UPIC Audit Versus OIG Audit: Telling the Two Apart

A UPIC letter and an HHS-OIG letter can look alike: a federal return address, a document request, a deadline. The agencies behind them answer to different statutes and leave the provider with different rights. A Unified Program Integrity Contractor investigation and an HHS Office of Inspector General audit or evaluation are not the same event under two letterheads. Treating one like the other gives up ground the provider does not know it has to give.

Who Is Asking

A UPIC acts for CMS. Contractors assigned to five regional jurisdictions, currently Qlarant, SafeGuard Services and CoventBridge, hold CMS task orders to investigate one provider's Medicare and Medicaid billing for fraud, waste and abuse. The letterhead names the contractor, not CMS, though the contractor works CMS's caseload.

An OIG audit or evaluation comes from a separate agency: the HHS Office of Inspector General. Its Office of Audit Services runs the audits; its Office of Evaluation and Inspections runs the evaluations. A provider named in an OIG audit is usually one sample in a national review, not the sole subject of a fraud case.

Legal Authority

UPICs operate under the Medicare Integrity Program, created by Section 1893 of the Social Security Act, and the parallel Medicaid Integrity Program under Section 1936. The CMS Medicare Program Integrity Manual sets the rules it follows when it audits claims, interviews staff, or runs a site visit.

HHS-OIG answers to a separate statute. The Inspector General Act of 1978 gives it its own mandate to audit and evaluate HHS programs, Medicare and Medicaid included, and to report its findings to the Secretary and Congress. It sets its own work plan for audits and evaluations.

Scope

A UPIC investigation usually runs wide for one provider: claims across multiple years, a specific billing pattern, interviews, and sometimes a parallel RAC audit from a different contractor. Where a RAC checks coding and coverage rules, a UPIC is building a fraud case.

An OIG audit usually runs narrow on the topic and wide across providers: a sample of claims testing one coverage or billing rule, repeated at provider after provider inside the same national review. That provider did not necessarily do anything unusual; it is one data point in a review built to test the rule.

What Findings Do

When a UPIC investigation substantiates fraud, the contractor can recommend a payment suspension, extrapolate a recoupment demand where a sustained or high error rate supports it, or send a fraud referral to law enforcement. Where those referrals go is its own subject.

An OIG audit produces a public report with findings and recommendations addressed to CMS, not a unilateral action against the provider. If the sample turns up overpayments, CMS directs its Medicare Administrative Contractor to issue a demand to collect them. OIG does not issue that demand or suspend payments. If OIG's own investigators separately substantiate fraud, that finding can move to a civil or criminal referral, a document separate from the audit report.

Appeal Rights

Because a UPIC-driven overpayment demand runs through CMS's own payment system, the provider gets the standard Medicare appeals ladder: redetermination, reconsideration before a Qualified Independent Contractor, an administrative law judge hearing, and judicial review, under 42 CFR Part 405 Subpart I. A payment suspension that accompanies the investigation does not travel that ladder; the provider's only recourse there is a written rebuttal.

An OIG report's recommendations to CMS carry no independent appeal, because they are not an adverse action against a specific claim. The provider's chance to be heard comes earlier, during the audit's comment period on the draft report. Once an overpayment from that report reaches the provider as an actual demand, it travels the same appeals ladder a UPIC-driven demand would.

A UPIC letter puts a provider's own billing history under investigation for fraud. An OIG audit is testing one coverage rule against a sample of providers, and this one simply got pulled.

Why Early Legal Counsel Is Critical

It is critical that healthcare providers promptly retain experienced healthcare defense counsel upon receiving a UPIC document request, an OIG audit notice, or any other government inquiry. Early legal intervention can protect the provider's rights, shape appropriate responses to government requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with investigators or auditors on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.

How Health Law Alliance Can Help

Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience. The firm defends pharmacies, physicians and healthcare companies that receive a UPIC letter, an OIG letter, or both. If you have received either letter and are not sure what it asks of you, contact us for a free, confidential consultation through our UPIC audit defense page.