Unified Program Integrity Contractors: Audits, Overpayments, and Appeals

A Unified Program Integrity Contractor audit is a fraud and overpayment review conducted by a private company that the Centers for Medicare and Medicaid Services (CMS) has hired to police billing across both Medicare and Medicaid. If you receive a letter from a UPIC, you are on a short clock: the contractor can demand records, freeze your payments, extrapolate a small sample of errors into a seven-figure repayment demand, and refer serious cases for criminal prosecution. What you do in the first 45 days often determines the outcome.

What Triggers a UPIC Audit

Most UPIC investigations begin with data rather than a tip. CMS contractors run algorithms that compare your billing against providers in the same specialty and region. If your practice bills an unusually high share of top-tier evaluation and management codes, or your claim volume for certain services far exceeds the peer average, the system flags your account.

Investigations also come from outside sources. A former employee or business partner can file a whistleblower lawsuit under the False Claims Act (a qui tam action), which requires them to share evidence with the government while the case stays under seal for at least 60 days.¹ Referrals from other federal agencies, state Medicaid offices, and private insurance carriers can also open a case. High-volume billing in home health, durable medical equipment, and certain lab services draws scrutiny faster than other service lines because those sectors have historically had higher fraud rates.

UPICs replaced the older split system in which Zone Program Integrity Contractors handled Medicare and separate Medicaid Integrity Contractors handled Medicaid. A single UPIC now investigates a provider’s billing across both programs at once, so information that used to sit in separate silos now travels with your file.²

Responding to an Additional Documentation Request

When a UPIC pulls your claims for review, you receive an Additional Documentation Request (ADR). The letter identifies the specific claims under scrutiny and lists the records the contractor wants.³ You have 45 calendar days from the date of the request to respond. If the contractor does not receive your documentation by day 46, federal regulations authorize an outright denial of the claim.⁴

What you send depends on the service, but expect to assemble the full patient medical record for each claim: intake assessments, progress notes, physician orders, and any certificates of medical necessity. Every entry needs to be legible, dated, and signed by the treating clinician. The reviewer is looking for proof that the service was actually provided, that it met Medicare’s coverage and medical necessity rules, and that the billing codes match what the documentation supports.³

You do not have to mail paper. CMS operates the Electronic Submission of Medical Documentation (esMD) system, which lets providers submit ADR responses digitally and can shorten the process on both sides.⁵

Prepayment vs. Postpayment Review

An audit takes one of two forms, and the difference matters for your cash flow. In a prepayment review, the contractor holds your claims before paying them and requests documentation to justify payment. No check goes out until the reviewer approves the claim. In a postpayment review, the contractor pays the claim first and examines the records afterward; if the review finds a problem, you receive a demand letter for the overpaid amount.⁶

Prepayment review hits harder in real time because it freezes incoming revenue while you assemble records. Postpayment review feels less urgent, but the financial exposure is often larger because you may have already spent the money the government now wants back. The 45-day response window applies to both.

Unannounced Site Visits

UPIC activity does not always start with paperwork. CMS has authority to conduct unannounced site visits during normal business hours. The inspector carries a photo ID and a CMS-issued letter of authorization; you can review those documents but cannot copy or keep them.⁷

During the visit, inspectors may photograph the facility, interview staff, review documentation, and assess inventory. For DME suppliers, that can include complaint logs, warranty records, and rental agreements. Providers classified as moderate or high risk, including ambulance services, home health agencies, and DME suppliers, face mandatory site visits during initial enrollment, revalidation, or whenever they add a new practice location.⁷

Refusing a site visit is one of the fastest ways to lose Medicare billing privileges. CMS can deny enrollment or revoke existing enrollment based on a failed or refused on-site review.⁷

How the Overpayment Number Gets So Large

After the documentation review, you receive a findings letter listing denied claims, coding problems, or services that did not meet medical necessity criteria. If the errors are scattered across a few claims, the overpayment is the sum of those claim amounts.

When the contractor finds a pattern of errors, it switches to statistical extrapolation. Instead of reviewing every claim you have submitted, the UPIC pulls a random sample, reviews it, calculates the error rate, and projects the overpayment across your entire claims universe. CMS’s Program Integrity Manual requires contractors to consult a statistical expert, use a recognized probability sampling method (simple random, systematic, stratified, or cluster sampling), and document the methodology, including the universe definition, sample size calculation, and overpayment worksheets.⁸

This is where the numbers get large fast. A 15% error rate on a small sample can produce a six- or seven-figure repayment demand when applied across years of claims. It is also where many providers have grounds to push back. An appeal challenging the sampling methodology must show an actual statistical error that affected the overpayment amount; simply pointing out that the contractor skipped a procedural step will not automatically invalidate the projection.⁸

Payment Suspensions During the Investigation

In serious cases, CMS does not wait for the review to finish before cutting off your revenue. Federal regulations allow CMS or its contractor to suspend Medicare payments in whole or in part when reliable information indicates an overpayment exists, or when there is a credible allegation of fraud following consultation with the Office of Inspector General or the Department of Justice.⁹

A fraud-based suspension triggers a review cycle. Every 180 days CMS must evaluate whether good cause exists to continue the suspension, with certification from OIG or law enforcement that the investigation remains active. A suspension based on credible fraud allegations is presumed to expire after 18 months without resolution, though CMS can extend it if DOJ or OIG certifies that the case warrants continued suspension.⁹

Medicaid rules are more rigid. When a state Medicaid agency determines that a credible allegation of fraud exists, it must suspend all payments unless it documents a specific good cause exception, such as a law enforcement request to avoid tipping off the target, or a situation where suspension would cut off patient access to care in an underserved area.¹⁰

A payment suspension is not appealable in the traditional sense. Your main recourse is a written rebuttal addressing the agency’s concerns, and the window is narrow, typically 15 calendar days from receiving the suspension notice. That rebuttal is often the only chance to get payments restored before the investigation concludes, so it needs to confront the specific allegations with documentary evidence.

Penalties If the Audit Finds Fraud

Under the Civil Monetary Penalties Law, a provider who knowingly submits a false claim to a federal healthcare program faces a penalty of up to $25,595 per claim in 2026, plus treble damages, meaning three times the amount the government overpaid.¹¹ Separately, the False Claims Act allows the government or a whistleblower to pursue civil litigation with its own per-claim penalty range, adjusted annually for inflation.¹ When a provider has billed thousands of claims over years, even modest per-claim penalties compound into devastating totals.

If the investigation reveals intentional fraud, the case can be referred to the Department of Justice for criminal prosecution. Federal healthcare fraud carries a maximum prison sentence of 10 years per offense. If a patient suffered serious bodily injury because of the fraud, the maximum jumps to 20 years. If someone died, the sentence can be life imprisonment.¹²

A fraud conviction also triggers mandatory exclusion from all federal healthcare programs, including Medicare, Medicaid, and TRICARE. The Secretary of Health and Human Services has no discretion: any provider convicted of a criminal offense related to delivering items or services under Medicare or a state healthcare program must be excluded. The statute also allows permissive exclusion for misdemeanor fraud convictions or obstruction of an audit or investigation.¹³ For most providers, exclusion ends a career: no federal program will reimburse for your services, and any entity that employs you faces its own penalties.

Appealing a UPIC Finding

A UPIC finding is not the final word. Medicare has a five-level appeals process established by statute, and each level has firm filing deadlines you cannot afford to miss.¹⁴

Redetermination by the Medicare Administrative Contractor, requested within 120 days of the initial determination; the MAC has 60 days to decide.¹⁴
Reconsideration by a Qualified Independent Contractor, a separate entity from the MAC, which has 60 days to decide.¹⁴
Hearing before an Administrative Law Judge at the Office of Medicare Hearings and Appeals, requested within 60 days of the reconsideration decision.¹⁵
Review by the Medicare Appeals Council, requested within 60 days of the ALJ decision.
Suit in federal district court, filed within 60 days of the Appeals Council decision, after administrative remedies are exhausted.

For a provider facing a large extrapolated overpayment, the ALJ hearing is usually the most consequential stage. That is where you can present expert testimony challenging the sampling methodology, argue that individual claim denials were wrong, and potentially get the entire extrapolation overturned. If an appellate decision finds the sampling methodology invalid, the contractor must either correct the errors and recalculate or fall back to recovering only the actual overpayments found in the sampled claims.⁸

If You Find the Problem Before the UPIC Does

If you discover billing errors or potential fraud in your own practice before a UPIC does, you have the option to come forward voluntarily. The Office of Inspector General operates a Provider Self-Disclosure Protocol that lets providers report self-discovered compliance problems. Voluntary disclosure typically results in lower penalties and avoids the cost and disruption of a full government investigation.¹⁶

Self-disclosure does not guarantee immunity, and it will not help if the government already knows about the problem. But for a practice that uncovers genuine billing mistakes during an internal audit, reporting the issue is almost always better than waiting to be caught. The difference in how the government treats a provider who self-reports versus one who is found out is substantial, both in dollar terms and in the likelihood of criminal referral.

1
Office of the Law Revision Counsel. 31 USC 3730 – Civil Actions for False Claims
2
Office of Inspector General. UPICs Hold Promise To Enhance Program Integrity Across Medicare and Medicaid but Challenges Remain
3
Centers for Medicare & Medicaid Services. Additional Documentation Request
4
eCFR. 42 CFR 405.930 – Failure to Respond to Additional Documentation Request
5
Centers for Medicare and Medicaid Services. Electronic Submission of Medical Documentation (esMD)
6
Centers for Medicare & Medicaid Services. Medicare Claim Review Programs
7
Centers for Medicare & Medicaid Services. Provider Enrollment Site Visits
8
Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual Chapter 8
9
eCFR. 42 CFR 405.371 – Suspension, Offset, and Recoupment of Medicare Payments
10
eCFR. 42 CFR 455.23 – Suspension of Payments in Cases of Fraud
11
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
12
Office of the Law Revision Counsel. 18 USC 1347 – Health Care Fraud
13
Office of the Law Revision Counsel. 42 USC 1320a-7 – Exclusion of Certain Individuals and Entities From Participation in Medicare and State Health Care Programs
14
GovInfo. 42 USC 1395ff – Provision of Information to Beneficiaries and Providers
15
Centers for Medicare & Medicaid Services. Third Level of Appeal – Decision by Office of Medicare Hearings and Appeals
16
Office of Inspector General. Self-Disclosure Information