Medicare and Medicaid Audits in Behavioral Health: RAC, UPIC, TPE, SMRC and MFCU Explained

Medicare and Medicaid audits of behavioral health providers come from several different reviewers, and the letterhead tells you most of what you need to know. Your Medicare Administrative Contractor (MAC) runs medical review and Targeted Probe and Educate (TPE). Recovery Audit Contractors (RACs) recover improper Medicare payments for a contingency fee. Unified Program Integrity Contractors (UPICs) pursue fraud, waste, and abuse in Medicare and Medicaid. The SMRC and CERT review claims for CMS, and on the Medicaid side, state program integrity units, Medicaid RACs, managed care plans, and Medicaid Fraud Control Units (MFCUs) do similar work. Most Medicare record requests give you 45 calendar days; a UPIC gives you 30.

For behavioral health (BH) and substance use disorder (SUD) programs, payer mix decides which of these you meet. Medicaid is the single largest payer for behavioral health services, according to MACPAC, and CMS expects UPICs to keep focusing on mental health, opioids, and telehealth in their Medicaid work with states through fiscal year 2028. Medicare exposure is growing too: marriage and family therapists and mental health counselors have been able to bill Medicare since January 1, 2024.

This guide covers who runs each audit, what triggers it, what they request, what can follow, how appeals work, and how to be ready before the letter arrives.

Who audits behavioral health providers

Medicare contractors, one by one

MAC medical review and TPE

Your MAC can review any claim at any time. The Medicare Program Integrity Manual directs MACs to target providers with high denial rates, billing that varies from peers, or evidence of risk to the Medicare Trust Fund, and to review new providers (generally 20 to 40 claims). A Comparative Billing Report showing how your utilization compares with your specialty is an early warning.

A TPE round typically covers 20 to 40 claims for one service, followed by one-on-one education, and the MAC must wait at least 45 days after that session before pulling new claims. It typically runs for up to three rounds. Compliant providers are not reviewed on that topic again for at least a year. Providers who still have errors after three rounds go to CMS, which can order more TPE, 100 percent prepayment review, extrapolation, referral to a RAC, or referral for revocation under 42 CFR 424.535(a)(8)(ii), which covers a pattern or practice of claims that fail Medicare requirements.

Recovery Audit Contractors (RACs)

Mandated by the Tax Relief and Health Care Act of 2006, RACs run automated and complex post-payment reviews in five regions (four for Part A and B, one nationwide for DMEPOS, home health, and hospice). The statement of work sets the guardrails:

• Look-back: no claims more than three years past the paid date.
• Topics: every review topic needs CMS approval, and CMS publishes approved topics. No random selection.
• Record limits: CMS caps requests and adjusts the cap by denial rate.
• Timing: results within 30 days of receiving records, then a 30-day discussion period before the claim goes to the MAC.
• Fees: the RAC repays its contingency fee if you win an appeal at any level.

Unified Program Integrity Contractors (UPICs)

UPICs took over the work of Zone Program Integrity Contractors (which is why people still say "ZPIC audit"), Program Safeguard Contractors, and Medicaid Integrity Contractors, and since 2018 they have covered five jurisdictions. Leads come from data analysis, complaints, the Fraud Prevention System, CMS, and law enforcement, and a lead becomes an investigation only after CMS approves it.

Confirm yours in the CMS Review Contractor Directory, since contracts change. A UPIC can call, visit on site, request records, impose prepayment review (typically 25 to 50 claims or specific codes), set auto-denial edits, and recommend suspension or revocation. It refers overpayments to your MAC, which sends the demand letter.

SMRC and CERT

The SMRC (Noridian Healthcare Solutions, per CMS) runs nationwide review projects on Medicare, DMEPOS, and Medicaid claims chosen from CMS data analysis, CERT results, and oversight agency findings. CERT reviews a random sample of Medicare claims each year to measure the improper payment rate: 6.55 percent, or $28.83 billion, in fiscal year 2025. CMS stresses that this is not a fraud rate, but an unanswered CERT request still counts as an improper payment and may be recouped.

Medicaid audits: states, Medicaid RACs, and managed care plans

• State program integrity units. Under 42 CFR Part 455, a complaint or questionable practice triggers a preliminary investigation and, if warranted, a full one. Outcomes include a warning letter, recovery, suspension or termination, and other sanctions. Suspected provider fraud must go to the MFCU.
• Medicaid RACs. State-contracted and paid from recoveries. Federal rules bar review of claims more than three years old without state approval, require overpayment notices within 60 days, require states to limit record requests, and guarantee appeal rights under state law. States may exclude managed care claims or seek a CMS exception.
• UPIC Medicaid audits. UPICs audit Medicaid providers with states and report overpayments to the state. CMS lists mental health services among the most common collaborative audit areas.
• Managed care plans. Under 42 CFR 438.608, plans must verify that billed services were delivered, refer potential fraud to the state or the MFCU, and suspend payments when the state finds a credible allegation of fraud.
• PERM. Measures Medicaid and CHIP improper payment rates in one-third of states each year; states must then file corrective action plans.

MFCUs and OIG: when an audit becomes an investigation

MFCUs investigate and prosecute Medicaid provider fraud and patient abuse or neglect. There are 53, usually in the state attorney general's office, certified and recertified annually by HHS-OIG and federally funded at 90 percent for the first 12 quarters and 75 percent after. In fiscal year 2025 they reported 1,185 convictions (856 for fraud), 674 civil settlements and judgments, almost $2 billion in recoveries, and 5,991 fraud referrals from managed care plans.

HHS-OIG audits programs, investigates fraud, and can exclude providers or seek civil monetary penalties. Its audits show what reviewers test in BH. Reviewing Medicare psychotherapy from March 2020 through February 2021, OIG found 128 of 216 sampled enrollee days out of compliance and estimated $580 million in improper payments out of $1 billion. Psychotherapy time was undocumented for 60 sampled days, treatment plans were incomplete or missing for 43, and signatures were missing for 31.

Payment suspension hits cash flow fastest. In Medicare, CMS can approve one on reliable information of an overpayment or incorrect payments, failure to furnish records, or a credible allegation of fraud. General suspensions last 180 days and cannot exceed 360; fraud suspensions can run longer at law enforcement's request. You can submit a rebuttal, generally within 15 calendar days. In Medicaid, 42 CFR 455.23 requires the state to suspend payments once it finds a credible allegation of fraud, unless it has good cause not to, and to refer the case to the MFCU by the next business day.

An audit is not an accusation, and an investigation is not a finding. But once a UPIC, MFCU, or OIG is involved, bring in health care counsel before you respond. This article is general information, not legal advice.

What auditors request, and the deadlines that matter

Most reviews start with an additional documentation request (ADR) listing the claims, the records needed, why you were selected, the due date, and the consequences of silence.

• 45 calendar days for MAC, RAC, SMRC, and CERT requests; 30 for UPIC requests (42 CFR 405.929).
• Extensions for good cause are at the contractor's discretion. Ask in writing, before the deadline.
• No response means denial, typically coded CO-50 with remark M127. Repeated UPIC non-response can also support a payment suspension.

Three rules matter in BH. Medicare reviewers may never request psychotherapy notes as HIPAA defines them, but you must extract what supports the claim: session times, modality, diagnosis, treatment plan, and progress. Amendments and late entries must show date and author. And for SUD records under 42 CFR Part 2, disclosure for a Medicare, Medicaid, or CHIP audit or evaluation is permitted under 42 CFR 2.53(e) when the recipient agrees in writing to Part 2's safeguards, while using records to investigate or prosecute a Part 2 program generally requires a court order under 42 CFR 2.66.

Possible outcomes, from education to referral

Extrapolation turns a small sample into a large number. A Medicare contractor may extrapolate only after determining a sustained or high level of payment error or documented failed education, and that determination cannot be appealed. The sampling methodology and each sampled claim can be. Contractors usually demand the lower limit of a one-sided 90 percent confidence interval, need a statistician's approval, and must disclose the universe, sampling frame, and calculations. Reversing sampled claims on appeal forces a recomputation. If you take a sampling challenge to an ALJ, the hearing request must cover each sampled claim you are appealing and state why you disagree with how the sample or extrapolation was done (42 CFR 405.1014).

Appeals and recoupment: the clock after the demand letter

Each deadline runs from receipt of the prior decision, but the dates that protect cash come sooner. Interest starts on day 31 after the demand letter if unpaid, even during an appeal. Recoupment starts on day 41, so file the redetermination by day 30. If the MAC upholds the overpayment, recoupment can resume on day 60 after that decision unless a reconsideration request has arrived. From the ALJ level on, recoupment continues during the appeal. A rebuttal (due in 15 days) does not stop recoupment. Medicaid appeals follow state law.

Why behavioral health is different

1. More reviewers. A Medicaid-heavy program can face the state agency, a Medicaid RAC, several managed care plans, a UPIC, and the MFCU, on top of Medicare.
2. Time-based and plan-based services. Psychotherapy codes depend on documented time, and Medicare IOP requires a physician certification and a written plan of care for patients who need at least 9 hours of services a week.
3. Extra disclosure steps. Psychotherapy notes and Part 2 records each need handling before records leave the building.
4. Telehealth. In the OIG psychotherapy audit, claims for 29 sampled enrollee days did not accurately show whether the session was telehealth or in person.

The first week after a letter arrives

1. Identify the reviewer and program from the letterhead and the rule cited, and check it against the CMS Review Contractor Directory or your state's notice.
2. Calendar the deadline from the date on the letter, with an internal deadline a week earlier.
3. Read the scope: the claims, the dates of service, and whether the review is prepayment, post-payment, or a statistical sample. A sample means extrapolation is possible.
4. Escalate by type. A MAC or RAC request goes to your billing and compliance leads. A UPIC request, a suspension notice, or any MFCU or OIG contact goes to counsel first.
5. Assemble the complete record for each claim: treatment plans, signatures, time documentation, orders, and consents. Check it against the payer's rules before it leaves.
6. Apply your Part 2 and psychotherapy notes procedures, send through a trackable channel (esMD, or the secure exchange the UPIC specifies), and keep an exact copy of what you sent.
7. Look beyond the sample. If the problem likely extends past the requested claims, talk to counsel about the 60-day overpayment rule.

How to be ready before the letter arrives

• Know your MAC, RAC region, UPIC jurisdiction, state Medicaid RAC, and each managed care plan's program integrity contact.
• Route every audit letter to one owner who logs reviewer, claims, and due date the day it arrives.
• Register for electronic medical documentation requests through esMD.
• Keep a written ADR playbook: who pulls, who reviews, who signs, how delivery is confirmed.
• Write procedures for Part 2 disclosures (including the auditor's written agreement) and for psychotherapy notes.
• Self-audit monthly: psychotherapy time, treatment plan elements and signatures, IOP and PHP hours against the level billed, group notes, and telehealth modality.
• Track denial rates by service; CMS weighs the percentage of denied claims in revocation decisions.
• Keep a signature log, an attestation process, and an amendment policy that preserves dates and authors.
• Follow the 60-day rule: report and return identified overpayments within 60 days, with up to 180 days for a timely, good-faith investigation of related ones.
• Keep an appeal calendar and know which health care attorney you will call.

How Adentris helps

Adentris reviews every active chart, not a sample, against payer and regulatory rules before claims go out, including ASAM level of care, medical necessity, 42 CFR Part 2, Medicaid and payer documentation rules, and treatment plan and signature timing. Each finding cites the rule that fired, and Adentris drafts the correction for your staff to approve. It works on top of any EHR, connecting through its API or FHIR, HL7 feeds, an API our agents build where none exists, or the AI Web Agent, usually with no IT project on your side, and is typically live in about 30 days. Our payer audit readiness service runs a mock audit before a UPIC, RAC, TPE, or commercial SIU runs a real one, with chart defensibility scoring, extrapolation exposure, and an ADR playbook. To see it on your own charts, book a 30-minute call with our team.

Related reading

• Prosecuted by Algorithm? What the DOJ's Data-Driven Fraud Push Means for Behavioral Health
• AI-Powered Behavioral Health Payer Audit Readiness Solutions
• Medical Necessity Documentation for Behavioral Health: What Payers Require

Sources

• CMS, Medicare Program Integrity Manual, Chapter 3: Verifying Potential Errors and Taking Corrective Actions
• CMS, Medicare Program Integrity Manual, Chapter 4: Program Integrity
• CMS, Medicare Program Integrity Manual, Chapter 8: Administrative Actions and Sanctions and Statistical Sampling for Overpayment Estimation
• CMS, Targeted Probe and Educate
• CMS, Medicare Fee for Service Recovery Audit Program
• CMS, Statement of Work for the Part A/B Recovery Audit Contractor, Region 2
• CMS, Supplemental Medical Review Contractor
• CMS, Comprehensive Error Rate Testing (CERT)
• CMS, Resources for State and Territory Program Integrity Directors (UPIC jurisdictions)
• CMS, Review Contractor Directory
• HHS-OIG, UPICs Hold Promise To Enhance Program Integrity Across Medicare and Medicaid (OEI-03-20-00330)
• UPIC contractor coverage pages: SafeGuard Services, Qlarant UPIC West, Qlarant UPIC Southwest, NGS (Wellpoint Federal) UPIC table
• CMS, Comprehensive Medicaid Integrity Plan, FYs 2024 to 2028
• eCFR: 42 CFR 405.929, 405.930, 405.379, 405.942, 405.962, 405.1014, 405.1102, 405.1130, 424.535, 401.305, Part 455 (including 455.23 and Subpart F), 438.608, 1007.19, 2.53, 2.66
• HHS-OIG, Medicaid Fraud Control Units and MFCU Annual Report, Fiscal Year 2025 (OEI-09-26-00140)
• HHS-OIG, Medicare Improperly Paid Providers for Some Psychotherapy Services (A-09-21-03021)
• CMS, Medicare Overpayments fact sheet (MLN006379)
• CMS, Original Medicare (Fee-for-Service) Appeals and Federal Register, CY 2026 Amount in Controversy Thresholds
• CMS, Medicare and Mental Health Coverage (MLN1986542)
• MACPAC, Behavioral Health

Frequently asked questions

What is the difference between a RAC audit and a UPIC audit?

A RAC looks for improper Medicare payments after the fact, works only on CMS-approved topics, can look back three years from the paid date, and is paid a contingency fee. A UPIC looks for fraud, waste, and abuse in both Medicare and Medicaid, can use prepayment review, payment suspension, revocation, and referral to OIG, and gives you 30 calendar days to send records instead of 45.

What is a TPE audit?

Targeted Probe and Educate is a MAC review of typically 20 to 40 claims for one service, followed by one-on-one education. It typically repeats for up to three rounds. Providers who become compliant are released from review on that topic for at least a year; those who do not are referred to CMS for possible 100 percent prepayment review, extrapolation, RAC referral, or revocation.

How long do I have to respond to a Medicare additional documentation request?

Generally 45 calendar days for MAC, RAC, SMRC, and CERT requests, and 30 calendar days for UPIC requests. Contractors may accept late records for good cause, but if nothing arrives in time the claim is denied.

What does a Medicaid Fraud Control Unit do?

An MFCU investigates and prosecutes Medicaid provider fraud and patient abuse or neglect. There are 53 units, usually in the state attorney general's office, certified and overseen by HHS-OIG. State Medicaid agencies must refer suspected provider fraud to them, and managed care plans refer cases as well.

Can Medicare extrapolate an overpayment from a sample of claims?

Yes, after a determination of a sustained or high level of payment error or documented failed education. The contractor must use a statistician-approved method and usually demands the lower limit of a one-sided 90 percent confidence interval. You can appeal the methodology and each sampled claim, and overturned claims reduce the projected amount.

Can we send SUD records protected by 42 CFR Part 2 to a Medicare or Medicaid auditor?

Generally yes for an audit or evaluation: 42 CFR 2.53(e) permits disclosure for a Medicare, Medicaid, or CHIP audit or evaluation when the recipient agrees in writing to Part 2's safeguarding and use limits. Using records to investigate or prosecute a Part 2 program generally requires a court order under 42 CFR 2.66, so confirm the purpose of the request with counsel.