OPINION OF THE COURT
DONALD D. CONN, Hearing Officer.Final Order signed by Robert B. Williams as Assistant Secretary for Programs, for the Department.
FINAL ORDER
This matter comes before the Department of Health and Rehabilitative Services upon the receipt of the Recommended Order of Donald D. Conn, Hearing Officer, Division of Administrative Hearings, entered August 17, 1988. Upon consideration, it is ORDERED as follows:
The final hearing in this case was held in Tampa, Florida, on June *22722, 1988, before Donald D. Conn, Hearing Officer, Division of Administrative Hearings.
The issue in this case is whether David’s Pharmacy (Petitioner) over billed Medicaid for drugs provided to Medicaid recipients, and whether the Department of Health and Rehabilitative Services (Respondent) should impose sanctions against Petitioner for these alleged violations of Medicaid policy. The Respondent presented the testimony of five witnesses and introduced seven exhibits; two witnesses testified on behalf of Petitioner, the testimony of one witness was preferred, and five exhibits were introduced. The transcript of the final hearing was filed on July 25, 1988, and the parties were thereafter allowed ten days to file proposed recommended orders and memoranda.
FINDINGS OF FACT
1. In November, 1987 a routine Medicaid audit was conducted on Petitioner’s pharmacy by representatives of Respondent. The audit period was from January 1, 1987 to September 30, 1987. As a result of this audit, an overpayment in the amount of $43,708.05 was identified.
2. Petitioner timely requested a hearing after receiving Respondent’s notice of overpayment and imposition of administrative fine on or about March 14, 1988.
3. A reaudit of Petitioner was performed by Jo Ann V. Padell, R. Ph., on May 26 and 27, 1988, on behalf of Respondent. Petitioner cooperated fully in this reaudit. After reviewing additional data, and making adjustments to the initial calculations, the overpayment amount was identified to be either $6,079.34 or $32,683.31, depending upon varying assumptions used in the calculation. The overpayment amount relied upon, and pursued by Respondent at hearing is $32,683.31. Petitioner was informed by letter from Respondent dated June 15, 1988 that Respondent seeks the recoupment of the $32,683.31 overpayment, a $10,000 administrative fine and a three month suspension of the pharmacy from the Medicaid program.
4. Petitioner is under contract with Respondent to participate in the Medicaid program by providing prescription drugs to Medicaid recipients, and receiving Medicaid reimbursement. It is located in a low socio-economic neighborhood in Tampa, Florida and many customers cannot afford medications unless paid for by the Medicaid program. Petitioner has participated in the Medicaid program for over ten years, and has not previously had any problems with Respondent’s audits.
5. David Cartaya is the owner and operator of Petitioner. He is a registered pharmacist, and has an excellent reputation in the commu*228nity for truthfulness and veracity. Respondent’s representative who conducted the reaudit in May, 1988, Jo Ann V. Padell, indicated in her report that she trusts Cartaya’s sincerity and professionalism as a pharmacist and business owner. She also reported that it “seemed obvious that their (Petitioner’s) business could substantiate their claims to Medicaid.”
6. In determining that Petitioner had been overpaid by the Medicaid program, Respondent followed a procedure which is not set forth by agency rule. The procedure used in this case had never been used before; it is substantially set forth in a manual entitled “Florida Medicaid/PRO Pharmacy Audit Program,” dated March, 1988, which had been adopted by the Medicaid office of Respondent for use as guidelines in the conducting of audits of pharmacies. An essential element of the audit procedure set forth in this manual, establishing a beginning and ending inventory of drugs available for dispensing, was not conducted by Respondent in this case. Therefore, there is no formally adopted rule or policy of Respondent which is applicable in this case and which sets forth the Medicaid audit procedure used in this case. The procedure in the manual was not followed in this case. Rather, the Respondent utilized incipient, non-rule policy, and then sought to explicate that policy at hearing.
7. The audit policy followed by Respondent in this case is a four step process set forth in its letter to Petitioner dated March 14, 1988, as follows:
a) We (Respondent) determined from your (Petitioner’s) invoices and suppliers’ statements the total number of units of the drug available to be dispensed to all customers during the audit period, and we multiplied that number by the fraction (proportion) of your business that is Medicaid to obtain the total number of units of the drug available to be dispensed to Medicaid recipients.
b) We increased the number in (a) of the units of the drug available for Medicaid recipients by an additional one-fourth in case an unusually large proportion of that drug happens to be dispensed to Medicaid recipients.
c) We multiplied the adjusted number found in (b) of the units available for Medicaid recipients by the unit price paid by Medicaid for that drug to determine the highest total dollar amount that Medicaid reasonably should have paid to you for that drug during the audit period based on your invoices from your suppliers.
d) We subtracted the highest amount that Medicaid reasonably should have paid you for the drug during the audit period found in
*229(c) from the amount that Medicaid actually did pay you for the drug, and the result we must consider to be an overpayment, unless you can provide additional invoices showing that you had the drug available to be dispensed or unless you can provide documentation showing that an even larger proportion of that drug is, on the average over an extended period of time, dispensed to Medicaid recipients. Please bear in mind that we have already increased the proportion regarded to be available for Medicaid recipients by one-fourth or 25%.
The drugs audited were the 100 drugs for which the highest dollar amounts were paid to Petitioner by Medicaid during the audit period. Respondent’s review was an attempt to determine if Petitioner had adequate inventory to cover the claims made. This audit policy has never been validated.
8. Petitioner was the first pharmacy audited by Respondent using this procedure. Rather than it being an audit conducted fully in accordance with generally accepted accounting principles, the procedure estimated overpayments for a listing of drugs sold during the audit period. The listing consists of the 100 drugs for which Medicaid paid the highest dollar amounts to Petitioner during the audit period. It is usual and customary for Respondent to rely on estimates based upon samples, since this provides reasonable assurance that the estimates produced fairly represent the financial condition of the pharmacy under review. Sampling is also less onerous and time consuming for the pharmacy being audited. The use of the sample size identified in this case has never been validated.
9. The beginning and ending inventories of the 100 drugs evaluated by Respondent in this case were not known by Respondent, and were not used in calculating what inventory was available during the audit period, although this is a step in Phase II of the audit process as stated in Respondent’s manual, which it relied upon at hearing as a statement of its incipient policy.
10. The 15% by which a pharmacy’s overall Medicaid percentage is to be increased, as provided at (b) of the incipient audit procedure set forth in Finding of Fact 7, was chosen arbitrarily, and Respondent presented no evidence which would form a reasonable basis for utilizing this figure. Respondent’s own expert in account, Robert West, testified that he did not know how the Respondent came up with the 25% factor.
11. It is well established that there are seasonal variations in the pharmacy business, especially in central and south Florida which have *230seasonal population increases. Seasonal variations in the volume and kinds of drugs dispensed result in variations in a pharmacy’s inventory. Yet, according to Robert West, the audit procedure used in this case assumed that seasonal and inventory variations were immaterial, and did not account for such variations, other than through the arbitrary 25% factor. Additionally, the audit period itself only covered nine months, and therefore variations occurring in the remaining three months were not considered.
12. The drugs audited consisted of the top 100 drugs, by dollar amounts, dispensed at Petitioner. A more defensible technique would have been taking a random sample of all prescriptions, according to Robert West, since this technique, he said, would have produced a more representative sample.
13. The original audit of Petitioner was on November 16, 19, 20, and 27, 1987 by Patricia J. Yanderbeek of Professional Foundation for Health Care, Inc. (PFHC), representing Respondent. This original audit, termed a Phase I-Part B report, concluded:
David’s Pharmacy appears to be legitimate in their contractual agreement with Medicaid. PFHC does not recommend to proceed with Phase II Audit procedures.
PFHC based this recommendation, in part, on the report of the certified public accounting firm of Copeland and Company, which concluded that no overpayment was, indicated. Despite this recommendation, a Phase II audit was conducted, using the procedure set forth at Finding of Fact 7, above, and a report prepared in which the overpayment amount was initially identified at $43,708.05.
14. The manual, upon which Respondent relies as a statement of its incipient policy, clearly requires the Phase I auditor to obtain authorization of the Medicaid Fraud and Abuse Section before proceeding with a Phase II review. A Phase II review can only be initiated with the approval of the Medicaid Program Integrity Office. In this case, the Phase I audit resulted in the recommendation that Phase II not be conducted. Nothing in the record establishes that approval and authorization for the Phase II audit, or the Phase II reaudit conducted by Padell, as required by the manual on which Respondent relies, was ever sought or given.
15. In the Phase II reaudit, Padell questioned Petitioner’s owner and sole pharmacist, David Cartaya, about his estimate of the percentage of each of the top 100 drugs he dispensed to Medicaid patients, and she found his estimate to be credible. Utilizing Cartaya’s percentages, the amount of the overpayment was calculated to be $6,079.34, which *231Padell felt was reasonably accurate. However, the estimate was also calculated without determining beginning and ending inventories.
16. As a result of Padell’s reaudit, 32 of the top 100 drugs were not shown to have been overpaid, and that 32 drugs were thereafter ignored in Respondent’s calculation of the $32,683.31 overpayment which is the subject of this case. That is, Respondent estimated the overpayments on the remaining 68 drugs and took the position that there were no underpayments. Beginning and ending inventories were also not calculated in arriving at this overpayment amount.
17. Competent substantial evidence was not offered by Respondent to support its position that $32,683.31 has been paid to Petitioner, contrary to the reports and recommendations of its own representatives and consultants, Padell, PFHC and Copeland and Company. It has not been established that Petitioner over billed Medicaid for medication patients did not receive.
18. David Suhrweir, a representative of Respondent involved with post-payment review of Medicaid payments, testified at hearing and critiqued Padell’s reaudit conclusion that the amount of overpayment was $6,079.34. He termed this calculation irrational since it results in the conclusion that the pharmaceutical needs of Medicaid patients are very different from the needs of non-Medicaid patients, which he found to be illogical. However, James E. Martinez, who was accepted as an expert in pharmacy, gave competent, credible testimony that Medicaid patients are more likely to obtain expensive brand name drugs, and non-Medicaid patients are more likely to obtain the less expensive generic drugs. He said that this is because persons without Medicaid coverage in the poor neighborhoods that use Petitioner for their pharmaceutical needs are more likely to request the less expensive generic drugs than those persons with Medicaid coverage. Therefore, according to Martinez, the utilization of drugs is skewed, and the procedure utilized by Respondent does not take this into account. The testimony of Suhrweir does not discredit Padell’s calculation of the $6,079.34 overpayment, and does not establish a basis upon which the alleged $32,683.31 overpayment can be supported.
19. It is common practice for pharmacies to exchange or barter inventory, and such exchanges might not appear on any record of drugs purchased.
20. Since its March 14, 1988 letter, Respondent has been withholding payment of ten percent of Petitioner’s Medicaid billings.
21. Medicaid providers, such as Petitioner, are required to keep records and invoices to support Medicaid billings, and to provide them *232to Respondent upon request to facilitate audit procedures. Neither the auditor who performed the initial audit nor the auditor who performed the reaudit found Petitioner’s owner and operator, Cartaya, to be uncooperative, and in fact Padell was impressed with his truthfulness. There is no indication that he withheld, or failed to produce any requested information that he had available. None of Respondent’s on-site auditors recommended pursuing the amount Respondent now contends was an overpayment.
CONCLUSIONS OF LAW
The Division of Administrative Hearings has jurisdiction over the parties and subject matter in this cause. Section 120.57(1), Florida Statutes. The Respondent, as the party seeking to establish that Petitioner over billed Medicaid for drugs provided to Medicaid recipients, has the burden of proving this allegation, and establishing a basis for the sanctions it seeks to impose on Petitioner, by a preponderance of the evidence. Florida Department of Transportation v J.W.C. Co., Inc., 396 So.2d 778 (Fla. 1st DCA 1981).
The Respondent is required to take all necessary steps to recover Medicaid payments paid to providers through fraud or mistake, including the withholding of reimbursement payments until an overpayment is recovered. Section 409.335(1), (2), Florida Statutes. In addition, Section 409.266(14), Florida Statutes, provides:
Medicaid assistance payments to a provider, received as a result of a violation of this section, may be withheld pending completion of an investigation under this section when there is reasonable cause to believe that a provider has committed one or more violations resulting in such payments. However, when payments are withheld, the monthly medical assistance payment shall not be reduced by more than 10 percent. Payments withheld under this section shall be paid to a provider within 60 days at 10 percent interest per year on determining that no such violation has occurred.
Further sanctions are authorized by Section 409.266(12), to include suspension from the Medicaid program for up to a year and imposition of an administrative fine of up to $10,000. Therefore, the Respondent has the authority to impose the specific sanctions sought in this case is the facts established at hearing support such imposition.
It is clear that Respondent has not proven that any actions of Petitioner constitute fraud or mistake, and therefore Section 409.335 is not applicable. The testimony and reports of the Respondent’s representatives and auditors who conducted the on-site review of Petitioner’s *233records uniformly establish Petitioner’s truthfulness and veracity, and he has an outstanding reputation in the community.
Section 409.266(11), Florida Statutes, sets forth grounds in addition to fraud or mistake, upon which Respondent may impose the authorized sanctions:
409.266 Medical assistance—
* * *
(11) The department may impose administrative sanctions on a provider participating in the Medicaid program when:
* * *
(f) The provider has refused access to Medicaid records to authorized auditors or investigators acting as employees or agents of the Fraud and Abuse Unit or audit staff of the department, the Medicaid fraud control unit or the Division of Public Assistance Fraud of the Auditor General, a state attorney, or the Federal Government;
(g) The provider is in noncompliance with officially adopted depártment Medicaid policy manuals, the Florida Administrative Code, the Florida Statutes, or the Federal Rules and Regulations as they pertain to the Medicaid program:
(h) The provider fails to comply with conditions prescribed in any Medicaid provider agreement executed between the department and the provider or contained in certifications found on claim forms signed and submitted by the provider or a duly authorized representative.
The record establishes that Petitioner was fully cooperative with Respondent. In fact, on the basis of records and information Petitioner provided, Respondent arrived at two different recalculations of the alleged overpayment after its initial determination of $43,708.05. Petitioner did not withhold anything. While Respondent apparently wanted Petitioner to disprove its estimation of an overpayment, no administrative rule, policy or manual was referenced which identifies the specific records Petitioner allegedly failed to keep or produce, or which places this burden to disprove Respondent’s calculation of overpayment upon Petitioner.
Rule 10C-7.042(17)(a), Florida Administrative Code, does require pharmacies to furnish Respondent “with all information regarding claims submitted to the Medicaid program and . . . (to) permit access to all Medicaid records for the purpose of claims audit. . . . This includes all pharmacy invoices with said invoices being retained for a *234period of at least three years from the date of invoice.” See also Rule 10C-7.030(8). While Petitioner’s records and invoices may not have been as orderly as Respondent would have liked, this rule does not require that Petitioner keep its records and invoices in any particular manner. Additionally, Respondent has not established that Petitioner failed to produce records and invoices for the nine month period being audited. To the contrary, Petitioner produced these records and they were considered by Respondent’s auditors. The relevance of records and invoices beyond or outside of the audit period was not established, and therefore any failure of Petitioner to retain records for the full three year period is deemed irrelevant to the issues in this case, which are strictly limited to the alleged overpayments to Petitioner between January and September, 1987.
Therefore, Respondent has failed to establish any basis for action against Petitioner under Section 409.335, Florida Statutes (fraud or mistake) or under Section 409.266(1 l)(f), (g), Florida Statutes (refused access to records or failure to maintain records). It is also clear that the procedure by which the audit and review of Petitioner was conducted in this case is not set forth in any statute, agency rule, or manual, or in federal rules and regulations as they pertain to the Medicaid program. The Respondent admittedly applied the audit procedure used in this case for the first time against Petitioner, and the only expression of this procedure, other than in the letter assessing sanctions against Petitioner, is in a manual entitled “Florida Medicaid/ PRO Pharmacy Audit Program.”
While it is well settled that not every expression of agency policy must be codified in formally adopted rules, Barker v Board of Medical Examiners, 428 So.2d 720 (Fla. 1st DCA 1983), the applicable statute in this case leaves no doubt that sanctions may only be imposed when a provider is in noncompliance with the Florida Administrative Code. Section 409.266(11). This specific expression of legislative intent applicable in this case must prevail over the generally recognized principle that agencies may proceed under incipient policy.
If the Respondent were to be allowed to urge that a basis exists in incipient policy for its action in this case, it must still explicate that policy at hearing. McDonald v Department of Banking & Finance, 346 So.2d 569 (Fla. 1st DCA 1977); Department of Commerce v Matthews Corp., 358 So.2d 256, 259 (Fla. 1st DCA 1978). The Respondent has failed to explicate its policy by failing to produce evidence that would establish a rational, reasonable basis for the procedure utilized in this case. The 25% factor is arbitrary and without any basis. No beginning or ending inventories were taken. Seasonal variations were ignored. The *235common practice between pharmacies of exchanging non-controlled substance inventories was not considered. The character of the neighborhood and customers of Petitioner, and how this affects whether generic drug substitutes are requested, were not taken into account. The sample chosen, the top 100 drugs rather than a random sample, is a less defensible sampling technique. No effort to validate the audit procedure used in this case has been made.
Therefore, the Respondent has not explicated its non-rule policy which was used in this case to conduct the audit of Petitioner, and as such there is no basis upon which to conclude that Respondent has shown that Petitioner was overpaid for Medicaid claims submitted during the audit period.
Based upon the foregoing, Respondent hereby dismisses this action against Petitioner and will promptly refund any funds withheld plus appropriate interest as authorized by Section 409.335(3), Florida Statutes; further, Respondent hereby removes all other sanctions imposed upon Petitioner arising from the audit which is the subject of this case.
DONE AND ORDERED this 15th day of September, 1988, in Tallahassee, Leon County, Florida.