A UPIC records request opens a narrow, fast-moving window. The Unified Program Integrity Contractor's Additional Documentation Request sets the scope of what must be produced, starts a 30-calendar-day clock, and puts every claim in the sample at risk of denial if the response is late, incomplete, or defective. What a practice sends back, and how it documents having sent it, shapes the outcome of the underlying audit and any appeal that follows.
Scope of the Records Request
A UPIC does not request every record in a practice's file. Under the Medicare Program Integrity Manual, the reviewer is directed to identify in the request only the individual pieces of documentation needed to make a determination on the claims under review: the medical record, the order or referral, proof of medical necessity, and any signature documentation tied to the sampled dates of service. That instruction cuts both ways. It limits what the UPIC can properly demand, and it means a practice that reads the letter closely, rather than producing an entire chart, controls what the reviewer actually sees. Which contractor issued the request affects the request format; Qlarant UPIC Audits: Jurisdiction and Process covers the jurisdiction-specific detail, and a full UPIC audit defense strategy accounts for it from the first letter.
The 30-Day Response Clock
A provider or supplier has 30 calendar days to respond to a UPIC's Additional Documentation Request, whether the review is prepayment or post-payment, shorter than the 45 days allowed for Medicare Administrative Contractor and Recovery Audit Contractor requests. Under 42 CFR 405.903 and 405.929 through 405.930, addressed in the Medicare Program Integrity Manual, Chapter 3, the clock does not pause for staff turnover or a busy billing office. If no response arrives, the UPIC denies the claim as a missing medical record. If a response arrives but the documentation does not establish that coverage requirements were met, the UPIC issues a benefit category denial instead, a harder posture to unwind on appeal than a straightforward missing-record denial.
A missed UPIC deadline does not pause the audit. It converts every claim in the sample into an automatic denial before the practice ever gets to argue the merits.
Completeness and the Signature Log
Completeness is judged claim by claim. If the order, the progress note, or the certifying signature is missing or illegible, the reviewer can request a signature log or attestation statement, a typed list matching each practitioner's name to a handwritten signature. CMS allows 20 calendar days to submit it once the UPIC asks, and extends the review period by 15 days to consider it. A signature log can be created at any time, even after the request arrives, and reviewers accept logs regardless of when they were made. What cannot happen is backdating the underlying record itself; an attestation fixes a signature gap, it does not rewrite the clinical entry.
Privilege Review Before Production
Before anything goes out, the response should pass through a privilege review. UPIC requests target the medical, billing, and ordering records tied to the sampled claims, not internal compliance memoranda, self-audit findings prepared at counsel's direction, or legal-hold correspondence about the audit itself. Producing a full chart or a shared drive folder without separating those categories risks handing the reviewer material that has nothing to do with the claims in question, and can compromise privilege the practice needs later if the matter escalates to a program integrity referral. Every document that leaves the building should be checked against the request's actual scope first, not assembled by whoever has the fastest access to the file.
The Production Log
Every UPIC production should be tracked in its own production log: a record of what was sent, on what date, by what method (mail, fax, Kiteworks, or electronic submission), and who sent it. The log does for the production what the signature log does for the chart. It lets the practice prove exactly what happened if the UPIC later claims a document was never received, or an appeal turns on whether a specific record was timely in the file. A practice that cannot reconstruct its own production months later starts an appeal at a real disadvantage.
It is critical that healthcare providers promptly retain experienced healthcare defense counsel upon receiving a UPIC records request, audit notice, or other government inquiry. Early legal intervention can protect the provider's rights, ensure appropriate responses to government requests, avoid inadvertent admissions, preserve relevant defenses, and allow counsel to communicate with the contractor on the provider's behalf. Delaying legal representation can significantly affect the outcome of a matter and expose the provider to unnecessary risk.
Health Law Alliance represents healthcare providers nationwide in UPIC audits, from the first records request through appeal. The firm reviews the request's actual scope, manages the privilege review, builds the production log, and tracks every deadline in the file. If your practice has received a UPIC records request, contact us for a free, confidential consultation.
