A Recovery Audit Contractor (RAC) and a Unified Program Integrity Contractor (UPIC) can both open a Medicare audit against the same physician practice, and the notice itself does not always say which one arrived. The distinction controls everything that follows. RACs are paid under a contingency fee arrangement to find improper payments and pursue recoupment; a coding dispute is the whole matter. UPICs exist to detect Medicare and Medicaid fraud, waste, and abuse, and a UPIC review can end in a payment suspension and a referral to the Department of Justice before an appeal is ever filed. Reading the letter correctly in the first week determines whether a practice needs a coding consultant or defense counsel.

What a RAC Audit Is

RACs operate under CMS's Medicare Fee for Service Recovery Audit Program, created by Congress through the Medicare Modernization Act and the Tax Relief and Health Care Act of 2006, which gave CMS authority to pay Recovery Auditors a contingency fee, a percentage of every improper payment identified and recovered. The RAC reviews claims against Medicare's own coverage and coding rules, including National Coverage Determinations and the Medicare Administrative Contractor's local coverage determination, generally looking back three years from the date a claim was paid. A RAC review typically opens with a records request, and a practice that receives one should treat it as the formal proceeding it is, not routine paperwork (see Responding to a Medicare Additional Documentation Request (ADR)). If the RAC's finding is wrong, the practice's recourse is the standard Medicare appeals ladder: redetermination, reconsideration, and an Administrative Law Judge hearing. A RAC that loses at any level of that appeal must return the contingency fee it collected, which is why a records-heavy response that corrects the extrapolation math is often the most effective one.

What a UPIC Audit Is

CMS's Medicare Program Integrity Manual states that the primary goal of the UPIC is to identify cases of suspected fraud, waste and abuse, develop them thoroughly and in a timely manner, and take immediate action to ensure that Medicare Trust Fund monies are not inappropriately paid. UPICs are not paid on a contingency fee basis. They operate under CMS contracts covering five geographic jurisdictions, currently including Qlarant, SafeGuard Services, and CoventBridge, and they investigate both Medicare and Medicaid claims through data analysis, medical record review, and field interviews. When a UPIC develops reliable evidence of fraud, CMS policy authorizes payment suspensions and revocations, and the matter is referred to the HHS Office of Inspector General or the Department of Justice for consideration of civil or criminal prosecution. For what happens after that point, see Medicare Payment Suspensions: Credible Allegations and the Path Back.

Responding to a RAC Audit Versus a UPIC Audit

The right first move depends on which contractor sent the letter. A RAC audit chases a recoupment number capped by what the sample actually supports, so the strongest response documents medical necessity and works the Medicare appeals ladder. A UPIC audit chases a fraud finding, and CMS can suspend payments under 42 C.F.R. § 405.371 once it has consulted with the OIG and determined that a credible allegation of fraud exists, sometimes before the practice has any real chance to respond. Treating a UPIC document request like a routine RAC audit, by responding informally or characterizing a pattern as a series of isolated clerical errors without counsel, can hand the investigator exactly the evidence it is looking for.

A RAC audit chases a recoupment number, capped by what the sample supports on appeal. A UPIC audit chases a fraud finding, and it can end in a payment suspension long before any appeal is filed.

Why Early Legal Counsel Is Critical

It is critical that physicians and practice owners promptly retain experienced healthcare defense counsel upon receiving a RAC audit notice, a UPIC document request, or any other government inquiry tied to Medicare billing. Early legal intervention can protect the practice's rights, ensure appropriate responses to the reviewing contractor, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with the contractor or investigators on the practice's behalf. Delaying legal representation can significantly affect the outcome of a matter, particularly when a records request that looks like routine RAC paperwork is actually the opening move of a UPIC fraud investigation.

How Health Law Alliance Can Help

Health Law Alliance represents physicians and practices nationwide in both RAC and UPIC matters, drawing on the firm's experience with 2,000+ audits overseen. The firm's bench includes Brian O'Loughlin, Of Counsel and a former healthcare fraud investigator for Qlarant, one of CMS's largest UPIC contractors, which gives the firm direct insight into how these investigations are built. Physicians who have received a RAC or UPIC notice may contact Health Law Alliance's Medicare audit defense team for a free, confidential consultation.