UPIC Audit Response Guide: The First 72 Hours After a Records Request

A records request from a Unified Program Integrity Contractor, or UPIC, is different from a routine Medicare documentation request. UPICs are CMS contractors dedicated to detecting and preventing fraud, waste, and abuse in Medicare and Medicaid. A UPIC request may be part of a data-driven review, a complaint investigation, or a broader investigation that could lead to payment suspension, revocation, overpayment demands, or referral to law enforcement.

UPIC requests also come with a shorter deadline. Under CMS's Medicare Program Integrity Manual, providers generally have 30 calendar days to respond to a UPIC documentation request, compared with 45 days for Medicare Administrative Contractors (MACs), Recovery Audit Contractors (RACs), and the Supplemental Medical Review Contractor (SMRC). In a heightened enforcement environment, in which CMS reported 537 Medicare payment suspensions and 5,586 revocations in 2025, how a provider responds in the first few days can significantly affect the outcome.

This guide explains what UPICs are, what a UPIC records request may signal, and a step-by-step plan for the first 72 hours and the remainder of the response period. It is educational and not legal advice. Providers that receive a UPIC request should consider involving experienced legal counsel.

What Is a UPIC?

CMS describes UPICs as performing fraud, waste, and abuse detection, deterrence, and prevention activities for Medicare and Medicaid claims. UPICs perform integrity activities associated with Medicare Parts A and B, durable medical equipment, home health and hospice, Medicaid, and the Medicare-Medicaid data match program.

UPICs operate in five geographic jurisdictions. According to CMS, the jurisdictions are Midwest, Northeast, Western, Southeast, and Southwestern, and the location of a provider's state determines its UPIC. UPICs combine functions previously performed by Zone Program Integrity Contractors, Program Safeguard Contractors, and Medicaid Integrity Contractors.

What UPICs Do

CMS manuals describe UPIC activities that include:

• Proactively identifying potential fraud, waste, and abuse through data analysis.

• Investigating allegations of fraud from beneficiaries, providers, CMS, HHS-OIG, and other sources.

• Screening leads, which may include verifying enrollment status, data analysis, beneficiary interviews, and site verification.

• Conducting investigations, which may include contact with the provider by telephone or on-site visit, beneficiary interviews, interviews of employees or associates, and medical record requests and reviews.

• Performing medical review for program integrity purposes.

• Recommending administrative actions, such as payment suspensions, revocations, prepayment review, and overpayment determinations.

• Referring cases to HHS-OIG and law enforcement.

What UPIC Medical Review Looks For

UPIC medical review focuses on more than coverage and coding. CMS's Medicaid Program Integrity Manual explains that program integrity medical review may include looking for possible falsification or alteration of medical record documentation, such as obliterated sections, missing pages, inserted pages, white-out, and excessive late entries. UPICs may also look at whether services were actually rendered as billed.

What a UPIC Records Request May Signal

A UPIC records request does not necessarily mean the provider has committed fraud. UPIC reviews can arise from data analysis showing outlier billing, a complaint, a referral from a MAC during Targeted Probe and Educate, or a broader review of a service type. However, because UPICs focus on potential fraud, waste, and abuse, a request should be treated as a high-priority matter.

Possible outcomes of a UPIC review include:

• No further action.

• Education.

• Prepayment review.

• Postpayment review and overpayment determinations, sometimes using statistical sampling and extrapolation.

• Payment suspension.

• Revocation of Medicare enrollment.

• Referral to HHS-OIG or law enforcement.

The First 72 Hours: A Step-by-Step Plan

Hour 0 to 4: Receive, Log, and Escalate

• Log the request. Record the date received, the date on the letter, the UPIC name and contact, the claims or beneficiaries listed, the documents requested, and the deadline.

• Calendar the deadline. Calculate the 30-day deadline, or the deadline stated in the letter, and set reminders.

• Escalate immediately. Notify the compliance officer and senior leadership. Make sure staff know that any UPIC correspondence must be forwarded immediately.

• Verify authenticity. Confirm that the request comes from the UPIC assigned to your jurisdiction by checking contact information against CMS's official review contractor directory.

Hour 4 to 24: Engage Counsel and Preserve Records

• Consider engaging experienced legal counsel. Because UPICs investigate potential fraud, counsel can help evaluate the scope of the request, the potential risks, and the best approach to communications.

• Issue a legal hold. Preserve all records related to the request, including medical records, billing data, emails, text messages, schedules, and electronic health record audit trails. Notify vendors, such as billing companies and electronic health record providers, to preserve data.

• Do not alter records. Never change, backdate, or create documents. UPIC medical review specifically looks for signs of alteration, and altering records after receiving a request can create serious legal consequences.

• Limit internal communications. Share information only with those who need to know, and route sensitive discussions through counsel where appropriate.

Hour 24 to 48: Understand the Scope and Assemble the Team

• Analyze the request. Identify the claims, beneficiaries, dates of service, and categories of documents requested. Note whether the request mentions a specific review type, such as postpayment review or prepayment review.

• Assemble a response team. Include a coordinator, clinical reviewers, records staff, billing staff, and counsel.

• Identify record locations. Determine where each requested record is maintained, including electronic health records, paper charts, archived systems, contracted providers, and former locations.

• Identify gaps early. Determine whether any records may be missing or difficult to retrieve, so there is time to locate them.

Hour 48 to 72: Plan the Response

• Create a response plan. Assign tasks, set internal deadlines well before the UPIC deadline, and build in time for quality review.

• Consider contacting the UPIC. If the request is unclear, if records are voluminous, or if more time is needed, consider contacting the UPIC, often through counsel, to clarify scope or request an extension in writing. Contractors may accept late documentation for good cause, but providers should not assume an extension will be granted.

• Brief leadership. Provide leadership with a summary of the request, potential risks, the response plan, and resource needs.

• Consider a privileged internal review. Under counsel's direction, consider reviewing the requested records to understand potential issues before submission.

A First-72-Hours Checklist

The following checklist summarizes the key actions:

• Log the request with the date received, UPIC name, claims, documents requested, and deadline.

• Calendar the deadline and set reminders at 21, 14, and 7 days.

• Notify the compliance officer and senior leadership.

• Verify the UPIC's contact information through CMS's review contractor directory.

• Decide whether to engage legal counsel and, if so, do so promptly.

• Issue a written legal hold to staff and vendors.

• Confirm that routine deletion of relevant electronic data is suspended.

• Identify where each requested record is located.

• Assemble the response team and assign roles.

• Draft an internal timeline with a completion date at least one week before the deadline.

• Determine whether clarification or an extension request is needed.

• Brief leadership on risks and resources.

Understanding the UPIC Investigative Process

CMS manuals describe a general process that UPICs follow. A lead is first screened to determine whether further investigation is warranted. CMS's Medicaid Program Integrity Manual states that screening shall be completed within 45 calendar days after receipt of the lead, and it lists activities such as verification of enrollment status, data analysis, contact with a complainant, beneficiary interviews, and site verification. Screening activities generally do not involve contact with the subject provider or administrative actions.

If a lead moves to investigation, the UPIC may contact the provider, request records, interview beneficiaries and employees, and recommend administrative actions. CMS's Medicare Program Integrity Manual describes case coordination meetings at which certain actions, such as 100 percent prepayment review requests, payment suspension recommendations, revocation requests, and extrapolated overpayment requests, are discussed with CMS.

Understanding this process helps providers recognize that a records request often comes after the UPIC has already conducted data analysis or other screening work.

Internal Questions to Answer Early

Answering several questions early helps shape the response:

• Why might the UPIC have selected these claims or this service? Review your own billing data for outliers or recent changes.

• Have there been recent complaints, employee concerns, or hotline reports related to these services?

• Has the organization recently been in TPE or other medical review for the same service?

• Are there any known documentation weaknesses for this service?

• Are all clinicians who provided the services properly licensed, credentialed, and enrolled?

• Are there any financial relationships with referral sources related to these patients?

• Does the organization have any identified but unreturned overpayments related to this service?

Practical Document Management Tips

Large UPIC requests can involve thousands of pages. Good document management makes the submission easier to review and protects the organization:

• Assign each document a unique page number or identifier.

• Organize records by claim, then by document type and date.

• Create an index that lists each claim and the documents included.

• Keep a complete copy of the production in the exact form submitted.

• Track any documents that could not be located and the efforts made to find them.

• Protect patient information during transmission and storage.

Days 4 Through 30: Completing the Response

Gather Complete Records

Collect all documentation supporting each claim, which may include:

• Orders and referrals.

• Certifications and recertifications.

• Face-to-face encounter documentation, where required.

• Plans of care.

• Assessments, progress notes, and visit notes.

• Test results.

• Staff schedules, visit logs, and time records that show who provided services and when.

• Signature logs and attestations.

• Proof of delivery for supplies or equipment.

Review Before Submitting

• Confirm that records are complete, legible, and correctly identified.

• Check signatures and dates.

• Make sure late entries and addenda are clearly identified and dated according to Medicare documentation rules.

• Remove any records that belong to other patients.

Organize the Submission

• Use a cover letter that lists the claims and enclosed documents.

• Number pages and organize records by claim.

• Keep the cover letter factual and avoid statements that are not supported by the records.

Submit Securely and Keep Proof

• Use the submission method specified by the UPIC, such as the Electronic Submission of Medical Documentation (esMD) system, where accepted.

• Keep an exact copy of everything submitted and proof of delivery.

Track Follow-Up

• Monitor for additional requests, interview requests, or site visits.

• Calendar any additional deadlines.

Preparing for Interviews and Site Visits

UPIC investigations may include on-site visits and interviews of employees and beneficiaries.

Site Visits

• Make sure front-desk staff know how to greet visitors, verify identification, and notify leadership and counsel.

• Confirm that the practice location matches enrollment records, is staffed during posted hours, and has required signage.

• Provide requested information cooperatively, and keep notes of what was requested and provided.

Employee Interviews

• Employees may be contacted by UPIC staff or law enforcement.

• With counsel's guidance, inform employees of their rights in a lawful, non-coercive way, including that they may choose whether to speak and may have counsel present.

• Do not discourage employees from speaking with investigators, and do not retaliate against anyone who cooperates.

• Remind employees that any statements must be truthful.

Common Mistakes to Avoid

• Treating a UPIC request like a routine ADR.

• Missing the shorter 30-day deadline.

• Failing to preserve records or allowing routine deletion to continue.

• Altering, backdating, or creating documents.

• Sending incomplete records or records for the wrong patient.

• Speaking with investigators without preparation.

• Ignoring signs of a broader investigation, such as interview requests or site visits.

• Failing to evaluate overpayment obligations if internal review identifies problems.

• Not involving counsel when the risk is significant.

When the Request Involves Medicaid

UPICs also perform program integrity work for Medicaid in partnership with state Medicaid agencies. CMS's Medicaid Program Integrity Manual explains that UPICs collaborate with state Medicaid agencies under joint operating agreements, follow state policies, and may use audit protocols preferred by the state. If a UPIC request involves Medicaid claims, providers should review the applicable state Medicaid documentation requirements, confirm the response timeframe stated in the request, and consider whether state-specific appeal rights apply. Medicaid findings may also be shared with the state Medicaid agency and, where appropriate, the state Medicaid Fraud Control Unit.

Communicating With the UPIC

Professional, accurate communication helps the response go smoothly. Practical guidelines include:

• Designate a single point of contact for the UPIC, often coordinated with counsel.

• Keep communications in writing when possible, or document phone calls with notes.

• Confirm any agreements, such as extensions or clarified scope, in writing.

• Answer questions accurately and avoid speculation.

• Do not volunteer opinions or explanations that are not supported by records.

• Keep copies of all correspondence in the response file.

Possible Next Steps After the Response

Medical Review Results

The UPIC may issue review results and overpayment determinations. Overpayments can be appealed through the Medicare fee-for-service appeals process. Filing a redetermination request within 30 days of the demand letter, and a reconsideration request within 60 days of the redetermination decision, can limit recoupment during those appeals under 42 CFR 405.379.

Statistical Sampling and Extrapolation

UPICs may use statistical sampling to estimate overpayments. Under Section 1893(f)(3) of the Social Security Act, extrapolation is generally limited to situations involving a sustained or high level of payment error or documented failed educational intervention. Providers can challenge sampling methodologies on appeal, often with a qualified statistician.

Payment Suspension

A UPIC may recommend, and CMS may approve, a payment suspension under 42 CFR 405.371. Providers generally have the opportunity to submit a rebuttal statement, typically within 15 days, under 42 CFR 405.374.

Revocation

A UPIC may recommend revocation under 42 CFR 424.535. Revocations can be appealed under 42 CFR Part 498, generally starting with a reconsideration request within 60 days.

Referral to Law Enforcement

UPICs may refer cases to HHS-OIG and law enforcement for consideration of civil, criminal, or administrative action.

Protecting Your Organization From Identity Misuse

Sometimes a UPIC review reveals that claims were submitted under a provider's identifiers without the provider's knowledge. CMS's Victimized Provider Project, coordinated with UPICs, assists legitimate providers who have suffered financial liability because their identities were stolen and used to bill Medicare. If a records request involves patients or services your organization does not recognize, document that fact, gather evidence, and contact the UPIC and counsel promptly so that potential identity theft can be investigated.

Building UPIC Readiness Into Your Compliance Program

• Maintain an effective compliance program consistent with HHS-OIG's General Compliance Program Guidance.

• Adopt a written protocol for responding to UPIC requests, site visits, and interviews.

• Monitor billing data for outlier patterns.

• Conduct regular internal audits of high-risk services.

• Keep enrollment information accurate.

• Maintain strong records management and retention practices.

• Train staff on how to handle contractor and government contact.

Frequently Asked Questions

How long do I have to respond to a UPIC records request?

Generally 30 calendar days, according to CMS's Medicare Program Integrity Manual. Always follow the deadline in the letter.

Does a UPIC request mean I am being investigated for fraud?

Not necessarily. UPIC reviews can result from data analysis or complaints, and many end without major action. However, because UPICs focus on fraud, waste, and abuse, requests should be treated seriously.

Should I call the UPIC?

It may be appropriate to contact the UPIC to clarify scope or request an extension. Many organizations choose to do so through counsel.

What happens if I do not respond?

Claims under review are typically denied, which can lead to overpayment demands. Failure to furnish requested records can also be a basis for payment suspension under 42 CFR 405.371.

Can a UPIC visit my office?

Yes. UPIC investigations may include site verification, on-site visits, and interviews.

Can I request more time from a UPIC?

Providers can request an extension, preferably in writing, and should explain the reason. Contractors may accept late documentation for good cause, but extensions are not guaranteed, so plan to meet the original deadline.

Should I submit records for all requested claims even if some are weak?

Yes. Submit complete records for every requested claim. Failing to submit records results in denial, and incomplete submissions can raise additional concerns. If internal review identifies weaknesses, discuss next steps, including potential overpayment obligations, with counsel.

Conclusion

A UPIC records request is a serious matter that calls for a fast, organized, and careful response. The first 72 hours set the tone: log and escalate the request, calendar the 30-day deadline, consider engaging counsel, preserve records, understand the scope, assemble a team, and plan the response. Over the rest of the response period, gather complete records, review and organize them carefully, submit on time, and prepare for possible follow-up, including site visits, interviews, overpayment determinations, payment suspension, or revocation.

Organizations that prepare in advance, with strong documentation, internal audits, and a written response protocol, are best positioned to respond effectively when a UPIC request arrives.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in program integrity, UPIC audit response, and compliance. We help providers organize and review records before submission, coordinate response logistics, conduct internal reviews in coordination with legal counsel, analyze billing patterns, prepare for site visits, and strengthen compliance programs. If your organization has received a UPIC records request, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Review Contractor Directory, Interactive Map. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/review-contractor-directory-interactive-map

• Centers for Medicare & Medicaid Services. Resources for State and Territory Program Integrity Directors. https://www.cms.gov/medicare/medicare-medicaid-coordination/resources-state-medicaid-agencies/resources-state-territory-program-integrity-directors

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 4. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c04.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 8. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c08.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Exhibits. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83exhibitspdf.pdf

• Centers for Medicare & Medicaid Services. Medicaid Program Integrity Manual, Chapter 1. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/mpi115c01.pdf

• Centers for Medicare & Medicaid Services. Medicaid Program Integrity Manual, Chapter 3. https://www.cms.gov/files/document/chapter-3-medicaid-investigations-audits.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-15, Transmittal 12871. https://www.cms.gov/files/document/r12871mpi.pdf

• Centers for Medicare & Medicaid Services, Center for Program Integrity. Crushing Fraud: Annual Report 2025. https://www.cms.gov/files/document/crushing-fraud-annual-report.pdf

• Centers for Medicare & Medicaid Services. Original Medicare (Fee-for-Service) Appeals. https://www.cms.gov/medicare/appeals-grievances/fee-for-service

• U.S. Social Security Administration. Social Security Act, Section 1893, Medicare Integrity Program. https://www.ssa.gov/OP_Home/ssact/title18/1893.htm

• Electronic Code of Federal Regulations. 42 CFR 405.371, Suspension, Offset, and Recoupment of Medicare Payments. https://www.ecfr.gov/current/title-42/section-405.371

• Electronic Code of Federal Regulations. 42 CFR 405.374, Opportunity for Rebuttal. https://www.ecfr.gov/current/title-42/section-405.374

• Electronic Code of Federal Regulations. 42 CFR 405.379, Limitation on Recoupment of Provider and Supplier Overpayments. https://www.ecfr.gov/current/title-42/section-405.379

• Electronic Code of Federal Regulations. 42 CFR 424.535, Revocation of Enrollment in the Medicare Program. https://www.ecfr.gov/current/title-42/section-424.535

• Electronic Code of Federal Regulations. 42 CFR Part 498, Appeals Procedures for Determinations That Affect Participation in the Medicare Program. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-498

• Centers for Medicare & Medicaid Services. CMS Victimized Provider Project, UPIC Points of Contact. https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/MedicareProviderSupEnroll/downloads/providervictimpocs.pdf

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/