When Audits Become Ambushes: The Perils of Financially Incentivized Medicare Investigations

We all know that Recovery Audit Contractors (RACs), Unified Program Integrity Contractors (UPICs), and other Centers for Medicare & Medicaid Services (CMS)-hired entities are financially incentivized to find alleged wrongdoing. The more “improper payments” they identify, the more money they stand to make.

This structure creates a system in which neutrality takes a back seat to profit, and providers are left to defend themselves against allegations that often collapse under scrutiny. The problem compounds when audit findings are funneled into False Claims Act (FCA) cases or criminal prosecutions. What should be a compliance check too often becomes an ambush.

A System Built on Bounties

RACs are explicitly paid a contingency fee, often between 9 and 12.5 percent of the “overpayments” they recover. While this model is meant to incentivize detection of true fraud, in practice, it incentivizes volume over accuracy. In 2016, the American Hospital Association (AHA) reported that 66 percent of appealed RAC denials were ultimately overturned in favor of hospitals. Yet providers had already spent millions on legal fees and staff time to fight those denials – costs that cannot be recovered.

UPICs, which replaced the old Zone Program Integrity Contractors (ZPICs), are supposed to focus on fraud investigations. But their contracts also reward findings that justify further referrals to U.S. Department of Justice (DOJ) or U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG). That pressure skews the process. Innocent errors in coding or ambiguous guidance can be portrayed as “fraud,” creating leverage for settlements.

When Audit Findings Morph into Prosecutions

Take United States v. AseraCare, Inc., 938 F.3d 1278 (11th Cir. 2019). In that case, DOJ pursued a massive FCA action based on hospice eligibility determinations. The government relied heavily on RAC-like reviews of medical necessity. Ultimately, the Eleventh Circuit rebuked the prosecution, holding that a “reasonable difference of opinion” among physicians is not enough to prove falsity under the FCA.

Yet providers spent years – and millions – defending themselves against allegations that boiled down to subjective medical judgment. That is the cost of a system in which bounty-hunters supply the evidence.

Another example is United States v. Hernandez, in which a Florida nurse practitioner received a 20-year sentence tied to a $200 million telehealth/genetic testing scheme. Reports suggest that early investigative findings from contractors were used to frame the case, while exculpatory evidence was sidelined. Similar to AseraCare, questions of regulatory interpretation and medical judgment were cast as fraud. Unlike AseraCare, the defendant here lost her liberty.

Real-Life Consequences for Providers

I have seen firsthand how RAC and UPIC audits can devastate practices even when the government’s case ultimately fails. In one matter, a rural hospital was accused of “upcoding” wound care services after a UPIC review. The auditors ignored the hospital’s own documentation protocols, which were consistent with Medicare’s Local Coverage Determination (LCD). After three years of litigation, the government quietly dropped the case. By then, the hospital had closed its outpatient wound clinic, unable to absorb the compliance and legal costs.

In another case, a physician practice faced a $12 million extrapolated overpayment demand based on a statistical sample of just 30 claims. The physician prevailed on appeal when an Administrative Law Judge (ALJ) ruled the sampling methodology invalid. But it took four years and nearly bankrupted the practice. The RAC that initiated the review, however, had already been paid for its “findings.”

The Compliance Takeaway

Financial incentives distort the integrity of Medicare and Medicaid audits. Contractors are rewarded for findings, not for fairness. DOJ prosecutors often lean on these audit results to bring FCA claims, despite courts like that of AseraCare warning that disagreements over clinical judgment do not equal fraud. The result is a system where providers, especially smaller practices, face existential threats from audits untethered to constitutional safeguards.

As Justice Sutherland famously wrote in Berger v. United States, the prosecutor’s role “is not that it shall win a case, but that justice shall be done.” The same must be demanded of auditors and investigators whose work feeds the system.

Until Congress reforms the contingency fee model, providers must remain vigilant, appeal aggressively, and demand transparency at every stage.