(786) 808-8288Book a consultation
ENES
A reviewer studies printed spreadsheets and a summary chart at an office table

Compliance

Medicare and Medicaid audit readiness: CMS audit, UPIC and TPE support

A CMS audit starts with a records request, and the clock is short: you have 45 calendar days to answer a MAC, RAC, SMRC or CERT request and 30 days for a UPIC, after which the contractor may deny the claim (42 CFR 405.903(b)–(c) and 405.929(b)–(c) set the days; 405.930 the denial). We assist with audits, investigations and corrective action plans, and coordinate responses to documentation requests from regulatory agencies and payers.

Book a consultationCall (786) 808-8288

The short answer

How do I respond to a CMS audit?

Answer the records request on time, 45 calendar days for a MAC, RAC, SMRC or CERT and 30 for a UPIC, or the contractor may deny the claim. After a Medicare overpayment demand, a redetermination filed within 30 days delays recoupment. The Advixor Group assists with audits, investigations and corrective action plans, and coordinates responses to documentation requests.

Sources42 CFR part 405, subpart I42 CFR 405.372 to 405.379

Who Audits

Who runs a CMS audit in Florida: from CERT to a UPIC

Auditor Why it calls Records due Its decision If it finds an overpayment
CERT (error-rate review) A random sample 45 days; extensions possible Counts toward the national error rate The MAC adjusts the claim
MAC medical review, including TPE Data analysis, high denial rates, referrals 45 days 30 days after the records (prepayment), 60 (post-payment) Denial or demand; after TPE, CMS action
RAC, Region 3 (Florida) CMS-approved review topics 45 days 30 days after the records, then a discussion period The MAC issues the demand
SMRC CMS-directed national projects 45 days Reported to CMS The MAC adjusts or recoups
UPIC Fraud, waste and abuse leads 30 days Findings 60 days after the records Suspension, revocation, OIG referral
Florida Medicaid (AHCA’s Office of Medicaid Program Integrity) Suspected overbilling or fraud, including complaints When asked, during business hours Preliminary, then final audit report Hearing rights, 10% interest, sanctions, fraud referral
Florida Medicaid RAC State contract Set by the state Set by the state Recovery through AHCA

Sources CMS CERT, Recovery Audit Program and SMRC pages (2026); Program Integrity Manual ch. 3, §3.2.5 and review timeliness (MACs, TPE, RACs, UPICs), and ch. 4, §4.2.2.1 (UPICs); 42 CFR 405.903, 405.929, 455.508; AHCA’s Office of Medicaid Program Integrity page; s. 409.913, F.S.

A long records room aisle lined with rolling compact shelving units

Records Requests

Audit readiness: answering the records request on time

Late records count only for good cause, such as natural disasters or interruptions in business practices (42 CFR 405.903(b)(2), 405.929(b)(2)). For practices indirectly affected by a disaster, MACs and RACs extend the 45 days to 90 (PIM ch. 3, §3.8); CERT may grant extensions (CMS CERT page).

A RAC waits at least 60 days after payment to request records, and caps its requests per tax ID and three-digit ZIP code by how many clinicians billed there the year before: from 10 records per 45 days for the smallest groups to 50 (RAC Statement of Work; CMS, Feb 14, 2011).

RAC and TPE

RAC audits and Targeted Probe and Educate: rounds, discussions and revocation

  1. A TPE roundTypically covers 20 to 40 claims and should finish within about 6 months.
  2. EducationOne-on-one education follows, then at least 45 days before new claims are picked.
  3. The resultMeet the error goal and you are released for a year; miss it after 3 rounds and CMS decides what follows, up to revocation.

Source PIM ch. 3, §3.2.5.

  • Revocation risk: the results letter quotes 42 CFR 424.535(a)(8)(ii), which lets CMS revoke billing privileges for “a pattern or practice of submitting claims that fail to meet Medicare requirements” (Medicare enrollment).
  • RAC: Florida is in Region 3. The RAC reviews nothing more than 3 years past the initial paid date, and waits 30 days after its results letter before sending the claim to the MAC: that is your discussion period, with written requests confirmed within 1 business day (RAC Statement of Work, Regions 3–5).
  • Reopening: every post-payment review is a reopening (42 CFR 405.929(a)), allowed within 1 year of the initial determination for any reason, within 4 years for good cause and at any time for fraud or similar fault (405.980(b)).

UPIC

UPIC audits: payment suspension, extrapolation and fraud referrals

UPICs, called ZPICs in older CMS instructions, work fraud, waste and abuse cases in Medicare and Medicaid and refer cases to OIG for civil or criminal action (PIM ch. 4, §4.2.2.1).

  • 180 daysis how long a payment suspension generally lasts, with one extension of up to 180 more, and no time limit while a credible allegation of fraud is investigated.
  • 15 daysat least to rebut a suspension, when notice is given.
  • 90%one-sided confidence interval: an extrapolated demand is normally its lower limit, and a statistician or someone with equivalent expertise must review and approve the sampling method.

Sources 42 CFR 405.372(d) and 405.374; PIM ch. 8, §8.4.1.5, §8.4.5.

  • Florida Medicaid must suspend payments on a credible allegation of fraud unless it finds good cause not to (42 CFR 455.23).
  • Extrapolation is allowed only after a determination of “a sustained or high level of payment error” or failed education, and that determination can’t be appealed (42 U.S.C. 1395ddd(f)(3)).

Appeals

Healthcare audit defense: stopping recoupment and the appeal levels

Recoupment stops when a timely, valid redetermination request arrives, and again at reconsideration (42 CFR 405.379(d)). After those two levels it resumes at 100%, whether or not you appeal further, and interest keeps accruing (Financial Management Manual ch. 3, §200).

“These limitations do not affect a provider’s right to appeal nor the requirements and timeframes associated with appealing; however, to stop recoupment, a provider must act decidedly to appeal.”

CMS, Medicare Financial Management Manual, ch. 3, §200

The MAC and the QIC each decide in 60 days, the ALJ and the Medicare Appeals Council in 90. An ALJ hearing needs at least $200 in controversy and federal court $1,960 in 2026 ($2,000 from January 1, 2027), and each notice is presumed received 5 days after its date.

Deadlines that run against the practice after a finding, in calendar days
Florida Medicaid hearing petition, from receipt of the final audit report21 days
Medicare redetermination, to delay recoupment (from the demand letter)30 days
Earliest day Medicare recoupment can beginday 41
Reconsideration, to keep recoupment delayed (from the redetermination)60 days
ALJ hearing, Appeals Council or federal court filing60 days
Redetermination filing limit120 days
Reconsideration filing limit180 days

Sources Rule 28-106.111(2), F.A.C.; 42 CFR 405.379, 405.942, 405.962, 405.1002, 405.1102 and 405.1130; Financial Management Manual ch. 3, §200 (Rev. 13825).

Florida Medicaid

Medicaid audit in Florida: from the preliminary report to a final order

  • The review: AHCA may examine your Florida Medicaid records during normal business hours, with 24-hour notice if treatment would be disrupted (s. 409.913(9)), and may project a sample’s results to all your claims (409.913(20)).
  • The reports: a preliminary audit report comes first. Paying after it does not avoid sanctions at the final report unless AHCA offers amnesty (Rule 59G-9.070(2)).
  • The money: overpayments bear 10% interest a year from the final determination (409.913(25)(c)); payments are withheld during a hearing unless you repay or agree a plan within 30 days of AHCA’s probable-cause notice (27); a final order no longer open to appeal must be paid or put on a plan within 30 days, or you are terminated (30); and AHCA can recover its investigative and legal costs (23).
  • The fines: for Medicaid-law violations, erroneous-claim patterns or short goods behind an overpayment, capped at 20%, 40% or 50% of it for a first, second or third offense; in an audit with no overpayment, $20,000 and $50,000 for a first and second offense, then no cap (Rule 59G-9.070(4)).
AHCA’s program integrity office in FY 2024–25, in dollars (2,055 cases opened)
113 fines, in total$2,277,816
Overpayments alleged in final audit letters$33,544,008
Recovered from its audits$42,985,447
Overpayments alleged in preliminary audit letters$46,118,075

Source AHCA, Florida’s Efforts to Control Medicaid Fraud & Abuse, FY 2024–2025.

The office is separate from AHCA’s licensure side (AHCA licensing).

Our Service

Compliance audit preparation services: what we do, and what goes to your attorney

We also track each records request and appeal deadline, assemble and index the records packet, sample claims before they are billed, draft redetermination and reconsideration requests, arrange a statistician to test an extrapolation and prepare Florida Medicaid self-audits.

We provide compliance consulting and coordination, not legal advice or representation: whether and how to appeal, ALJ and Florida administrative hearings, self-disclosure decisions and any allegation of fraud go to your own attorney.

Audit readiness

As part of your compliance program, we:

  • Conduct internal compliance reviews and risk assessments
  • Help keep audit records in order
  • After a finding, help put new procedures and workflows in place (operational efficiency)
Book a consultation

What’s included

What our CMS audit readiness service includes

Documentation audits

Chart reviews against Medicare and Florida Medicaid rules, and the errors behind most denials.

Learn more

Progress notes

Progress notes that hold up in a Medicare or Florida Medicaid audit, note by note.

Learn more

Compliance

The yearly compliance audit OIG expects, and the 60-day rule for returning an overpayment.

Learn more

Compliance training

Fraud, waste and abuse training by role, with the records that prove it.

Learn more

OIG exclusion checks

Monthly exclusion-list checks, so an excluded person's work never reaches a claim.

Learn more

Accreditation

How mock surveys and plans of correction work.

Learn more

Quick answers

CMS audit questions: triggers, protocols and Florida Medicaid timing

What counts as a CMS audit, its triggers and protocols, and Florida Medicaid look-backs and timing. Bring your records request to a consultation.

Hands flip through hanging file folders in a row of document boxes
What is an insurance audit, and when is it a CMS audit?
A payer's review of claims it paid, against your records; a CMS audit is one run by a Medicare contractor (table above). OCR's HIPAA audits (HIPAA checklist) and CMS's audits of Medicare Advantage plans (other payers) are separate programs.
What triggers a Medicare audit?
For targeted review, MACs pick providers with historically high claim denial rates, billing that differs from their peers or a risk to the Medicare Trust Fund, and act on referrals from a RAC, CERT, a UPIC, OIG or GAO (Program Integrity Manual ch. 3, §3.2.5). Your denial rate is one of the healthcare KPIs worth tracking.
What protocols do CMS auditors follow?
The Medicare Program Integrity Manual (chapter 3: medical review, records requests and TPE; chapter 4: UPICs; chapter 8: sampling and extrapolation; all revised in 2026), and for recoupment, chapter 3 of the Financial Management Manual.
How far back can a Florida Medicaid audit go?
Florida requires Medicaid records to be kept 5 years after the service (s. 409.913(9)), and a Medicaid RAC may not review claims more than 3 years old without the state's approval (42 CFR 455.508(f)).
How long does a Medicaid audit take in Florida?
AHCA's program integrity cases averaged 0.36 years from opening to payment in full in FY 2024–25. If you request a hearing, it must be held within 90 days after an administrative law judge is assigned, absent exceptionally good cause (s. 409.913(31)).

Keep reading

Related

HIPAA compliance

HIPAA compliance services for medical and mental health practices: policies, patient notices, staff training, compliance reviews and rule updates.

Learn more

Talk to an advisor

You care for patients. Who’s taking care of the business?

Tell us where your practice is today. We will tell you what we would do first.

Book a consultationor call (786) 808-8288

Official sources

All read Oct 20–21, 2026.