UPIC Audit Response for Behavioral Health and SUD Providers: The First 30 Days

A UPIC audit is a review by one of CMS's five Unified Program Integrity Contractors, the contractors that investigate fraud, waste, and abuse in Medicare and Medicaid. When a UPIC asks for records, you have 30 calendar days to respond, not the 45 days a MAC or RAC gives you, and any claim without records by the deadline is denied. Use those 30 days for five things: bring in counsel, preserve every record, assemble complete charts, clear 42 CFR Part 2 and psychotherapy note rules before anything leaves the building, and review your own charts before the UPIC does, so your response explains the documentation instead of leaving it to interpretation.

The stakes are higher than in a routine medical review. A UPIC can recommend prepayment review, an extrapolated overpayment, payment suspension, enrollment revocation, or referral to HHS-OIG. A records request is not an accusation, and an investigation is not a finding. But a UPIC is the contractor CMS uses when it wants more than education. For behavioral health (BH) and substance use disorder (SUD) programs the exposure is double, because UPICs audit Medicaid with the states too, and CMS lists mental health services among the most common areas of those collaborative audits.

This guide walks through how UPIC reviews start, what the request looks like, what can follow, a week-by-week plan for the first 30 days, and how to contest an extrapolation. It is general information, not legal advice.

What a UPIC is, and which one covers you

UPICs replaced the Zone Program Integrity Contractors (ZPICs), Program Safeguard Contractors, and Medicaid Integrity Contractors, and since 2018 five of them have covered the country. Under the Medicare Program Integrity Manual, a UPIC's job is to prevent, detect, and deter fraud, waste, and abuse in both Medicare and Medicaid, investigate allegations, take administrative action, and refer cases to law enforcement. Per CMS, the current contractors are CoventBridge (Midwestern), SafeGuard Services (Northeastern and Southeastern), and Qlarant Integrity Solutions (Western and Southwestern). For example, California is in the Western jurisdiction, Texas in the Southwestern, New York in the Northeastern, Florida in the Southeastern, and Ohio in the Midwestern. Contracts change, so confirm yours in the CMS Review Contractor Directory.

For how UPICs compare with RACs, TPE, SMRC, and the Medicaid side, see our guide to Medicare and Medicaid audits in behavioral health.

How UPIC reviews start

UPIC leads come from two directions. Proactive leads come from the UPIC's own data analysis, which looks for billing aberrancies tied to specific providers. Reactive leads come from outside: beneficiary complaints, the Fraud Prevention System, CMS, law enforcement, and other contractors. A MAC, RAC, CERT, or SMRC reviewer who finds potentially fraudulent entries in medical records refers them to the UPIC, and a MAC can refer providers who do not answer TPE record requests.

Two rules shape what happens next. A UPIC may open an investigation only after CMS approves the lead, so a formal investigation means CMS has signed off. And the UPIC is expected to establish the facts and take appropriate action within 210 calendar days unless CMS specifies otherwise. Its tools include phone calls and on-site visits, medical record requests, prepayment review of a limited set of claims (typically 25 to 50) or specific codes, auto-denial edits, and recommendations to CMS for payment suspension or revocation.

What the records request looks like

The request identifies the claims under review, the documentation needed, and the due date, and UPIC letters should name a point of contact. A few rules apply to every UPIC request:

• 30 calendar days. Under 42 CFR 405.929(c) and the Program Integrity Manual, you have 30 days to respond to a UPIC, for prepayment and post-payment review. The UPIC may accept late records for good cause, such as a natural disaster or business interruption, but that is its call.
• Secure exchange. UPICs are authorized to use Kiteworks to exchange records with providers. If a Kiteworks request goes unacknowledged after two attempts, the UPIC sends it by certified mail, courier, or fax, so watch both channels.
• Third parties. A UPIC may also request records from other clinicians involved in the patient's care, but the billing provider remains responsible for supporting its own claim.
• Statistical samples. If the review will be used to estimate an overpayment, the notice should explain why you were selected, the period under review, the claims requested, where the review will happen, your appeal rights, and how the sample results will be used.
• No psychotherapy notes. Medicare reviewers, UPICs included, may not request psychotherapy notes as defined by HIPAA, and refusing to send them cannot by itself cause a denial. You are responsible for extracting the information that supports the claim.

What can follow a UPIC review

After a law enforcement referral, the UPIC generally holds off on further administrative action during the 60-day window OIG or DOJ has to respond. Even when a case closes, the UPIC monitors your claims for at least six months. Silence after your response does not mean the matter is over.

The first 30 days: a week-by-week response plan

Days 1 to 3: triage and protect

• Log the date received, the reviewer, the claims, and the due date. Set an internal deadline at day 23.
• Confirm the request is real: match the contractor and contact details against the CMS Review Contractor Directory before sending any patient data.
• Call health care counsel experienced with UPICs. Ask whether counsel should direct the internal review and whether communications should go through counsel.
• Issue a written preservation hold: suspend routine deletion of EHR data and audit logs, scheduling and attendance records, telehealth platform logs, group sign-in sheets, billing files, and related email.
• Tell clinical and billing staff that no record may be edited because of the audit. Any late entry or amendment must carry its own date and author, as CMS expects.
• Check whether a payment suspension notice came with or before the request. If so, the rebuttal clock is already running.
• Name one coordinator for all UPIC contact, including any on-site visit.

Days 4 to 10: assemble the complete record

For each claim, pull everything that supports the service on that date, not just the progress note:

• Intake assessment, diagnosis, and, for SUD, the ASAM level of care determination in effect.
• The treatment plan in effect on the date of service, with its dates and signatures, and any updates.
• The progress note with start and stop times or total time for time-based psychotherapy codes, and modality and patient location for telehealth.
• Group notes with patient-specific content, and attendance records.
• Physician certifications and orders where required, such as for IOP and PHP.
• Medication records, consents, and discharge documentation where relevant.
• Signature logs or attestations for illegible or missing signatures, where CMS allows them.

Then run the disclosure checks. HIPAA permits disclosure to a health oversight agency, a definition that includes contractors acting for a public agency. For SUD records covered by 42 CFR Part 2, disclosure for a Medicare or Medicaid audit, evaluation, or civil or administrative investigation is permitted under 42 CFR 2.53(e) if the recipient agrees in writing to maintain, retain, and limit use of the records as Part 2 requires. A request to investigate or prosecute the program itself in a criminal matter generally requires a court order under 42 CFR 2.66. Confirm with counsel which applies, and keep the UPIC's written agreement in the file.

Days 11 to 20: review your own charts first

• Score every claim against the rules the UPIC will apply: Medicare coverage policy, CPT time rules, treatment plan requirements, signature requirements, and level-of-care criteria. Sort claims into supported, supported with explanation, and unsupported.
• For each supported claim, note the page where each requirement is met. For each weak one, write a factual explanation, not an argument.
• Look for patterns. Under 42 CFR 401.305, once you identify an overpayment you generally must report and return it within 60 days, with up to 180 days allowed for a timely, good-faith investigation of related overpayments. If the problem reaches beyond the requested claims, decide next steps with counsel.
• Do not create new documentation to fill gaps. A labeled late entry may be acceptable; a backdated note is a different problem.

Days 21 to 27: build the response package

• A cover letter listing every claim, the documents enclosed for each, and a short claim-by-claim summary pointing the reviewer to where each requirement is met.
• An index, page numbers on every page, and an explanation of how your EHR prints signatures, timestamps, and amendments.
• Records labeled as Part 2 protected where applicable, so the recipient applies the limits it agreed to.
• An identical copy of everything you send, kept by the coordinator.

Days 28 to 30: submit and confirm

• Submit through the channel the UPIC specified and keep the delivery receipt.
• If any record cannot be produced on time, request an extension in writing before the deadline and explain the good cause.
• Fix the documentation problems you found in current charts now. The UPIC may keep reviewing new claims while it evaluates the old ones.

After you respond: findings, demand letter, and appeals

The UPIC sends a findings letter, and if it identifies an overpayment, refers it to your MAC, which issues the demand letter. Appeals start with the MAC, and the UPIC forwards its case file. The clock matters more than the filing deadlines. Recoupment begins on day 41 after the demand letter, so file the redetermination by day 30 to stop it. If the MAC affirms, recoupment can resume on day 60 after that decision unless a reconsideration request has arrived. Interest accrues from day 31 if the debt is unpaid, even during an appeal.

One rule shapes the whole appeal: absent good cause, evidence not submitted before the QIC issues its reconsideration cannot be considered later, and new evidence at the ALJ level needs a good-cause explanation. Treat reconsideration as your last chance to complete the record. From the ALJ level on, recoupment continues while you appeal.

How to contest an extrapolation

By statute, Medicare can extrapolate only after a determination of a sustained or high level of payment error or documented failed education. That determination cannot be appealed, but the sample and every sampled claim can. CMS's manual says an appeal of the method must show actual statistical error that affects the overpayment amount; a contractor's failure to follow the manual is not automatically enough.

1. Get the full methodology. The contractor must disclose the universe, sampling frame, sampling unit, strata, sample size, period, estimation method, sampling error, and the overpayment on each sampled claim, and must document the random number source and seed so the sample can be replicated.
2. Check the universe. It should match the period and services under review, and claims with no final payment should not be in the sampling frame.
3. Check the demand. Contractors usually demand the lower limit of a one-sided 90 percent confidence interval rather than the point estimate.
4. Hire an independent statistician early enough to raise problems at redetermination and reconsideration.
5. Appeal every sampled claim on its merits. Each reversal forces a recomputation of the projected overpayment.
6. Preserve the issue for the ALJ. The hearing request must cover each sampled claim you are appealing and state why you disagree with the sample or extrapolation (42 CFR 405.1014).

How Adentris helps

The fastest way through a UPIC review is a record that already holds up. Adentris reviews every active chart, not a sample, against payer and regulatory rules before claims go out, including ASAM level of care, medical necessity, 42 CFR Part 2, Medicaid and payer documentation rules, and treatment plan and signature timing. Each finding cites the rule that fired, and Adentris drafts the correction for staff to approve. It runs on top of any EHR, connecting through its API or FHIR, HL7 feeds, an API our agents build where none exists, or the AI Web Agent, usually with no IT project on your side. Our payer audit readiness service runs a mock audit before a UPIC runs a real one, with chart defensibility scoring, extrapolation exposure, and an ADR playbook. To see it on your own charts, book a 30-minute call with our team.

Related reading

• Medicare and Medicaid Audits in Behavioral Health: RAC, UPIC, TPE, SMRC and MFCU Explained
• Prosecuted by Algorithm? What the DOJ's Data-Driven Fraud Push Means for Behavioral Health
• 42 CFR Part 2 Documentation and Consent: A 2026 Compliance Guide for SUD Programs

Sources

• CMS, Medicare Program Integrity Manual, Chapter 3 (ADRs, time frames, psychotherapy notes, signatures, amendments)
• CMS, Medicare Program Integrity Manual, Chapter 4 (UPIC roles, vetting, investigations, referrals)
• CMS, Medicare Program Integrity Manual, Chapter 8 (overpayments, payment suspension, statistical sampling)
• CMS, Resources for State and Territory Program Integrity Directors (UPIC jurisdictions and contractors)
• CMS, Review Contractor Directory
• HHS-OIG, UPICs Hold Promise To Enhance Program Integrity Across Medicare and Medicaid (OEI-03-20-00330)
• CMS, Comprehensive Medicaid Integrity Plan, FYs 2024 to 2028
• UPIC contractor coverage: Qlarant UPIC West, Qlarant UPIC Southwest, SafeGuard Services, NGS (Wellpoint Federal) UPIC table
• eCFR: 42 CFR 405.929, 405.379, 405.966, 405.1014, 405.1018, 424.535, 401.305, 2.53, 2.66, 45 CFR 164.512
• CMS, Medicare Overpayments fact sheet (MLN006379)
• CMS, Original Medicare (Fee-for-Service) Appeals and Federal Register, CY 2026 Amount in Controversy Thresholds

Frequently asked questions

What is a UPIC audit?

It is a review by a Unified Program Integrity Contractor, one of five CMS contractors that investigate fraud, waste, and abuse in Medicare and Medicaid. It usually starts with a records request and can lead to education, prepayment review, an overpayment demand, payment suspension, revocation, or referral to law enforcement.

How long do I have to respond to a UPIC records request?

30 calendar days, for both prepayment and post-payment review. The UPIC may accept late records for good cause, but claims without records by the deadline are denied, so request any extension in writing before the due date.

Is a ZPIC audit the same as a UPIC audit?

Effectively, yes. UPICs took over the work of the Zone Program Integrity Contractors (ZPICs), Program Safeguard Contractors, and Medicaid Integrity Contractors, and have covered all five jurisdictions since 2018.

Can a UPIC extrapolate an overpayment?

Yes. After a determination of a sustained or high level of payment error, or documented failed education, the UPIC can project the error rate in a statistical sample to the whole universe of claims, usually demanding the lower limit of a one-sided 90 percent confidence interval. You can appeal the methodology and each sampled claim.

Do we need patient consent to send SUD records to a UPIC?

Generally no, if the disclosure is for a Medicare or Medicaid audit, evaluation, or civil or administrative investigation under 42 CFR 2.53(e). The UPIC must agree in writing to Part 2's safeguarding and use limits. Investigating or prosecuting the program itself in a criminal matter generally requires a court order under 42 CFR 2.66, so confirm the purpose with counsel.

Should we hire a lawyer for a UPIC audit?

It is wise to involve experienced health care counsel from the first days, because a UPIC review can lead to extrapolation, payment suspension, revocation, or referral to law enforcement. Counsel can also advise on directing the internal chart review and on any overpayments you identify along the way.