UPIC Records Requests Versus OIG Subpoenas: What Compels Production

A demand letter from a Unified Program Integrity Contractor (UPIC) and a subpoena from the U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) can look nearly identical on the page. Both list requested records, both name a due date, and both arrive without warning to a physician's office or a hospital compliance department. The two instruments rest on different legal authority, carry a different consequence for non-production, and signal something different about where the matter stands. A provider that reads a UPIC records request and an OIG subpoena the same way is misreading the file at the exact moment that reading matters most.

Who Signs the Demand

A UPIC records request is issued by the contractor CMS has engaged to run Medicare and Medicaid program-integrity reviews, under authority the Social Security Act ties to payment itself: Section 1833(e) conditions payment on the provider furnishing the information the contractor needs to support the claim. The request carries no court process behind it. It is a condition attached to the provider's Medicare enrollment, and CoventBridge, one of the contractors CMS uses for this work, sends this exact type of request routinely. An HHS-OIG subpoena is a different instrument. It is issued by the Inspector General under the Inspector General Act of 1978, codified at 5 U.S.C. Section 406, which lets OIG compel production of documents necessary to its own audits and investigations. That authority reaches any person or entity OIG believes holds relevant records, regardless of Medicare enrollment status, and it is backed by the federal courts rather than by the terms of a provider agreement.

What Non-Production Costs in Each Case

Failing to produce records to a UPIC carries administrative consequences that run through the Medicare program itself. Under 42 C.F.R. Section 424.535(a)(10), CMS can revoke a provider's Medicare enrollment for failing to document or provide access to documentation, and a UPIC that gets no response, or an incomplete one, typically treats the gap as unsupported billing, which can lead directly to an adverse recoupment finding. Failing to produce records to HHS-OIG carries a different kind of exposure. Because the subpoena is compulsory federal process, the Inspector General Act lets OIG ask the Department of Justice to seek enforcement in a U.S. district court, and a court order enforcing the subpoena carries that court's own contempt power behind it, a mechanism the UPIC's own administrative process lacks. Neither agency has to prove the underlying allegation before compelling the documents. The records request itself is a step that precedes a finding, not a product of one.

Why an OIG Subpoena After a UPIC Request Is a Signal

Receiving an OIG subpoena on a matter that began as a UPIC records request is worth reading carefully. A UPIC review is a program-integrity function performed inside CMS's own administrative structure, and it can still produce an extrapolated overpayment and a referral for recoupment, but the contractor's authority stays inside that structure. HHS-OIG is also the office that investigates potential health care fraud for referral to the Department of Justice, and its subpoena power exists for that broader mission. An OIG subpoena is a different instrument than a target letter, the notice a U.S. Attorney's Office sends once a grand jury has identified a specific target, and its arrival alone establishes no charge and no finding. What it does establish is that investigators outside the contractor, and outside CMS's routine audit channel, now have an interest in the same records, a different posture than a program-integrity review and one that calls for a different response. For the steps that follow once the subpoena itself is in hand, see Responding to an HHS-OIG Subpoena.

An HHS-OIG subpoena carries the enforcement weight of a federal court order behind it. A UPIC records request carries the weight of the provider's own Medicare enrollment agreement.

Why Early Legal Counsel Is Critical

It is critical that providers promptly retain experienced healthcare defense counsel upon receiving either a UPIC records request or an HHS-OIG subpoena. Early legal intervention protects the provider's rights, ensures the response to the contractor or to OIG is appropriate to the authority actually being exercised, avoids inadvertent admissions in what gets produced or said, preserves defenses that a rushed or incomplete production can forfeit, and lets counsel communicate with the contractor or OIG on the provider's behalf. Delaying representation can affect how the matter is ultimately resolved and creates risk that a timely response would have avoided.

How Health Law Alliance Can Help

Health Law Alliance has represented providers in 2,000+ audits and 5,000+ matters across Medicare, Medicaid, and federal investigations. If your practice has received a UPIC records request, an HHS-OIG subpoena, or both, contact Health Law Alliance's UPIC audit defense attorneys for a free, confidential consultation.