# What Is a UPIC Audit? How CMS Contractors Review Medicaid NEMT Claims

Canonical URL: https://nemtguide.com/glossary/upic/ · Updated 2026-10-02

A UPIC audit is a review of your Medicaid or Medicare claims by a Unified Program Integrity Contractor, a company CMS hires to find fraud, waste, and abuse. For Medicaid, CMS and your state must approve the case first. The contractor requests records, usually with 30 days to answer, and reports any overpayment to the state, which collects it and hears your appeal.

- UPICs are CMS contractors that audit Medicaid providers in five regions, but only after CMS and your state approve each case.
- CMS points them at Medicaid cases where more than $50,000 is at risk on the questioned billing, unless fraud is suspected.
- The records letter lists the claim lines under review. CMS's manual allows 30 days, plus a 15-day extension if you ask for it.
- Records you never send can turn every sampled claim into an overpayment.
- The state, not CMS, collects any overpayment and runs your appeal.

A UPIC letter looks federal, but the case behind it was approved by your state as well as by CMS, and the state is the one that collects. Knowing that changes how you answer it: the deadline is real, the rules are your state's Medicaid rules, and your appeal runs through the state.

## What a UPIC is

A Unified Program Integrity Contractor is a private company under contract with CMS. Section 1936 of the Social Security Act, added by the Deficit Reduction Act of 2005, tells CMS to hire contractors to review Medicaid providers, audit their claims, find overpayments, and educate providers. The same contractors do this work for Medicare, so one UPIC can review both your Medicaid trips and any Medicare claims you bill.

UPICs work in five regional jurisdictions. CMS's review contractor directory lists the UPIC for each state with its mailing address, but the directory was last updated November 27, 2024, so confirm the name with your state too. The letter you get names the contractor and says CMS uses it to audit Medicaid claims under the Medicaid Integrity Program.

A UPIC never works a Medicaid case alone. CMS and the state Medicaid agency must both approve each case before it becomes an audit, and if the state is already auditing you for a similar issue, CMS may cancel or postpone the UPIC's work (Medicaid Program Integrity Manual, chapter 2, revised December 23, 2025). The state's own office is described on the [Medicaid program integrity](https://nemtguide.com/glossary/program-integrity/) page.

### How common UPIC audits are

Transportation is not among the provider types UPICs review most. CMS's report to Congress for fiscal year 2024 (September 2025) says UPICs opened Medicaid cases in 49 states and the District of Columbia that year, most often for hospitals, physicians, clinics, pharmacies, hospices, medical equipment suppliers, and labs. A NEMT company is more likely to hear from its state's own auditors first. States reported $19.3 million in federal-share recoveries from UPIC work that year.

New York's numbers show the scale in one state. Its inspector general's 2025 annual report says the Northeast UPIC completed nine audits there in 2025, with more than $3.5 million in overpayments identified and more than $2.5 million recovered. It also completed six investigations and sent eight providers to law enforcement, which accepted six.

## What triggers a UPIC review

A case starts as a lead. CMS's manual lists where leads come from:

- **The UPIC's own data work.** It studies Medicaid claims data from every state, from the national T-MSIS data set, looking for providers far outside the normal pattern.
- **The state.** The Medicaid agency can hand over leads from its own analytics or tips.
- **Medicare work.** A problem found in a provider's Medicare billing can lead to its Medicaid claims.
- **Law enforcement and the HHS OIG hotline.**
- **CMS.** Including complaints from members or their families sent through CMS regional offices.
- **Anything else.** Tips, news stories, and internet articles all count.

Money matters. CMS points UPICs at Medicaid cases where the money at risk on the questioned billing is more than $50,000, counting only the codes under question, not everything you billed. A state can ask for a smaller audit if the money at risk is still more than the audit would cost. The threshold does not apply when fraud is suspected (Medicaid Program Integrity Manual, section 3.2).

For a van company, an outlier could look like billed miles per wheelchair leg on [S0209](https://nemtguide.com/glossary/s0209/) far above other companies serving the same area, or many trips for one rider on days with no medical claim. Both patterns can be seen in claims data without asking you for anything.

You will not hear about the screening. The UPIC has 45 days to screen a lead, and it may check your enrollment and exclusion status, interview riders, and verify your business location, all without contacting you (section 3.3). If it then wants to go further, CMS and the state vet the case first.

## What the records request looks like

CMS's sample notification letter, in the manual's appendices (August 28, 2025), shows what you will receive:

- The dates of service under audit and the goal: whether claims were billed and paid under federal and state Medicaid rules.
- A statement that you must give CMS and the UPIC timely, unrestricted access to all documents and records related to your Medicaid claims and payments.
- For a desk audit, a list of the claim lines under review and the kinds of documents that can support them, to be sent within the time the letter sets.
- For a field audit, notice that an auditor will call to schedule an entrance conference and site visit, where you will be asked for an overview of your company, your claims process, your policies, and an organization chart.
- A warning that state sanctions can follow if you do not send the records, such as a payment hold or exclusion from the state's Medicaid program, and that payment for any service without records will be recovered.

The manual tells UPICs to give you 30 days to produce records, with a 15-day extension if you ask, unless the state or CMS sets another deadline (section 3.10). The sample letter itself says 30 business days. Go by the date in your letter, and ask for any extension in writing before it passes.

Missing records cost the most. When a provider does not send the records needed for review, every claim in the sample can be found overpaid, which CMS calls a 100 percent overpayment (section 4.3).

### What reviewers look for in your trip records

Reviewers may start with a probe of 20 to 40 claim lines, and CMS asks them to finish the medical review within 60 calendar days (section 3.9). They check that each claim matches a record by rider name, Medicaid ID, and procedure, that the service was really given, and that the records were not changed. Missing or inserted pages, white-out, and many late entries are red flags. Undated or unsigned notes handwritten in a margin are not considered at all.

Here is how that plays out for a NEMT company. Say your letter lists 30 wheelchair van legs from 2024 and 2025, each billed as an [A0130](https://nemtguide.com/glossary/a0130/) base charge plus S0209 miles. For each leg you send the trip record with pickup and drop-off times, the driver's name and signature, and the plate number, plus the GPS trace, proof of the appointment, and the driver and van files for that day. One log has a drop-off time squeezed into the margin later, in a different pen, with no date or initials. The reviewer will not consider that note, and if nothing else shows the time, the leg can fail. The [trip documentation guide](https://nemtguide.com/guides/nemt-trip-documentation/) covers what each leg's record should hold when it is made.

## What happens after you send records

The manual sets a clock for each step:

1. **Within 180 days of opening the case,** the UPIC asks CMS to close it, starts a referral to law enforcement, or sends an Initial Findings Report to the state (section 3.5).
2. **The state reviews the report for 30 calendar days.**
3. **If the state requires it, you get the report for 30 calendar days** to comment and send rebuttal records. If your response changes the money, a revised report goes to CMS and the state for 15 days (section 4.3).
4. **Within 13 months of opening the case,** the UPIC sends a Final Findings Report to CMS, which sends it to the state with the federal share it must repay.
5. **The state must refund the federal share to CMS one year** after that written notice, whether or not it has collected from you ([42 CFR 433.312](https://www.ecfr.gov/current/title-42/section-433.312) and [433.316](https://www.ecfr.gov/current/title-42/section-433.316)). That is why collection can start quickly.

Everything after that is the state's. Your state's appeal rules apply, the state defends the findings, and any settlement is negotiated with the state (sections 4.4 and 4.6). The [Medicaid recoupment guide](https://nemtguide.com/guides/medicaid-recoupment/) lists dispute deadlines in several states.

Two limits help you. A UPIC can project sample errors across all your claims only where state law allows it and the state agrees (section 3.7). And it follows the state's look-back period, checking with CMS before going beyond five years (section 3.8). If nothing is found, you get a close-out letter, which still warns that the same claims can be audited again later, so keep the records for your full [retention period](https://nemtguide.com/guides/nemt-record-retention/).

## How to respond to a UPIC audit

1. **Confirm the contractor** in CMS's directory and with your state's program integrity unit.
2. **Calendar the deadline** from the letter, and ask in writing for an extension before it passes if you need one.
3. **Name one person** to track every request and every page sent.
4. **Stop routine deletion** of trip, GPS, dispatch, and phone records for the audit period.
5. **Pull the full record for each claim line** on the list: trip log, signature, times, miles, appointment proof, and the driver and vehicle files for that date.
6. **Change nothing.** Send records as they were made, and explain any gap in a cover letter instead of filling it in.
7. **Send everything in order** with an index, and keep a copy of all of it.
8. **Answer the Initial Findings Report** in writing, claim by claim, within its 30 days.
9. **Appeal through your state** if you disagree with the final findings, inside the state's deadline.
10. **Fix the cause.** Check similar claims outside the audit period and return any overpayment within 60 days of finding it, under the [60-day overpayment rule](https://nemtguide.com/guides/medicaid-overpayment-60-day-rule/).

Call a health care attorney before you answer if the letter mentions fraud, law enforcement, or a [payment suspension](https://nemtguide.com/glossary/payment-suspension/).

## Frequently asked questions

### How do I know a UPIC letter is real?

The letter names the contractor and says CMS uses it to audit Medicaid claims under the Medicaid Integrity Program. Look the contractor up in CMS's review contractor directory, which lists the UPIC for each state with its mailing address, and call your state Medicaid program integrity unit, which must have approved the case. Do not use a phone number or upload link you cannot match to one of those two sources.

### Is a UPIC audit a fraud investigation?

It can become one. CMS calls the work investigations or audits, and a case can end with a close-out letter, an overpayment finding, or a referral to law enforcement. When a UPIC finds signs of fraud and CMS agrees, it meets with CMS, the state, and law enforcement about a referral, and HHS OIG reviews every UPIC fraud referral (Medicaid Program Integrity Manual, section 4.10). A UPIC can recommend a payment suspension, but only the state can impose one. Call a health care attorney if fraud is mentioned.

### How far back can a UPIC audit go?

As far as your state's own audits can. CMS tells UPICs to follow the state's look-back period and to ask CMS first if that period is longer than five years (Medicaid Program Integrity Manual, section 3.8). In New York, for example, claims can be audited for six years from the date of service or billing, whichever is later, with no limit where fraud is involved.

### Can I appeal a UPIC finding to CMS?

No. CMS does not set the appeal process for UPIC Medicaid findings. Your state's Medicaid appeal rules apply, the state defends the findings, and the UPIC may testify for the state. Any settlement is negotiated with the state too, and the state still owes CMS the full federal share of the overpayment CMS referred.

### Can a UPIC review trips I ran for a health plan or broker?

Yes. UPICs audit Medicaid managed care plans, and part of each audit samples claims the plan paid its network providers over the past two federal fiscal years. The providers in that sample are reviewed as secondary subjects. If the records show questionable billing outside the audit's scope, the UPIC opens a separate lead on that provider (Medicaid Program Integrity Manual, section 3.12.3).

## Official resources

- [CMS: Review Contractor Directory, find the UPIC for your state](https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/review-contractor-directory-interactive-map)
- [CMS: Medicaid Program Integrity Manual, Chapter 3, Medicaid Investigations and Audits](https://www.cms.gov/files/document/chapter-3-medicaid-investigations-audits.pdf)
- [CMS: Medicaid Program Integrity Manual, Chapter 4, Reporting Investigational Findings](https://www.cms.gov/files/document/chapter-4-reporting-investigational-findings-making-referrals.pdf)
- [CMS: Center for Program Integrity](https://www.cms.gov/medicare/medicaid-coordination/center-program-integrity)