The UPIC program aims to simplify and strengthen Medicaid integrity by replacing Zone Program Integrity Contractors with United Program Integrity Contractors to conduct unified audits across Medicare, Medicaid, and other federal health programs; UPICs will focus on identifying fraudulent providers, strengthening oversight of state financial policies, and collaborating between federal and state agencies to combat fraud, waste, and abuse. Providers can expect increased scrutiny of billing practices and medical records from UPIC audits starting in 2018.

1. The UPIC Revolution:
CMS Integrity Auditors 2.0
Stephen Bittinger
Healthcare Reimbursement Attorney
NEXSEN PRUET, LLC

2. Goals for Today
Review the purpose and objectives of CMS’ UPIC Program
Understand UPIC implementation
Understand the focus of the UPIC program
Learn UPIC auditors’ tactics and operations
Learn the fundamentals of audit defense and basic legal
rights in audit defense

3. Types of Medicare Audits
Recovery Audit Contractors (“RACs”)
 Old news
 Audits focus on “errors and omissions”
 Paid a contingency fee of the recovery amount
Quality Improvement Organizations (“QIOs”)
 Comprised of health quality experts, clinicians and consumers with focus on
improving quality of care
 Two kinds
(1) Beneficiary and Family Centered Care (BFCC-QIO) – manage all
individual beneficiary complaints
(2) Quality Innovation Network (QIN-QIO) – data driven initiatives that
promote best practices for better care of beneficiaries

4. Types of Auditors: Zone Program
Integrity Contractors (“ZPICs”)
History:
 In 1996, the Health Insurance Portability and Accountability Act (“HIPAA”)
revised the Social Security Act and established the Medicare Integrity Program
(“MIP”).
 MIP’s primary purpose is to deter fraud and abuse by giving the Centers for
Medicare and Medicaid Services (“CMS”) authority to hire outside, independent
contractors for enforcement.
 In 1999, CMS developed Program Safeguard Contractors (“PSCs”) to: (a)
support MIP; (b) stop fraud; and (c) facilitate adherence by providers.
 In 2003, the Medicare Modernization Act (“MMA”) implemented Medicare
Fee-for-Services Contracting Reform and created the Medicare Administrative
Contactors (“MACs”) over seven program integrity zones.

5. Types of Auditors: Zone Program
Integrity Contractors (“ZPICs”)
History (cont.):
 From 2009 through 2011, new entities called Zone Program Integrity
Contractors (“ZPICs”) were created for each of the seven zones, replaced the
PSCs, and were tasked with performing “program integrity” [fraud and abuse
investigation] for Medicare Parts A, B, DME, Home Health and Hospice, and
Medicare-Medicaid data matching.
 Note: Medicare Part C and D program integrity efforts are handled separately
by a single Medicare Drug Integrity Contractor (“MEDIC”) (Health Integrity,
LLC).
 ZPICs and MEDIC work collaboratively under the authority of the Center for
Program Integrity (“CPI”) in CMS.
 South Carolina ZPIC = AdvanceMed

6. Types of Auditors: ZPICs & The
Reality
 ZPICs are targeting providers that are statistical “outliers” from their peers
based on services billed.
 ZPICs are using the “threat” of reporting potential fraud and abuse to the OIG,
DOJ, or FBI to coerce providers into submission to overly aggressive audit
tactics, unfounded repayment demands, and inappropriate Medicare payment
suspension or participation denial.
 ZPICs are “shadow reporting” fraud and abuse to the OIG, DOJ, and FBI during
audits without notice to providers to increase the civil penalties and criminal
convictions of providers.
 ZPICs have begun shifting their focus from Medicare Part A and Home Health
and Hospice (2009-2012) to Medicare Part B and DME providers (2011-
Present).

7. What Constitutes Fraud
by a Provider
 Old Standard – “fraudulent conduct” in the facts
 billing for services with no qualified provider,
 repeated, blatant violations of supervision regulations
 billing under NPI of provider who did not provide service.
 New Standard - “fraudulent pattern”
“[Dr. Miller] submitted, or caused to be submitted, claims to Medicare for nerve
block injections that were false and fraudulent because the nerve block injections
were not medically indicated and necessary for the patients’ health per Medicare
coverage guidelines.” - U.S. v. Michael K. Miller (Missouri) (Plea Agreement –
April 2014 – 15 months and $880,000 in restitution).

8. Types of Auditors: United Program
Integrity Contractors (“UPICs”)
 UPICS are the newest fraud, waste, and abuse auditor that CMS is
implementing in 2018 that will replace the ZPICs.
 UPICs formed as part of the Comprehensive Medicaid Integrity Plan (CMIP) to
wrap all federally funded integrity reviews into a single audit.
 Formed in response to projected $119 billion increase in Medicaid spending
over FY 2014-2018.
 CMS awarded multiple 10-year, $2.5B IDIQ (Indefinite delivery/indefinite
quantity) UPIC contracts in support of CMS’ audit, oversight, antifraud, waste,
and abuse general budget.
 Contract for the Midwestern region, which includes Ohio, has been
awarded to AdvanceMed, an NCI, Inc. company.

9. 1. Simplify and Streamline – increased federal spending in UPIC program will
heavily influence state control over Medicaid program
2. Identifying Fraudulent Providers – UPIC will collaborate with state agencies
to identify and remove fraudulent providers.
3. Shared Accountability – federal and state will have shared accountability for
developing and delivering “cost-effective” healthcare to Medicaid beneficiaries.
4. Fraud Preventions – through provider screening, periodic revalidation, and
temporary suspension of payments for “credible allegations of fraud.”
5. Oversight of Financial Policies – federal will oversee state plans, waivers, and
financial management for grant making to the states.
6. Strengthen Medicaid Integrity – federal and state auditors will share data,
coordinate audits, and collaborate with state and federal law enforcement
agencies.
Objectives of the UPIC

10. Implementation of the UPIC
 The work completed by the ZPICs and PSCs will be phased out and the
UPICs will transition into the primary audit and investigation body over the
next two to three years.
 To date, neither CMS nor UPICs have released specific timeframes for
implementation of the UPICs in 2018, but we have seen them starting in other
jurisdictions.
 From current experience with ZPIC investigations, the volume of new
investigations appears to have dwindled with only extreme outliers currently
receiving new notices while these contractors are preparing for the UPIC
integration and role out.

11. Impact of UPICs
 Despite UPIC unifications, CMS will continue with other
audit programs, including RACS and QIOs.
 Providers will face a higher level of unified scrutiny across
ALL FEDERAL PAYERS: Medicare, Medicaid, Medicare
supplemental plans and all military plans, such as Tricare and
VA Choice.

12. UPICs: What to Expect
 We have already begun to see the UPIC program begin to operate in the
Midwestern region by AdvanceMed under many of the same premises and
modes of operation as they previously used under the ZPIC/PSC contracts.
 Expect:
• small initial records requests to probe for issues;
• larger sample records requests to be used to support stratified
samples and extrapolations; and
• and “office raids” (know your rights).

13. Overpayments Discovered by
Providers: “60-day Rule”
 Under the Affordable Care Act, healthcare providers are
required to report and return overpayments to CMS
within 60 days after identification of the overpayment.
 “Reasonable diligence standard” – a provider is
deemed to have identified an overpayment when the
provider has or should have through the exercise of due
diligence determined that the provider received an
overpayment and quantified the amount of the
overpayment (6 month maximum from discovery).

14. Penalties Under False Claims Act
for Failure to Disclose
 As of March 2017, overpayments retained after that 60
day deadline are considered “reverse false claims” that
are subject to civil and criminal penalties under the
federal False Claims Act.
 Penalties can be imposed for between $5,500-$11,000
per claim plus treble damages for the total amount of the
overpayment. (e.g., claims totaling $5,000 of
reimbursement improperly held could total $550,000 in
penalties and $15,000 in treble damages)

15. Private Payer Audits
 Private payor medical and billing policies can be different than CMS
or can default to CMS policy. The payor’s website usually has a link
to all medical service policies.
 Audits are conducted in a similar fashion to CMS when statistical
outliers are identified.
 Private payors have Special Investigative Units (“SIUs”) that become
involved if fraud is suspected.
 Every payer has its own unique overpayment appeal process that can
usually be found in the provider manual.

16. Be Proactive
• Rise to the Level of Scrutiny – Unified
investigations will immediately expose any
insufficiencies for all federally funded
reimbursement. This increased risk
necessitates providers raising their level of
compliance efforts to prevent potential
disaster.

17. Compliance Strategies
 Compliance Team – every medical entity must ensure their compliance
officer and reporting team is fully educated on their duties to ensure
compliance across both federal and private payor reimbursement.
 Compliance Plan – every compliance plan (now required to be a current,
“living” plan of action) must include a specific protocol for cross-checking
Medicare and Medicaid claim data, in addition to CMS coverage
guidelines, billing and coding protocols, staff hiring and training
protocols, documentation guidelines, and HIPAA/HITECH.
 Internal Audits – conduct periodic and random audits of patient records,
billing documentation, services codes, provider signatures, and EOBs.

18. Compliance Strategies (cont.)
 External Audits – hire a third party expert to conduct annual or semi-annual
baseline compliance audits. Take the advice and implement that into every
day operations.
 Tracking – make sure that all payor document requests and reimbursement
denials are tracked carefully to detect and correct problems before they rise to
level of external review by an auditor.
 Compliance Enforcement – despite providers’ chagrin with compliance, it is
more necessary than ever them to make time to participate in development
and training for the compliance plan. Staff, as well as providers, must have
real and apparent consequences for failure to adhere, including additional
training, mandatory observation, and escalation proceedings.

19. Compliance Strategies (cont.)
 Billing and Coding – hiring certified and experienced billing and coding
experts to manage and monitor payor policies and billing practices is more
essential than ever.
 Proper Documentation – provide sufficient descriptions of the patients’
complaints, diagnoses, and treatments in the medical record. Ensure that all
service billed are properly accounted for in the patients’ medical records.
 Conduct Quarterly Compliance Reviews – at least once a quarter, the
compliance team must review all payor coverage policies, guidelines, and
handbooks. A complete “new search” for payor guidelines on all services
must be performed to ensure adherence.

20. Defending an Audit
 Communication – cautious, but open, communication with investigators is
essential to determine the basis for initiation of an audit and to determine
the scope (both in length of time and breadth of services). Initiate
communication to express cooperation and to determine investigator’s
motives.
 Self-Audit – self-auditing can be one of the most effective tools to
preventing fiscal collapse. Hire an independent expert to review claims
targeted by the auditor to determine an objective assessment of non-
compliant reimbursement and disclose overpayments prior to the auditor
producing their extrapolated findings. Self-disclosure may be the only
escape from the nightmare of the CMS or private payer appeal process.

21. Defending an Audit (cont.)
 Corrective Actions – quickly establish a thorough corrective action plan
for any medical necessity or billing errors found during the self-audit.
Disclose this plan to the auditor and the claims administrator collecting the
overpayment disclosure.
 Education and Training – implement the corrective actions and document
the implementation process and training provided to providers and staff.
 Review Compliance Failure History – complete an internal investigation
into the origin of the reimbursement error and develop a protocol for
prevention to be added to the compliance plan.

22. Appeals
 If a payor determines a significant overpayment occurred, an
appeal may be necessary, especially if it a federal payor:
 Steps to Take:
1. Seek legal counsel regarding your rights as a provider as applied to
recoupment and claims withholding;
2. Expedite appeal time to prevent early recoupment; and
3. Understand the administrative appeal process to make an informed
decision on whether other strategic options outweigh the long and
tedious wait to be heard by an administrative law judge (“ALJ”).

23. Summary
 CMS’ UPIC changes are here.
 Refund all identified overpayments promptly.
 Avoid audits by ramping up your compliance
efforts and understanding policies for services
billed to both federal and private payors.
 Be prepared to defend your business.

24. Stephen Bittinger, Esq.
www.nexsenpruet.com
sbittinger@nexsenpruet.com
(o) 843-720-1703
(c) 440-823-0664