UPIC On-Site Visits and Unannounced Audits: How to Prepare Your Staff and Protect Your Agency

Few events test a healthcare organization's readiness like an unannounced visit. A site inspector or investigator arrives during business hours, asks to confirm that the location is operational, requests information, and may want to speak with staff. For hospices, home health agencies, durable medical equipment suppliers, and other providers in categories CMS considers higher risk, these visits are becoming more common.

Medicare uses two main types of on-site activity that providers may experience:

• Enrollment site visits, which verify that a provider's practice location is operational and that enrollment information is accurate. These are generally performed by CMS's National Site Visit Contractor (NSVC) or other CMS contractors.

• Program integrity on-site visits, which may be conducted by Unified Program Integrity Contractors (UPICs) as part of screening or investigating potential fraud, waste, and abuse.

Both can have serious consequences. A finding that a location is not operational can lead to revocation of Medicare billing privileges, with the revocation potentially effective on the date the location was found non-operational. UPIC visits can lead to records requests, interviews, payment suspensions, revocations, or referrals.

In 2026, CMS has described nationwide hospice site visits, enhanced screening for high-risk home health agencies including site verification of reported practice locations, and nationwide enrollment moratoria for hospices and home health agencies. This article explains how site visits work, what reviewers look for, how to prepare staff, and how to protect your agency. It is educational and not legal advice.

The Legal Basis for Medicare Site Visits

Federal regulations give CMS broad authority to conduct on-site reviews:

• Under 42 CFR 424.517, CMS reserves the right, when deemed necessary, to perform onsite review of a provider or supplier to verify that enrollment information is accurate and to determine compliance with Medicare enrollment requirements. Based on the results, a provider may be subject to denial or revocation of billing privileges.

• Under 42 CFR 424.518, providers and suppliers in the moderate and high screening risk categories are subject to site visits as part of screening.

• Under 42 CFR 424.535(a)(5), CMS may revoke enrollment if, upon on-site review or other reliable evidence, it determines that the provider is no longer operational or otherwise fails to satisfy any enrollment requirement. For revocations based on a non-operational practice location, the revocation effective date may be the date the location was no longer operational, as determined by CMS or its contractor.

• Under 42 CFR 424.540(a)(5), CMS may deactivate billing privileges if a practice location is non-operational or otherwise invalid.

Enrollment site visits are separate from surveys conducted by state survey agencies or accrediting organizations to assess compliance with conditions of participation.

What "Operational" Means

CMS regulations at 42 CFR 424.502 define what it means to be operational. CMS training materials summarize the requirements: a provider must have a qualified physical practice location, be open to the public for the purpose of providing health care related services, be prepared to submit valid Medicare claims, be properly staffed to furnish items or services, and possess the necessary equipment. Additional requirements apply to certain supplier types, such as durable medical equipment suppliers, which must meet supplier standards including maintaining a permanent visible sign and posting hours of operation, being accessible and staffed during posted hours, and maintaining space for records.

How Enrollment Site Visits Work

According to CMS provider enrollment training materials:

• Enrollment site visits are conducted by the National Site Visit Contractor.

• Site visits are required for moderate and high risk providers and suppliers, such as ambulance suppliers, independent diagnostic testing facilities, durable medical equipment suppliers, and home health agencies, at initial enrollment, revalidation, and when adding a new location.

• CMS has authority to perform site visits on all providers, for example in response to address validation errors, corrective action plans or reconsiderations, and provider enrollment initiatives.

• Site visits are unannounced and conducted during normal business hours, generally 9 a.m. to 5 p.m., or during posted business hours.

Non-Operational Indicators

CMS training materials list indicators that a practice location may be non-operational, including:

• A vacant suite with no signage, or a suite posted for lease.

• Signage present, but no business activity observed during posted hours of operation.

• An unrelated business at the location that does not match a listed business name.

CMS has also noted that claims billed after the date of a non-operational site visit can indicate fraudulent billing, and that untimely reporting of a new practice location can lead to administrative action. Providers must report a change, addition, or deletion of a practice location to their Medicare Administrative Contractor (MAC) within 30 days under 42 CFR 424.516(d).

Second Attempts

CMS manual instructions have described that when a site verifier cannot determine whether a location is operational and there are no obvious indications that it is non-operational, a second attempt on a different day during posted hours of operation should be made. However, providers should not count on a second visit.

How UPIC On-Site Visits Differ

UPIC on-site visits are part of program integrity work rather than routine enrollment verification. CMS manuals describe that UPIC screening of a lead may include site verification to validate a provider's practice location, and UPIC investigations may include contact with the provider by telephone or on-site visit, beneficiary interviews, interviews of employees or associates, and medical record requests.

During a UPIC on-site visit, investigators may:

• Confirm that the location is operational and matches enrollment records.

• Observe operations, staffing, and patient activity.

• Request copies of records, such as patient charts, staff schedules, visit logs, policies, or business documents.

• Ask to speak with administrators, clinicians, or other staff.

• Ask questions about ownership, management, referral sources, or billing practices.

A UPIC visit may indicate that the UPIC is evaluating potential fraud, waste, or abuse. Outcomes may include records requests, prepayment review, overpayment determinations, payment suspension recommendations, revocation recommendations, or referral to HHS-OIG and law enforcement.

Why Site Visits Matter More in 2026

CMS's 2026 actions have increased the importance of site visit readiness, especially for hospices and home health agencies:

• In May 2026, CMS implemented six-month nationwide moratoria on new Medicare enrollment of hospices and home health agencies.

• CMS described related actions including nationwide hospice site visits to verify operations and identify suspicious activity, heightened oversight of newly enrolled hospices in states with elevated fraud risk, and enhanced enrollment screening measures for high-risk home health agencies, including site verification of reported practice locations and fingerprint-based background checks.

• CMS reported suspending payments to approximately 800 hospices and home health agencies suspected of fraud in Los Angeles.

Preparing Your Location

Signage and Hours

• Display a permanent, visible sign with the business name as enrolled with Medicare.

• Post hours of operation clearly. In a multi-tenant building, make sure signage or hours are visible at the main entrance or at the entrance to your suite, consistent with requirements for your provider type.

• Make sure the business name on signage matches the legal or doing-business-as name in your enrollment record.

Staffing During Posted Hours

• Make sure the location is open and staffed during all posted hours.

• If staff work primarily in the field, as is common for home health and hospice, make sure someone is present at the office during posted hours or adjust posted hours to reflect when the office is staffed, while meeting applicable requirements.

• Maintain a staffing schedule that shows who is responsible for the office each day.

Enrollment Accuracy

• Confirm that the practice location address in the Provider Enrollment, Chain, and Ownership System (PECOS) exactly matches the physical location, including suite numbers.

• Report changes in practice location within 30 days.

• Make sure branch or additional locations are properly enrolled.

• Remember that during the hospice and home health moratoria, new branch and practice locations cannot be enrolled.

Documentation On Hand

Keep key documents readily available, such as:

• State licenses and accreditation documents.

• Medicare enrollment approval letters.

• A list of key personnel, including owners, administrators, and managing employees as reported in enrollment.

• Policies and procedures.

• Staff licenses and credentials.

• Lease or proof of occupancy.

Preparing Your Staff

Front-desk staff and on-site managers are often the first point of contact. A short, written protocol and regular training make a significant difference.

A Site Visit Protocol

A practical protocol includes:

1. Greet the visitor professionally.

2. Ask for identification and business card, and note the visitor's name, organization, and purpose.

3. Notify the administrator or designated site visit lead immediately.

4. If the designated lead is not present, contact them by phone and follow their instructions.

5. Cooperate with the visitor's request to observe the location.

6. Do not obstruct, mislead, or provide false information.

7. Keep a written record of what was observed, asked, and provided.

8. Notify the compliance officer and, for UPIC visits, legal counsel as appropriate.

Training Points for Staff

• Be courteous and professional.

• Answer factual questions truthfully if you know the answer, and say you do not know if you do not.

• Do not guess or speculate.

• Do not alter, hide, or destroy any documents.

• Refer requests for records or detailed information to the designated lead.

• Understand the difference between an enrollment site visit and an investigative visit.

Employee Rights in Investigative Interviews

When a UPIC or law enforcement agent asks to interview employees, the organization should seek guidance from counsel. Employees may choose whether to speak with investigators and may have counsel present. The organization must not discourage employees from speaking with the government or retaliate against anyone who cooperates. Any statements must be truthful.

Responding to Records Requests During a Visit

UPIC investigators may request records during a site visit.

• Ask whether the request can be put in writing and what the deadline is.

• If records are provided on-site, make a copy or list of everything provided.

• Protect patient privacy by confirming the request is for a legitimate program integrity purpose. HIPAA permits disclosures to health oversight agencies under 45 CFR 164.512(d).

• Consider involving counsel before producing large volumes of records.

• Calendar any follow-up deadlines. UPIC documentation requests generally require a response within 30 calendar days, according to CMS's Medicare Program Integrity Manual.

After the Visit

Document What Happened

Prepare a written summary that includes the date and time, the visitor's identity, areas observed, questions asked and answered, documents provided, and any concerns raised.

Review and Correct Issues

If the visit revealed issues, such as outdated signage, unstaffed hours, or enrollment discrepancies, correct them promptly and document the corrections.

Monitor for Follow-Up

Watch for correspondence such as records requests, notices of prepayment review, payment suspension, deactivation, or revocation.

Respond to Adverse Actions Quickly

• If you receive a revocation notice based on a non-operational finding, review the appeal options immediately. A corrective action plan may be available for certain revocations under 42 CFR 424.535(a)(1), generally within 30 days of the notice, and a reconsideration request may be filed generally within 60 days of receiving the notice under 42 CFR Part 498. CMS notices state that additional evidence must be submitted with the reconsideration request.

• Gather evidence that the location was operational, such as staffing schedules, patient appointment records, visit logs, photographs, leases, and utility bills.

• Consult counsel.

Special Considerations for Home Health and Hospice Offices

Home health and hospice agencies face unique site visit challenges because most patient care happens in patients' homes, not at the office. As a result, offices may be quiet or lightly staffed for much of the day, which can create the appearance of a non-operational location if the agency is not prepared.

Practical steps include:

• Make sure the office is staffed by at least one knowledgeable person during all posted hours.

• Keep a current list of field staff and their schedules accessible at the office.

• Display signage that clearly identifies the agency by its enrolled name.

• Keep policies, licenses, and accreditation documents at the office.

• Make sure the administrator or a designated alternate can be reached by phone at all times during posted hours.

• If the agency has branches, make sure each branch location is properly enrolled and staffed, and remember that new branches cannot be enrolled during the current moratoria.

• For hospices, make sure the medical director and administrator, who CMS has clarified are managing employees that must be reported on the Form CMS-855A, are accurately listed in enrollment.

Running a Mock Site Visit

A mock site visit is one of the best ways to test readiness. A simple exercise includes:

1. Select a day and time during posted hours without advance notice to front-desk staff.

2. Have a compliance staff member or outside reviewer arrive and act as a site inspector.

3. Observe whether signage, posted hours, and the business name match enrollment records.

4. Note how staff greet the visitor, verify identification, and notify leadership.

5. Ask for a few common documents, such as licenses or a staff list, and note how quickly they are provided.

6. Debrief with staff, identify gaps, and update the protocol and training.

7. Document the exercise and any corrective actions.

Repeating the exercise periodically, and at each location, helps keep staff prepared.

A Site Visit Log

Keeping a log of every site visit and contractor contact creates a valuable record. A useful log captures:

• Date and time of the visit.

• Visitor name, organization, and identification.

• Stated purpose of the visit.

• Staff members present.

• Areas observed and questions asked.

• Documents requested and provided.

• Follow-up actions and deadlines.

• Name of the person completing the log.

Common Mistakes to Avoid

• Posting hours when the office is not staffed.

• Signage that does not match the enrolled business name.

• Failing to report a move or new location within 30 days.

• Operating from an unenrolled location.

• Front-desk staff refusing entry, providing inaccurate information, or failing to notify leadership.

• Producing records without tracking what was provided.

• Ignoring follow-up correspondence.

• Continuing to bill after a revocation effective date.

Coordinating With Other Reviews

Site visits rarely happen in isolation. An enrollment site visit may occur during revalidation or when adding a location, while a UPIC visit may accompany a records request or prepayment review. Agencies should connect site visit readiness with their broader compliance activities by tracking all contractor contacts in one place, making sure enrollment updates are made promptly after any operational change, and reviewing site visit results alongside medical review and billing data. This integrated approach helps leadership see the full picture of contractor activity and respond consistently.

Building Site Visit Readiness Into Your Compliance Program

• Include site visit readiness in your annual compliance risk assessment.

• Conduct periodic internal mock site visits during posted hours.

• Audit enrollment information against actual locations, signage, and staffing.

• Train staff at hire and annually on the site visit protocol.

• Maintain an up-to-date binder or digital folder of key documents.

• Report results to leadership and the compliance committee.

Frequently Asked Questions

Are Medicare site visits announced in advance?

CMS training materials state that National Site Visit Contractor visits are unannounced and conducted during normal business hours or posted business hours.

Who conducts Medicare site visits?

Enrollment site visits are generally conducted by CMS's National Site Visit Contractor. UPICs may also conduct site verification and on-site visits as part of program integrity work.

Can I be revoked for a failed site visit?

Yes. Under 42 CFR 424.535(a)(5), CMS may revoke enrollment if a provider is found not operational, and the effective date may be the date the location was found non-operational.

Do I have to let a site inspector in?

Providers should cooperate with legitimate site visits. Refusing access or obstructing a visit can lead to adverse findings. Verify the visitor's identity and notify leadership.

Are state surveys the same as Medicare site visits?

No. Enrollment site visits verify enrollment information and operational status. State survey agency or accrediting organization surveys assess compliance with conditions of participation.

What should I do if a site visit happened when no one was at the office?

Contact your Medicare Administrative Contractor and review any correspondence carefully. If you receive a deactivation or revocation notice, act quickly on available appeal options, gather evidence showing the location was operational, and consult counsel. Then fix the staffing gap that led to the problem.

How often should we run a mock site visit?

There is no required frequency, but many organizations run mock visits at least annually at each location, and more often after staff turnover, a relocation, or a change in hours.

Conclusion

Unannounced site visits and UPIC on-site visits are an important part of Medicare program integrity, and their consequences can be severe. A non-operational finding can lead to revocation, and a UPIC visit can be the beginning of an investigation. In 2026, with heightened scrutiny of hospices, home health agencies, and other high-risk provider types, readiness is essential.

Agencies can protect themselves by keeping locations properly signed and staffed during posted hours, ensuring enrollment information is accurate, reporting changes on time, training staff on a clear protocol, documenting every visit, correcting issues promptly, and responding quickly to any follow-up action.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in Medicare enrollment, program integrity, and audit readiness. We help agencies conduct mock site visits, review enrollment information against actual operations, develop site visit protocols and staff training, prepare for UPIC on-site visits, and respond to records requests and adverse actions in coordination with legal counsel. If you would like help preparing your staff and protecting your agency, please get in touch with us. We will be happy to help you with this topic.

References

• Electronic Code of Federal Regulations. 42 CFR 424.517, Onsite Review. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424/subpart-P/section-424.517

• Electronic Code of Federal Regulations. 42 CFR Part 424, Conditions for Medicare Payment. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-424

• Electronic Code of Federal Regulations. 42 CFR 424.535, Revocation of Enrollment in the Medicare Program. https://www.ecfr.gov/current/title-42/section-424.535

• Electronic Code of Federal Regulations. 42 CFR 424.540, Deactivation of Medicare Billing Privileges. https://www.ecfr.gov/current/title-42/section-424.540

• Electronic Code of Federal Regulations. 42 CFR 424.516, Additional Provider and Supplier Requirements for Enrolling and Maintaining Active Enrollment Status. https://www.ecfr.gov/current/title-42/section-424.516

• Electronic Code of Federal Regulations. 45 CFR 164.512, Uses and Disclosures for Which an Authorization or Opportunity to Agree or Object Is Not Required. https://www.ecfr.gov/current/title-45/section-164.512

• Centers for Medicare & Medicaid Services. Medicare Provider Enrollment Compliance Conference: Provider Enrollment Site Visits (February 2024). https://www.cms.gov/files/document/22024provider-enrollment-site-visits.pdf

• Centers for Medicare & Medicaid Services. Maintaining Compliance with Enrollment Requirements and the Appeals Process. https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/MedicareProviderSupEnroll/Downloads/Maintaining_Compliance_with_Enrollment_Requirements.pdf

• Centers for Medicare & Medicaid Services. Strengthening Provider and Supplier Enrollment Screening, Fact Sheet. https://www.cms.gov/newsroom/fact-sheets/strengthening-provider-and-supplier-enrollment-screening

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-08, Transmittal 306. https://www.cms.gov/Regulations-and-Guidance/Guidance/Transmittals/downloads/R306PI.pdf

• Centers for Medicare & Medicaid Services. Admin Info 24-22-ALL (Revised August 23, 2024). https://cms.gov/files/document/admin-info-24-22-all-revised-8-23-24.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. Medicaid Program Integrity Manual, Chapter 1. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/mpi115c01.pdf

• Centers for Medicare & Medicaid Services. Medicaid Program Integrity Manual, Chapter 3. https://www.cms.gov/files/document/chapter-3-medicaid-investigations-audits.pdf

• Centers for Medicare & Medicaid Services. CMS Announces Aggressive Nationwide Crackdown on Fraud with Six-Month Hospice and Home Health Agency Enrollment Moratoria. https://www.cms.gov/newsroom/press-releases/cms-announces-aggressive-nationwide-crackdown-fraud-six-month-hospice-home-health-agency-enrollment

• Centers for Medicare & Medicaid Services. Provider Enrollment Moratoria. https://www.cms.gov/medicare/enrollment-renewal/providers-suppliers/chain-ownership-system-pecos/provider-enrollment-moratoria

• Electronic Code of Federal Regulations. 42 CFR Part 498, Appeals Procedures for Determinations That Affect Participation in the Medicare Program. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-G/part-498

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/