Telehealth billing volume has turned physicians and multi-state telehealth platforms into a growing target for Unified Program Integrity Contractor (UPIC) audits. UPICs run data-analytics shops built to mine Medicare and Medicaid claims for outlier patterns, and telehealth now sits alongside wound care and durable medical equipment among the categories reviewed most actively. A UPIC audit of a telehealth practice tests the volume pattern that opened the file, the platform's controlled-substance prescribing, and whether the encounter documentation actually supports what was billed.
How UPICs Select Telehealth Claims for Review
Each UPIC's data-analytics shop looks for statistical outliers rather than waiting for a complaint. For telehealth, that means the number of encounters a single practitioner bills in a day, how that volume compares to specialty peers, and whether the code-level mix clusters at the highest-paying tier more often than a peer group would predict. A solo physician billing hundreds of telehealth encounters in a single day, or a platform whose prescribing volume for one drug class spikes month over month, is the profile the model is built to surface. Geographic clustering adds another flag: patients concentrated far from the distant site, or originating sites that do not match the billed place of service. None of this proves fraud. It means the file crossed a threshold that opens a records request, and the request is where the practice's actual documentation gets tested.
Platform Prescribing and the DEA Telemedicine Extension
Many telehealth platforms prescribe controlled substances under the DEA and HHS telemedicine flexibility, extended for a fourth time through December 31, 2026. The extension lets a DEA-registered practitioner prescribe a Schedule II-V controlled substance based on a telemedicine encounter without a prior in-person evaluation, and permits audio-only prescribing of Schedule III-V medications approved for opioid use disorder treatment, when the applicable conditions are met. The conditions are doing the real work. The exception is not a blanket authorization; it depends on the encounter actually occurring, being documented, and supporting the prescribing decision. A UPIC that finds prescribing volume disconnected from documented encounters does not treat the DEA extension as a defense. It treats the mismatch as the indicator. Where the platform routes the prescription to an affiliated pharmacy, the audit typically reaches the pharmacy's signature log too, the same record PBM and Medicare contractor audits use to confirm a patient received what was billed.
The Encounter Documentation UPICs Test
Medicare's telehealth billing rules condition payment on documentation beyond a chart note. The record has to show the patient's location and the practitioner's location, because originating site rules still govern which encounters Medicare will pay for. It has to show that consent to the telehealth modality was obtained, verbally or in writing. And it has to independently support medical necessity and the code level billed, the same standard as an in-person visit. When these elements are missing across a claims sample, a UPIC applies statistical extrapolation across the full claims universe and turns a documentation gap into a recoupment demand that can reach six or seven figures.
A prescription that satisfies DEA's telemedicine exception can still generate a Medicare overpayment finding if the encounter documentation does not independently support it.
The two failures are independent, and a UPIC audit is built to test both at once.
When a Telehealth Audit Escalates
A UPIC records request rarely resolves on its own. Depending on the jurisdiction, it comes from SafeGuard Services, Qlarant, or AdvanceMed, and a pattern across the sample, not an isolated error, can move the matter to a site visit, a payment suspension, or prepayment review before a final determination issues (see SafeGuard Services UPIC Audits: What Providers Should Know for the procedural sequence, and UPIC Prepayment Review: The Exit Strategy for what it takes to get off prepayment status). Findings that suggest prescribing volume with no supporting encounters are the pattern most likely to bring HHS-OIG, DOJ, or a U.S. Attorney's Office into the file, sometimes by way of a target letter to an individual practitioner (see When a UPIC Audit Becomes a Law Enforcement Referral).
Why Early Legal Counsel Is Critical
It is critical that physicians and telehealth providers promptly retain experienced healthcare defense counsel upon receiving a UPIC records request, site visit notice, or any related inquiry. Early legal intervention can protect the provider's rights, ensure appropriate responses to the UPIC's requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with the UPIC on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance has overseen 2,000+ audits and represented 2,500+ clients across UPIC audit defense nationwide, including telehealth platforms and the physicians who prescribe on them. If your practice has received a UPIC records request tied to telehealth encounters or platform prescribing, contact us for a free, confidential consultation and put an attorney between your practice and the auditor before the response deadline runs.
