A federal audit reaching a physician practice does not originate from a single national office. It arrives from one of five Unified Program Integrity Contractors (UPICs) that CMS assigns by geography, and the contractor named on the notice determines who reviews the records, who sets the response deadline, and who decides whether the matter moves toward a recoupment or a referral for further investigation. Physicians who assume every UPIC audit runs on the same desk are missing a distinction that shapes the entire response. The jurisdiction map is public. Most practices never check it until the notice is already open.
The Five UPIC Jurisdictions
CMS divides UPIC oversight into five geographic jurisdictions, each covering Medicare and Medicaid program integrity work for every state inside it. The boundaries do not follow MAC (Medicare Administrative Contractor) lines or state Medicaid agency lines; they follow the UPIC contract itself. A practice in Ohio and a practice in California answer to different contractors, different regional offices, and in practice, different document formats and turnaround expectations, even though both audits proceed under the same federal authority. A practice's jurisdiction is set by its billing address, not by where a claim was rendered or where the beneficiary lives. Confirming the correct jurisdiction before responding to a notice keeps a rebuttal from going to the wrong regional office inside a deadline that does not move.
The Contractor Assigned to Each Region
Two contractors currently cover the five-jurisdiction map. Qlarant holds two jurisdictions: the Western jurisdiction, covering Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, North Dakota, Oregon, South Dakota, Utah, Washington, and Wyoming, and the Southwestern jurisdiction, covering Colorado, New Mexico, Oklahoma, Texas, Arkansas, Louisiana, and Mississippi. CoventBridge Group holds the Midwest jurisdiction, covering Iowa, Illinois, Indiana, Kansas, Kentucky, Michigan, Minnesota, Missouri, Nebraska, Ohio, and Wisconsin. SafeGuard Services holds the remaining two jurisdictions: Northeast, covering Maine, Vermont, New Hampshire, Massachusetts, Rhode Island, Connecticut, New York, Pennsylvania, New Jersey, Delaware, Maryland, and the District of Columbia, and Southeast, covering West Virginia, Virginia, North Carolina, South Carolina, Tennessee, Alabama, Georgia, and Florida.
Why the Assigned Contractor Changes the Audit
Every UPIC operates under the same CMS statement of work, but the contractor handling a specific file controls the practical experience of the audit. The regional office issues the notice, sets the document production deadline, and reviews the response. It is also the office a practice's counsel corresponds with directly when negotiating scope, requesting an extension, or challenging a sampling methodology. A practice that engages counsel unfamiliar with the assigned contractor's procedures loses time relearning basic logistics: where to send records, how the contractor formats its signature log requests, and which regional program integrity office fields a rebuttal. None of that changes the underlying law. It changes how quickly a practice can respond inside a deadline that does not move.
The contractor named on a UPIC notice determines who reviews the file and how fast the deadline runs. It has no bearing on how seriously the audit should be taken.
What a UPIC Finding Can Trigger
A UPIC review that finds billing irregularities can move in more than one direction. The contractor can issue a recoupment demand recovering claims it deems improperly paid, frequently projected across a broader review period through statistical sampling. It can place the practice on prepayment review, requiring pre-approval on future claims before payment issues. And where the contractor sees markers of intentional misconduct, it can refer the matter to CMS program integrity staff or to law enforcement, a step that moves the exposure from administrative to potentially criminal. When a UPIC Audit Becomes a Law Enforcement Referral walks through how that escalation happens and the markers that tend to precede it.
Early Engagement of Counsel
It is critical that physicians and practice owners promptly retain experienced healthcare defense counsel upon receiving a UPIC audit notice, subpoena, or other government inquiry. Early legal intervention can protect the practice's rights, ensure appropriate responses to the contractor's requests, avoid inadvertent admissions, preserve every available defense, and let counsel communicate with the contractor on the practice's behalf. Delaying representation can significantly affect the outcome and expose the practice to unnecessary risk.
How Health Law Alliance Can Help
Health Law Alliance defends physicians and healthcare practices against UPIC audits across every CMS jurisdiction, from the initial document request through appeal and, where it becomes necessary, negotiation with the contractor's referral posture. Our bench includes a former federal prosecutor and a former senior healthcare-industry executive, a background that informs how a UPIC finding is built and where it can be challenged. If your practice has received a UPIC audit notice, contact us for a free, confidential consultation.
