Self-Disclosure and Voluntary Refunds While a UPIC Audit Is Open

A physician who finds a billing overpayment while a Unified Program Integrity Contractor (UPIC) audit is open faces three decisions at once: whether the reporting clock is already running, which channel fits the overpayment that was found, and whether an uncoordinated refund could do more damage than the overpayment itself. 42 CFR 401.305 sets that clock, and it keeps running whether or not a UPIC contractor is already reviewing the same claims. The choices made in the next few weeks shape what the contractor sees when it eventually asks.

The Reporting Obligation Under 42 CFR 401.305

The regulation treats an overpayment as identified the moment a provider knowingly receives or retains it, a standard borrowed from the civil False Claims Act's own definition of knowing: actual knowledge, deliberate ignorance, or reckless disregard. Once identified, the provider has 60 days to report and return the overpayment, or until any corresponding cost report is due if that date falls later. The lookback period runs 6 years from the date the overpayment was received, and an amount kept past the deadline becomes a False Claims Act obligation in its own right. UPIC reviews reach ambulance suppliers, behavioral health providers, and clinical laboratories as readily as physician practices, and in every one of those settings an overpayment left unresolved compounds the recoupment exposure the audit itself may already carry.

The Deadline During an Open UPIC Review

Being under review by a UPIC does not appear among the events that pause the 401.305 clock. Only three circumstances suspend it: OIG's acknowledgment of a submission to the Self-Disclosure Protocol, CMS's acknowledgment of a submission to its Voluntary Self-Referral Disclosure Protocol, and a request for an extended repayment schedule. A separate provision suspends the deadline for up to 180 days while the provider conducts a good-faith investigation into whether related overpayments exist from the same cause. A pending UPIC review sits outside all four. A physician who assumes the audit itself buys time can run past the 60-day deadline without realizing it, adding False Claims Act exposure on top of whatever the UPIC later recoups.

Contractor Refund or Self-Disclosure Protocol

The two channels serve different conduct. The OIG Self-Disclosure Protocol fits conduct that may violate a law carrying civil monetary penalty (CMP) exposure, a kickback, false billing, an arrangement with an excluded person. OIG's own guidance limits the protocol to that category: a matter involving only an overpayment or a billing error, with no accompanying violation, belongs with the Medicare contractor through the ordinary voluntary refund process instead. A government inquiry already underway, a UPIC audit included, does not by itself rule out using the Self-Disclosure Protocol for conduct that does implicate a CMP-eligible violation. The disclosure still has to be made in good faith, not as a way to get ahead of the UPIC's own findings, and the submission has to say so when a contractor review is already open.

Medicare Contractor and UPIC Coordination on Voluntary Refunds

A voluntary refund lands squarely inside the UPIC's view once a UPIC is already active on the account. Medicare's Program Integrity Manual requires the Medicare contractor to notify the UPIC of refunds it receives, and directs the UPIC to investigate any voluntary refund where there is suspicion of an inappropriate payment or the provider is already under active investigation. Sending a refund without first lining up the internal investigation, the prescriber verification, the delivery record, the signature log, hands the UPIC a new lead rather than a closed question.

Medicare's own contractors tell every provider who sends a voluntary refund that acceptance does not limit the government's right to pursue criminal, civil, or administrative remedies on the same claims.

A disclosure timed to blunt an active UPIC referral, rather than to resolve the overpayment itself, risks the opposite outcome: the same facts moving toward a target letter instead of a negotiated settlement.

Why Early Legal Counsel Is Critical

It is critical that physicians promptly retain experienced healthcare defense counsel upon finding an overpayment while a government audit or inquiry is open. Early legal intervention can protect the physician's rights, shape how and when a disclosure is made, avoid an admission that outruns the facts, and allow counsel to coordinate directly with the UPIC and the Medicare contractor on the physician's behalf as part of a coordinated UPIC audit defense. Delaying legal representation can significantly affect the outcome of the matter and expose the physician to unnecessary risk.

How Health Law Alliance Can Help

Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience.

If an overpayment has surfaced while a UPIC review is already open, contact us for a free, confidential consultation before a refund or disclosure goes out on its own timeline.