51 JFK Parkway, Short Hills, NJ 07078
UPIC Audit Defense · SafeGuard · Qlarant · AdvanceMed · CMS Program Integrity

UPIC Audit Defense Attorneys

SafeGuard, Qlarant, AdvanceMed audits, ALJ appeals, and FCA exposure.

UPICs (Unified Program Integrity Contractors) are the CMS contractors that conduct Medicare and Medicaid program integrity audits across the United States. SafeGuard Services covers the Northeast. Qlarant covers the Midwest, Southeast, and Western jurisdictions. AdvanceMed covers the Southwest.

A UPIC audit notice produces one of three procedural postures: a document request that initiates a postpayment review with statistical extrapolation across the full claim population, a prepayment review notice that stops cash flow on every new claim, or a focused medical review that signals the matter is heading toward a False Claims Act referral.

Health Law Alliance defends UPIC audits across pharmacies, physicians, wound care providers, and DME suppliers. Our defense framework focuses on the document request response, the statistical extrapolation challenge, the QIC and ALJ appeal record, and parallel coordination with any FCA or criminal referral that follows.

5,000+
Federal & State Healthcare Matters
100+
Combined Years at DOJ, HHS-OIG & CMS Co's
5
Levels of Medicare Appeal Through Federal Court
24/7
Response, From Document Request to ALJ
UPIC Audit Defense Hotline · Direct Line
(800) 345 - 4125
Speak with counsel who has defended UPIC audits across SafeGuard, Qlarant, and AdvanceMed jurisdictions. Privileged. Available 24/7.
Former officials from the agencies investigating your matter
U.S. Department of Justice
DOJ
FBI
FBI
HHS OIG
HHS-OIG
DEA
DEA
OptumRx
OptumRx
McKesson
McKesson
NAMFCU
NAMFCU
U.S. Treasury
Treasury
The Stakes
A UPIC audit compounds three exposures at once: cash flow, recoupment, and the criminal-referral pipeline

Prepayment review can stop cash flow on every new claim within days. Postpayment review with statistical extrapolation turns a 30-claim sample into a multi-million dollar recoupment demand across the full claim population. The UPIC's referral authority to HHS-OIG, the DOJ Civil Division, and the local U.S. Attorney converts what looks like a billing audit into a False Claims Act or criminal healthcare fraud matter. The defense posture has to address all three from the document request response forward.

  • Prepayment review: cash flow stops on every new claim
  • Postpayment recoupment: extrapolation across the full claim population
  • Criminal-referral pipeline to OIG, DOJ, and U.S. Attorneys
Case files binders
Case files
01
Prepayment review: cash flow stops on every new claim

UPIC prepayment review means CMS pauses payment on every new claim from the provider until the UPIC reviews and approves it. Reviews can take 60 to 180 days per claim. Multi-year prepayment review under recent CMS frameworks can extend that posture for 18 to 36 months. Most pharmacies and practices cannot operate through extended prepayment review without external financing or a substantial cash reserve. The defense focuses on getting off prepayment review as quickly as the substantive defense allows, often through a sustained low error rate showing or a corrective action plan that the contractor accepts as resolution.

Cash Flow Exposure
02
Postpayment recoupment: extrapolation across the full claim population

UPIC postpayment review uses statistical extrapolation. The contractor reviews a sample (often 30 to 50 claims), calculates an error rate, and extrapolates the error rate across the full claim population for the audit window. A $50,000 sample finding can produce a $5M to $20M recoupment demand after extrapolation. CMS withholds payment on incoming claims to recoup the demand, which compounds the cash flow exposure. The largest dollar defense in most postpayment matters is the statistical methodology challenge: sample frame defects, sample size deficiencies, RAT-STATS application errors, or Cochran formula objections.

Recoupment Exposure
03
Criminal-referral pipeline to OIG, DOJ, and U.S. Attorneys

UPICs refer matters to HHS-OIG, the DOJ Civil Division, and the local U.S. Attorney when the audit findings produce evidence of intent rather than billing errors. The civil FCA referral runs through DOJ Civil Division and may surface as a Civil Investigative Demand. The criminal referral runs through the local U.S. Attorney or DOJ Fraud Section and may surface as a federal grand jury subpoena or a target letter. The audit is rarely the end of the matter when the findings cross the referral threshold. Coordinating UPIC defense with parallel FCA and criminal defense from day one is essential because evidence in one track is admissible in the others.

Criminal Exposure
Why UPIC Audit Defense Is Different
Four structural features make UPIC audits fundamentally distinct from RAC, MAC, or commercial PBM audits

UPICs operate under the CMS Program Integrity Manual, with their own statistical methodology, their own document request conventions, and their own referral authority to HHS-OIG and DOJ. Defense counsel that treats a UPIC audit as a routine billing dispute misses the procedural posture and the realistic exposure.

Factor 01
UPICs differ structurally from RAC, MAC, ZPIC, and SMRC contractors.
RACs (Recovery Audit Contractors) work on contingency and focus on postpayment overpayment recovery. MACs (Medicare Administrative Contractors) adjudicate claims and process payments rather than conducting program integrity work. ZPICs (Zone Program Integrity Contractors) were the predecessor to UPICs and were largely consolidated into the UPIC program in 2016. SMRCs (Supplemental Medical Review Contractors) conduct medical review of specific topics on direct CMS direction. UPICs combine the program integrity function across Medicare and Medicaid in a specific geographic jurisdiction. The procedural framework, the statistical methodology, and the referral authority are different across all four contractor types.
Factor 02
Statistical extrapolation is the largest dollar issue.
UPIC postpayment recoupment math turns on the extrapolation methodology. The CMS Program Integrity Manual requires UPICs to use statistically valid sampling and the RAT-STATS software for extrapolation calculations. In practice, contractors make methodology choices (sample size, sample frame, point estimate vs. lower confidence bound) that defense counsel can challenge. A successful extrapolation challenge can reduce a multi-million dollar recoupment to the actual sample-claim amount, which is typically a small fraction of the extrapolated number. Statistical defense requires either an in-house defense expert or a retained statistician with healthcare claims experience.
Factor 03
The Medicare appeal track has 5 levels with strict deadlines.
Medicare appeals run through five levels: redetermination by the MAC (120-day deadline), reconsideration by a Qualified Independent Contractor (180-day deadline), Administrative Law Judge hearing (60-day deadline, historically with a multi-year backlog), Medicare Appeals Council review, and federal district court review under 42 USC § 405(g). Missing any deadline waives the appeal at that level. The redetermination and reconsideration are the most consequential procedural steps because the record built at those levels is the record the ALJ will review. Defense counsel that skips ahead misses the procedural foundation that supports the later appeal.
Factor 04
UPIC contractor differences matter more than they appear.
SafeGuard Services (Northeast), Qlarant (Midwest, Southeast, Western), and AdvanceMed (Southwest) each have somewhat different document request conventions, different statistical methodology preferences, and different working relationships with the local U.S. Attorney's office in their jurisdiction. Defense counsel that has worked with the specific contractor on prior matters knows the procedural patterns that an unfamiliar counsel will not. The contractor identity is in the audit notice but is often missed because the notice arrives on CMS letterhead with the contractor name in smaller text.
"A UPIC document request is the first procedural opportunity in the audit. The production response shapes everything that follows."
Protect Your Practice Now →
The HLA UPIC Defense Process
A four-stage protocol built for the UPIC document request, the extrapolation challenge, and the Medicare appeal track

Our bench includes a former Assistant U.S. Attorney with DOJ Director's Award recognition and senior healthcare-company counsel. We have defended UPIC audits across SafeGuard, Qlarant, and AdvanceMed jurisdictions, produced statistical extrapolation reductions in postpayment matters, and coordinated UPIC defense with parallel False Claims Act and criminal exposure. This is the protocol.

  • Document request response and audit scope evaluation
  • Initial determination engagement and statistical methodology challenge
  • Formal appeals: redetermination, QIC reconsideration, ALJ hearing
  • Parallel FCA and criminal coordination if the UPIC refers
Federal government building
Federal enforcement
01
Document request response and audit scope evaluation

From the day the UPIC notice arrives: evaluate the audit type (prepayment review, postpayment review, focused medical review), the contractor (SafeGuard, Qlarant, AdvanceMed), the dispensing or service window covered, and the document request as written. Most document requests can be narrowed through written response on scope and timing. We conduct a privileged pre-production review of every document before it leaves the practice, which preserves defenses for the appeal track and avoids producing material that becomes evidence in any subsequent FCA or criminal matter.

02
Initial determination engagement and statistical methodology challenge

When the UPIC issues findings: respond on the substantive defense for each flagged claim and challenge the statistical methodology where postpayment extrapolation is used. The methodology challenge focuses on sample frame defects, sample size deficiencies, RAT-STATS application errors, and Cochran formula objections. A successful methodology challenge at this stage often reduces the recoupment demand by a meaningful percentage before the matter reaches the formal appeal track.

03
Formal appeals: redetermination, QIC reconsideration, ALJ hearing

The Medicare appeal track requires the right record at every level. We draft and file the redetermination request to the MAC within the 120-day window, prepare the QIC reconsideration with the substantive and statistical record, and present to the Administrative Law Judge with witness preparation, expert testimony where applicable, and a procedural record built to support the ALJ's decision. The record built at the redetermination and QIC stages is the record the ALJ reviews; defense counsel that skips ahead loses the procedural foundation.

04
Parallel FCA and criminal coordination if the UPIC refers

When UPIC findings produce a referral to HHS-OIG, the DOJ Civil Division, or the local U.S. Attorney's office: civil FCA defense (CID response, intervention or declination engagement, Rule 9(b) motion practice) and criminal defense (target letter response, attorney proffer, grand jury subpoena management) run in parallel with the UPIC appeal. Our former-federal-prosecutor bench coordinates the UPIC appeal, the civil FCA matter, and the criminal track as one matter to avoid locking in admissions in one forum that hurt the defense in another.

Common UPIC Audit Triggers
The six patterns that put a UPIC audit in motion

UPICs use CMS-supplied data analytics to identify providers whose billing patterns deviate from peer comparables. The following triggers are the most common predicates for a UPIC document request, prepayment review notice, or focused medical review.

01
Data analytics flags from peer comparator analysis.
CMS provides UPICs with claims data and peer comparator analytics. Providers whose billing patterns fall in the top decile of their peer group on a specific code, code combination, or modifier usage face elevated UPIC review frequency. Common high-risk patterns include high E/M code distribution (CPT 99214 and 99215 over 80% of visits), high modifier 25 utilization, high modifier 59 utilization, and outlier reimbursement per beneficiary on Part B drug administration.
02
Qui tam relator or whistleblower complaint referral.
A qui tam complaint filed with DOJ under seal can produce a UPIC referral when the DOJ Civil Division wants the UPIC's billing analysis to support the FCA case. Internal whistleblower hotline reports, when escalated outside the company, can produce the same referral pipeline. The UPIC document request that follows often does not identify the underlying relator complaint, but the document scope tracks the relator's allegations closely enough that experienced defense counsel can identify the underlying matter.
03
Prior contractor findings (RAC, MAC, SMRC, CERT).
A RAC overpayment determination, a MAC medical review with high error rate, an SMRC focused review with adverse findings, or a CERT (Comprehensive Error Rate Testing) sample finding can produce a downstream UPIC review. The UPIC inherits the prior contractor's findings as the starting point for its own review and can expand the scope materially. Providers who have closed a prior contractor matter without a clean record should anticipate the UPIC follow-up.
04
Specialty-specific enforcement initiatives.
UPICs run focused enforcement initiatives targeted at specific specialties or service lines. Recent examples include skin substitute applications following the Apex Medical $309M FCA settlement, debridement coding following the Vohra $45M settlement, hospice eligibility review, home health face-to-face documentation, and remote patient monitoring billing. Providers operating in an initiative-targeted area face elevated UPIC review regardless of individual billing patterns.
05
Medicare Drug Integrity Contractor (MEDIC) referral on Part D.
For Part D matters (pharmacies dispensing Medicare prescription drug benefit claims), the Medicare Drug Integrity Contractor identifies suspicious patterns and refers them to the UPIC for parallel medical review. The MEDIC and UPIC tracks coordinate, which means a Part D investigation at the pharmacy level can produce a UPIC review at the prescriber level (or vice versa). Cross-track exposure is common in opioid, GLP-1, and specialty drug dispensing patterns.
06
State Medicaid Fraud Control Unit (MFCU) cross-referral.
State MFCUs investigate Medicaid fraud and refer matters to the UPIC for parallel Medicare review when the provider participates in both programs. The MFCU investigation can produce a UPIC review on the Medicare side that the provider did not anticipate. The state-federal coordination is increasingly tight, and defense counsel that handles only one side often misses procedural exposure on the other.
Recent UPIC Defense Outcomes
Representative Case Results

Outcomes are summarized for confidentiality. Client names, precise geography, and identifying facts are redacted.

Case files Recoupment Reversed
Statistical Extrapolation Challenge Reduces UPIC Demand by Substantial Margin.

Provider received a UPIC postpayment review finding with statistical extrapolation across a multi-year claim window. Health Law Alliance challenged the contractor's sample frame, sample size methodology, and RAT-STATS application errors at the redetermination and QIC reconsideration stages. The extrapolated recoupment demand was reduced to the actual sample-claim amount, a small fraction of the original number. The procedural record built at the redetermination level supported the QIC's reduction without requiring an ALJ hearing.

Federal · Healthcare provider · 2024
Washington DC DOJ Declination
DOJ Declines Civil and Criminal Action After UPIC Referral.

Healthcare company received a UPIC referral that produced a Civil Investigative Demand from the DOJ Civil Division covering alleged $6M in false claims. Health Law Alliance produced documents under a negotiated rolling schedule, presented the factual rebuttal of the government's theory in a meeting with the line attorneys, and prepared a written submission addressing the materiality and falsity defects. DOJ declined both civil intervention and criminal referral. Pre-unsealing engagement, when the matter surfaces through other channels, is the highest-leverage window in any FCA matter.

National scope · Healthcare company · 2024
Federal courtroom Indictment Dismissed
Federal Healthcare Fraud Indictment Following UPIC Referral Collapses.

Solo physician faced a multi-count federal indictment that included healthcare fraud counts following an upstream UPIC referral to the local U.S. Attorney. Health Law Alliance filed responsive motions, built the procedural record, and challenged the government's theory through pre-trial motion practice; the indictment collapsed before trial. The UPIC-to-criminal escalation risk is real in matters where the contractor's findings include intent evidence; a unified defense across the UPIC appeal track and the parallel criminal track is the most efficient way to avoid the criminal exposure.

Northeast · Solo physician · 2025

Attorney advertising. Prior results do not guarantee a similar outcome. Case summaries are generalized for confidentiality and are not a substitute for legal advice on your specific matter.

The Firm
We Used to Work for Them.
Now We Fight for You.
Client Reviews
What Clients Say
  1. Anthony's background as a former federal prosecutor and executive for major healthcare companies provided a level of expertise and insight that made all the difference. His deep understanding of healthcare law, particularly in litigation and compliance matters, helped navigate complex legal issues with ease.
UPIC Audit Defense FAQ
Frequently Asked Questions

Seven questions that come up on almost every first call. The answers below are general; specific situations require privileged consultation.

What is a UPIC and how is it different from a RAC, MAC, or ZPIC? +
A UPIC (Unified Program Integrity Contractor) is a CMS contractor responsible for Medicare and Medicaid program integrity work in a specific geographic jurisdiction. CMS established the UPIC program in 2016 to consolidate work that was previously split between Zone Program Integrity Contractors (ZPICs) and Program Safeguard Contractors (PSCs). UPICs are different from Recovery Audit Contractors (RACs), which conduct postpayment review of paid claims for overpayment recovery on a contingency basis; from Medicare Administrative Contractors (MACs), which adjudicate claims and process payments; and from Supplemental Medical Review Contractors (SMRCs), which conduct medical review of specific topics on CMS direction. The procedural framework, the appeal track, and the realistic exposure differ across all four contractor types.
Which UPIC is auditing my pharmacy or practice? +
Five UPICs cover the United States by region. SafeGuard Services audits the Northeast jurisdiction. Qlarant audits the Midwestern, Southeastern, and Western jurisdictions. AdvanceMed audits the Southwestern jurisdiction. The audit notice itself identifies the contractor, but providers often miss the contractor identification because the notice arrives on CMS letterhead with the contractor name in smaller text. The contractor matters because each UPIC has somewhat different document request conventions, different statistical methodologies, and a different working relationship with the local U.S. Attorney's office. Defense counsel that has worked with the specific contractor on prior matters knows the procedural patterns that an unfamiliar counsel will not.
What is the difference between UPIC prepayment review and postpayment review? +
Prepayment review means the UPIC reviews each claim before CMS pays it. The provider continues to submit claims as usual, but cash flow stops while each claim sits in review (typically 60 to 180 days per claim). Multi-year prepayment review is a possible posture under recent CMS frameworks. Postpayment review means the UPIC reviews claims that have already been paid and demands recoupment of any claims found non-compliant. Postpayment review typically uses statistical extrapolation: the UPIC reviews a sample (often 30 to 50 claims), calculates an error rate, and extrapolates the error rate across the full claim population for the audit window. The procedural defenses, the cash flow consequences, and the ALJ appeal posture differ materially between the two.
How do I challenge a UPIC's statistical extrapolation? +
Statistical extrapolation challenges focus on whether the UPIC's methodology meets the CMS Program Integrity Manual standards and the relevant federal court precedent. Common defense angles include sample frame defects (the sample is drawn from a population that does not match the audit scope), sample size deficiencies (the sample is too small to support extrapolation at the cited confidence interval), RAT-STATS application errors (the contractor's use of the CMS-mandated statistical software), and Cochran formula objections (the formula used to calculate the point estimate or the lower confidence bound). A successful extrapolation challenge can reduce a multi-million dollar recoupment demand to the actual sample-claim amount, which is typically a small fraction of the extrapolated number. Statistical defense requires either an in-house defense expert or a retained statistician with healthcare claims experience.
What is the timeline for appealing UPIC findings? +
The Medicare appeal track has five levels with strict statutory deadlines. Level 1 is the redetermination request to the MAC, due within 120 days of the initial determination. Level 2 is the reconsideration request to a Qualified Independent Contractor (QIC), due within 180 days of the redetermination. Level 3 is the Administrative Law Judge (ALJ) hearing, due within 60 days of the QIC reconsideration; the ALJ hearing has historically had a multi-year backlog, though CMS has worked to reduce it. Level 4 is the Medicare Appeals Council review. Level 5 is federal district court review under 42 USC § 405(g). Missing any deadline waives the appeal at that level and forecloses subsequent levels. The redetermination and reconsideration are the most consequential procedural steps because the record built at those levels is the record the ALJ will review.
When does a UPIC audit produce a criminal referral? +
UPICs refer matters to HHS-OIG, the DOJ Civil Division, and the local U.S. Attorney's office when the audit findings produce evidence of intent rather than billing errors. Common referral patterns include: documented patterns of false certifications, evidence of services billed but not provided, kickback or anti-kickback indicators, suspected upcoding of E/M or procedure codes for financial gain, and any pattern that the UPIC investigator believes supports a False Claims Act theory. The civil FCA referral runs through the DOJ Civil Division (the matter may surface as a Civil Investigative Demand). The criminal referral runs through the local U.S. Attorney or DOJ Fraud Section (the matter may surface as a federal grand jury subpoena or a target letter). Coordinating the UPIC defense with parallel FCA and criminal defense from the first contact is essential because evidence developed in one track is admissible in the others.
When should I engage counsel in a UPIC audit? +
Before responding to the document request. The UPIC document request letter is the first procedural opportunity in the audit, and the production response shapes everything that follows: which documents the UPIC reviews, what claim universe the sample is drawn from, what the realistic findings range will be, and whether the UPIC sees patterns that escalate to criminal referral. A document production made without privileged counsel can produce material that becomes evidence in subsequent civil and criminal litigation, and the procedural defenses available later (extrapolation challenges, ALJ appeal arguments) can be foreclosed by an inadequate or over-inclusive production. The earlier counsel is engaged, the more leverage the defense has across the audit, the appeal, and any parallel matters.
Speak with UPIC Audit Defense Counsel Today

A UPIC document request is the first procedural opportunity in the audit — the production response shapes everything that follows

Before you produce documents to the UPIC, before the contractor draws the sample for extrapolation, before the matter escalates to a DOJ Civil Division referral, have a privileged conversation with attorneys who defend UPIC audits across SafeGuard, Qlarant, and AdvanceMed jurisdictions. Free, confidential, no retainer.

"The UPIC sent a document request covering three years of claims. Health Law Alliance was on the call within two hours, walked us through the production framework, and ran a privileged pre-production review of every document before it left the practice. When the contractor's findings came back with extrapolation, the methodology challenge at the redetermination level reduced the recoupment demand to a small fraction of the original number. The procedural record built at the redetermination stage carried through the QIC reconsideration." - Practice administrator, multi-location practice (anonymized client, 2024)
UPIC document request? The production response shapes everything.