It usually starts with a letter. A managed care organization (MCO), a Recovery Audit Contractor (RAC), or a Unified Program Integrity Contractor (UPIC) notifies your practice that it has completed an audit and determined that you owe a significant overpayment—sometimes hundreds of thousands of dollars. That alone is alarming. But buried in the fine print may be a sentence that changes everything: “This matter has been referred to the Office of Inspector General.” If you see that sentence, stop everything and call a lawyer.

From Audit to Investigation: How It Escalates

MCOs, RACs, and UPICs are tasked with identifying overpayments and rooting out waste in Medicare and Medicaid. Under 42 C.F.R. § 438.608(a)(7), managed care organizations must promptly refer any potential fraud, waste, or abuse to the State Medicaid program integrity unit—or potential fraud directly to the State Medicaid Fraud Control Unit. The consequences can be swift.

Under 42 C.F.R. § 455.23(a)(1), once a State Medicaid agency determines there is a “credible allegation of fraud” for which an investigation is pending, it must suspend all Medicaid payments to the provider—unless it finds good cause not to. The suspension can happen without prior notice. One day your reimbursements are flowing; the next, they are not.

The Critical Protection Most Providers Don’t Know About

Here is where providers need to pay close attention. Many assume that if an MCO, RAC, or UPIC flags alleged fraud, the State must accept those findings at face value and suspend payments. That is simply not true.

Under 42 C.F.R. § 455.2, a “credible allegation of fraud” is defined as an allegation “which has been verified by the State,” and allegations are credible only “when they have indicia of reliability and the State Medicaid agency has reviewed all allegations, facts, and evidence carefully and acts judiciously on a case-by-case basis.” Further, 42 C.F.R. § 455.14 requires that when the agency receives a fraud complaint from any source, it must conduct its own preliminary investigation to determine whether there is a sufficient basis to proceed.

The State cannot simply rubber-stamp an MCO’s or RAC’s allegations. This requirement raises the bar for “indicia of reliability”—the State must do more than accept a contractor’s spreadsheet. It must independently review the facts, examine the evidence, and make its own judicious determination.

A Real-World Example

Consider a home health agency that receives a $1.2 million overpayment demand from a UPIC. The UPIC concludes the agency billed for medically unnecessary services and refers the matter to the OIG. The State suspends the agency’s Medicaid payments. But the provider’s attorney discovers the UPIC relied on a flawed extrapolation methodology and a statistically questionable sample. Confronted with the § 455.2 requirement to independently verify the allegations, it becomes clear the State never conducted its own preliminary investigation—it simply adopted the UPIC’s conclusions wholesale. That failure creates a viable defense.

Consequences and Defenses

A payment suspension can be existential. Without Medicaid revenue, a practice may be unable to make payroll, pay rent, or serve patients. But the law provides defenses. Under § 455.23(e), the State may find good cause not to suspend where the provider is the sole source of essential services in a community, beneficiary access to care would be jeopardized, or the provider submits written evidence demonstrating the suspension should be removed. Providers can also challenge whether the State satisfied its obligation to independently verify the allegations under § 455.2 and whether a proper preliminary investigation occurred under § 455.14.

The Bottom Line

Every provider who receives an overpayment letter from an MCO, RAC, or UPIC should read the entire document—especially the fine print. Look for any language indicating a referral to the OIG, a Medicaid Fraud Control Unit, or another government watchdog. If that language is there, you are no longer dealing with a billing dispute. You are facing a potential fraud investigation that could result in suspension of your Medicaid payments, exclusion from federal healthcare programs, and even criminal prosecution. The good news is that the law requires the State to do its homework before pulling the trigger—and a provider who understands that requirement is in a far stronger position to fight back.