Welcome back everybody after the holidays. As a CPA, I have always been uncomfortable when the word “Audit” is used to describe activity since the term audit comes with specific requirements as CPA.
That being said, let’s talk about the four audit worlds in healthcare and how it may impact you.
1. Unified Program Integrity Contractors (UPICs)
Purpose: Detect and investigate fraud, waste, and abuse in Medicare & Medicaid
Who they work for: The Centers for Medicare & Medicaid Services (CMS)
Who they target: Providers, suppliers, billing companies
What they do:
- Advanced data mining (peer comparisons, utilization spikes)
- Deep claim reviews (often 5–10 years back)
- Medical record requests
- Extrapolation of overpayments
- Referrals to OIG / DOJ
Key powers:
- Recommend payment suspension
- Recommend revocation or exclusion
- Build cases for civil or criminal action
Tone: Investigative, adversarial
Translation: “We think something is wrong — prove us wrong.”
2. Office of Inspector General (OIG – HHS)
Purpose: Oversight, enforcement, and law enforcement support
Who they work for: Department of Health & Human Services
Who they target: Providers, vendors, states, CMS itself
What they do:
- Criminal and civil investigations
- National audit reports (e.g., Medicare Advantage risk adjustment)
- Subpoenas and interviews
- Corporate Integrity Agreements (CIAs)
- Exclusions from federal programs
Key powers:
- Can refer cases directly to DOJ
- Can impose exclusions
- Can negotiate settlements
Tone: Law enforcement
Translation: “This could end in handcuffs or headlines.”
🔥 Important: UPICs often build the case → OIG prosecutes or escalates it.
3. Government Accountability Office (GAO)
Purpose: Oversight of federal programs, not individual providers
Who they work for: Congress
Who they target: CMS, HHS, states, federal programs
What they do:
- Policy and performance audits
- Program effectiveness studies
- Cost-benefit and efficiency reviews
What they do not do:
- No provider-level recoupments
- No payment suspensions
- No fraud investigations
Tone: Analytical, policy-focused
Translation: “Is the system working the way Congress intended?”
GAO findings often change policy, not prosecute providers.
4. “DOGE Audits” (Let’s Be Precise)
There is no standing federal audit authority called DOGE that:
- Replaced UPICs
- Conducted Medicare fraud audits
- Had statutory program integrity authority
What people call “DOGE audits” were:
- Informal efficiency reviews
- Internal data pulls
- Contract and spending reviews
- Not audits under GAGAS or CMS rules
Key point: DOGE could not ignore UPICs — and UPICs never answered to DOGE.
Side-by-Side Reality Check:
| Entity | Targets Providers? | Recoups Money? | Refers to DOJ? | Changes Policy? |
| UPIC | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No |
| OIG | ✅ Yes | ✅ Yes | ✅ Yes | ⚠️ Sometimes |
| GAO | ❌ No | ❌ No | ❌ No | ✅ Yes |
| “DOGE” | ❌ No | ❌ No | ❌ No | ❌ No |
Why This Confusion Keeps Happening
- Providers use “audit” as a catch-all word
- UPICs replaced ZPICs but kept the same fear factor
- Policy audits (GAO) get mistaken for enforcement
- Political rhetoric blurred lines between oversight and investigation
Bottom Line
- UPICs = the hunters
- OIG = the prosecutors
- GAO = the architects
- DOGE = not in the enforcement chain
If a provider receives the following:
- A UPIC letter → this is serious
- An OIG subpoena → call counsel immediately
- A GAO report mention → policy risk, not repayment risk


















