Medicaid rebate invoice validation, explained.

The state counts the units, the maker pays per unit, and any doubt must be proved

One state invoice, from the pharmacy fill to the state's credit

1. A pharmacy fills a prescriptionA Medicaid patient picks up one carton of two pens. The pharmacy bills the state or the patient's Medicaid health plan.
2. The state totals the quarterWithin 60 days of the quarter's end, the state adds units by drug code, quarter and delivery route, and multiplies by the rebate amount.
3. The invoice reaches the makerIt comes through a portal, by mail or by file transfer. The postmark date starts the clock on interest.
4. The maker validates every lineUnits against claims, package, history, the 340B list and earlier payments. A person decides each suspect line. This is where the dollars are kept or paid.
5. The maker pays, disputes, and the two sides settleUndisputed units are paid. Disputed units go on a federal form, and the state corrects its data or shows the claims.

Step 4 is the subject of this guide. The steps follow the statute, the rebate agreement and CMS releases, the numbered notices CMS sends to manufacturers.1,7

Four surprises on a Medicaid invoice: units only, low payments, claims on request, under-billing

The invoice vocabulary: CMS-R-144, URA, claim-level data and ROSI

Fourteen terms are defined in the one-page summary.

What a CMS-R-144 invoice line says, and which field each validation test reads

In shortFederal rules require at least 11 fields on a state invoice. Five do the work: the drug code, the quarter, the delivery route, the units and the prescription count. Validation tests whether the units fit the prescriptions, the package, the history and the exclusions that apply to that route.

The regulation lists 11 minimum fields: state code, NDC, period, product name, URA, units, rebate claimed, prescriptions, Medicaid amount, non-Medicaid amount and total amount. Managed care data must be kept separate from fee-for-service.3

The five tests on one line, and the invoice fields each needs

Many teams work at two depths. A line test needs only the invoice and your own product data: does this quantity per prescription make sense for this package? A claim test needs the prescription rows: which plan, pharmacy, fill date and quantity sit behind it? The first finds a line to question. The second is usually what ends the argument, because it shows the state where its count went wrong.

A manufacturer also receives more than the 51 federal invoices from 50 states and the District of Columbia. As of September 2025, KFF, a health policy research group, counted 48 states and DC with supplemental rebate agreements, extra rebates a state negotiates on top of the federal one, and one vendor describes invoices from "more than 400 programs", a count it does not break down. CMS's GENEROUS model, launched in January 2026, adds another quarterly supplemental invoice in the states that join it.15,18,19

Section 1927, the rebate agreement and CMS's numbered releases: what decides what, as of November 2026

In shortThe statute sets the rebate and the payment. The signed national agreement sets the dispute steps. CMS's releases, some of them 30 years old, say how those steps work. A 2024 rule added the first time limit on disputes, and the removal of the rebate cap in 2024 raised the price of a wrong unit.

Who is who: CMS runs Medicare and Medicaid. HRSA (Health Resources and Services Administration) runs 340B, the federal discount program for safety-net hospitals and clinics. OIG is the Inspector General of the Department of Health and Human Services. GAO is the Government Accountability Office, which reports to Congress. MACPAC is the congressional commission that advises on Medicaid.

The newest changes that touch a state invoice's checks

Day 30, day 38, day 60 and 12 quarters: the four clocks on a Medicaid rebate invoice

In shortPeople say "38 days". The law says 30 days from receipt. CMS says interest starts on the 38th day from the postmark, so you have 37 days clear. Failing to pay or dispute within 60 days of receipt breaches the agreement. And since late 2024, a dispute must start within 12 quarters.

How interest on a late or lost dispute is worked out

The rate moves weekly. CMS's page gives seven steps: take the yields from each weekly auction of 13-week Treasury bills in the period, average them, multiply by the unpaid rebate, divide by 365, and multiply by the days owed. The period starts on the 38th day from the postmark. If a maker wins a dispute after paying, the state owes the credit with interest too.32,10

At these amounts, interest alone rarely decides whether to dispute. A wrong dispute costs more in work on both sides, and in standing with a state that has already shown you its data. A correct one recovers many times its risk. Paying in full and disputing afterward is allowed: Release 27 says it "effectively eliminates" interest liability, and the state must credit any reduction, with interest. It also means asking for money back from a state, instead of holding it.10

How a Unit Rebate Amount times units becomes the rebate claimed, worked through

In shortFor a brand drug, the rebate per unit starts at the greater of 23.1% of average manufacturer price or that price less Best Price, the lowest price most buyers got, and adds an amount for price rises above inflation. Since 2024 nothing caps the total. The state multiplies by units. So an error in the unit count scales with a number that can now exceed what the maker receives.

AMP is average manufacturer price, what wholesalers and retail pharmacies pay the maker on average. Best Price is the lowest price the maker gave most buyers in the quarter. Generic drugs follow a separate 13% rule. Take an invented brand drug in one quarter: AMP $600, Best Price $380. 23.1% of $600 is $138.60; $600 less $380 is $220. The basic rebate is the greater, $220. A $40 inflation add-on makes the URA $260.15,20

What the end of the 100% cap does to a wrong unit

Until the end of 2023, the rebate on a unit could not exceed the average manufacturer price. For periods from January 1, 2024 the cap is gone, so a drug whose price has risen for years can carry a URA above AMP. The unit that was never dispensed then costs more than the maker earned on a real one. Take a drug with an invented $600 AMP and a calculated rebate of $730 per unit.15,20

Why "units" is harder than it sounds: each, milliliter and gram

The unit is whatever the manufacturer reported to CMS for that drug, with a figure called units per package size: tablet, capsule, each, gram or milliliter, among others. OIG says solutions, injectable liquids and drugs measured by volume should be billed in milliliters, and gives an example: one dose of albumin is 12.5 grams per 240 milliliters, so two doses are 480 billing units if counted correctly, and 25 if a pharmacy keys grams. Keying grams cuts the rebate by a factor of nearly 20 for the same two doses.14,2

CMS asks labelers to send conversion factors before billing, and to speak with states as soon as a unit problem appears.14,2,24 This guide's sample counts pens one by one to keep the sums plain, so check how your own injector pens are reported.

Package errors have their own dispute codes, D, E, F and T. F covers a package size discrepancy, and section 9 lists the others.13

Claim-level data: the file that proves a Medicaid unit, and why you have to ask for it

In shortThe invoice gives totals. The claim rows show which pharmacy, plan and fill produced them. CMS publishes suggested fields and encourages states to share them, and it requires none to do so routinely. States and manufacturers told OIG that reviewing claims is a helpful first step. So the first job on any state's invoice is knowing what it will send, in what layout, and when.

Asking a state for claims, and what CMS expects in return

So you can expect the data to exist, and a state may still offer something other than rows.12,7

A team's working list follows from that. Which states send claims with the invoice, which on request, which only at audit? We found no public count. Vendors describe many states, and your own record is the only reliable figure: count them, by state and route, for your last four quarters.

Data rights matter as well. Claim rows carry prescription numbers, fill dates and pharmacy identifiers. Before any row reaches a tool, check the state's data use terms and the privacy position.25

Shifted decimals and doubled pens: how Medicaid unit-of-measure errors are found and proved

In shortThree signals point to a unit error: units per prescription against the package, the plan's own history, and reimbursement per unit. The first two can support a dispute. The third can only help you find one. OIG heard from states that disputing every dose above an average is a problem too, so a threshold needs a reason behind it.

The three signals, and how far each one goes

The limit CMS and states put on thresholds

Thresholds decide what a team looks at, and they can be abused. One state told OIG about a manufacturer that disputed any dose above the average, even where the dose sat inside the range on the drug's own package insert. A patient on a higher labeled dose is a valid claim.2

CMS tells labelers to raise thresholds after a state has shown the data, and calls repeat disputes for the same reason inappropriate once a state has shown its utilization is reasonably accurate. So a defensible test checks the label's dosing range and the prescription's days, and it records why each threshold sits where it does.24,10

A state's own process can explain high units too. A change in the state's preferred drug list, an expansion population or a waiver can move average utilization, and Release 95 names them as reasons to look again. Look for these before you write the letter.24

Under-billing, the error CMS says teams overlook

CMS has noted that low billing "is not being recognized and disputed nearly as much as high utilization/rebate billing", and tells makers to find suspected errors in both directions, including the decimal-versus-whole-number kind. It adds there is no limit on the time for correcting and paying under-billed rebates. A validation process that only ever finds errors in the maker's favor sits badly with that guidance, and it leaves the accrual, the money set aside for rebates still owed, open to a later correction from the state.13

340B duplicate discounts on a state invoice: the Medicaid Exclusion File covers fee-for-service only

In shortFederal law bars a 340B price and a Medicaid rebate on the same drug. The tool for it, HRSA's Medicaid Exclusion File, was built for fee-for-service. For managed care, states use a mix of methods, and OIG found most rely on provider-level lists that can miss or wrongly exclude individual claims. Two other overlaps round out the test: a plan's own rebate and a correction that re-bills paid units.

340B lets hospitals and clinics that serve many low-income patients, called covered entities, buy drugs at steep discounts. If such an entity also bills Medicaid for that drug and the state then invoices a rebate, the maker has discounted the drug twice, which 42 USC 256b(a)(5)(A) forbids.22

HRSA says 340B purchases reached about $100 billion in 2025, against $66.3 billion in 2023.21 A covered entity tells HRSA whether it will use 340B drugs for its Medicaid fee-for-service patients, and those that do are listed in the Medicaid Exclusion File with the billing numbers they use.33

Provider list or claim flag: which 340B test holds up

OIG recommended in 2016 that CMS require claim-level methods. CMS did not concur, saying the statute does not contemplate such a requirement, though it agreed they matter.17

GAO recommended in 2020 that CMS and HRSA do more on duplicate discounts in managed care, including audits. Its product page, read November 2026, lists all three recommendations as open, with CMS's response still awaited in March 2026. GAO adds that HRSA does not require covered entities to address managed care duplicate discounts it identifies or to work with manufacturers to repay them, so "manufacturers may be subject to duplicate discounts".17,33,34

For the invoice reader, that means a date test on every match: was the entity listed for the quarter and billing number on the claim? Which method does this state use? CMS code X, "PHS entity not extracted from state data", requires documentation including the provider number. A covered entity may also buy outside 340B for its Medicaid patients, in which case the state may properly invoice the units, so a match opens a question for the state and only sometimes settles it.13,33

A health plan's own rebate on the same Medicaid fill

A manufacturer may also pay a Medicaid plan a rebate under a private contract. When a plan bills the maker for a fill that the state also invoices, one prescription carries two rebates. Prescription number and fill date show the match. What to do about it is a contract question, and no CMS dispute code names it directly.

Read the plan agreement first: it may say which payment gives way, in which case recovery may lie with the plan and leave the state's invoice untouched. We found no federal text that settles it, so take this one to counsel.

Corrections that re-bill units you already paid

States send prior-quarter changes alongside the current invoice. Some report the change as an addition, and others as a full replacement of the earlier figure. A replacement read as an addition bills every unit twice. Since managed care invoices moved to date of service in 3Q2017, CMS has warned makers to learn each state's logic for reversals and rebills, so valid claims are not disputed as duplicates. Code M covers a duplicate claim, and the form for a prior quarter is the PQAS.13,35

ROSI, PQAS and CMS dispute codes: how a Medicaid rebate dispute runs from notice to credit

In shortPay the undisputed units on time and report the disputed ones on the federal forms, with codes. A spreadsheet alone is not official documentation, and an unpaid amount without those forms counts as non-payment. Then the two sides exchange data, and CMS's dispute team and the state hearing stand behind them.

ROSI or PQAS: which federal form carries which line

Which CMS dispute code fits which Medicaid error

Codes from CMS's list in Release 105, attachment 7.10.4. CMS posts the form layouts and definitions in one place. Your state letter may use plain words as well, but the form carries the codes.13,36

What makes a state stop treating it as a dispute

CMS's dispute page, updated August 17, 2026, is explicit. Disputed units "must be filled out completely, including the assignment of the appropriate dispute code(s)", and "an excel spreadsheet without appropriate context is not considered official documentation". Rebates unpaid without that documentation are non-payment, which CMS handles through a separate route. Release 27 warned in 1997 that manufacturers who persist in withholding inappropriately risk termination from the program, and that withholding after a state has shown its data fails to demonstrate good faith.8,10

Small amounts have their own rule. Under State Release 19, as CMS restated it in 2017, a state need not pursue a dispute further when it is under $10,000 per manufacturer and under $1,000 per product code in a quarter, and more effort would not be cost-effective. A state should not invoice a total under $50 per labeler code a quarter.13

$58.4 billion in Medicaid drug rebates, and the one federal study of how much is disputed

In shortRebates have nearly quadrupled since fiscal 2011. In the one federal study of dispute shares we found, most responding states reported 2% or less of invoiced dollars in dispute, and the study is old and limited. One vendor claims to find 1% to 2% of Medicaid liability with claim-level checks. We found no independent source for error rates by cause, recovery rates, or time to credit.

Share of Medicaid rebate dollars in dispute, by state

What nobody publishes about state invoice errors

We found no public figure for hours per state invoice, disputed units by cause, how many disputes are won, how long credits take, or how many states send claim-level data routinely. Treat any confident number on those with care, including one from a vendor. Your own past quarters answer all of them, and Part C shows how.

One vendor's 2021 announcement says manufacturers using its claim-level product find 1% to 2% of Medicaid liability as leakage on average. It gives no dataset, and we could read only an excerpt of it, because the page no longer opens.41

Drug Channels Institute put total gross-to-net reductions on brand drugs at $416 billion for 2025 and notes its scope has moved between years.42,40 A gap of 1% on a billion dollars of Medicaid liability is $10 million a year, so a validation process has to prove itself on a small share of a large number.

Overpaid rebates, interest, breach and an unsupported accrual: the price of a wrong call on a state invoice

In shortPay a wrong unit and the money rarely returns unless someone asks. Dispute a right unit and you owe it with interest, and lose standing with the state. Skip the forms and the shortfall is non-payment under the agreement. Each mistake also reaches the rebate reserve, which is a financial statement number.

Reading, matching, drafting: where software helps on a state invoice, and what a rebate manager keeps

In shortRule-based checks have been doing unit tests for years. AI adds reading: odd layouts, state notices, letters, and a first draft of the reasoning. It cannot supply claims a state will not send, and it should not decide whether a dispute is made in good faith. We found no regulator's rule on AI in this work, so internal controls and your evidence are the test.

A blind trial on your own Medicaid invoices, with bad units planted

We found no published independent test of these tools. The fair trial is your own. Take paid invoices with known answers, copy them, and plant errors of each type: a shifted decimal, a doubled package, a covered entity on the list for the wrong quarter, a stale URA, a correction read as an addition. Add clean copies to count false alarms. Report by type, with the number planted, because one overall accuracy figure hides the rare, expensive errors.

A Medicaid rebate quarter today: 51 clocks, spreadsheets and one signature

In shortAnalysts collect invoices from dozens of portals, load them, line up claims where they exist and test what time allows. The manager decides, government pricing checks the rebate amounts, accounting moves the reserve and counsel steps in on the large ones. The state clocks run in parallel, so a team may pay what it had no time to check.

Who touches a state invoice: analyst, manager, pricing, accounting, counsel

From postmark to settled dispute: where a state invoice changes hands

Matching and testing fill most of a hand-checked invoice's 20 working days

Twenty days across 51 invoices that land within weeks of each other cannot all be done in sequence. A team can rank states by dollars and give the smallest a line test only, which accepts some unchecked units. One vendor describes staff retrieving invoices by hand from a long list of portals, "spending countless hours", with limited time left for analysis.18 The interest clock on each state runs on its own.

Medicaid validation in spreadsheets, in a pricing system or at a processor

A $51.7 million sample invoice: 24 lines scrubbed, 14 disputed, and $47.4 million released on day 32

In shortThis is the example from the top of the page, inside the product. Agents read the invoice and match every line to the claims. Lena Ortiz, the rebate manager, sees 14 lines at ten times the claims, each with its reason. She approves 14 drafted disputes, the letter is written from her decisions, counsel co-signs, and the undisputed amount is released for day 32 as its value date, the day the money moves.

1

Every state invoice by stage and days left

Wednesday, October 7, 2026. Lena's screen lists the quarter: 48 of 51 invoices in, each with its days left. The invoice labeled New York has arrived through the state portal, postmarked October 1, a month past the 60-day mark the rule sets for states. The clock still counts from the postmark.

24 lines, 16 of them for earlier quarters, $51,739,198 claimed, 220,421 units and 14,230 prescriptions. Nothing has been checked yet, and she presses Scrub.

2

Each line matched as she watches

The claim-data matcher works down the lines, matching on prescription number, fill date and NDC. The units and pricing checker and the duplicate-discount checker test each line as it is matched, and a suspect line turns red as soon as it is found. Partway through, five lines have turned, and the suspect amount is already $1,892,230.

3

Fourteen lines at ten times the claims

The strip now reads $51,739,198 invoiced, minus $4,294,991 suspect, equals $47,444,207 supported by the claims. The 14 red lines are managed care adjustments for 2Q2025 to 1Q2026, with the same reason on each: ten times the claims, decimal shifted. The ten clean lines sit beside them at 1.00×.

4

Line 1: 240 pens invoiced, 24 supported

Lena opens line 1. All 12 prescriptions come from Kestrel Family Health's late encounter batch, re-sent to the state on August 14 after the plan moved claims systems. Each reports 20.0 pens for a fill whose package and days' supply give 2.0, while Kestrel's own history sits at 2.0 for eight quarters.

Each statement links to its source. The recommendation reads: dispute 216 units, $387,720.00, pay the 24 units the claims support, and ask the state to re-run the batch with the quantity corrected. Under 85% confidence, the checker recommends asking for claims instead.

5

The claim rows and the tablet line

The first source opens the state's claim file: each row with its claim number, prescription number, plan and NDC. Those rows go with the dispute. Line 14 shows the same fault on another product: 3,600 Dravenzo tablets on 12 prescriptions, 300 per prescription for a bottle of 30, against 30.0 in the plan's history, $299,376.00 to dispute.

6

Fourteen disputes drafted, one tracker each

Draft 14 disputes writes one per suspect line: the reason, the units, the amount and the evidence. Each gets a tracker that runs from drafted through approved, sent with payment and state reviewing to resolved.

The screen words the reason plainly, as units not supported by claim data. On the federal forms the same reason carries CMS's letter codes, Q and S among them. Lena approves all 14.

7

The letter is written only from her decisions

The letter states the amount paid for undisputed use, lists every disputed line with its NDC, type, period, units, amount and reason, explains why, and offers a dispute resolution meeting. The disputed lines are all for prior quarters, so they belong on form CMS-304a. The letter encloses CMS-304 as well because the invoice also carries current-quarter lines.

Under the rebate agreement, it says, the maker disputes the units below in good faith, $4,294,990.80 in all.

8

Above $1 million, counsel co-signs

The signing screen shows what she is committing to: pay $47,444,207.20 for a November 2 value date, dispute $4,294,990.80 on 14 lines, and send the letter through the state portal. The disputes pass $1,000,000, so Dana Okafor, counsel for government programs, signs too.

November 2 is day 32 from the postmark, inside 30 days from receipt and six days before interest could begin to count. The header then reads paid October 7, the day the payment was released.

9

Paid, booked, and each dispute open

The payment and accrual agent releases the undisputed amount and posts the true-up. Disputed dollars stay in the reserve. Fourteen dispute records open from D-1236, each marked as sent. The statement shows each line's paid and disputed units, and the waterfall ties back to the invoice.

The solution's own figures for this kind of invoice are estimates and targets. Part C tells you how to measure them on your own invoices.

The sample Ohio invoice's five findings, and the screens that run the rest of the rebate quarter

In shortThe sample Ohio invoice shows every kind of check on one bill: a doubled pen, a 340B match, a plan overlap, a stale rebate amount and a correction. The other screens show the record behind each decision, every invoice, the map, the open disputes, what the quarter found and the settings that belong to you.

Five findings on one state invoice, from doubled pens to a stale rebate amount

Signatures, the activity record and what happens after payment

Every state on one screen: invoices, days left and the payment clock

State names, dollars and dates on these screens are sample data. No state sent these invoices or holds these disputes.

Open disputes, sample recoveries and the settings you control

State names on these screens label sample data. No state holds these disputes.

Every flagged Medicaid line goes to a rebate manager, after six agents check and draft

In shortEach agent has one job and limits it does not cross. None signs or pays. The rebate manager decides each suspect line, counsel adds a signature above $1,000,000, government pricing reviews wrong rebate amounts and accounting approves entries over $5 million. Each finding keeps its source, and every action is on the audit trail.

The six agents on a state invoice, and what each refuses to do

Rebate manager, counsel, pricing, accounting: who signs off what on a state invoice

Role-based access, maker-checker and an audit trail are controls that support your financial reporting and your own compliance work. Security: SOC 2 Type II audited, with information security managed to ISO 27001.

Lena, Sam, Omar and Dana on the sample screens

What the solution reads and writes: state invoices and claim files, then cited lines, letters and a true-up

In shortIt reads what the quarter already runs on, and works alongside your government pricing and finance systems. The result is a decision on every line, a letter and statements per state, a payment file and a true-up, and a record of each open dispute. Numbers below are the solution's design targets and estimates, to be measured on your own invoices.

The solution's estimate for a state invoice: 2.6 days against 20 by hand

$12.4M, 32 of 32, $10M+: the solution's Medicaid targets and their basis

The portals, pricing system and ERP a Medicaid rollout touches

What keeps running as it does today: your pricing system, signers and state relationships

Unchecked units and late decisions: the bill a manufacturer pays on Medicaid invoices

In shortStart from your own paid invoices. We found no regulator or independent study that publishes how much Medicaid rebate money is paid on wrong units. What is published frames the stakes: the size of the flow, the 37 clear days before interest, and the 12 quarters you have to raise a challenge.

Six places overpaid Medicaid rebates hide, and how to size each in a week

Good-faith questions, reserve surprises and other costs outside the arithmetic

The return on checking every state line: credited dollars, analyst hours and the tool's cost

In shortPut in your own numbers. The calculator separates what is found from what comes back, because a dispute only saves money once a state accepts it. Nearly every default is an assumption to replace. Two inputs decide the answer: how much you already find, and how much states accept.

Six places checking every line pays back: units, 340B, corrections, hours, interest, accruals

Work out your Medicaid return from rebates invoiced, share disputed and share credited

A team already running claim-level validation across all states will see the first bar or less. A team paying most lines unchecked has more to find. If your review of one paid quarter shows little, say so before buying anything.

Scoring your Medicaid rebate team on states, claim data, dispute records and sign-off

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Under 7: get claim data and dispute records in order before a pilot

Eighteen vendor questions on claim matching, CMS codes and 340B evidence, with the answers to expect

In shortAsk every vendor the same questions, us included. The answers show how the checks run: what the tool reads, what it calls a match, how it treats CMS's unit rule, what evidence you keep and how you would measure it on your own invoices.

The planted-error test in section 12 also measures your current process.

A 14-week Medicaid pilot: paid invoices with planted errors, a live quarter, then a decision

In shortMeasure first, then test on your own paid invoices with errors you planted, then run a live quarter in parallel, then decide with three numbers. None of these steps commits you to a vendor.

1. Time three state invoices, one large, one small and one with many prior-quarter lines. That is your baseline.
2. Pull last year's evidence: disputes filed and credited, interest paid, true-ups, and any audit comments on Medicaid.
3. Gather paid invoices from eight to ten states with claim files, and clear each state's data terms. Copy them and plant known errors.
4. Run in parallel on a live quarter with your people deciding and signing, and your normal process still paying.
5. Decide with three numbers: catches by error type, false alarms on clean copies, and hours from postmark to decision.

Five measures that settle a Medicaid pilot

The 38 days, disputes, ROSI, 340B and interest: Medicaid rebate invoice questions people search

In shortThe questions rebate teams and buyers search for, each answered on its own.