Most billing reviews are a nuisance. A UPIC audit is a different category of event, and the difference is worth understanding before one arrives rather than during.
A UPIC audit is a federal program integrity investigation conducted by a Unified Program Integrity Contractor on behalf of the Centers for Medicare and Medicaid Services. Its purpose is detecting fraud, waste, and abuse in Medicare and Medicaid billing. Unlike a routine claims review, a UPIC review can lead to extrapolated overpayment demands, suspension of payments, revocation of billing privileges, and referral to the Office of Inspector General or the Department of Justice.
If your practice bills a federal health program, this is worth an hour of your attention now.
Who UPICs are and how they differ from other auditors
UPICs are private companies under contract with CMS. They replaced the older Zone Program Integrity Contractors beginning in 2016, and the consolidation gave them broader data access and stronger analytics across both Medicare and Medicaid. Five contractors cover the country, each assigned to a CMS geographic jurisdiction, and their work spans Medicare Parts A and B, durable medical equipment, and home health and hospice.
The distinction from the other contractors you may have dealt with matters:
- MACs process claims, educate providers, and conduct routine medical review. A MAC finding is usually a claims problem.
- RACs identify and recover improper payments. A RAC finding usually costs money.
- CERT measures the program's own error rate rather than auditing you for your sake.
- TPE is targeted probe and educate, which is explicitly corrective and comes with education.
- UPICs are the fraud tier. A UPIC finding can cost the practice.
That last line is not rhetoric. UPIC work can include interviews, unannounced site visits, payment suspension, and law enforcement referral, none of which are tools the other contractors reach for.
What puts you on the list
Selection is largely data-driven. Common triggers include billing patterns that make you a statistical outlier against your peers for a particular code or service, high volumes of a high-risk service, unusual utilization patterns, complaints from patients or former employees, referrals from a MAC or a state Medicaid agency, and association with a provider or supplier already under review.
Being an outlier is not evidence of anything. Plenty of legitimate practices are outliers because of specialty mix, patient population, or a service line their peers do not offer. But the analytics do not know that, and being an outlier is enough to get you a letter.
What arrives, and the clock it starts
The audit generally opens with an Additional Documentation Request identifying the claims under review and specifying what documentation is required. Under the Medicare Program Integrity Manual, the reviewer is directed to request the specific documentation needed to make a determination on the sampled claims: the medical record, the order or referral, evidence of medical necessity, and signature documentation for the dates of service at issue.
You typically have 30 calendar days to respond, which is shorter than the window MACs and RACs allow, and some requests come with even less time. The clock does not pause for staff turnover, a busy billing office, or a practice owner on vacation. If no response arrives, the claims are denied for missing records, and a denial for missing documentation is the worst possible starting position for an appeal, because there is nothing in the record to argue about.
The tools a UPIC can use
Prepayment review. Claims are held and reviewed before payment. This is the one that hurts a small practice fastest, because it stops cash flow while your costs continue.
Postpayment review with extrapolation. This is the mechanic that turns a modest sample into a large number. The contractor reviews a statistically drawn sample, calculates an error rate, and extrapolates that rate across the entire universe of claims in the review period. A thirty-claim review can produce a six or seven figure demand. Challenging the extrapolation methodology is often as important as challenging the individual claim determinations.
Payment suspension. Where there is a credible allegation of fraud, payments can be suspended while the investigation proceeds.
Site visits and interviews. Including unannounced visits and interviews with staff who have never been prepared for one.
Referral. To the OIG, to the Department of Justice, or to a state Medicaid program integrity unit.
Revocation. Recommendation to revoke Medicare billing privileges, which carries a reenrollment bar.
What happens after the review
The contractor issues review results, and the MAC follows with a demand letter stating the overpayment amount. From that point the deadlines run on two different tracks, and confusing them is a common and expensive error.
Interest generally begins accruing on the thirty-first day after the demand letter. Absent an appeal, recoupment from your current payments begins around day forty-one.
The appeal path has five levels: redetermination by the MAC, reconsideration by a Qualified Independent Contractor, a hearing before an Administrative Law Judge, review by the Medicare Appeals Council, and finally federal district court. Each level has its own filing deadline, and each of the first two has a shorter deadline to stop recoupment than to preserve the appeal itself. Filing within the appeal deadline but after the recoupment deadline means you have preserved your rights while money is already being taken back. Calendar both dates the day the demand arrives.
What to do in the first seventy-two hours
Read the letter carefully and identify three things: exactly which claims are in scope, exactly what documentation is requested, and the precise response deadline.
Get help immediately. That means a coding and documentation professional who can assess the records objectively, and healthcare counsel, particularly if there is any indication the review is fraud-focused rather than documentation-focused. Engaging counsel early also matters for protecting the internal review work you are about to do.
Do not alter records. Late entries and addenda made after a records request are visible in EMR audit logs, and a legitimate documentation problem becomes something much worse the moment it looks like an attempt to fix the record retroactively.
Assemble the response completely and document what you sent, when, and how. Send it in a way that produces proof of delivery, and keep an exact copy of the production.
Communicate early if you need an extension. Contractors sometimes grant them, and asking is free. Missing the deadline without asking is not.
Preparing before you get one
The practices that come through these well are the ones that did unremarkable things consistently.
Run internal chart audits on your highest-volume and highest-dollar codes on a regular schedule, and treat the findings as education rather than as a filing exercise. Make sure signature and date requirements are met on every note, since missing signatures produce denials that have nothing to do with the quality of the care. Confirm that orders, referrals, and documentation of medical necessity are actually in the record rather than assumed. Keep your enrollment information current in PECOS. Know how to pull a complete record for a date of service from your EMR quickly, including the audit trail, because you will be doing it under time pressure eventually.
And keep a compliance program that exists in practice. The OIG's general compliance program guidance describes routine auditing and monitoring as a core element for a reason, and a documented internal audit history is genuinely useful when a contractor is deciding whether your errors look like a documentation problem or a pattern.
A note for cash-pay practices
If you do not bill Medicare or Medicaid at all, UPIC review is not your exposure. Two cautions anyway. Many practice owners retain Medicare enrollment from a prior setting without realizing it, and enrollment carries obligations. And if you are considering adding any federal program billing, including the newer coverage pathways for weight management drugs, understand that the compliance posture of your practice changes the day you do.
How I help
At Camino Strategy Group we build the compliance infrastructure that makes an audit survivable: documentation standards, internal audit cadence, policies people actually follow, and the records that demonstrate oversight when someone asks for it. If you have received a records request, or you want to know how your documentation would hold up before anyone asks, reach out and we will walk you through it.
References
- CMS Medicare Program Integrity Manual, Chapter 3 (Verifying Potential Errors and Taking Corrective Actions) and Chapter 4 (Program Integrity)
- 42 C.F.R. Part 405, Subpart I (Medicare appeals procedures)
- 42 C.F.R. 405.371 (payment suspension)
- HHS Office of Inspector General, General Compliance Program Guidance: https://oig.hhs.gov/compliance/general-compliance-program-guidance/
- CMS, Medicare Program Integrity contractors: https://www.cms.gov/