UPIC Findings of Missing Records: When Documentation Cannot Be Found

A UPIC audit continues past the chart that cannot be found. When a provider cannot produce the documentation behind a flagged claim, whether a billing vendor closed its doors, an electronic health record system was decommissioned, or a storage failure destroyed the file, CMS treats that claim exactly as it treats one with no documentation submitted at all. The UPIC denies the claim, and the exposure reaches past the single claim to the provider's Medicare enrollment. The rule that drives this outcome, 42 CFR 424.516(f), places the retention and production duty on the billing provider, not on whatever vendor or system last held the chart.

The UPIC Missing-Records Finding

Providers and suppliers have 30 calendar days to respond to a UPIC additional documentation request (ADR), a shorter window than the 45 days given to a Medicare Administrative Contractor, Recovery Audit Contractor, or the Supplemental Medical Review Contractor. If no response arrives within that window, the UPIC denies the claim as not reasonable and necessary under sections 1815(a), 1833(e), and 1862(a)(1)(A) of the Social Security Act and 42 CFR 405.929 and 405.930, using the remittance code reserved for a missing patient medical record. A response that arrives but fails to establish that coverage requirements were met draws a narrower benefit-category denial instead. Both outcomes apply claim by claim, so a missing-records finding on one sampled claim becomes an extrapolated demand across the full audit period once the UPIC calculates an overpayment.

Records Held by a Former Vendor or Closed EHR System

The duty to produce a record survives the vendor relationship that created it.

CMS's own guidance on 42 CFR 424.516(f) states plainly that a provider who relies on an employer, billing company, or electronic health record vendor to hold records remains responsible for producing them on request. A hospital employer's refusal to release a chart is, in the agency's words, not a valid excuse. The same principle reaches a pharmacy's former PBM vendor, an ambulance supplier's closed dispatch software, or a behavioral health practice's discontinued EHR platform: the seven-year retention period set by 424.516(f) runs regardless of who holds the keys to the system. A provider who cannot produce records because a vendor contract lapsed, a platform was sunset, or a storage vendor lost a backup faces the same missing-record denial as a provider who never created the documentation, and the same revocation exposure under 42 CFR 424.535(a)(10), with a re-enrollment bar under 424.535(c) that CMS may lengthen for each missing record named in the request letter.

The Narrow Path for Disaster Relief

The one documented path to relief is narrower than most providers assume. Under the Program Integrity Manual's UPIC-specific disaster provision, relief applies only to a FEMA-declared natural disaster: the UPIC delays its records request for 60 days from the FEMA-designated date, and where records were completely destroyed with no backup, the UPIC consults CMS case by case on whether reconstruction is appropriate, while confirming the delay is not concealing evidence of fraud. A vendor's bankruptcy, a canceled software contract, or an ordinary storage failure falls outside this provision. The Manual lists interruptions in business practices only as a possible good-cause reason for a contractor to accept a late submission, never as a basis for excusing production altogether, and the extension is the contractor's discretion, not the provider's right. A missing signature log compounds the same exposure: an unauthenticated entry with no log or attestation to identify the signer draws its own insufficient-documentation finding even where the underlying chart exists.

Why Early Legal Counsel Is Critical

It is critical that physicians and other providers promptly retain experienced healthcare defense counsel upon receiving a UPIC additional documentation request, a target letter, or any other government inquiry tied to a missing-records finding. Early legal intervention can help reconstruct what records exist, document the chain of custody for records held by a former vendor, and press for good-cause treatment before the 30-day window closes, rather than after a denial becomes an extrapolated recoupment. Delaying legal representation can significantly affect the outcome of the matter and expose the provider to unnecessary risk. The same pattern plays out across provider types: see UPIC Audits and Your Medicare Enrollment Status, and the document-heavy caseloads described in UPIC Audits of Ambulance Suppliers and UPIC Audits of Behavioral Health Providers.

How Health Law Alliance Can Help

Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience. If your practice has received a UPIC document request and the underlying records are missing, we provide a free, confidential review of the audit and the documentation gap. Contact us today for a free, confidential consultation before the response window closes.