UPIC Audit Defense Lawyers

UPIC stands for Unified Program Integrity Contractor. These are private auditing and investigative companies contracted by the Centers for Medicare & Medicaid Services (CMS) to detect, investigate, and deter fraud, waste, and abuse across the Medicare and Medicaid programs.

ZPIC vs. UPIC: What Changed?

If you’ve seen the term ZPIC (Zone Program Integrity Contractor), it refers to the same kind of audit. CMS replaced ZPICs with UPICs, combining Medicare and Medicaid program integrity work under one contractor in each region. The tactics are the same: data-driven targeting, records requests, site visits, payment suspensions, and referrals to law enforcement. Our ZPIC and UPIC audit lawyers handle both, including older ZPIC-era overpayments that are still under appeal.

Which UPIC Is Auditing You?

Five UPIC jurisdictions cover the country, run by three contractors. The contractor’s name is on your letter, and it tells you who you’re dealing with and which Medicare Administrative Contractor (MAC) will handle your first appeal.

• UPIC Northeast (SafeGuard Services): Connecticut, Delaware, the District of Columbia, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island, Vermont, and Arlington and Fairfax Counties and the City of Alexandria in Virginia.
• UPIC Southeast (SafeGuard Services): Alabama, Florida, Georgia, North Carolina, South Carolina, Tennessee, Virginia, West Virginia, Puerto Rico and the U.S. Virgin Islands.
• UPIC Midwest (CoventBridge Group): Illinois, Indiana, Iowa, Kansas, Kentucky, Michigan, Minnesota, Missouri, Nebraska, Ohio and Wisconsin.
• UPIC Southwest (Qlarant): Arkansas, Colorado, Louisiana, Mississippi, New Mexico, Oklahoma and Texas.
• UPIC West (Qlarant): Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, North Dakota, Oregon, South Dakota, Utah, Washington and Wyoming.

Contracts change. Confirm the current contractor on the CMS Review Contractor Directory.

Got a UPIC Records Request or Site Visit? What to Do First

1. Identify the contractor and the type of review from the letter: records request (ADR), prepayment review, site visit, or payment suspension.
2. Calendar every deadline in the letter. UPIC deadlines are short, and a missed deadline can mean an automatic denial.
3. Preserve all records: medical records, billing data, emails, and texts. Don’t alter or “fix” old documentation.
4. Don’t contact patients about the audit. UPICs often interview beneficiaries, and outreach from the practice can look like interference.
5. Prepare staff for a site visit or interviews. Staff should be polite and accurate, and know they can ask to have counsel present.
6. Call a UPIC audit lawyer before producing anything. What you send, and how it’s organized, shapes the sample, the error rate and any referral decision.

Learn more about records requests during healthcare audits with our post on MAC audits vs. UPIC audits.

UPIC Payment Suspensions: How to Respond

A payment suspension can cut off a practice’s Medicare revenue overnight, before any finding of wrongdoing. Under 42 C.F.R. § 405.372, a suspension based on reliable information of an overpayment is generally limited to 180 days, with possible extensions. A suspension based on a credible allegation of fraud can last much longer while the investigation continues.

• Rebuttal statement: you generally have at least 15 days after the notice to submit a written rebuttal explaining why the suspension should be lifted (42 C.F.R. § 405.374). It’s often the best early chance to reduce the damage.
• Cash flow planning: suspended payments are held, not necessarily lost. Plan for months without that revenue.
• Criminal exposure: a fraud-based suspension usually means the case has been or will be referred to HHS-OIG or the DOJ. What you say in the rebuttal can be used later, so have counsel review it.

Appealing UPIC Audit Results

UPIC overpayment findings are appealed through the standard five-level Medicare appeals process. The deadlines below are the outside limits. File faster to stop recoupment while you appeal.

1. Redetermination by the MAC: within 120 days. File within 30 days to stop recoupment. If no appeal is filed, Medicare can begin recouping on day 41.
2. Reconsideration by a Qualified Independent Contractor (QIC): within 180 days. File within 60 days to keep recoupment stopped.
3. Administrative Law Judge (ALJ) hearing: within 60 days.
4. Medicare Appeals Council review: within 60 days.
5. Federal district court: within 60 days.

Many of the strongest arguments are about the statistics. When a UPIC extrapolates from a sample, we test whether the sample and the universe of claims were defined correctly, whether the sampling followed the Medicare Program Integrity Manual, Chapter 8, and whether each “error” holds up on clinical review. Overturning a sample can wipe out most of an extrapolated demand. Our Medicare audit defense lawyers can guide the sampling error defense.

When a UPIC Refers Your Case to OIG or the DOJ

UPICs don’t prosecute, but they refer. Warning signs that an audit has turned into, or is running alongside, a criminal investigation:

• A payment suspension based on a “credible allegation of fraud”
• HHS-OIG special agents or the FBI contacting staff or former employees
• A grand jury subpoena or a civil investigative demand
• Questions about referral sources, marketers, or payments, which point to Anti-Kickback concerns
• Requests that reach well beyond the sampled claims

At that point, the defense strategy changes completely. Lowther | Walker is a federal criminal defense firm, so the same team that handles the audit can protect you if it becomes a criminal case. If an agent has contacted you, read what to do when HHS-OIG contacts you.

What Are the Different Types of UPIC Audits?

Pre-payment Reviews and Payment Suspensions

If a UPIC suspects a “credible allegation of fraud,” they can request that CMS suspend your Medicare or Medicaid payments. Providers can be placed on up to 100% pre-payment review, meaning all newly submitted claims are frozen and meticulously scrutinized before any funds are released. This indefinite withholding of reimbursement often causes immediate operational cash flow disruptions before any liability has been formally adjudicated.

Post-payment Reviews and Statistical Extrapolation

Post-payment audits scrutinize claims already paid to identify issues such as missing documentation, improper coding, or a lack of medical necessity. This process involves statistical sampling and extrapolation. UPIC auditors will review a small, localized sample of claims, calculate an error rate, and mathematically apply that percentage to the entire universe of a provider’s claims for that period. Because of extrapolation, a minor actual overpayment in the sample (e.g., $5,000) can instantly multiply into a catastrophic, multi-million-dollar recoupment demand.

Data-driven Audits and Investigation Triggers

UPIC investigations rarely happen by chance; they are proactively data-driven. Contractors use the CMS Fraud Prevention System and data analytics to identify statistical anomalies and “outliers”. Audits are triggered when a provider’s claims profile shows a high frequency of specific services compared to national peers, impossible billing hours, lengths of stay outside industry norms, or mismatched physician records. UPICs aggressively pursue leads generated by whistleblower complaints, beneficiary tips, and direct referrals from other agencies like the Office of Inspector General (OIG) and the FBI.