Medicare Audits and Contractors: Who Reviews the Claim, Who Moves the Money

The difference between Medicare MAC, RAC, UPIC and CERT reviews comes down to payment administration, paid-claim review, fraud investigation and national payment-error measurement. A request for the same patient chart can serve very different purposes. Records changed after a request and billing that continued after specific errors were explained can show what happened inside the business. That is where an insider’s knowledge matters.

The Medicare Contractor Map

Medicare contractors divide the work of paying claims, reviewing their support and investigating suspected fraud. The Centers for Medicare & Medicaid Services assigns different responsibilities to each.

These roles overlap at the claim. A reviewer may identify the payment problem while the MAC handles the resulting adjustment. Knowing which organization performed each job connects the medical finding to the money.

What a MAC Does

A MAC is the private contractor that administers Original Medicare fee-for-service claims for its assigned work. The Centers for Medicare & Medicaid Services’ description of the MAC role reaches beyond processing bills: MACs also conduct medical review, provide education, make local coverage determinations and audit institutional cost reports. They handle the first review of a disputed claim decision, called a redetermination.

That puts the MAC at several points in a healthcare business’s accounts. It can process the original claim, examine its medical support and carry out a later payment adjustment. A notice from the MAC may therefore reflect work another contractor started.

Coverage also has a place and a date. A local coverage policy belongs to a particular jurisdiction and version. The service date, policy in effect, clinical record and claim belong together when we examine why Medicare paid or denied a service.

For institutional providers, the payment story can extend beyond the individual claim. Interim amounts, a certified cost report, audit adjustments and final settlement are separate events. A finance employee who understands the cost report may see a payment question that the person submitting daily claims never encounters.

MAC Versus RAC Versus UPIC Medicare Review

MAC medical review can occur before or after payment. RAC review examines paid claims. UPIC work develops the factual basis for suspected fraud, waste or abuse.

A RAC can use automated review or examine medical records. Medicare defines automated review as a decision made by the system using electronic information without a human reviewing the medical record. A records-based review can reach the order, clinical support and other documentation behind the billed service.

The business arrangement behind recovery auditing helps explain its focus. In Medicare Program Integrity: Activities to Protect Medicare from Payment Errors, Fraud, and Abuse, the Congressional Research Service described the RAC contingency model in 2011: contractors received a percentage of the overpayments they recovered. The report also described the tension created by paying claims quickly:

We see the problem in that arrangement: Medicare pays the claim, then pays a contractor to recover the overpayment. For an insider, the original payment and the later review can reveal different parts of the same conduct.

A UPIC’s inquiry can combine billing analysis, medical review, interviews and site visits. Medicare’s medical-review instructions specifically identify possible falsification, altered records, evidence about whether the service occurred and patterns suggesting fraud as matters UPIC staff examine. A changed chart and the instructions behind that change can matter alongside the billing pattern that first drew attention.

CERT Sample Versus Fraud Investigation

A CERT sample estimates payment accuracy across Original Medicare fee-for-service claims. A fraud investigation develops evidence about suspected conduct. CERT uses a stratified random sample to estimate payment error across the program.

Medicare’s fiscal-year 2025 report put estimated improper payments at $28.83 billion, or 6.55% of fee-for-service payments. The underlying claims were submitted from July 2023 through June 2024.

The estimate answers a payment-accuracy question. The report groups findings into insufficient documentation, no documentation, medical necessity, coding and other errors.

An individual sampled claim can still have a payment consequence. Medicare’s medical-review manual includes CERT in the requirements for documenting denials and verifying overpayments.

What Are the Most Common Causes of Improper Medicare Payments?

Insufficient documentation accounted for the largest share of estimated improper payments in Medicare’s fiscal-year 2025 fee-for-service report. The missing support can leave reviewers unable to confirm that the payment requirements were met.

For an insider, the next useful detail is what happened to that support: what existed when the service was provided, what accompanied the claim and what appeared after the request for records. The contractor’s request and the versions of the medical record can reveal that sequence.

Targeted Probe and Educate and Supplemental Medical Review

Targeted Probe and Educate is a MAC review program that combines examination of selected claims with education. The Supplemental Medical Review Contractor conducts national review projects directed by the Centers for Medicare & Medicaid Services. Both examine medical support, but their selection and purpose differ.

Medicare’s Targeted Probe and Educate instructions describe a typical round of 20 to 40 claims for a provider and an item or service, followed by education. The process typically allows up to three rounds.

Selection can follow high denial rates, billing that differs from peers, data analysis or referrals. After a round, the MAC offers individualized education about the actual claim errors and sends a results letter. Continuing high error rates can lead to further review or referral to a recovery auditor.

Those exchanges matter to a whistleblower because they put the concern inside the business. The findings identify the claims and the problem. The education identifies what the provider was told. Later billing and internal instructions can show what management did with that information.

A Supplemental Medical Review Contractor request identifies the service under review and the documentation needed. For an insider, it connects the national review issue to the claims inside the business.

I-MEDIC and Part D Oversight

The I-MEDIC investigates suspected misconduct by prescribers, pharmacies and beneficiaries in the drug-plan payment system. Medicare’s program-integrity manual places I-MEDIC under the UPIC umbrella statement of work while assigning it a specific Parts C and D investigative purpose.

The payment chain explains why the distinction matters. A pharmacy claim goes through a plan or pharmacy benefit manager. The Part D sponsor submits prescription drug event data and direct and indirect remuneration reports, and CMS reconciles federal payments. Delegating work to a pharmacy benefit manager leaves the sponsor responsible under its CMS contract.

The Centers for Medicare & Medicaid Services’ August 2026 attestation memorandum makes that connection concrete for the 2025 payment reconciliation. A sponsor’s chief executive, chief financial or chief operating officer signs the required attestations. The payment attestation covers prescription drug event data, summary direct and indirect remuneration data and other information used to determine reinsurance and risk-corridor costs, certifying that the information is accurate, complete and truthful.

A pharmacy employee may understand the dispensing record. A plan employee may understand the submitted data or a correction that never reached reconciliation. Those views connect different representations to the federal payment.

When One Review Leads to Another

Contractor findings can move toward payment correction, provider education or investigation. Medicare’s instructions make one handoff particularly clear: when MAC, CERT, SMRC or RAC reviewers identify potentially fraudulent entries in medical documentation, they refer the case to the UPIC. The contents of the record can change who examines it next.

A MAC can begin with unusual billing identified through data analysis, a complaint or an alert from another reviewer. A UPIC can develop a lead through claims analysis, interviews and other information, then refer a case to the HHS Office of Inspector General for consideration of civil or criminal enforcement. UPICs also work with state Medicaid program-integrity units on assigned Medicare and Medicaid matters.

The payment work can return to the MAC. Medicare’s instructions describe a UPIC completing its review, calculating an overpayment and referring the matter to the MAC when recovery is the appropriate outcome. The MAC can also provide education or further medical review. This is why the investigator’s name and the name on the payment correspondence can differ.

Statistical extrapolation adds another distinction. Under Medicare’s sampling instructions, a contractor can use sampled findings to estimate overpayments across a larger defined group of claims after the required payment-error or failed-education determination. A TPE review, a national CERT estimate and an extrapolated provider overpayment answer different questions.

Why an Older RAC Review May Have a Different Owner

A contractor taking over a region does not necessarily take over every older review or appeal. Medicare’s RAC transition history shows why the review date matters.

When Medicare awarded Cotiviti Regions 3 through 5 in April 2025, Performant retained administrative and appeal responsibilities for its earlier Region 5 work. In the earlier Region 2 transition to Performant in 2022, Cotiviti completed its finding letters and retained its own appeal work.

The results letter, the contractor that completed the review and the later correspondence explain the history of that claim. For a billing or contractor employee tracing an old finding, the handoff itself can explain why records sit with more than one organization.

The Auditors Needed Better Oversight Too

The Office of Inspector General’s March 2025 cost-report audit found that every one of the 12 MAC jurisdictions failed the specified desk-review or audit-quality contract requirement in at least one year during fiscal years 2019 through 2021. The Centers for Medicare & Medicaid Services identified 287 audit issues across the jurisdictions.

The problems reached medical-education reimbursement, allocation of charges to cost centers, nursing and allied-health programs, and bad debts. MAC officials cited unclear guidance, limited feedback, inadequate training, staffing and workload issues.

Cost reports help set future Medicare payment rates and wage indexes as well as reimburse facilities. A weak review can therefore affect more than the paperwork on one provider’s desk. We expect the contractors checking the books to meet the standards for checking them. The auditors needed auditing.

The Centers for Medicare & Medicaid Services generally concurred with the recommendations. The later recommendation tracker records all three implemented by September 2026, covering better explanations of review results, updated audit instructions and additional training.

What an Insider Can Recognize

The useful sequence connects the claim, the request for support, the finding, the response and the later payment. Medicare requires MAC, RAC, CERT and SMRC post-payment documentation requests to follow a common format while identifying the particular program and reason for selection. Similar-looking letters can belong to different kinds of review.

We connect those exchanges to the orders, claims, warnings and payments behind the concern. An employee may know why a record changed, who received an audit finding or why billing continued after a specific problem was explained. That knowledge gives the documents their business context.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

When You Know What Happened After the Review

If you work in health care and know how audit findings, altered records or ignored corrections connect to Medicare payments, speak with our whistleblower experts about what happened inside the business. We work beside you to build your strongest Medicare whistleblower case around those decisions and bring in Medicare fraud whistleblower lawyers who understand contractor reviews and the payment system. We bring the judgment and partnership to pursue it with you.