The Types of Medicare Audits

A practice that receives a letter from a Medicare contractor tends to file it under one word — “audit” — and to feel the same way about all of them. But CMS uses several distinct programs, run by different contractors, and they are not doing the same job. One is checking whether a claim met Medicare's coverage rules. One is looking for money that was paid in error, in either direction. One is measuring how accurately the whole program pays, using a random sample. One is investigating conduct that might be fraud. The letterhead, the contractor's name, and the reason stated in the notice are the fastest way to tell which kind of review a practice is in.

This sits in the Compliance and Regulations category because being reviewable — and being ready for it — is a compliance function. The programs below are the ones a physician practice, supplier, or facility billing Medicare fee-for-service is most likely to encounter. Medicare Advantage (Part C) plans run their own reviews under their own rules and are not covered here.

The Medicare Administrative Contractor (MAC) is the contractor that processes and pays a practice's Medicare fee-for-service claims in its region — and the same contractor also reviews them. MAC medical review checks whether a claim met Medicare's requirements, most often whether the service was reasonable and necessary under national policy or the MAC's own Local Coverage Determination. Because the MAC is the payer, its review can be prepayment or post-payment.

The MAC review a practice is most likely to meet by name is Targeted Probe and Educate (TPE). Its purpose is not simply to claw back money — it is to reduce a provider's claim errors and appeals through one-on-one education. The MAC uses data analysis to select providers whose billing stands out: high claim-error rates, or patterns that differ from peers, on items and services that carry a high error rate and financial risk to Medicare. A provider whose claims are accurate and unremarkable is unlikely to be selected.

1. 01

   A probe of a sample of claims

   The MAC reviews a sample of the provider's claims and the supporting documentation for the service under scrutiny. The number of claims in a round is a figure CMS sets; the point is that it is a sample, not the whole book of business.
2. 02

   One-on-one education

   After the round, the MAC provides individualized education on the specific errors it found — the step that gives the program its name and its purpose. The provider is given time to correct the problems before anything else happens.
3. 03

   Repeat, up to a limited number of rounds

   A provider who is still making the same errors moves to another round of review and education. CMS caps the number of rounds. A provider who comes into compliance is removed from the process.
4. 04

   Escalation after the final round

   A provider who remains non-compliant after the final round is referred to CMS, which decides what happens next. That can include further review, placing the provider on 100 percent prepayment review, extrapolation of an error rate to a larger set of claims, or referral to a Recovery Auditor or a program-integrity contractor.

The Recovery Audit program uses Recovery Audit Contractors (RACs, or Recovery Auditors) to find and correct improper payments in Medicare fee-for-service after claims have been paid. Its mission runs in both directions: it identifies overpayments Medicare should recover and underpayments a provider is owed. The program's authority is section 1893(h) of the Social Security Act, which directs the Secretary to contract with recovery audit contractors to identify underpayments and overpayments and to recoup overpayments.

Two features distinguish a RAC from the MAC's own review. First, Recovery Auditors work purely post-payment, and some of their work is automated — applying rules to claims data without asking for records — while complex review requires a human to read the medical record. Second, and unusually, a Recovery Auditor is paid on a contingency basis: a share of what it recovers, rather than a flat fee, with that fee returned if its finding is later overturned on appeal. Recovery Auditors operate by geographic region.

Comprehensive Error Rate Testing (CERT) is the program CMS uses to measure the Medicare fee-for-service improper payment rate — how much of what the program pays does not meet Medicare's requirements. This is the type most often misunderstood, because a practice caught in a CERT sample experiences it as an audit, but the program's purpose is measurement of the program as a whole, not scrutiny of that provider.

CERT works by drawing a statistically valid random sample of claims from across the program each reporting period and requesting the medical records behind them. A random sample is the point: it lets CMS calculate a rate that reflects all claims the program processed, and it produces breakdowns by contractor, service, and provider type. It is not built to spot a particular provider's billing patterns — because the sample is random, its reviewers generally cannot see the kind of pattern that would signal fraud. The improper payment rate it produces is not a fraud rate; it is a measure of payments that did not meet the rules, for any reason, including missing documentation.

A Unified Program Integrity Contractor (UPIC) is the contractor a practice least wants to hear from, because a UPIC's job is not improper payments — it is benefit integrity: detecting, deterring, and investigating potential fraud, waste, and abuse. UPICs work across both Medicare and Medicaid, including the data match between the two programs. They were created by consolidating earlier program-integrity contractors — the Zone Program Integrity Contractors (ZPICs), Program Safeguard Contractors (PSCs), and Medicaid Integrity Contractors (MICs) — into a single integrated function organized by region.

The focus of a UPIC review is different in kind from a MAC's, a CERT sample, or a Recovery Auditor's. Where those ask whether a claim met the rules, a UPIC asks whether the billing reflects what actually happened — whether the service billed was really provided, whether documentation may have been falsified, and whether there are patterns that indicate potential fraud. Because the question is different, so are the tools and the consequences: a UPIC can initiate administrative actions to deny or suspend payments, ensure improper payments are recouped, and refer cases of potential fraud to the HHS Office of Inspector General for consideration of civil or criminal action and administrative sanctions such as exclusion.

The Supplemental Medical Review Contractor (SMRC) is a single national contractor CMS uses to perform medical review as CMS directs — nationwide reviews of specific topics, services, or vulnerabilities that CMS has identified, often from its own data analysis, the CERT results, professional organizations, or federal oversight agencies. Its purpose is to help lower improper payment rates and protect the Medicare Trust Funds.

What sets the SMRC apart from a MAC's medical review is scope. A MAC reviews within its own jurisdiction; the SMRC is a single contractor conducting one CMS-directed review across the whole country, so a practice anywhere can be included in an SMRC project focused on a particular service. Like the other reviewers, it requests records, denies claims when the documentation does not support them or is not produced, and may use statistical sampling to project a result.

The programs are easiest to keep straight when their purposes are set side by side. The single most useful column is the first data column — what the contractor is actually trying to do — because that is what determines how serious the contact is and who inside the practice should own the response.

For all their differences, these programs run on a few common mechanics, and knowing them is most of knowing how to respond to any of them.

The Additional Documentation Request (ADR)

When a reviewer cannot decide a claim on the information it already has, it asks the provider to send the medical records that support the claim, through an Additional Documentation Request. The ADR is the pivot point of most reviews: MACs, Recovery Auditors, the SMRC, and UPICs all use it, and if no response arrives within the timeframe the contractor sets, they deny the claim — in whole or in part — as not reasonable and necessary. The timeframe is CMS-controlled, so the operative deadline is the one on the request; missing it converts a reviewable claim into a denied one for a reason that had nothing to do with the care.

Extrapolation

Rather than review every claim, a contractor may review a statistical sample and project the error rate it finds onto the larger universe of similar claims to calculate a total overpayment. That projection is extrapolation, and it is why a sample of a few claims can produce a demand far larger than the dollars in the sample itself. The sampling and projection methodology is governed by CMS rules; a practice facing an extrapolated overpayment often has grounds to challenge the methodology, not only the individual claims.

The right to appeal

A contractor's determination is not the last word. A denial or overpayment finding from these programs is appealable through Medicare's standard five-level fee-for-service appeals process, and filing a timely appeal generally pauses recoupment while the appeal is pending. The deadlines and any dollar thresholds for each level are set by CMS and stated in the determination notice, so the notice itself is where a practice reads the clock it is working against.

A practice cannot choose whether to be reviewed, but it can control how ready it is and how it responds. The work is mostly ordinary — the discipline of a practice that documents its care and answers its mail.

• Identify the contractor and the type before reacting. Read the letterhead and the stated reason: a TPE round from the MAC, a Recovery Audit demand, a CERT sample, and a UPIC contact are different situations with different owners inside the practice.
• Treat every Additional Documentation Request as a deadline. The fastest way to lose a claim that was fine is to not send the records on time. Track the request date, the response deadline on the notice, and what was sent.
• Answer a TPE the way it is meant. Send complete documentation, then act on the education. TPE is built to end in correction, not recovery, for a provider who engages with it.
• Escalate a benefit-integrity contact immediately. A UPIC contact, a payment suspension, or anything that reads as a fraud investigation goes to the compliance program and counsel at once — not through the normal appeal-and-refund routine.
• Preserve the record and mind the downstream duty. An audit that confirms an overpayment does not end at the demand: a practice also has its own obligation under the 60-day overpayment rule for overpayments it has identified, and a documented, timely response is what shows good faith across all of it.