A medical record request can look routine until its source reveals a different level of exposure. RAC versus UPIC audits both place Medicare claims, documentation, and repayment at issue, but they are not interchangeable reviews. One is generally focused on identifying improper payments. The other may be part of a broader program integrity inquiry with consequences that extend well beyond a single claim determination.

For providers, the distinction affects how quickly to escalate the matter internally, what records to preserve, how broadly to assess related claims, and whether a repayment demand is the central concern or an early warning of deeper scrutiny. A defensible response begins with understanding what the contractor is authorized to do and what the request may signal.

RAC Versus UPIC Audits: The Core Difference

Recovery Audit Contractors, commonly called RACs, are CMS contractors that identify and recover improper Medicare fee-for-service payments. Their work includes both overpayments and underpayments. A RAC may identify an issue through automated review, where no medical record is needed, or through complex review, where the provider must submit documentation supporting the claim.

The RAC model is payment-focused. A review may involve coding, medical necessity, duplicate billing, incorrect units, coverage requirements, or documentation that does not support the service billed. Findings can be significant, especially when an issue is applied across a sample or when similar claims are vulnerable. Still, the immediate purpose is generally to determine whether a particular payment was proper under Medicare rules.

Unified Program Integrity Contractors, or UPICs, support CMS and state Medicaid agencies in detecting and preventing fraud, waste, and abuse. Their work can include data analysis, medical review, provider investigations, beneficiary interviews, site visits, and coordination with law enforcement or other oversight entities. A UPIC request may begin with claims review, but the underlying concern can be provider behavior, referral patterns, billing relationships, enrollment issues, or indications of potential fraud.

That difference matters. A RAC denial can require a tightly reasoned challenge to a specific payment determination. A UPIC matter may require a broader response that protects the practice’s legal, operational, and reputational interests while addressing the immediate request accurately and on time.

How Each Audit Typically Develops

A RAC review often follows a defined claims-editing or medical-record review process. The provider receives a request or determination, submits the requested records, and may face an overpayment demand if the contractor concludes the claim was not supported. Medicare appeal rights are available, but deadlines are strict and interest can become a practical concern if an overpayment is not addressed appropriately.

A UPIC review can be less predictable because its activity is driven by program integrity concerns. The first contact may be a medical-record request, a request for business records, an unannounced site visit, or outreach related to a beneficiary, employee, or referral source. In some matters, the provider may not know the full scope of the concern at the outset.

Neither type of audit should be treated as an administrative task delegated without oversight. But UPIC activity warrants particular discipline. An incomplete, inconsistent, or unnecessarily expansive response can create avoidable exposure. At the same time, withholding responsive records or missing deadlines can create its own serious problems. The goal is not resistance. It is a controlled, accurate, and defensible response.

What Is at Stake for the Practice

RAC audits primarily place reimbursement at risk. A denial may affect one claim, a group of claims, or a larger payment issue if the contractor identifies a recurring billing defect. Providers should assess whether the alleged error is isolated, whether the documentation actually supports the service, and whether the rationale is being applied correctly under the relevant coverage and billing rules.

UPIC audits can place more than reimbursement at risk. Depending on the facts, a UPIC inquiry may precede or coincide with payment suspension, referral to CMS or a Medicaid agency, enrollment action, civil investigative activity, or law enforcement involvement. That does not mean every UPIC request reflects an allegation of fraud. It does mean the practice should avoid assumptions and respond with the level of care appropriate to a potentially expanding inquiry.

The practical trade-off is clear. Overreacting can disrupt operations and create unnecessary alarm. Underreacting can allow documentation gaps, inconsistent explanations, and unreviewed claims patterns to become larger liabilities. A measured assessment gives leadership a clearer view of the facts before the response posture hardens.

Documentation Is the Common Pressure Point

Whether the reviewer is a RAC or a UPIC, the medical record remains central. The record must support the service billed, the level of service, medical necessity, required orders or certifications, supervision requirements when applicable, and the identity and qualifications of the rendering professional. Claims data alone rarely tells the full story.

Providers often discover that their real vulnerability is not a lack of clinical care. It is a gap between the care delivered, the documentation maintained, and the claim submitted. Templates that produce identical narratives, late signatures, unsupported time-based services, inconsistent diagnosis selection, cloned notes, and missing ancillary documentation can all weaken the defense of an otherwise legitimate claim.

For a RAC appeal, record analysis should focus closely on the specific denial rationale. If the contractor cites a coverage limitation, the response should show where the record meets that requirement or explain why the contractor’s interpretation is incorrect. General statements that care was medically necessary are rarely enough.

For a UPIC inquiry, the record review should be broader. Leadership should determine whether the requested claims reveal patterns that appear elsewhere in the practice, whether related records are consistent, and whether any operational issue requires immediate correction. Corrective action should be fact-based and carefully structured, not a hurried attempt to rewrite history.

A Strategic Response Process

The first response decision is organizational: designate a single point of control. Medical records, billing, compliance, practice leadership, and outside advisors should not communicate independently with the contractor. Centralized coordination reduces the risk of missed deadlines, conflicting explanations, and incomplete production.

A disciplined response generally requires four parallel actions:

• Preserve the audit notice, requested records, claims data, correspondence, and relevant policies in their original form.
• Confirm the requester, authority, deadlines, claim universe, and precise scope of the request before assembling documents.
• Conduct a privileged or otherwise protected internal assessment, as appropriate, of the claims and documentation at issue.
• Build a response that is complete, organized, accurate, and limited to what has been requested unless a broader production is strategically warranted.

The internal assessment should not stop at finding deficiencies. It should identify strengths in the record, clarify whether the billing rule was applied correctly, and separate a correctable operational error from a disputed clinical or coding judgment. This is where experienced audit support changes the quality of the response. The strongest position is built from the actual record, applicable authority, and a clear understanding of how reviewers evaluate risk.

When a RAC Finding Requires a Broader Review

A RAC denial does not automatically mean the practice should audit every similar claim. The right scope depends on the basis for the finding. A claim denied because a single document was missing may call for a focused workflow correction. A denial involving a repeated coding practice, recurring medical-necessity issue, or systemic documentation failure may justify a targeted retrospective review.

The same principle applies to repayment. Providers should not assume that a contractor’s rationale is correct, but they should not ignore credible evidence of an overpayment. A prompt, structured investigation can help the practice determine whether repayment, appeal, corrective action, or a combination of those steps is appropriate.

Preparing Before the Next Request Arrives

Audit readiness is not a binder on a shelf. It is the ability to retrieve a complete record, explain why the claim was billed, show that staff followed a workable process, and identify problems before an outside reviewer does.

Year-round quality assurance reviews are particularly valuable for services with high documentation demands, recurring payer edits, or prior denial history. Practices should test records against the rules that govern their highest-risk claims, not merely confirm that a note exists. They should also examine whether charge capture, coding, clinical documentation, and billing workflows tell the same story.

For organizations facing active scrutiny, Praevera Risk Associates helps translate audit findings into a practical defense strategy and durable corrective action. The objective is not generic compliance activity. It is protecting reimbursement and regulatory standing with processes that can withstand review.

The next audit notice may not be predictable, but the practice’s response can be. Treat each request as an opportunity to establish control of the facts, protect the integrity of the record, and make decisions from a position of informed strength.