The Drug Went Over the Counter. The NDC Never Did.
OIG found $587.7 million in Part D payments for five drugs whose brand-name versions went OTC years earlier. We ran the same test against today's NDC Directory: fifteen of those prescription listings are still live, and naloxone has eight more sitting outside the audit window.
Allergan lists Lastacaft under two NDCs.
The first, 0023-4290, has been a prescription drug since November 2010. The second, 0023-4291, has been over the counter since December 2021.
Same company, same NDA, same 2.5 mg/mL of alcaftadine in the same bottle. Both listings are active in the FDA NDC Directory right now, and the labeler certified both as current through December 31 of this year.
That pairing is the entire mechanism behind a $587.7 million finding HHS OIG issued on August 31 and posted Wednesday, and it is sitting in public data anyone can query.
Where the Money Actually Went
Report OAS-24-02-004 looked at Part D prescription drug events for CYs 2021 through 2023, covering six brand-name drugs that switched from prescription-only to OTC during CYs 2020 through 2022.
Five of the six produced ineligible payments: $587,680,439 across 16.8 million PDEs and 35 NDCs. Part D does not cover products you can buy without a prescription, so none of it was a covered drug by the time it paid.
The distribution is the first thing worth your attention (chart above). Generic equivalents of Voltaren, the topical diclofenac sodium 1% arthritis gel, account for $562.1 million of the total.
That is 96% of the finding on one product family, at an average of $35.42 per PDE.
Everything else rounds to noise. Pataday generics came to $25.5 million, Astepro to $95,703, Lastacaft to thirteen prescriptions totaling $3,413, and Sklice to six prescriptions worth $1,469.
And the annual trend runs the wrong way. Part D paid $184 million in 2021, $194.54 million in 2022, and $209.14 million in 2023, so the last year of the audit was the biggest one.
OIG is not recommending recovery, which tells you where the fault sits. The sponsors paid these claims in compliance with CMS's own Formulary Reference File and CMS's own guidance on selling through existing inventory.
The File Is the Policy
Here is how a covered drug stays covered after it stops being one.
- FDA approves a full Rx-to-OTC switch for a brand-name drug and posts it to the public switch list.
- Under 21 CFR 314.94(a)(8)(iv), every generic equivalent must switch its own labeling or stop marketing, because a generic has to carry the same labeling as the brand. Rx labeling on a switched molecule is obsolete, and the product is deemed misbranded under 21 USC 353(b)(4).
- The generic manufacturer is supposed to delist the Rx NDC and list a new OTC one. FDA populates the NDC Directory from those self-submitted listings, self-certified once a year.
- CMS builds the monthly Formulary Reference File from FDA data plus commercial databases, and directs sponsors to drop the product once the OTC version is on the market.
- CMS's Drug Data Processing System checks every incoming PDE's NDC against those same databases and rejects it if the NDC carries an OTC category code.
Every step after the first depends on the manufacturer telling FDA something. If nobody delists the Rx NDC, the NDC Directory keeps reporting a live prescription product, the FRF keeps carrying it, DDPS finds no OTC category code, and the PDE pays.
OIG puts CMS's position in one sentence: "CMS has no control over the accuracy or completeness of NDC data in FDA or commercially available databases."
Then there is the grace period. CMS lets manufacturers sell existing Rx-labeled inventory under Part D after a switch, and never set a date by which sponsors have to start rejecting it.
FDA had no deadline either, and told OIG it relied on complaints from other manufacturers to start its notification process.
So eight Voltaren generic equivalents were still being sold as prescription drugs in CY2023, almost four years after the brand went to the shelf.
The rest of this brief is for subscribers.
The impact tables, the code-level detail, and the rest of the analysis sit past this line.
$50 a month, or $500 a year.
Already a subscriber? Sign in