Which UPIC Covers Your State? A Provider's Guide to Contractor Jurisdictions and Review Focus Areas

When a Medicare or Medicaid provider receives a letter from a Unified Program Integrity Contractor, or UPIC, one of the first questions is often, "Who is this contractor, and why are they contacting us?" UPICs are CMS contractors that detect and prevent fraud, waste, and abuse in Medicare and Medicaid. They operate in five geographic jurisdictions, and the location of a provider determines which UPIC is responsible for program integrity activities affecting that provider.

Knowing which UPIC covers your state helps you verify that a request is legitimate, find the correct contact and mailing information, understand regional enforcement priorities, and prepare for possible reviews. This guide explains what UPICs do, lists the five UPIC jurisdictions and the states and territories they cover, describes common review focus areas, and offers practical advice for preparing for UPIC activity. Because contractor assignments can change, providers should always confirm current information using CMS's official Review Contractor Directory.

What Is a UPIC?

CMS describes UPICs as performing fraud, waste, and abuse detection, deterrence, and prevention activities for Medicare and Medicaid claims processed in the United States. Specifically, UPICs perform integrity-related activities associated with Medicare Parts A and B, durable medical equipment, home health and hospice, Medicaid, and the Medicare-Medicaid data match program.

CMS explains that UPIC contracts combine and integrate functions previously performed by Zone Program Integrity Contractors (ZPICs), Program Safeguard Contractors (PSCs), and Medicaid Integrity Contractors (MICs).

What UPICs Do

Based on CMS manuals, UPIC activities include:

• Proactively identifying potential fraud, waste, and abuse through data analysis.

• Investigating allegations from beneficiaries, providers, CMS, HHS-OIG, and other sources.

• Screening leads through activities such as enrollment verification, data analysis, complainant contact, beneficiary interviews, and site verification.

• Conducting investigations that may include provider contact, on-site visits, interviews, and medical record reviews.

• Performing medical review for program integrity purposes, including prepayment and postpayment review.

• Recommending administrative actions, such as payment suspensions, revocations, and overpayment determinations.

• Referring cases to HHS-OIG and law enforcement.

• Partnering with state Medicaid agencies on Medicaid investigations and audits.

How UPICs Differ From Other Contractors

Medicare Administrative Contractors (MACs) process claims and conduct routine medical review. Recovery Audit Contractors (RACs) identify and recover improper payments, typically after payment. The Comprehensive Error Rate Testing (CERT) program measures improper payment rates. UPICs focus specifically on fraud, waste, and abuse and work closely with CMS's Center for Program Integrity and law enforcement. A UPIC request should therefore be treated as a high priority.

The Five UPIC Jurisdictions

According to CMS's resources for state program integrity directors, UPICs operate in five geographical jurisdictions, and the location of a provider's state determines its UPIC:

• Midwest jurisdiction: CoventBridge.

• Northeast jurisdiction: SafeGuard Services.

• Western jurisdiction: Qlarant Integrity Solutions.

• Southeast jurisdiction: SafeGuard Services.

• Southwestern jurisdiction: Qlarant Integrity Solutions.

The state and territory assignments below are based on CMS's published list of UPIC points of contact by state. Contractor names on that list may reflect earlier contract awards for some jurisdictions, so providers should confirm current contractor names and contact information using CMS's Review Contractor Directory Interactive Map.

Western Jurisdiction

Alaska, American Samoa, Arizona, California, Guam, Hawaii, Idaho, Montana, Nevada, North Dakota, the Northern Mariana Islands, Oregon, South Dakota, Utah, Washington, and Wyoming.

CMS's Review Contractor Directory lists the Western jurisdiction UPIC as Qlarant Integrity Solutions.

Southwestern Jurisdiction

Arkansas, Colorado, Louisiana, Mississippi, New Mexico, Oklahoma, and Texas.

CMS lists the Southwestern jurisdiction UPIC as Qlarant Integrity Solutions.

Midwest Jurisdiction

Illinois, Indiana, Iowa, Kansas, Kentucky, Michigan, Minnesota, Missouri, Nebraska, Ohio, and Wisconsin.

CMS lists the Midwest jurisdiction UPIC as CoventBridge.

Northeast Jurisdiction

Connecticut, Delaware, the District of Columbia, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island, and Vermont.

CMS lists the Northeast jurisdiction UPIC as SafeGuard Services.

Southeast Jurisdiction

Alabama, Florida, Georgia, North Carolina, Puerto Rico, South Carolina, Tennessee, the U.S. Virgin Islands, Virginia, and West Virginia.

CMS lists the Southeast jurisdiction UPIC as SafeGuard Services.

How to Confirm Your UPIC

Because contractor assignments and contact information can change, providers should:

• Use CMS's Review Contractor Directory Interactive Map to find the current UPIC, mailing address, phone number, and whether the UPIC accepts submissions through the Electronic Submission of Medical Documentation (esMD) system.

• Compare the contractor name and contact information on any letter with CMS's directory.

• Be cautious of requests that do not match official contact information, and verify before sending records.

How UPIC Jurisdictions Relate to Other Contractor Regions

UPIC jurisdictions do not align exactly with other contractor regions. For example:

• Recovery Audit Contractor regions are organized differently. CMS lists RAC Regions 1 through 4 for Part A and Part B claims, and a nationwide Region 5 for durable medical equipment, home health, and hospice.

• MAC jurisdictions are also organized differently, and home health and hospice claims are processed by specialized home health and hospice MACs.

A provider may therefore deal with a MAC, a RAC, and a UPIC whose regions cover different combinations of states. Keeping a list of the contractors that apply to each location helps avoid confusion.

Multi-State Providers

Organizations with locations in more than one state may interact with multiple UPICs. CMS's Program Integrity Manual describes coordination among UPICs for national actions, such as national payment suspensions, in which a lead UPIC coordinates with non-lead UPICs in other jurisdictions. Multi-state providers should:

• Map each location to its UPIC, MAC, and RAC.

• Centralize tracking of contractor requests across locations.

• Make sure enrollment information is accurate for every location.

• Recognize that issues identified in one jurisdiction may lead to coordinated action in others.

Common UPIC Review Focus Areas

UPICs set priorities based on CMS direction, data analysis, and regional trends. While specific priorities vary by jurisdiction and change over time, CMS program integrity materials and enforcement actions point to recurring focus areas:

Home Health and Hospice

UPICs perform program integrity activities for home health and hospice. CMS has described significant fraud concerns in these sectors, imposed nationwide enrollment moratoria in May 2026, and reported payment suspensions for approximately 800 hospices and home health agencies suspected of fraud in Los Angeles. In its hospice moratorium notice, CMS described recent increases in hospice enrollment in Arizona, California, Georgia, Nevada, and Texas.

Durable Medical Equipment

CMS's Fraud Defense Operations Center reported more than $226 million in suspended payments related to suspect durable medical equipment billing in the first half of 2026, and CMS imposed a nationwide moratorium on certain DMEPOS medical supply companies in February 2026.

Laboratories

CMS has reported stopping more than $1.6 billion in potentially improper Medicare laboratory payments and revoking 157 laboratory providers. Genetic testing and repeated testing patterns have been highlighted in CMS examples.

Wound Care and Skin Substitutes

CMS's Fraud Defense Operations Center has reported significant suspended payments related to skin substitutes.

Medicaid Services

UPICs partner with state Medicaid agencies. CMS's Medicaid Program Integrity Manual explains that UPICs collaborate with states under joint operating agreements and pursue investigations generally involving Medicaid dollars at risk above certain thresholds. In 2026, CMS also launched the Medicaid Fraud War Room in coordination with the White House Task Force to Eliminate Fraud.

Identity Misuse

UPICs also participate in CMS's Victimized Provider Project, which assists legitimate providers whose identities were stolen and used to bill Medicare.

Regional Enforcement Context

While UPIC priorities are set nationally by CMS and adjusted for regional risks, recent federal actions highlight issues that have received attention in particular regions. This context is not a list of official UPIC priorities, but it can help providers understand the environment in their area.

• Western jurisdiction. CMS reported payment suspensions for approximately 800 hospices and home health agencies suspected of fraud in Los Angeles, and identified recent hospice enrollment increases in Arizona, California, and Nevada. The Department of Justice also formed a West Coast Health Care Fraud Strike Force covering Arizona, Nevada, and Northern California in 2026.

• Southwestern jurisdiction. CMS identified recent hospice enrollment increases in Texas, and CMS described heightened oversight of newly enrolled hospices in states including Texas.

• Southeast jurisdiction. CMS identified recent hospice enrollment increases in Georgia, and Florida has historically been a focus of Medicare fraud enforcement, including strike force activity.

• Midwest jurisdiction. The Department of Justice and CMS announced significant Medicaid fraud enforcement actions involving Minnesota, and CMS deferred federal Medicaid matching funds to Minnesota in 2026 based on program integrity concerns. CMS also described heightened hospice oversight in Ohio.

• Northeast jurisdiction. The Department of Justice expanded its Northeast Health Care Fraud Strike Force to Philadelphia in 2026, with a focus on Medicaid fraud, including home health aide schemes.

Providers in every jurisdiction should assume that data analytics are being used to identify outliers and should focus on accurate billing and documentation regardless of location.

Understanding the UPIC Workflow

CMS manuals describe a general workflow for UPIC activity:

• Leads. UPICs receive leads from data analysis, complaints, referrals from MACs and other contractors, CMS, HHS-OIG, and other sources.

• Screening. UPICs screen leads to decide whether further investigation is warranted. CMS's Medicaid Program Integrity Manual states that screening shall be completed within 45 calendar days after receipt of the lead, and that screening activities may include enrollment verification, data analysis, complainant contact, beneficiary interviews, and site verification. Screening generally does not involve contact with the subject provider or administrative actions.

• Investigation. If warranted, UPICs open an investigation, which may include provider contact, records requests, medical review, interviews, and site visits.

• Administrative actions. UPICs may recommend actions such as prepayment review, payment suspension, revocation, or overpayment determinations. CMS's Medicare Program Integrity Manual describes case coordination meetings at which certain actions, such as 100 percent prepayment review requests, payment suspension recommendations, revocation requests, and extrapolated overpayment requests, are discussed with CMS.

• Referral. UPICs may refer cases to HHS-OIG and law enforcement.

Understanding this workflow helps providers recognize that by the time they receive a request, the UPIC may already have analyzed their data.

UPICs and Medicaid

UPICs also support Medicaid program integrity. According to CMS's Medicaid Program Integrity Manual:

• UPICs collaborate with state Medicaid agencies in their jurisdictions under joint operating agreements.

• UPICs follow state policies and may use audit protocols preferred by the state.

• UPICs access Medicaid claims data through CMS's Integrated Data Repository.

• UPICs generally pursue proactive Medicaid investigations involving dollars at risk above a specified threshold, and leads are vetted with the state and CMS.

• UPICs may also audit program integrity activities of Medicaid managed care plans.

Providers that bill Medicaid should understand that UPIC activity can involve both Medicare and Medicaid claims and that findings may be shared with state agencies.

Keeping a Contractor Map

A simple contractor map helps organizations respond quickly to any request. For each location, record:

• The state and address.

• The Medicare Administrative Contractor and jurisdiction.

• The home health and hospice MAC, if applicable.

• The Recovery Audit Contractor region.

• The UPIC jurisdiction and contractor.

• Official contact information from CMS's directory.

• The state Medicaid agency and any Medicaid managed care plans.

Review the map at least annually and whenever CMS announces contractor changes.

Common Misunderstandings About UPICs

• "A UPIC request means we are accused of fraud." Not necessarily. UPIC reviews can result from data analysis or complaints and can end without action. However, they should be treated seriously.

• "UPICs only handle Medicare." UPICs also perform Medicaid program integrity work in partnership with states.

• "Our RAC and UPIC are the same." They are different contractors with different roles and regions.

• "We have 45 days to respond." UPIC documentation requests generally require a response within 30 days.

• "If we are in another state, our home-state UPIC handles everything." Multi-state providers may interact with multiple UPICs.

What a UPIC Request May Look Like

UPIC activity can take several forms:

• A documentation request for specific claims, generally with a 30-day response deadline under CMS's Medicare Program Integrity Manual.

• A notice of prepayment or postpayment review. CMS instructions require UPICs to notify providers in writing before beginning provider-specific review and to indicate whether the review is prepayment or postpayment.

• A site visit or interview request.

• A request for information about ownership, management, or business operations.

• Notice of an administrative action, such as a payment suspension or revocation recommendation approved by CMS.

Why Jurisdiction Matters in Practice

Knowing your UPIC jurisdiction has several practical benefits:

• Verification. Scam letters and phishing attempts sometimes impersonate government contractors. Matching the sender to your official UPIC helps confirm that a request is legitimate before you send protected health information.

• Correct submission. Each UPIC has its own mailing address and electronic submission options. Sending records to the wrong contractor can cause delays and missed deadlines.

• Awareness of local trends. Understanding enforcement activity in your region helps you focus internal audits on the services and patterns most likely to draw attention.

• Coordination. If you also receive requests from your MAC or RAC, knowing which contractor is which helps you track deadlines and avoid confusion.

• Multi-state planning. Organizations expanding into new states can anticipate which UPIC they will interact with and plan compliance resources accordingly.

Questions to Ask When You Receive a UPIC Letter

• Which UPIC sent the letter, and does it match my jurisdiction in CMS's directory?

• What type of activity is this: a documentation request, prepayment or postpayment review notice, site visit, or administrative action?

• Which claims, beneficiaries, dates of service, or locations are involved?

• What is the deadline, and how must records be submitted?

• Does the request involve Medicare, Medicaid, or both?

• Is there any indication of a broader investigation, such as interview requests?

• Do we need to involve legal counsel now?

How to Prepare for UPIC Activity

Know Your Contractors

• Identify your UPIC, MAC, and RAC for each location.

• Save their official contact information.

• Make sure mail and electronic portals are monitored.

Maintain Strong Documentation

• Make sure records support medical necessity, orders, certifications, and services provided as billed.

• Avoid cloned documentation.

• Follow Medicare rules for late entries and addenda.

Monitor Your Data

• Review your billing patterns for outliers compared with peers.

• Use comparative reports such as CMS's Program for Evaluating Payment Patterns Electronic Report (PEPPER), where available.

• Investigate and document reasons for significant changes.

Keep Enrollment Accurate

• Confirm that practice locations, ownership, and managing employees are accurately reported.

• Report changes within required timeframes.

• Prepare for site visits.

Have a Response Plan

• Adopt a written protocol for UPIC requests, site visits, and interviews.

• Designate a response coordinator.

• Identify experienced legal counsel in advance.

Responding to a UPIC Request

When a UPIC request arrives:

1. Log the request and calendar the deadline.

2. Verify the UPIC's identity using CMS's directory.

3. Notify the compliance officer and leadership.

4. Consider engaging experienced legal counsel.

5. Issue a legal hold to preserve records.

6. Gather complete records, review them for quality, and submit them on time.

7. Keep copies and proof of submission.

8. Monitor for follow-up actions.

Frequently Asked Questions

How many UPIC jurisdictions are there?

CMS states that UPICs operate in five geographic jurisdictions: Midwest, Northeast, Western, Southeast, and Southwestern.

Which UPIC covers my state?

Use the jurisdiction lists above as a starting point and confirm using CMS's Review Contractor Directory Interactive Map, which provides current contractor names and contact information.

Do UPICs handle Medicaid too?

Yes. CMS describes UPICs as performing program integrity activities for both Medicare and Medicaid, working in partnership with state Medicaid agencies.

Is my UPIC the same as my RAC?

No. UPICs and RACs are different contractors with different roles and different regional structures.

How quickly must I respond to a UPIC request?

Generally within 30 calendar days for documentation requests, according to CMS's Medicare Program Integrity Manual. Always follow the deadline in the request.

Can a UPIC visit my office without notice?

Yes. UPIC screening and investigations may include site verification and on-site visits. Make sure staff know how to respond professionally and notify leadership.

Where do I send records for a UPIC request?

Follow the instructions in the request and confirm the address or electronic submission method using CMS's Review Contractor Directory, which also indicates whether the UPIC accepts esMD submissions.

Do UPIC jurisdictions ever change?

Yes. CMS periodically awards new contracts, and contractor names and assignments can change. CMS's Review Contractor Directory is the best source for current information. Organizations should review their contractor map at least annually and whenever they receive correspondence from an unfamiliar contractor.

Does my UPIC handle durable medical equipment claims?

Yes. CMS describes UPICs as performing program integrity activities related to durable medical equipment, along with Medicare Parts A and B, home health and hospice, and Medicaid.

Conclusion

UPICs play a central role in Medicare and Medicaid program integrity, and knowing which UPIC covers your state is a practical first step in preparing for and responding to UPIC activity. The five UPIC jurisdictions, Western, Southwestern, Midwest, Northeast, and Southeast, each cover defined states and territories, and CMS's Review Contractor Directory provides current contractor information.

Providers that know their contractors, maintain strong documentation, monitor billing data, keep enrollment accurate, and have a written response plan are best positioned to handle UPIC requests efficiently and protect their organizations.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in program integrity, UPIC audit response, and compliance. We help providers identify their contractors, prepare for UPIC reviews and site visits, organize and review records before submission, analyze billing data for outlier patterns, and build response protocols. If you would like help preparing for UPIC activity in your state, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Review Contractor Directory, Interactive Map. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/review-contractor-directory-interactive-map

• Centers for Medicare & Medicaid Services. Resources for State and Territory Program Integrity Directors. https://www.cms.gov/medicare/medicare-medicaid-coordination/resources-state-medicaid-agencies/resources-state-territory-program-integrity-directors

• Centers for Medicare & Medicaid Services. CMS Victimized Provider Project, Medicare Unified Program Integrity Contractor Points of Contact. https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification/MedicareProviderSupEnroll/downloads/providervictimpocs.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 4. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c04.pdf

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 8. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c08.pdf

• Centers for Medicare & Medicaid Services. Medicaid Program Integrity Manual, Chapter 1. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/mpi115c01.pdf

• Centers for Medicare & Medicaid Services. Medicaid Program Integrity Manual, Chapter 3. https://www.cms.gov/files/document/chapter-3-medicaid-investigations-audits.pdf

• Centers for Medicare & Medicaid Services. Medicare Fee for Service Recovery Audit Program. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medicare-fee-service-recovery-audit-program

• Centers for Medicare & Medicaid Services. CMS Announces Aggressive Nationwide Crackdown on Fraud with Six-Month Hospice and Home Health Agency Enrollment Moratoria. https://www.cms.gov/newsroom/press-releases/cms-announces-aggressive-nationwide-crackdown-fraud-six-month-hospice-home-health-agency-enrollment

• Federal Register. Announcement of Nationwide Temporary Moratorium on Enrollment of Hospices (May 15, 2026). https://www.federalregister.gov/documents/2026/05/15/2026-09718/medicare-medicaid-and-childrens-health-insurance-programs-announcement-of-nationwide-temporary

• Centers for Medicare & Medicaid Services. Crushing Fraud through the Fraud Defense Operations Center, Fast Facts (CY 2026 update). https://www.cms.gov/files/document/cpi-fdoc-fact-sheet-updated-first-year.pdf

• Centers for Medicare & Medicaid Services. CMS Prevents $1.6 Billion in Fraudulent Medicare Laboratory Payments. https://www.cms.gov/newsroom/press-releases/cms-prevents-1-6-billion-fraudulent-medicare-laboratory-payments

• Centers for Medicare & Medicaid Services. CMS Medicaid Fraud War Room Stops More Than $203 Million in Improper Payments During First 88 Days. https://www.cms.gov/newsroom/press-releases/cms-medicaid-fraud-war-room-stops-more-203-million-improper-payments-during-first-88-days

• U.S. Department of Justice, Office of Public Affairs. The Fraud Division Launches West Coast Strike Force to Target Health Care Fraud Schemes Across Arizona, Nevada, and Northern California. https://www.justice.gov/opa/pr/fraud-division-launches-west-coast-strike-force-target-health-care-fraud-schemes-across

• U.S. Department of Justice, Office of Public Affairs. The Fraud Division Announces Charges Against 19 Defendants for Medicaid Home Health Aid Schemes. https://www.justice.gov/opa/pr/fraud-division-announces-charges-against-19-defendants-medicaid-home-health-aid-schemes

• Centers for Medicare & Medicaid Services. Trump Administration Prioritizes Affordability by Announcing Major Crackdown on Health Care Fraud. https://www.cms.gov/newsroom/press-releases/trump-administration-prioritizes-affordability-announcing-major-crackdown-health-care-fraud

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance/