Most Medicare audit losses are not fraud findings. They are missing pages. CMS estimated that 6.55% of Medicare fee-for-service payments in fiscal year 2025, or $28.83 billion, were improper, and said most of those improper payments happened because reviewers could not confirm compliance from incomplete or missing documentation, according to its FY 2025 improper payments fact sheet.
That is the pattern in Medicare audits. The care was usually provided. What fails is the record that proves it: an unsigned note, a missing order or a chart that does not support the level billed. Preparing for a Medicare audit is mostly the work of making sure every claim can defend itself before anyone asks.
One terminology note before you start. Zone Program Integrity Contractors (ZPICs) no longer exist as a separate program: CMS folded their work into Unified Program Integrity Contractors (UPICs), and recent CMS instructions refer to them together as “ZPIC/UPIC.” This guide uses UPIC for current audits.
Who Audits Medicare Claims?
| Auditor | What It Does | How It Usually Starts |
|---|---|---|
| Medicare Administrative Contractor (MAC) | Processes claims and runs medical review, including Targeted Probe and Educate (TPE) | A TPE notice, then Additional Documentation Requests (ADRs) |
| Unified Program Integrity Contractor (UPIC, formerly ZPIC) | Investigates potential fraud, waste and abuse | Records requests, data analysis, interviews or site visits |
| Recovery Audit Contractor (RAC) | Finds and recovers improper payments on CMS-approved topics | ADRs on paid claims, generally within a three-year lookback |
| Supplemental Medical Review Contractor (SMRC) | Runs CMS-directed national reviews | ADRs for a specific project |
| Comprehensive Error Rate Testing (CERT) | Measures the national improper payment rate from a random sample | A CERT documentation request; responding is mandatory |
| HHS Office of Inspector General (OIG) | Audits, evaluates and investigates HHS programs | An audit notice or investigative contact |
| Medicare Advantage plans and CMS | Plan reviews of providers; CMS program audits of plans | Plan chart requests or CMS audit engagement letters |
What Happens During a Medicare Audit?
Most Medicare audits follow the same path, whichever contractor runs them:
| Stage | What Happens |
|---|---|
| 1. Notice | You receive a letter or ADR naming the claims, the review type and the deadline |
| 2. Records | You submit the requested documentation, usually within 45 days, by portal, esMD, fax or mail |
| 3. Review | Clinical and coding reviewers compare the records with coverage, coding and documentation rules |
| 4. Results | You receive a results letter listing claims allowed, denied or adjusted and the reasons |
| 5. Follow-up | Education, a corrective action request, an overpayment demand or referral to another contractor |
| 6. Appeal | You can appeal any denial through Medicare’s five appeal levels |
What Is a Medicare Part B TPE Audit?
Targeted Probe and Educate (TPE) is a MAC review program for providers whose billing stands out from their peers or who bill services with high national error rates. CMS made TPE the standard MAC approach through Change Request 10249, as its transmittal R2239OTN sets out.
| TPE Feature | Detail |
|---|---|
| Rounds | Up to three rounds of review |
| Sample | 20 to 40 claims per round, prepayment or postpayment |
| Response deadline | Records due within 45 days of the ADR |
| Education | One-on-one education after each round with errors |
| Time to improve | At least 45 days, and generally 45 to 56 days, between rounds |
| After round three | Continued high error rates are referred to CMS, which may order extrapolation, UPIC or RAC referral or 100% prepayment review |
TPE is the best chance to fix a problem cheaply. A provider that treats round one seriously, attends the education and corrects the documentation pattern usually exits before the stakes rise.
What Is a ZPIC or UPIC Audit?
A UPIC audit is a program integrity review aimed at potential fraud, waste or abuse rather than routine billing errors. UPICs analyze claims data, request records, interview staff and patients, conduct unannounced site visits, recommend payment suspensions, calculate overpayments with statistical extrapolation and refer cases to the OIG or law enforcement. A UPIC records request deserves a faster and more careful response than a routine ADR, and many practices involve health care counsel at this stage.
What Is a MAC Audit, and How Is CMS Different From a MAC?
CMS is the federal agency that runs Medicare and sets its policies. Medicare Administrative Contractors are private companies that CMS hires to process claims and enroll providers in each region, and a MAC audit is the medical review those contractors perform, most often through TPE. CMS writes the rules; the MAC applies them to your claims.
What do MACs, CERT and OIG do?
MACs process and review claims in their jurisdictions. CERT reviews a random national sample of claims every year to estimate the improper payment rate, which CMS publishes on its CERT page. The OIG is the independent watchdog for HHS: it audits programs, investigates fraud and maintains the exclusion list. A CERT request is not an accusation, but an ignored CERT request is counted as an error.
What About RAC, SMRC and Medicare Advantage Audits?
RACs review paid claims on topics CMS has approved and published, such as facility versus non-facility reimbursement, generally looking back three years from the payment date. The SMRC performs national reviews that CMS assigns. Medicare Advantage audits work differently: plans review their own network providers’ claims and charts under their contracts, while CMS audits the plans themselves. CMS publishes its Part C and D program audit protocols and has said it will post a revised audit process overview and submission checklist before conducting 2027 program audits.
What Triggers a Medicare or Medicaid Audit?
| Trigger | Example |
|---|---|
| Billing that stands out from peers | A higher share of level 4 and 5 E/M visits than similar practices |
| High-risk services | Services on CMS, OIG or RAC watch lists, such as skin substitutes, DME or modifier 25 visits |
| Prior errors | Denials in an earlier review or a non-response to ADRs |
| Random selection | A CERT or PERM sample |
| Complaints and tips | Patient complaints, former employees or whistleblowers |
| Medicaid-specific | State Medicaid program integrity units, Medicaid RACs and Medicaid Fraud Control Units |
How to Prepare for a Medicare Audit: Step-by-Step Checklist
Preparation works best before a letter arrives. Use this checklist as a standing Medicare compliance routine.
| Done | Item | Why It Matters |
|---|---|---|
| ☐ | Name an audit lead and a backup | Someone must own every request and deadline |
| ☐ | Log every ADR with its due date | Missing the 45-day window turns a reviewable claim into a denial |
| ☐ | Know your data | Compare your coding patterns with peers using Comparative Billing Reports or PEPPER reports where available |
| ☐ | Audit a sample every quarter | Review 10 claims per provider against the record through an internal or external medical billing audit |
| ☐ | Fix documentation templates | Cloned notes and missing medical necessity statements are common audit findings |
| ☐ | Check signatures and orders | Every note signed; every test and service that requires an order has one |
| ☐ | Control late entries | Amendments must be clearly labeled, dated and attributed, never backdated |
| ☐ | Keep records retrievable | Records must be producible on request for the full retention period |
| ☐ | Return overpayments within 60 days | Identified overpayments must be reported and returned on time |
| ☐ | Train billing and clinical staff | Teach the documentation rules behind your highest-risk codes |
How to respond to a records request
Send exactly what is requested, in order, with a cover letter that lists each claim, its date of service and the documents enclosed. Include the order, the visit note, test results, signatures and any signature attestations. Paginate the packet, keep a copy and confirm receipt. Never alter or add to a record after the request; a properly labeled late entry made before the request is acceptable, but a backdated one turns a billing error into a credibility problem.
What Are Medicare Documentation Requirements?
| Requirement | What Reviewers Look For |
|---|---|
| Medical necessity | The reason for the service, tied to the diagnosis and coverage policy |
| Complete visit notes | History, exam or findings, medical decision making or time and the plan |
| Orders | A signed order for services that require one, such as tests and DME |
| Signatures | A legible handwritten or valid electronic signature, or a signature attestation where allowed |
| Support for the code | Documentation that matches the level, units and modifiers billed |
| Time | Start and stop times or total time for time-based services |
What Are Medicare Record Retention Requirements?
| Rule | Retention Period |
|---|---|
| Medicare providers and suppliers (42 CFR 424.516(f)) | 7 years from the date of service for documentation supporting orders, certifications and referrals |
| Medicare Advantage contracts (42 CFR 422.504(d)) | 10 years |
| HIPAA policies and documentation | 6 years |
| State medical record laws | Vary by state and can be longer; follow the longest rule that applies |
What Not to Say During an Audit?
Do not guess, speculate or explain what a record “probably” shows. Do not promise to send records you have not located, and do not volunteer information outside the scope of the request. Never suggest that a record can be updated or completed now. Keep answers factual and brief, route all communication through your audit lead and, for UPIC interviews or OIG contact, speak with health care counsel before answering substantive questions.
What Are the 5 C’s of Auditing?
The 5 C’s describe how an audit finding is built, and they are a useful way to read Medicare results letters and to run your own internal audits:
| C | Meaning | Medicare Example |
|---|---|---|
| Criteria | The rule the service must meet | The LCD or CPT guideline for the code |
| Condition | What the auditor actually found | The note does not document medical necessity |
| Cause | Why it happened | A template without a medical necessity field |
| Consequence | The effect of the finding | Denied claims and an overpayment demand |
| Corrective action | How to prevent it | Updated template and provider education |
What Are the 7 Steps in the Audit Process?
Internal and external audits generally follow seven steps: plan the scope and sample, notify the people involved, gather the records, review the claims against the rules, discuss the findings, issue a report with corrective actions and follow up to confirm the fixes worked. Running your own audits in the same seven steps means a Medicare audit will look familiar when it arrives.
How Do You Appeal Medicare Audit Findings?
| Level | Who Decides | Deadline to File |
|---|---|---|
| 1. Redetermination | The MAC | 120 days from the initial determination |
| 2. Reconsideration | A Qualified Independent Contractor (QIC) | 180 days from the redetermination |
| 3. Hearing | An Administrative Law Judge | 60 days from the reconsideration |
| 4. Review | The Medicare Appeals Council | 60 days from the hearing decision |
| 5. Judicial review | Federal district court | 60 days from the Council decision |
To stop Medicare from recouping an overpayment while you appeal, file the redetermination within 30 days of the demand letter and the reconsideration within 60 days of the redetermination decision. If the appeal fails, interest applies. Separately, any overpayment you identify yourself must be reported and returned within 60 days, a clock that can now be suspended for up to 180 days while you investigate in good faith, as Bass Berry explained.
What Changes for Medicare Audits in 2027?
| Development | What It Means |
|---|---|
| CMS program audit protocols | CMS will post a revised audit process overview and submission checklist before its 2027 Part C and D program audits |
| WISeR model | Original Medicare providers in six states can choose prior authorization or pre-payment review for selected services, as Baker Tilly explained |
| FY 2026 improper payment rate | CMS reports the next Medicare improper payment rate in the HHS Agency Financial Report |
| Overpayment rule | The 180-day investigation window adopted in 2025 continues to apply |
How Can iSolve RCM Help You Prepare for a Medicare Audit?
iSolve RCM runs pre-audit reviews that compare a sample of your Medicare claims with the documentation behind them, ranks findings by risk and shows you what to fix before a contractor finds it. Our medical coding and denial management teams then correct the patterns behind the errors, starting at 2.99% of monthly collections.
Frequently Asked Questions
How long do I have to respond to a Medicare ADR?
Most Medicare contractors require records within 45 days of the Additional Documentation Request. If the records are not received in time, the claim is denied for missing documentation.
What are the 2021 CMS audit protocols?
The CMS audit protocols are the program audit protocols CMS uses to audit Medicare Advantage and Part D plans, not individual providers. CMS has since revised them under CMS-10717 and plans to post an updated process overview before its 2027 program audits, so plans should use the current versions rather than the 2021 documents.
Is a ZPIC audit the same as a UPIC audit?
Yes, in practice. CMS consolidated ZPIC work into Unified Program Integrity Contractors, and current CMS instructions refer to ZPIC/UPIC together. A UPIC audit focuses on potential fraud, waste and abuse.
Can Medicare extrapolate audit findings?
Yes. When a contractor finds a sustained or high level of payment error, it can project the error rate from a sample to a larger group of claims. That is why early TPE rounds matter.
How often should a practice audit itself?
At least once a year for every provider, and quarterly for high-risk services or providers with prior findings. Internal audits should follow the same documentation rules Medicare reviewers use.
What is a Medicare compliance checklist?
A Medicare compliance checklist is a standing list of controls, such as ADR tracking, signature and order checks, internal audits, record retention and overpayment refunds, that keeps a practice ready for any Medicare review.
