Millions of people with severe asthma and allergies rely on the EpiPen. It’s made by Mylan, a drug company that’s unpopular despite its lifesaving product because it has increased retail EpiPen prices 600% in the last decade while also being accused of overcharging the US government for the device by improperly classifying the device as a generic treatment with the Medicaid Drug Rebate Program,

New government estimates suggest that Mylan may have actually made an extra $1.27 billion on federal rebates for the device, far more than the $465 million the company agreed to pay to settle misclassification claims with the Department of Justice last October.

Manufacturers participate in the Medicaid Drug Rebate Program in order to have their drugs covered by the government. Government agencies buy the drugs from the manufacturers, and then the manufacturers pay the government different rebate amounts for products based on various classifications—generic and brand name, among others. Because EpiPen has been classified as generic, Mylan owed less in rebates per device than it would if it were considered a branded product.

On May 31, Chuck Grassley, chairman of the Senate Judiciary Committee, received an estimate from the Department of Health and Human Services Office of Inspector General (HHS OIG) indicating that taxpayers may have overpaid as much as $1.27 billion from 2006 through 2016 for EpiPens because of its generic classification.

Still, the estimate is rough, the HHS OIG warns (PDF), as it doesn’t calculate differences based on state supplemental rebates. The agency also says it doesn’t determine whether Mylan actually misclassified EpiPen. Lawmakers say the generic classification is inconsistent with how EpiPen is classified in other contexts, for example Medicare Part D. Mylan insists that its generic classification follows the federal guidelines.

What the new HHS OIG letter does show is that Mylan earned much more money by classifying its drug as generic than was previously believed. It also explains how classification works, and why so much money would be lost due to a misclassification.

According to the agency, the classification of a drug is a key factor in determining the amount of rebates that a manufacturer owes under the Medicaid Drug Rebate Program. Generally, manufacturers get a higher rebate for generics: 13% of the average manufacturing price. Rebates for brand name drugs are calculated in a more complicated fashion, choosing between the higher of either average manufacturing price (23%) or adjusted “best price per unit” (not a fixed percentage) and percentage points are added to account for any increase in a drug’s price exceeding the rate of inflation.

In other words, because EpiPen was classified as a generic, Mylan only had to pay out a 13% rebate, despite the 600% price increase in the device—far beyond inflation—over the relevant years.

But Mylan denies misclassifying and Dey Laboratories, the previous EpiPen manufacturer, did appear to get permission for generic classification from HHS in 1997. At the time, the agency noted though the the drug used in EpiPens—epinephrine—wasn’t new and was made by multiple manufacturers, the spring-loaded device packaged and administered it in a new way.

Since then, however, the Center for Medicare and Medicaid Services (CMS) claims Mylan has been warned about its generic classification. In September, the CMS told media that it “has, on multiple occasions, provided guidance to the industry and Mylan on the proper classification of drugs and has expressly advised Mylan that their classification of EpiPen for purposes of the Medicaid Drug Rebate program was incorrect.”

Based on that statement, last October Grassley requested information from CMS about exchanges the agency had with Mylan. Grassley believes CMS and Mylan are thwarting authorities’ efforts to investigate; the senator renewed his request for evidence to CMS in Feb. 2017, writing, “Despite the public pronouncements, CMS has failed to provide any evidence of its communications with Mylan and has failed to describe the steps it took to hold Mylan accountable. The American people and Congress deserve answers, and CMS is obligated to provide them.”

The company proposed to settle the matter with the Department of Justice for $465 million last October and says it’s still working on a final agreement. But settlement doesn’t necessarily mean an admission of wrongdoing and it seems that Mylan would have gotten off cheap, considering it seems to have earned almost three times more than that in misclassified rebates. Additionally, Mylan could be subject to fraud charges if there’s proof it deliberately bilked the government.

Grassley has expressed frustration with CMS before and today blamed Mylan for thwarting authorities’ efforts to investigate the issue, threatening legal action. “The fact that Mylan is unwilling to cooperate and provide documents voluntarily makes me wonder what there is to hide and whether a subpoena is the only way to get to the bottom of this,” Grassley said.