit resources.

The OIG's own work plan and compliance guidance for post-acute providers has long emphasised claims-data monitoring as a compliance program expectation, and PEPPER is one of the few tools CMS hands directly to providers to do that monitoring themselves before a contractor does it for them. Coverage of the program from healthcare law and compliance specialists frames it plainly: PEPPER gives a facility advance visibility into the same utilization patterns that could attract external review. Treating it as a routine compliance input, not an optional report to skim once a year, is the difference between catching an outlier trend early and explaining it retroactively during a medical review.

It is worth being precise about what PEPPER is not. It is a CMS program-integrity and self-monitoring tool, not an OIG audit report, and not a survey or certification document. Confusing PEPPER with a state survey or an accreditation review is a common and avoidable error — it is purely a data benchmarking report, delivered for the provider's own compliance use.

Practical Steps for Managing PEPPER-Related Risk

Providers that get real value from PEPPER tend to treat it as a recurring compliance process rather than a document to file away. A few practices come up consistently in guidance aimed at skilled nursing, home health, and hospice compliance teams:

• Assign clear ownership. Someone — a compliance officer, DON, or billing manager — should be responsible for retrieving each report as soon as it is released, reviewing it, and reporting findings up to leadership.
• Look at trends, not single snapshots. A single elevated quarter can be noise. A target area that keeps climbing toward or past the 80th percentile over several reporting periods is a much stronger signal and deserves a documented response.
• Investigate each target area individually. High percentile rankings can come from legitimate case-mix differences, documentation gaps, or coding inconsistencies. The report will not tell you which — that requires pulling a sample of the underlying charts and comparing documentation against the billed codes.
• Run internal self-audits on flagged areas. Where a target area stands out, a focused internal or third-party chart review — checking that documentation actually supports medical necessity, level of care, and length of stay — is the standard next step before a payer or contractor does the same review for you.
• Build PEPPER into staff training and documentation practices. If a review finds a genuine documentation weakness, the fix usually involves refreshing clinical and coding staff on what supports a claim, not just correcting the individual charts already billed.
• Keep a paper trail of your compliance response. Documenting what was reviewed, what was found, and what corrective action followed is what turns an outlier percentile into evidence of a functioning compliance program rather than a red flag left unaddressed.

Where to Get PEPPER Reports and Guidance

Eligible facilities can access their reports and edition-specific user guides through the official PEPPER resources site, pepperresources.org, which also hosts a help desk for facilities that have trouble locating or interpreting their report. Each provider-type user guide explains exactly how each target area is calculated, which is essential reading before drawing conclusions from a percentile ranking.

Frequently Asked Questions

Is PEPPER the same as an OIG audit?

No. PEPPER is a CMS-funded, data-driven self-monitoring report, not an audit or an OIG enforcement action. It gives providers the same type of claims-pattern data that auditors and contractors use, so they can review their own risk areas before, rather than during, an external review.

Does a high percentile score automatically mean a facility did something wrong?

No. CMS states directly that PEPPER does not identify the presence of payment errors. It identifies statistical outliers that merit a closer look. Many facilities with elevated scores have a legitimate explanation tied to their patient population — the point of the report is to prompt that review, not to presume guilt.

Who receives a PEPPER report?

Distribution depends on facility type. Skilled nursing facilities, home health agencies, hospices, long-term acute care hospitals, critical access hospitals, inpatient rehabilitation facilities, inpatient psychiatric facilities, and partial hospitalization programs receive an annual report; short-term acute care hospitals receive one quarterly.

How often should a compliance team act on PEPPER data?

As soon as each new report is released, with a documented internal review process every time — not just when a target area looks obviously alarming. Consistent, timely review is itself evidence of an active compliance program if a facility is ever questioned about its oversight practices.

The Bottom Line

PEPPER will not stop an audit from happening, and it is not designed to. What it does is put the same claims-pattern signals that contractors and the OIG rely on directly in front of the provider, months or years before a formal review might occur. For post-acute organisations managing compliance with limited staff time, that head start is the whole value of the report — provided someone is actually reading it, investigating what it shows, and building the response into ongoing staff training and documentation practices. Ongoing compliance training remains one of the most effective ways to keep clinical and billing documentation audit-ready between report cycles; explore Learnsignal's US healthcare compliance and CPD training guide for a full overview of what US-based post-acute providers should have in place, including approaches to HIPAA training requirements and Joint Commission accreditation readiness, or browse Learnsignal's CPD courses to support ongoing staff development.