UPIC: the audit that can suspend payments — counsel now

What a UPIC investigation is

A Unified Program Integrity Contractor, or UPIC, is the contractor CMS uses to investigate suspected fraud, waste, and abuse in Medicare and Medicaid. Where a routine audit asks whether a claim was coded correctly, a UPIC asks whether a pattern of claims was legitimate at all. That shift in the question — from error to intent — is what makes a UPIC contact the serious end of the audit spectrum, not a paperwork exercise you can clear with a quick correction.

UPIC versus RAC versus TPE: the seriousness ladder

It is easiest to gauge a UPIC by what it is not. Targeted Probe and Educate reviews 20 to 40 claims per round and exists to teach — it hands back education between rounds and escalates only after three failed rounds 1Ref 1Centers for Medicare & Medicaid Services (2026).Targeted Probe and Educate (TPE).That Targeted Probe and Educate is an educational, error-focused Medicare review (20-40 claims per round, education between rounds, escalation after three failed rounds), the routine tier below a UPIC.. A Recovery Audit Contractor conducts post-payment review and gives you a full five-level Medicare appeals process against its findings 2Ref 2Centers for Medicare & Medicaid Services (2026).Medicare Fee for Service Recovery Audit Program.That Recovery Audit Contractors conduct post-payment error review with appeal rights through the five-level Medicare appeals process, a routine tier distinct from a fraud-focused UPIC.. Both are error-focused programs. A UPIC operates a rung above them, in the fraud-and-abuse tier, where both the questions and the consequences are heavier.

If a routine audit is the takeback letter you can often answer with clean documentation, a UPIC is where overpayments talk gives way to fraud talk — and the difference is not one of degree.

What makes it serious

The seriousness of a UPIC investigation lives in the tools available at its tier. Program-integrity reviews are where payment suspension, extrapolated demands that project a sample's error rate across years of claims, and referral to the OIG or the Department of Justice become realistic outcomes rather than distant ones. A UPIC's findings can also become the basis for how the False Claims Act reaches a solo practice. None of that follows a routine coding audit, which is precisely why the response has to be different from the first contact.

Why the records carry the whole case

Because a UPIC is testing legitimacy, your contemporaneous records are the entire defense. Medicare requires each service to be authenticated by a handwritten or electronic signature, and while a missing signature can sometimes be cured by a formal attestation in review, that is a narrow fix rather than a habit to lean on 3Ref 3Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires each service to be authenticated by a handwritten or electronic signature and that a missing signature may be cured by attestation in review — why signed contemporaneous records anchor a UPIC defense.. Confirm your notes are complete and signed as they stand — and never add, edit, or backdate anything after a request arrives, which converts a documentation gap into an alteration allegation. When the records request arrives, produce a complete, paginated copy and keep an identical set for yourself.

Why telehealth and outlier data draw UPIC attention

UPICs are data-driven; they start from billing patterns that sit outside the norm. A practice that pivoted to mostly-telehealth, that bills the highest-intensity codes far more than peers, or whose volume spikes can surface as an outlier worth a look. Sustained upcoding — billing higher-intensity codes than the work supports — is one of the patterns that draws the initial data flag. Telehealth deserves its own compliance check here: now that the pandemic-era enforcement discretion has ended, telehealth must run on HIPAA-compliant arrangements, with separate guidance for audio-only encounters 4Ref 4HHS Office for Civil Rights (2026).HIPAA and Telehealth.That telehealth must run on HIPAA-compliant arrangements now that the COVID enforcement discretion has ended, with separate OCR guidance for audio-only encounters — the compliance baseline for a telehealth-heavy practice under integrity review. As of July 2026. (as of July 2026).

The stakes at the end of the line

The reason to take a UPIC seriously from the first contact is where it can end. A finding can lead to exclusion from federal health programs, after which no federal program may pay for any service you furnish — OIG maintains the exclusion list as the public record 5Ref 5HHS Office of Inspector General (2026).Exclusions Program.That OIG can exclude an individual from federal health programs, after which no federal program payment may be made for services they furnish, with the LEIE as the public record — the exclusion stake at the end of a UPIC finding.. If your own review of the flagged claims surfaces conduct that implicates federal fraud laws, OIG's self-disclosure protocol is a defined route to resolve it, often on better terms than being pursued to a finding 6Ref 6HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That OIG maintains a self-disclosure protocol for conduct implicating federal health-program fraud laws — the defined route if the clinician's own review of flagged claims surfaces a real problem.. That combination — suspension, referral, exclusion — is what separates this tier from a refund dispute.

How a UPIC investigation typically unfolds

A UPIC investigation rarely announces itself as one. It usually opens with what looks like an ordinary records request for specific dates of service — the same envelope a routine review would send. From there it can widen: additional records requests, a request to interview you or your staff, on-site visits, and contact with patients or referral sources. The contractor is assembling a picture of whether the billing reflects real, necessary, and properly documented services.

The endpoint can be an education letter, an overpayment demand, an extrapolated repayment figure, a payment suspension, or a referral onward to law enforcement. Because the early steps mimic a benign audit, the real danger is treating a UPIC's opening request as routine and answering it casually. Read the letterhead and the language carefully — a program-integrity contractor's request is not a claims examiner's, even when the paperwork looks identical.

What to do when a UPIC contacts you

Treat a UPIC contact as the point where the audit playbook changes. This is the tier the title calls the counsel threshold, and the reasoning is structural rather than dramatic: the consequences reach past a refund into suspension, referral, and exclusion. Naming this as the stage where counsel usually earns its cost is informing your decision, not making it for you. Work a fixed sequence from day one:

• Preserve and freeze. Lock every record for the flagged claims exactly as it stands; do not edit, add, or backdate a note.
• Get the scope in writing. Obtain the specific claims, records, and deadline in writing before answering substantive questions.
• Route communications carefully. Investigators are trained to elicit admissions; decide what you say and produce with counsel rather than improvising.
• Produce a complete, logged copy. Send exactly what was requested, paginated, and keep an identical duplicate.
• Weigh self-disclosure. If your own review finds a real problem, evaluate the self-disclosure route before waiting to be pursued.

A commercial-payer parallel, the SIU call, escalates on a similar logic and is worth reading alongside this one.