Can a UPIC see a physician practice's communications with its attorney about the audit?

Generally, no. Attorney-client privilege protects a communication made to obtain or deliver legal advice, and under Upjohn Co. v. United States the privilege extends to communications between counsel and employees at any level of a practice when the communication is made at management's direction to secure legal advice and the employee understands that purpose. A UPIC document request targets the medical, billing, and ordering records tied to the sampled claims, not a practice's internal legal communications about how to respond to the audit. The distinction turns on purpose: a chart note written for treatment or billing is not privileged no matter how sensitive it reads, while an email to counsel analyzing the same claim, written because counsel asked for it to assess legal exposure, generally is. A practice should withhold privileged communications from the production and list each one on a privilege log identifying the document, its author, its date, and the basis for withholding it, rather than producing the full file and sorting the issue out afterward.

Does producing a self-audit to a UPIC waive privilege if a lawsuit follows later?

Often, yes. Voluntarily producing a privileged self-review to a UPIC to show that a billing problem was already found and corrected can resolve the audit faster, but it carries a real cost. The Second, Third, Ninth, and Tenth Circuits have rejected selective waiver, the theory that disclosing a privileged document to a government reviewer preserves the privilege against everyone else. Once the document is in the UPIC's file, a qui tam relator or a civil plaintiff who later obtains it through discovery can argue the privilege is gone for that document and, depending on how the disclosure was framed, for related communications on the same subject. Before a practice discloses a self-review to resolve a UPIC audit, counsel should weigh the audit-level benefit against the exposure in any case that could follow, because a decision made to close out one file can define the privilege landscape of a federal case that has not been filed yet.

What happens if a practice accidentally sends a UPIC a privileged document?

Federal Rule of Evidence 502(b) can preserve privilege after an inadvertent disclosure. The rule provides that a disclosure made in a federal proceeding or to a federal office or agency is not a waiver if the disclosure was inadvertent, the holder of the privilege took reasonable steps to prevent it, such as maintaining a privilege log and reviewing the chart set before production, and the holder promptly took reasonable steps to correct the error once discovered. A UPIC collects and uses the records it reviews on behalf of the Medicare program in administering its contract with CMS. Promptly means notifying the UPIC, identifying the specific document, and requesting its return or destruction as soon as the mistake is found, not after the production has already been reviewed and acted on. A practice that cannot show it had a privilege-review process in place before the mistake has a harder time meeting that second requirement, which is why building the privilege log during assembly of the production matters.

Privilege and Confidentiality in a UPIC Production

A Unified Program Integrity Contractor (UPIC) document request does not ask a physician practice to turn over its entire file. It asks for the records tied to a sampled set of claims. A practice that treats the production as a single document dump can hand over attorney-client communications, internal self-review findings, and legal-hold correspondence that have nothing to do with those claims. Privilege can be lost at the moment of production, before anyone notices the mistake.

Attorney-Client Privilege in a UPIC Production

Attorney-client privilege protects a communication made to obtain legal advice, not a document merely because it discusses a problem. In Upjohn Co. v. United States, the Supreme Court rejected the control group test that had limited corporate privilege to senior executives, holding that communications between counsel and employees at any level of the organization are privileged when made at the direction of corporate superiors to secure legal advice from counsel and the employee understands that purpose. An email from a billing coordinator to counsel describing a coding question, written because management asked for it to assess legal exposure, can be privileged even though the coordinator makes no management decisions. A chart note on the same coding question, written for treatment or billing rather than for counsel, carries no privilege at all.

Work Product and the Self-Review Counsel Directs

Work product protection covers a different category: material prepared at an attorney's direction because of anticipated litigation, not because the business needed it anyway. The doctrine traces to Hickman v. Taylor, and Federal Rule of Civil Procedure 26(b)(3) now codifies it, shielding an attorney's mental impressions, conclusions, opinions, and legal theories even when underlying facts are later ordered produced. A self-review of the sampled claims that counsel commissions to assess the practice's exposure can qualify for that protection. A coding audit the practice runs every quarter regardless of any outside inquiry does not become work product because a UPIC letter arrives the same month. The test is whether the review would have taken the same form without the anticipated proceeding, not whose name sits on the engagement letter.

Privilege attaches to how a document was created and at whose direction, not to the label on the folder that holds it.

Segregating and Logging the Chart Set

The production has to keep the two categories apart. The clinical, billing, and ordering records tied to each sampled claim, including the signature log entries confirming who rendered and ordered the service, go out complete. Withholding a routine clinical record on a privilege theory invites the UPIC to treat the response as incomplete, and an incomplete production can accelerate a recoupment demand on a thinner record. Attorney-client communications, the directed self-review, and legal-hold notices about the audit are pulled before the chart set goes out, and every withheld item goes on its own privilege log entry identifying the document, its author, its date, and the basis for withholding it. That log-building work happens alongside the broader response process covered in UPIC Audit Defense Timeline: Notice to Resolution, at the point where the practice still controls which documents a reviewer ever sees.

Disclosure, Waiver, and the Later Record

A privilege log protects a document only until someone hands it over anyway. Producing a privileged self-review to show a billing problem was already found and corrected can look persuasive, but the Second, Third, Ninth, and Tenth Circuits have all rejected selective waiver, the theory that disclosing a privileged document to a government reviewer preserves it against everyone else. A document given to a UPIC today can become discoverable by a qui tam relator or civil plaintiff later, with the privilege already gone. That risk compounds on escalation: a target letter naming the practice as a target of a federal investigation puts every disclosed document back in play, this time with criminal exposure attached. Before releasing anything beyond the chart set, a practice should know what it is giving up, not only what it hopes to gain.

Why Early Legal Counsel Is Critical

It is critical that physician practices promptly retain experienced healthcare defense counsel upon receiving a UPIC additional documentation request. Early legal intervention can shape which materials are created under privilege, keep the chart set segregated before production, avoid inadvertent waiver, and let counsel communicate with the UPIC on the practice's behalf. Delaying representation can affect the outcome of a matter and expose the practice to unnecessary risk.

How Health Law Alliance Can Help

Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience.

If your practice received a UPIC records request, Health Law Alliance can review it, direct the chart segregation, and build the privilege log before anything leaves the building. contact us for a free, confidential consultation and put an attorney between your practice and the reviewer before the production goes out.

Privilege and Confidentiality in a UPIC Production

Attorney-Client Privilege in a UPIC Production

Work Product and the Self-Review Counsel Directs

Segregating and Logging the Chart Set

Disclosure, Waiver, and the Later Record

Why Early Legal Counsel Is Critical

How Health Law Alliance Can Help

Frequently asked

More from Payor Disputes

Assisted Living Medicaid Waiver Audits

Arizona AHCCCS Audits and Provider Appeals

Reading Medicare CARC and RARC Codes in Audit Denials