CMS Pub. 100-15, ch. 4
(Rev. 14275; Issued:12-23-25)
4.1 Documentation of Investigations/Audits and Medical Review Findings 4.2 Overpayment Assessment 4.2.1 Overpayment Assessed from Medical Review 4.2.2 Overpayment Assessed Solely by Data Analysis 4.3 Overpayment Resolution Process 4.3.1 Calculation of Federal Financial Participation (FFP) Based on State's Date of Expenditure 4.4 State Appeal Process 4.5 Close-Out Letters 4.6 Medicaid Settlement Negotiations 4.7 Medicaid Payment Suspensions 4.8 Terminations 4.9 Immediate Advisements 4.10 Fraud Referrals 4.11 Reporting State Vulnerabilities
(Rev. 12871; Issued: 10-11-24; Effective: 11-14-24; Implementation: 11-14-24)
All investigations/audits and medical review findings must be supported by adequate documentation. Adequate documentation consists of documents obtained by the investigator during the course of the investigation or medical review and should be part of the investigation/audit working file. The working paper file contains evidence accumulated throughout the investigation/audit to support the work performed, the results of the investigation/audit, including adjustments made, and all findings made by the reviewer. All documents and working papers shall be uploaded to UCM.
Examples of documents are:
1. Copies of federal and/or state policies and regulations.
2. Copies of medical/financial records to support the finding.
3. Copies of state generated remittance advices which support the claim payment or credit adjustment.
4. Correspondence, such as Provider Notification Letters and Record Request Letters/Lists.
5. Investigator's notes regarding the investigation.
6. Miscellaneous memoranda that pertain to the investigation.
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
When assessing potential Medicaid overpayments, the UPIC shall ensure the necessary state law and/or SMA overpayment methodologies and requirements are followed at all times. Upon completion of the medical review, the UPIC determines if there is a potential overpayment.
(Rev. 13494; Issued: 12-23-25; Effective: 01-26-26; Implementation:01-26-26)
In certain instances, in collaboration with the SMA, the UPIC may identify overpayments based solely on data analysis from claims or financial payments. In these instances, the UPIC shall collaborate with the state to validate the analysis and to ensure the policy interpretation is accurate. Additionally, the UPIC shall coordinate with each individual SMA and the COR/BFL team to determine a state specific dollar threshold for action on overpayments based solely on data analysis. Data driven overpayments that meet the dollar threshold, once reviewed and approved by CMS, shall be vetted in accordance with Chapter 3.3 of this manual prior to submitting the overpayment to the SMA by CMS through a Final Findings Report (FFR). All data analysis identified overpayments that fall
below the state specified threshold will be sent to the SMA by the UPIC to take whatever action they deem necessary (i.e., collection of overpayments, identification of program vulnerabilities, necessary policy updates, automated edits, etc.).
(Rev. 13494; Issued: 12-23-25; Effective: 01-26-26; Implementation:01-26-26)
Upon identification of an overpayment based on a Medicaid investigation/audit, an Initial Findings Reports (IFR) is sent to the Medicaid BFL for review and approval. Once the BFL has approved the IFR, the UPIC will send the IFR to the SMA within 180 days of the Medicaid Investigation Start Date for review and comments for 30 calendar days. The 180-day time frame is based on normal progression of the investigation/audit with no cause for delay or circumstances outside UPIC control, unless otherwise specified by CMS. All delays shall be documented in the Unified Case Management (UCM) system. If the state disagrees with the findings of the UPIC, which results in monetary changes to the Appendix A, the UPIC will revise the IFR and incorporate any other grammatical or narrative corrections identified by the state and document the changes in the UCM, the document will remain an IFR. If there are monetary changes, the UPIC shall inform the BFL to determine the next step. If the state's comments speak to the body of the report and are primarily grammatical or corrections to cited regulations, terminology, etc., the document will remain an IFR, and the UPIC will make any necessary corrections.
The IFR may then be transmitted by the UPIC to the provider for review and comments for 30 calendar days, if required by the SMA. The Medicaid BFL and the UPIC will review the provider's responses, if any, to determine if adjustments to the findings are necessary. If no adjustments are made to the findings, resulting in no monetary changes to the Appendix A, the UPIC will produce an FFR. If adjustments to the findings, which result in monetary changes to the Appendix A, are necessary, the UPIC will make the revisions in a revised IFR (RIFR) and the RIFR is sent to CMS and the state, this time with a 15-day review and comment period. CMS, the UPIC, and, if necessary, the state will reconcile any issues with the RIFR, after which the UPIC produces an FFR and completes the FFR – State Transmittal Letter and submits both to CMS for approval within 13 months of the Medicaid Investigation Start Date. The 13-month time frame is based on normal progression of the investigation/audit with no cause for delay or circumstances outside UPIC control, unless otherwise specified by CMS. All delays shall be documented in the Unified Case Management (UCM) system. CMS, upon approving the FFR, sends the FFR and State Transmittal Letter to the state. The FFR – State Transmittal Letter (Appendix E) can be found in the Appendices. Versions of the State Transmittal Letter are available for FFS and/or managed care investigations/audits, where the managed care overpayments can be recouped (Appendix E); FFS and managed care investigations/ audits when the managed care overpayments are not recoupable, but the FFS are (Appendix F); and managed care-only investigations/audits when there are only managed care overpayments that are not recoupable (Appendix G).
The FFR identifies the total overpayment amount paid to the provider and specifies the amount of Federal Financial Participation (FFP) that the state must return to CMS. It is
the state's responsibility to adjudicate the review findings with the provider. The state has one year from the date the overpayment is identified to recover or attempt to recover the overpayment from the provider before the federal share must be refunded to CMS. Under CMS's regulations, the date of discovery of overpayments begins on the date that CMS first notifies the SMA in writing of the overpayment and specifies a dollar amount subject to recovery. (See 42 C.F.R. § 433.316).
Sometimes a 100% overpayment is identified because the provider or supplier does not provide the contractor with the required medical record documentation to conduct a post-payment medical review. A 100% overpayment means that all the claims in the contractor's selected sample are considered to be improperly billed and paid based on the documentation received (or lack thereof). Therefore, they are fully denied through post-payment review. In these instances, the UPIC shall consult with its BFL and SMA on any potential 100% overpayment determinations prior to initiation of state overpayment reporting actions or notice to the provider/supplier. If approved, the UPIC shall coordinate the overpayment reporting actions with the SMA. If denied, the UPIC shall follow the instructions provided by its Medicaid BFL.
In certain instances, the SMA may require an update to the FFR, based on updated analysis by the state, resulting in a downward adjustment in the amount of an overpayment due to an appeal decision from an administrative law judge, informal hearing decision, issues identified within the referenced policy, etc. In these instances, the UPIC shall notify CMS of the discrepancies and discuss a proposed resolution. If it is determined that an update to the FFR is necessary, CMS and the UPIC shall collaborate to draft a Revised FFR (RFFR), along with the FFR Addendum – State Transmittal Letter (Appendix H), which CMS shall submit to the SMA upon completion. The UPIC will edit the OPT financial information in UCM on the original OPT record, upload the RFFR and FFR Addendum – State Transmittal Letter, and notify the BFL via email.
(Rev. 13494; Issued: 12-23-25; Effective: 01-26-26; Implementation:01-26-26)
The UPIC shall calculate the FFP amount for each discrepant claim line identified based on the Federal Medical Assistance Percentage (FMAP) in place at the time of the state Medicaid agency's date of expenditure (i.e., the date the state Medicaid agency paid the applicable claim). The total overpayment amount shall be entered into Appendix A of the FFR. The UPIC shall comply with the following directions when preparing FFRs for all assigned Medicaid investigations.
The UPIC shall add a column to Appendix A identifying the date of expenditure, in addition to the date of service.
The UPIC shall use the appropriate “Federal Share Percentage” for FY and Quarter.
(Example)
| Federal Share % (FY15) | Federal Share % (FY16) | Federal Share Amount (FY15) | Federal Share Amount (FY16) | Federal Share Total |
|---|---|---|---|---|
| % | % | $ | $ | $ |
| Total | $ |
In calculation of the FFP, the UPIC shall consult the Federal Register for the applicable FMAP rate and shall monitor any changes to the FMAP as published in the Federal Register on an ongoing basis. The relevant FMAP table can be found quickly and directly by searching the internet for “Federal Register FMAP rates for FY [year].” The Federal Register displays adjustments to the FMAP for states and territories periodically based on legislation, (i.e., the American Recovery and Reinvestment Act (2009) increased the FMAP for certain claims for services on or after October 1, 2008. The UPIC may also contact the SMA for the applicable FMAP rate. In addition, The Patient Protection and Affordable Care Act (2010) allowed states to file a State Plan Amendment (SPA) to expand Medicaid to cover additional populations. The federal government financed the costs of these newly eligible beneficiaries at a different rate than those who were previously eligible.).
The UPIC shall ensure that the calculations for each claim/claim line and financial payments are accurate for each FY. If, as a result of an appeal, the overpayment needs to be recalculated, the UPIC shall follow the methodology used in the original overpayment calculation.
(Rev. 13494; Issued: 12-23-25; Effective: 01-26-26; Implementation:01-26-26)
The CMS does not dictate the process by which UPIC Medicaid review findings are appealed. Rather, appeal processes are determined by each state and are subject to the state’s Medicaid program requirements.
It is the responsibility of the SMAs to defend review findings in an administrative appeal or judicial proceeding, although the UPIC may provide testimonial support and other assistance to the state to defend the review findings throughout administrative or judicial proceedings.
It is recommended that the UPIC review each SMA’s appeal process during the onset of any proposed investigation, so they understand the level of support needed and can plan appropriately should the SMA require support during the appellate process.
The UPIC should alert the Medicaid BFL/COR to any situation where a state indicates a reluctance to defend FFR findings in an appeal.
The UPIC will notify CMS of any changes to the overpayment amounts resulting from hearing decisions.
(Rev. 13494; Issued: 12-23-25; Effective: 01-26-26; Implementation:01-26-26)
If the provider has been notified of the initiation of an investigation/audit and the Medicaid investigation/audit is later discontinued, or if the findings are insufficient to pursue, a close out letter will be issued to the provider. The close-out letter provides notification to the provider that the review has concluded and no further action on the part of the provider is necessary. The UPIC is responsible for obtaining approval from CMS prior to issuing a close-out letter. Upon approval, the UPIC sends the close-out letter to the provider in question, sends a copy to the state, and uploads a copy to UCM. A sample of the “Close-Out Letter” can be found at Appendix A.
In addition, the UPIC will complete a summary of the investigation that is submitted to the SMA along with the letter to the provider, and a copy is uploaded to UCM. This summary is not sent to the provider. The “Closing Summary” template can be found at Appendix B.
(Rev.) (Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
Overpayment settlement negotiations are a function of the SMA. If the SMA and provider agree to a negotiated settlement, the SMA is still required to remit payment for the full FFP referred by CMS, in accordance with 42 CFR Part 433 Subpart F.
The UPIC shall not participate in any discussions or review of the negotiated overpayment since this is the responsibility of the SMA.
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
Implementation of Medicaid payment suspensions is an SMA function and should be in accordance with 42 C.F.R. § 455.23. Although UPICs may recommend the implementation of a Medicaid payment suspension based on a credible allegation of fraud, it is at the state’s discretion to take the appropriate action.
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
If the UPIC identifies potential grounds for Medicaid termination, the UPIC shall notify the SMA so it can review the facts and consider the appropriate action.
(Rev. 12871; Issued: 10-11-24; Effective: 11-14-24; Implementation: 11-14-24)
The UPIC shall follow the Medicare PIM guidelines at 4.9.1 - Immediate Advisements to the HHS-OIG/OI and notify the SMA of such advisements when they are assisting the state with a Medicaid investigation/audit.
(Rev. 12871; Issued: 10-11-24; Effective: 11-14-24; Implementation: 11-14-24)
Throughout the course of a Medicaid investigation/audit, should the UPIC identify potential Medicaid fraud, the UPIC shall discuss the matter with the COR/BFL to determine if a referral to LE is warranted. If CMS agrees that a referral to LE is appropriate, the process for initiating and scheduling a Medicaid Major Case Coordination Meeting (Medicaid MCC) shall begin. The Medicaid MCC Meeting is an opportunity for UPICs to discuss their proposed Medicaid fraud referrals with CMS, the SMA, and LE. The goal is to collaborate with all of the key decision makers, provide guidance on each proposed LE referral, and identify any proposed secondary actions.
Note: All UPIC referrals of potential fraud shall be reviewed by the Department of Health and Human Services – Office of Inspector General (HHS-OIG) for determination and coordination with the state’s MFCU. State referrals of potential fraud will continue to follow state policy and be coordinated with the state’s MFCU.
The UPIC does not need the SMA’s approval for a LE referral but shall communicate with the state that suspected fraud has been identified and is being referred through CMS to HHS-OIG.
The UPIC shall finalize the MCC Pre/Post Meeting Report - Work Details (hereon referred to as the Executive Summary) within seven (7) calendar days. The UPIC shall notify CMS once these actions are complete. CMS will submit the Executive Summary to HHS-OIG for review of the possible referral. Then, the following processes will take place:
HHS-OIG may coordinate a preliminary review of the Medicaid UPIC case with the state’s Medicaid Fraud Control Unit (MFCU) to determine if they are interested in the case.
HHS-OIG will communicate the results of the preliminary review to CMS.
This initial review does not constitute the formal referral to law enforcement, and is, instead, a summary of the information for law enforcement to consider whether a formal referral is warranted and a Medicaid MCC Meeting needs to be held to collaborate with all parties.
CMS will coordinate a Medicaid MCC meeting and assure participants include at a minimum: CMS/CPI, HHS-OIG’s Office of Investigations (HHS-OIG/OI), the state’s MFCU, UPIC, and applicable SMA Program Integrity Unit staff. CMS will be responsible for scheduling the appointment at the agreed-upon time by all participants. CMS will also be responsible for establishing the agenda for the meeting.
Note: Attendance is optional for LE agencies if the cases are declined prior to the Medicaid MCC, and the case being presented is only subject to state administrative actions.
The UPIC shall ensure all revisions and updates to the case are completed in the UCM three (3) days prior to the scheduled Medicaid MCC.
The UPIC shall prepare and follow the guidance set forth in the Medicaid Executive Summary Tip Sheet (see Appendices to this manual) when presenting investigations/audits at the Medicaid MCC.
The CMS/CPI will record the primary and secondary actions identified during the Medicaid MCC to be resolved as case decisions in UCM (NexGen).
Following the Medicaid MCC Meeting, when applicable, the UPIC shall submit a formal referral to the appropriate LE within seven (7) calendar days, unless otherwise advised by CMS. Referrals shall include all applicable information that the UPIC has obtained through its investigation/audit at the time of the referral. The UPIC shall utilize the “LE Referral Template” available in CMS IOM 100-08: Exhibit 16.1. Once the referral package is complete, the UPIC shall submit the referral to LE and copy CMS and the SMA Program Integrity Unit point-of-contact. Upon submission of the referral to HHS-OIG/OI and/or MFCU, the UPIC shall request written and/or email confirmation from the respective law enforcement partner acknowledging receipt of the referral. The UPIC shall update UCM with the date the referral was sent, the name of the agent acknowledging receipt of the referral, and the date of receipt. In the event that written confirmation is not received, the UPIC shall notify CMS. Additionally, the UPIC shall refrain from implementing any additional administrative actions against the provider/supplier without CMS approval. If the UPIC has any questions related to LE referrals, the UPIC shall coordinate with CMS.
UPICs will need to verify all action items discussed during a Medicaid MCC in UCM. The UPIC is responsible for the updating the completion of action items identified during a Medicaid MCC.
Regarding cases declined by LE, the UPIC shall continue with the IFR/FFR if an overpayment has been identified. If no overpayment was identified, the UPICs shall refer the case to the state for any administrative actions the state finds necessary and close the case within seven (7) calendar days of the Medicaid MCC.
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
During the course of project development and/or investigational/audit activities, the UPIC may become aware of vulnerabilities in a state’s policies that leave the Medicaid program at risk for fraud, waste, or abuse. In these circumstances, the UPIC will follow the Medicare PIM Guidelines at 4.13 – Vulnerabilities for reporting the information to the COR and BFL, along with completing the Vulnerability Template (required elements are described in the Medicare PIM at 4.13), which is then submitted to the Vulnerability Mailbox at CPIVulnerabilityIntake@cms.hhs.gov. It is understood that not all aspects of the Vulnerability Template may be relevant to the Medicaid program or the SMA. In these circumstances, the UPIC shall complete the Template to the best of their knowledge and may indicate “Not Applicable or N/A” for those elements that may not be relevant to Medicaid. A copy of the Vulnerability Template may be found at Appendix M.
In addition, a copy of the vulnerability report shall be submitted to the respective SMA for their review and shall be presented on a regularly scheduled monthly collaboration call. The minutes of the meeting shall reflect the presentation/discussion of the vulnerability.
| Rev # | Issue Date | Subject | Impl Date | CR# |
|---|---|---|---|---|
| R13494MPI | 12/23/2026 | Updates of Chapters 1-5 in Publication (Pub.) 100-15, Including Updates to the Guidance Terminology, Existing Definitions, and Details to Standing Guidance | 01/26/2026 | 14275 |
| R12871MPI | 10/11/2024 | Updates of Chapter 1, Chapter 2, Chapter 3, Chapter 4, and Appendices in Publication (Pub.) 100-15, Including Auditing of Program Integrity Activities in Managed Care Plans | 11/14/2024 | 13720 |
| R11948MPI | 04/13/2023 | Updates of Publication (Pub.) 100-15, Including Revisions to Chapters 1 and 2, and the Addition of Chapters 3, 4, 5, and Appendices | 05/15/2023 | 13141 |
Back to top of Chapter