An audit letter is not a routine piece of mail.
For a skilled nursing facility or assisted living provider, a request for records can involve a standard payment review, a state Medicaid utilization review, an MCO audit, a contractor investigation, or a matter that requires legal counsel immediately.
The first question is not:
Which claim are they asking about?
It is:
Who sent the letter, what authority do they have, and what response deadline applies?
That distinction shapes everything that follows: who should lead the response, whether legal counsel should be involved immediately, what records must be preserved, whether payment suspension is possible, and what appeal rights may be available after a determination.
By: Paul Mason, Director of Strategic Partnerships at LTCPro
For: Skilled nursing facility and assisted living administrators, business office and billing leaders, and compliance teams responsible for coordinating a facility’s response to RAC, UPIC, MFCU, state Medicaid program-integrity, and MCO audit or overpayment notices.
Key Takeaway: A strong audit response starts with classification. Identify the requesting entity, preserve records, calendar the deadline, assign one response owner, and avoid treating every request as a routine billing issue.
Read the letter before pulling records
When an audit, records request, overpayment notice, or payment-review letter arrives, the first 24 hours matter.
Before anyone begins collecting documents, identify these facts from the notice.
| What to identify | Why it matters |
|---|---|
| Sender | Determines whether the matter is administrative, contractual, program-integrity related, or potentially legal |
| Program | Identifies whether the request concerns Medicare, Medicaid FFS, Medicaid managed care, HCBS, or another payer arrangement |
| Authority | Explains the reviewer’s role, record-request power, payment authority, and appeal process |
| Scope | Shows which residents, claims, dates of service, service lines, or facilities are being reviewed |
| Deadline | Establishes the real response clock |
| Request type | Distinguishes a medical-record request, audit, overpayment notice, prepayment review, subpoena, or investigative inquiry |
| Consequence of nonresponse | Identifies potential denial, recoupment, extrapolation, payment hold, termination, or referral risk |
| Contact and appeal language | Establishes the authorized communication route and any appeal or rebuttal rights |
Do not assume the sender’s name explains the entire matter. Read the letter carefully, retain the envelope or electronic transmission evidence, and document the date and time it was received.
A letter that appears administrative may contain language requiring immediate escalation. A routine-looking record request may have a short deadline. An overpayment notice may contain appeal rights that expire if no one calendars them.
Who sent the letter?
Medicaid and Medicare program integrity work is performed by several different entities. Their roles can overlap, but they do not carry the same authority or require the same response posture.
| Requesting entity | Primary role | Typical focus | Initial response posture |
|---|---|---|---|
| Recovery Audit Contractor, or RAC | Identifies and recovers improper payments | Post-payment review, coding, documentation, payment accuracy | Administrative response; preserve records, review scope, confirm deadlines and appeal rights |
| Unified Program Integrity Contractor, or UPIC | Detects and investigates Medicare and Medicaid fraud, waste, and abuse | Data analysis, medical review, suspected fraud or abuse, referrals, administrative actions | Escalate to counsel and compliance leadership promptly |
| Medicaid Fraud Control Unit, or MFCU | State law-enforcement unit investigating and prosecuting Medicaid provider fraud and patient abuse or neglect | Potential criminal fraud, abuse, or neglect | Involve legal counsel immediately; preserve records and follow counsel’s direction |
| State Medicaid program-integrity unit | State Medicaid oversight function; title and process vary by state | Utilization review, payment accuracy, eligibility, provider compliance, overpayments | Follow the state-specific process; review provider manual, notice, and appeal rights |
| Medicaid MCO Special Investigations Unit, or SIU | Plan-level investigative or payment-integrity function | Contract compliance, billing patterns, network issues, potential fraud or abuse | Review the provider contract, notice, documentation request, deadlines, and escalation process |
| Medicare Administrative Contractor, or MAC | Processes and pays Medicare claims; may conduct medical review and issue determinations | Claims processing, medical review, documentation, overpayments | Administrative review; calendar redetermination and appeal deadlines if a determination is issued |
| State survey agency or licensing entity | Surveys compliance with facility conditions, resident rights, and licensure requirements | Resident care, facility operations, quality, certification, or regulatory compliance | Involve compliance and counsel as appropriate; distinguish survey matters from claims-payment audits |
The same organization can send different types of notices. The letter’s stated purpose, cited authority, program, and requested action matter more than the logo alone.
RAC: a payment-accuracy review
Recovery Audit Contractors are generally associated with identifying and recovering improper Medicare payments. State Medicaid programs may use their own RAC or recovery-audit arrangements, but the structure, scope, and appeal process vary by state.
A RAC review is typically a payment-integrity or post-payment matter. It may involve:
- Medical-record requests
- Coding review
- Documentation review
- Coverage or medical-necessity review
- Duplicate-payment review
- Payment-policy review
- Overpayment determinations
A RAC matter is serious, but it is not automatically an allegation of criminal fraud.
The facility should still respond with discipline:
- Confirm the claims and dates under review
- Identify the specific records requested
- Preserve the original records
- Assemble an indexed response package
- Track every record sent
- Retain delivery confirmation
- Review the determination and appeal rights if an overpayment is identified
Do not assume that repayment is the only option. Review the notice, governing policy, and appeal process before taking action.
UPIC: a program-integrity investigation
A Unified Program Integrity Contractor, or UPIC, is a CMS contractor that conducts fraud, waste, and abuse detection, deterrence, and investigation activities across Medicare and Medicaid.
CMS guidance states that UPICs investigate providers’ billing and may recommend or support administrative actions such as overpayments, payment suspensions, terminations, referrals to licensing boards, and referrals to law enforcement. Read CMS’s Medicaid Program Integrity Manual guidance on UPICs.
UPICs may conduct data analysis, review medical records, identify vulnerabilities, investigate potential fraud, and refer cases for civil or criminal consideration. Read CMS’s Medicare Program Integrity Manual.
Why a UPIC request requires immediate escalation
A UPIC request should not be treated as ordinary billing correspondence.
CMS policy allows payment suspension in circumstances involving reliable information that an overpayment exists, concerns that payments may not be correct, or a credible allegation of fraud. Payment suspension requires CMS approval and coordination with the relevant Medicare Administrative Contractor. Read CMS guidance on UPIC-related payment suspensions.
This does not mean every UPIC records request results in suspension or referral.
It does mean that a UPIC request can carry greater program-integrity and financial stakes than a routine claim review.
What to do if the letter is from a UPIC
- Notify compliance leadership and qualified healthcare counsel promptly.
- Preserve all relevant records, emails, billing data, logs, and communications.
- Suspend routine document-destruction activity for records within the review scope, subject to counsel’s guidance.
- Designate one internal response leader.
- Do not alter, backdate, recreate, or “clean up” clinical or billing records.
- Confirm the request scope, format, due date, and submission method.
- Maintain a document-production log.
- Route external communications through the designated response process and counsel as appropriate.
- Assess whether payment suspension, prepayment review, overpayment, enrollment, or referral language appears in the notice.
- Avoid informal explanations that go beyond the requested facts without counsel’s review.
If your facility receives a UPIC, state program-integrity, MCO SIU, or other audit letter, LTCPro can help organize the billing, claims, AR, authorization, and record-retrieval workflow while your legal counsel directs the legal response.
Request an Audit Letter Triage Review →MFCU: treat it as a legal matter
Medicaid Fraud Control Units, or MFCUs, investigate and prosecute Medicaid provider fraud. They also investigate abuse or neglect of residents in healthcare facilities and other settings.
HHS OIG explains that MFCUs operate in all 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands. They are typically part of a state Attorney General’s office. Read the HHS OIG overview of Medicaid Fraud Control Units.
An MFCU inquiry is materially different from a routine billing denial, claim edit, or administrative documentation request.
Immediate response to an MFCU inquiry
If the facility receives a subpoena, civil investigative demand, search warrant, contact from an MFCU investigator, or another indication of an MFCU matter:
- Contact qualified legal counsel immediately.
- Preserve all relevant records and communications.
- Follow counsel’s instructions regarding communications and document production.
- Do not alter, destroy, conceal, backdate, or recreate records.
- Do not conduct informal interviews or make substantive statements on behalf of the facility without counsel’s guidance.
- Secure relevant electronic systems, logs, paper records, billing data, and communications.
- Identify a limited internal response team.
LTCPro can support records organization, data retrieval, billing history reconstruction, and internal workflow coordination. It should not be positioned as legal defense, legal counsel, or a substitute for an attorney handling an MFCU investigation.
State Medicaid program-integrity reviews
States operate their own Medicaid program-integrity functions. Their names, processes, audit scope, record-request methods, overpayment rules, extrapolation practices, and provider appeal processes differ.
A state review may focus on:
- Nursing-facility Level of Care documentation
- Medicaid eligibility
- Resident liability
- Prior authorization
- HCBS waiver enrollment
- EVV records
- MDS or assessment information
- Medical necessity
- Claims coding and units
- Provider enrollment
- Cost-report information
- Payment adjustments
- Duplicate claims
- Timely filing
- Documentation supporting services billed
The right source is the state’s current notice, Medicaid provider manual, state administrative rules, program-integrity guidance, and appeal procedures.
Do not assume a national response window
A state Medicaid records request may allow 10 days, 20 days, 30 days, or another timeframe. An MCO may establish a different contractual deadline. A federal contractor may use a separate schedule.
The only safe rule is:
The deadline in the actual notice controls unless counsel confirms otherwise.
Calendar the deadline on the day the notice is received. Build internal deadlines before the external due date to allow time for record collection, quality review, executive review, counsel review if needed, and secure transmission.
MCO SIU and payment-integrity reviews
Medicaid managed-care organizations may conduct their own audits, payment-integrity reviews, utilization reviews, credentialing reviews, and Special Investigations Unit inquiries.
These requests are often governed by:
- The provider participation agreement
- The MCO provider manual
- State Medicaid managed-care requirements
- The specific notice or records request
- Applicable state law
- Payer appeal and dispute processes
MCO reviews can involve:
- Authorization compliance
- Medical necessity
- In-network or credentialing status
- Claims coding
- Unit utilization
- Duplicate or overlapping claims
- EVV compliance for applicable services
- Resident liability
- Provider documentation
- Retrospective recoupments
- Payment offsets
- Contract compliance
Do not assume that an MCO audit follows Medicare RAC or federal Medicaid appeal rules.
Review the provider contract and the notice carefully. Confirm whether the request is a routine prepayment review, post-payment audit, fraud-waste-abuse inquiry, contract dispute, recoupment notice, or another review category.
LTCPro can help facilities organize plan-specific claims, authorizations, remittances, resident-liability records, and supporting documentation for Medicaid managed-care reviews.
Review My MCO Audit Response Workflow →The first 30 days: a practical response plan
An audit response is rarely a single-department task.
Claims, clinical documentation, MDS data, authorizations, eligibility records, resident liability, admissions records, and communications may be spread across multiple systems and teams.
Use a structured 30-day response plan, adjusted to the actual deadline in the notice.
Day 0–1: intake and classification
- Date-stamp the letter, envelope, email, portal notice, or subpoena.
- Identify the sender, program, request type, scope, deadline, and cited authority.
- Notify the administrator, compliance leader, business office leader, and counsel if appropriate.
- Determine whether the matter is RAC, UPIC, MFCU, state program integrity, MAC, MCO, survey, or another review.
- Assign a single response owner.
- Open a response log.
Day 1–3: preserve and organize
- Preserve all records within the scope of the request.
- Pause routine destruction of potentially relevant records under counsel’s direction.
- Identify systems containing relevant information.
- Create a resident-and-claim inventory.
- Assign document owners by category.
- Confirm secure submission requirements.
- Establish internal review deadlines.
Day 3–10: collect and validate
For each claim or resident under review, assemble:
- Claim form or electronic claim record
- Claim-submission confirmation
- Remittance advice and payment history
- Eligibility and payer verification
- Resident admission and census records
- Physician orders and certifications, if applicable
- Nursing documentation
- Care plan
- MDS or assessment records, where relevant
- Level of Care, PASRR, waiver, or authorization documents, where applicable
- Medication, therapy, or ancillary documentation, where relevant
- Patient-liability records
- Prior correspondence, corrected claims, appeals, or prior audit records
Create an index for each claim file. Confirm that dates, services, authorizations, and billing records align.
Day 10–20: review the record set
Before submission, review for:
- Missing records
- Inconsistent dates
- Incorrect resident or payer information
- Unsupported codes or units
- Missing signatures or credentials
- Authorization gaps
- Eligibility gaps
- Patient-liability discrepancies
- Duplicate or overlapping billing
- Conflicts between MDS, nursing, therapy, and billed service information
- Documents that need contextual explanation
Do not alter the original record. If a correction is legally and clinically appropriate, follow established amendment procedures and counsel’s guidance.
Day 20–30: submit and document
- Submit only through the requested secure method.
- Confirm delivery.
- Preserve copies of everything submitted.
- Update the response log.
- Record names, titles, dates, and substance of material communications.
- Calendar follow-up, decision, rebuttal, appeal, or repayment deadlines.
- Prepare leadership for potential next steps.
The actual timeline may be shorter or longer than 30 days. The structure remains useful: classify, preserve, collect, validate, submit, and track.
Build an audit response log
A response log protects the facility from losing track of its own work.
| Log field | What to record |
|---|---|
| Notice received date | Date and time received |
| Requesting entity | RAC, UPIC, MFCU, state agency, MCO, MAC, or other sender |
| Program | Medicare, Medicaid FFS, Medicaid MCO, HCBS, or other |
| Scope | Residents, claims, dates of service, facility locations, and service lines |
| External deadline | Due date in the notice |
| Internal deadline | Earlier date for complete record assembly |
| Response owner | Person accountable for coordination |
| Counsel involvement | Attorney or firm, if applicable |
| Records requested | Full list of documents and data |
| Production date | Date each item or package was submitted |
| Delivery confirmation | Portal receipt, tracking number, fax confirmation, or secure-email evidence |
| Communications | Contact, date, subject, and response |
| Determination date | When findings, denial, overpayment, or closure notice arrives |
| Appeal or rebuttal deadline | Exact date and required filing method |
| Next action | Owner and due date |
The log should be factual. It is not a place for speculative commentary, blame, or unverified conclusions.
If an overpayment determination arrives
An overpayment notice should be reviewed immediately.
Do not assume that the amount is final. Do not assume that repayment is the only response. Do not assume that the appeal process is identical across Medicare, Medicaid FFS, Medicaid managed care, or state program-integrity reviews.
The notice may identify:
- Claims under review
- Audit period
- Alleged error type
- Overpayment calculation
- Sampling or extrapolation method, if used
- Records considered
- Repayment instructions
- Reconsideration, rebuttal, hearing, or appeal rights
- Filing deadline
- Payment-offset implications
- Interest or recoupment terms
- Contact information
Sampling and extrapolation
Some government audit programs may use statistical sampling and extrapolation when permitted by law, regulation, and program rules.
This means an auditor may review a sample of claims and, under an authorized methodology, estimate an overpayment across a larger universe of claims.
Extrapolation is not used in every review. The rules vary by program, state, audit authority, methodology, and appeal process.
If extrapolation appears in a notice:
- Involve counsel and qualified reimbursement or statistical expertise as appropriate.
- Request and preserve the methodology, universe definition, sample selection approach, and calculation.
- Compare sample claims with facility records.
- Identify recurring process issues and claim-specific factual disputes.
- Calendar all rebuttal and appeal deadlines.
- Do not focus only on the individual sampled claims if the determination applies beyond them.
If your facility receives an overpayment or recoupment notice, LTCPro can help organize claims, remittances, authorizations, resident accounts, and billing documentation so leadership and counsel have a clear factual record for the response.
Organize My Audit Response Records →Three audit-response failures to avoid
The following scenarios are illustrative and are not legal advice or client case studies.
Treating a UPIC request as routine billing mail
A facility received a medical-record request and assigned it to the billing office without reviewing the requesting entity or cited authority.
The sender was a UPIC. The request required a higher level of internal coordination and legal review than a standard payer documentation request.
What failed: The facility classified the request by appearance rather than authority.
Better approach: Identify the entity, scope, and stated basis before assigning the response workflow.
Missing an appeal deadline after an overpayment notice
A facility received a post-payment determination and focused on reconstructing the claims history. The appeal window expired before leadership determined whether the findings were factually or procedurally contestable.
What failed: The team treated the determination as a records task rather than a deadline-driven administrative action.
Better approach: Calendar appeal, rebuttal, reconsideration, or hearing deadlines on the day the determination arrives.
Sending incomplete records without a production log
A facility responded to a document request but did not maintain an index or proof of what was sent. Later, the reviewer asserted that certain records were not received.
What failed: The facility had no defensible internal record of production.
Better approach: Use an indexed, claim-by-claim production package and retain transmission confirmation.
How LTCPro supports audit response readiness
LTCPro provides revenue-cycle, medical billing, accounts receivable, prior authorization, and back-office support for U.S. skilled nursing and assisted living facilities.
For audit, records-request, payment-review, and overpayment-response workflows, LTCPro can help facilities organize the operational information needed for a complete response.
Depending on the facility’s systems, payer mix, state, service lines, and available documentation, LTCPro can help:
- Triage the operational aspects of an audit or records request
- Organize claim, remittance, eligibility, authorization, and resident-account information
- Build claim-level document indexes and response logs
- Support record retrieval across billing, AR, admissions, authorization, and financial systems
- Identify missing claims documentation and payer-history gaps
- Reconcile expected versus paid amounts
- Track payer, state, MCO, and internal response deadlines
- Organize denial, recoupment, adjustment, and appeal-support documentation
- Improve coordination between business office, billing, clinical, MDS, admissions, and finance teams
- Build an audit-response intake protocol before a future request arrives
LTCPro does not provide legal advice, represent facilities in criminal or civil investigations, determine whether fraud occurred, or replace qualified healthcare counsel.
Any UPIC inquiry, MFCU contact, subpoena, search warrant, civil investigative demand, payment suspension, formal fraud allegation, or overpayment determination with material legal consequences should be reviewed promptly by qualified counsel.
If your facility received an audit letter tomorrow, would your team know who owns the response, where the records are, and which deadline controls? LTCPro can help establish that response workflow before the pressure is real.
Talk to LTCPro About Audit Response Readiness →FAQ
What should a nursing facility do first after receiving a Medicaid audit letter?
Identify who sent the letter, which program it concerns, the claims and dates under review, the response deadline, and whether the request contains fraud, payment suspension, subpoena, overpayment, extrapolation, or appeal language. Assign a response owner and involve counsel when the request indicates UPIC, MFCU, subpoena, fraud, payment suspension, or material legal exposure.
What is the difference between a RAC and a UPIC?
A RAC typically focuses on identifying and recovering improper payments through post-payment accuracy review. A UPIC is a CMS program-integrity contractor that investigates potential Medicare and Medicaid fraud, waste, and abuse and may recommend actions such as overpayments, payment suspensions, referrals, or enrollment actions. Read CMS UPIC guidance.
Can a UPIC stop payments to a facility?
A UPIC may support or coordinate a CMS-approved payment suspension in specified circumstances, including cases involving reliable information of an overpayment, concerns that payments may not be correct, or a credible allegation of fraud. A payment suspension is not automatic with every UPIC request. Read CMS payment-suspension guidance.
What is an MFCU?
A Medicaid Fraud Control Unit is a state law-enforcement unit that investigates and prosecutes Medicaid provider fraud and investigates abuse or neglect in healthcare facilities and other settings. MFCUs are typically located within state Attorney General offices. Read HHS OIG’s MFCU overview.
How long does a facility have to respond to an audit request?
There is no universal response timeframe. The deadline depends on the requesting entity, state, payer, contract, audit type, and notice. The facility should follow the deadline in the actual letter and establish internal deadlines before that date.
Can a Medicaid overpayment determination be appealed?
Often, yes. The available appeal, rebuttal, reconsideration, hearing, or dispute process depends on whether the claim involves Medicare, Medicaid fee-for-service, Medicaid managed care, a state program-integrity unit, or another review entity. Review the determination notice, provider manual, payer contract, and applicable state or federal rules immediately.
What documents should be included in an audit response?
The request controls. Common records may include claims, remittance advice, eligibility verification, admissions records, census history, physician orders, nursing documentation, care plans, MDS records, authorization records, Level of Care documents, PASRR records, patient-liability documentation, payer correspondence, and appeal or correction history.
Does receiving an audit letter mean a facility committed fraud?
No. A records request, audit, payment review, or overpayment notice does not by itself establish fraud. Many reviews concern documentation, claims accuracy, coverage, coding, payment, or program requirements. A letter from an MFCU, UPIC, or other program-integrity entity can carry more serious implications and should be evaluated promptly with counsel.
