UPIC Medicaid Audits and the Medi-Medi Program

Every UPIC article on this site has been written for a Medicare audit. That is only half of what a Unified Program Integrity Contractor (UPIC) does. UPICs hold the same investigative authority over Medicaid claims, and some of that work starts with a Medicare-Medicaid Data Match, known as Medi-Medi, rather than a Medicare lookback. A practice that treats a UPIC notice as Medicare-only can miss that the real exposure sits with the state Medicaid agency instead.

The Medi-Medi Data Match

Section 1893(g) of the Social Security Act created the Medi-Medi program. States volunteer into it; where a state participates, CMS contracts with a UPIC to run algorithms across that state's Medicare and Medicaid claims, looking for billing patterns tied to a provider, service, time, or patient that look suspect. CMS must share the resulting data with the Attorney General, the FBI Director, the HHS Office of Inspector General, and the states, including a state's Medicaid Fraud Control Unit, no less than quarterly. A Medicaid finding can come from matching Medicare billing against Medicaid billing, not from an anomaly inside either program alone. Which contractor runs the review depends on the UPIC jurisdiction covering that state; see UPIC Jurisdictions: Which Contractor Covers Your State.

How a UPIC Audits a Medicaid Claim

Section 1936 of the Social Security Act, added by the Deficit Reduction Act of 2005, is the statutory basis for a UPIC's Medicaid work, letting CMS contract with entities that review provider conduct under a state Medicaid plan, audit claims and cost reports, and identify overpayments. A review begins with a lead, a complaint, a data flag, or a Medi-Medi match, and goes through screening before a formal audit opens. CMS and the state Medicaid agency vet an Investigative Plan before medical-record requests or interviews begin. For an investigation the UPIC develops on its own rather than from a complaint or referral, CMS requires more than $50,000 in exposure before the UPIC pursues it, a threshold that does not apply where fraud is suspected.

The Overpayment Notice and the State's Own Appeal Process

Findings first appear in a Medicaid Initial Findings Report, and the provider gets a chance to submit rebuttal records before anything is final. If the UPIC still identifies an overpayment, it writes a Medicaid Final Findings Report, but CMS sends that report to the state Medicaid agency, because the state, not CMS, actually recovers the money. The letter also starts a separate federal clock: the state must remit the federal share of what it recovers back to CMS within one year of the letter's date, and none of that decides how the provider appeals. Because each state administers its own Medicaid program, a Medicaid overpayment moves through whatever administrative process that state has built, not the Medicare recoupment and appeal ladder, and the forum, deadline, and standard of review have to be confirmed against that state's own rule.

A Medicaid overpayment finding moves through whatever administrative process the state Medicaid agency has built, not the Medicare appeal ladder, and that process looks different in every state.

When a Medicaid Finding Becomes a Law Enforcement Referral

A UPIC's Medicaid authority also extends to referring a case onward. When a finding looks like more than a billing dispute, CMS convenes a Medicaid Major Case Coordination meeting with the state Medicaid agency, the UPIC, and law enforcement to decide whether a referral is accepted. That law-enforcement partner is ordinarily the state's own Medicaid Fraud Control Unit. Per the HHS Office of Inspector General, a Medicaid Fraud Control Unit operates in every state, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, usually sits inside the state Attorney General's office, and by federal requirement stays separate from the state Medicaid agency that ran the audit. See When a UPIC Audit Becomes a Law Enforcement Referral for how that escalation plays out.

Why Early Legal Counsel Is Critical

It is critical that physicians and practice owners promptly retain experienced healthcare defense counsel upon receiving a UPIC notice, a Medicaid Initial Findings Report, or any other government inquiry touching Medicaid claims. Early legal intervention can protect the provider's rights, confirm which state's procedure governs the appeal, avoid an inadvertent admission during a provider interview, and allow counsel to communicate with the UPIC, the state Medicaid agency, and any law enforcement referral on the provider's behalf. Delaying representation can affect the outcome.

How Health Law Alliance Can Help

Health Law Alliance's attorneys have overseen 2,000+ audits and handled 5,000+ matters, with 25+ years of experience. The firm represents physicians, group practices, and other providers through UPIC reviews that reach into Medicaid claims, Medi-Medi data matches, and the Medicaid Fraud Control Unit referrals that can follow. If your practice has received a UPIC notice touching Medicaid claims, contact Health Law Alliance's UPIC audit defense attorneys for a free, confidential consultation before you respond.