Medicaid Program Integrity Manual 
Chapter 4 - Reporting Investigational Findings 
and Making Referrals 
 
 
Table of Contents 
                                              (Rev. 11948; Issued:04-13-23) 
 
 
Transmittals for Chapter 4 
 
4.1  Documentation of Investigations/Audits and Medical Review Findings 
4.2  Overpayment Assessment 
  4.2.1  Overpayment Assessed from Medical Review 
  4.2.2  Overpayment Assessed Solely by Data Analysis 
4.3  Overpayment Resolution Process 
  4.3.1  Calculation of Federal Financial Participation (FFP) Based on States 
Date of Expenditure 
4.4  State Appeal Process 
4.5  Close-Out Letters 
4.6  Medicaid Settlement Negotiations 
4.7  Medicaid Payment Suspensions 
4.8  Terminations 
4.9  Immediate Advisements 
4.10  Fraud Referrals 
4.11  Reporting State Vulnerabilities 
    4.1 - Documentation of Investigations/Audits and Medical Review 
Findings 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
All investigations/audits and medical review findings must be supported by adequate 
documentation. Adequate documentation consists of documents obtained by the 
investigator during the course of the investigation or medical review and should be part 
of the investigation/audit working file. The working paper file contains evidence 
accumulated throughout the investigation/audit to support the work performed, the 
results of the investigation/audit, including adjustments made, and all assumptions made 
by the reviewer.  All documents and working papers shall be uploaded to UCM. 
 
Examples of documents are: 
 
1.  Copies of federal and/or state policies and regulations; 
2.  Copies of medical/financial records to support the finding; 
3.  Copies of state generated remittance advices which support the claim payment or 
credit adjustment; 
4.  Correspondence, such as Provider Notification Letters and Record Request 
Letters/Lists; 
5.  Investigators notes regarding the investigation; and 
6.  Miscellaneous memoranda that pertain to the investigation. 
 
4.2 - Overpayment Assessment-Reserve for future use 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
4.2.1 - Overpayment Assessed from Medical Review 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
When assessing potential Medicaid overpayments, the UPIC shall ensure the necessary 
state law and/or SMA overpayment methodologies and requirements are followed at all 
times.  Upon completion of the medical review, the UPIC determines if there is a 
potential overpayment.  
 
4.2.2 - Overpayment Assessed Solely by Data Analysis 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
In certain instances, in collaboration with the SMA, the UPIC may identify overpayments 
based solely on data analysis. In these instances, the UPIC shall collaborate with the 
state to validate the analysis and to ensure the policy interpretation is accurate. 
Additionally, the UPIC shall coordinate with each individual SMA and the COR/BFL 
team to determine a state specific dollar threshold for action on overpayments based 
solely on data analysis. Data driven overpayments that meet the dollar threshold, once 
reviewed and approved by CMS, shall be vetted in accordance with Chapter 3.3 of this 
manual prior to submitting the overpayment to the SMA by CMS through a Final 
Findings Report (FFR). All data analysis identified overpayments that fall below the state  specified threshold will be sent to the SMA by the UPIC to take whatever action they 
deem necessary (i.e., collection of overpayments, identification of program 
vulnerabilities, necessary policy updates, automated edits, etc.). 
 
4.3 - Overpayment Resolution Process 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
Upon identification of an overpayment based on a Medicaid investigation/audit, an 
Initial Findings Reports (IFR) is sent to the Medicaid BFL for review and approval.  
Once the BFL has approved the IFR, the UPIC will send the IFR to the SMA within 180 
days of the Medicaid Investigation Start Date for review and comments for 30 calendar 
days. The 180-day time frame is based on normal progression of the investigation/audit 
with no cause for delay or circumstances outside UPIC control, unless otherwise 
specified by CMS. All delays shall be documented in the Unified Case Management 
(UCM) system.  If the state disagrees with the findings of the UPIC, which results in 
monetary changes to the Appendix A, the UPIC will revise the IFR and incorporate any 
other grammatical or narrative corrections identified by the state.  If the states 
comments speak to the body of the report and are primarily grammatical or corrections 
to cited regulations, terminology, etc., the document will remain an IFR, and the UPIC 
will make any necessary corrections.   
 
The revised IFR (RIFR), or original IFR if the state review did not necessitate a revision, 
may then be transmitted by the UPIC to the provider for review and comments for 30 
calendar days, if required by the SMA. The Medicaid BFL and the UPIC will review the 
providers responses, if any, to determine if adjustments to the findings are necessary.  If 
so, the UPIC will make the subsequent revisions and the RIFR is sent to the state, this 
time with a 15-day review and comment period. CMS, the UPIC, and, if necessary, the 
state reconcile any issues with the RIFR, after which the UPIC produces an FFR and 
completes the FFR  State Transmittal Letter and submits both to CMS for approval 
within 13 months of the Medicaid Investigation Start Date. The 13-month time frame is 
based on normal progression of the investigation/audit with no cause for delay or 
circumstances outside UPIC control, unless otherwise specified by CMS. All delays shall 
be documented in the Unified Case Management (UCM) system.  CMS, upon approving 
the FFR, sends the FFR and State Transmittal Letter to the state.  The FFR  State 
Transmittal Letter (Appendix E) can be found in the Appendices.  Versions of the State 
Transmittal Letter are available for FFS and/or managed care investigations/audits, 
where the managed care overpayments can be recouped (Appendix E); FFS and 
managed care investigations/ audits when the managed care overpayments are not 
recoupable, but the FFS are (Appendix F); and managed care-only investigations/audits 
when there are only managed care overpayments that are not recoupable (Appendix G). 
The FFR identifies the total overpayment amount paid to the provider and specifies the 
amount of Federal Financial Participation (FFP) that the state must return to CMS. It is 
the states responsibility to adjudicate the review findings with the provider. The state 
has one year from the date the overpayment is identified to recover or attempt to recover 
the overpayment from the provider before the federal share must be refunded to CMS. 
Under CMSs regulations, the date of discovery of overpayments begins on the date that  CMS first notifies the SMA in writing of the overpayment and specifies a dollar amount 
subject to recovery. (See 42 C.F.R.  433.316). 
 
Sometimes a 100% overpayment is identified because the provider or supplier does not 
provide the contractor with the required medical record documentation to conduct a 
post-payment medical review. A 100% overpayment means that all the claims in the 
contractors selected sample are considered to be improperly billed and paid based on 
the documentation received (or lack thereof). Therefore, they are fully denied through 
post-payment review. In these instances, the UPIC shall consult with its BFL and SMA on 
any potential 100% overpayment determinations prior to initiation of state overpayment 
reporting actions or notice to the provider/supplier. If approved, the UPIC shall 
coordinate the overpayment reporting actions with the SMA. If denied, the UPIC shall 
follow the instructions provided by its Medicaid BFL. 
 
In certain instances, the SMA may require an update to the FFR, based on updated 
analysis by the state, issues identified within the referenced policy, etc. In these instances, 
the UPIC shall notify CMS of the discrepancies and discuss a proposed resolution. If it is 
determined that an update to the FFR is necessary, CMS and the UPIC shall collaborate 
to draft an FFR Addendum, along with the FFR Addendum  State Transmittal Letter 
(Appendix H), which CMS shall submit to the SMA upon completion.  The UPIC will edit 
the OPT financial information in UCM on the original OPT record and upload the FFR 
Addendum. 
 
4.3.1 - Calculation of Federal Financial Participation (FFP) Based on 
States Date of Expenditure 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
The UPIC shall calculate the FFP amount for each discrepant claim line identified based 
on the Federal Medical Assistance Percentage (FMAP) in place at the time of the state 
Medicaid agencys date of expenditure (i.e., the date the state Medicaid agency paid the 
applicable claim).  The total overpayment amount shall be entered into Appendix A of the 
FFR. The UPIC shall comply with the following directions when preparing FFRs for all 
assigned Medicaid investigations. 
 
  The UPIC shall add columns to Appendix A identifying the Federal Share 
Percentage and Federal Share Amount for each Fiscal Year (FY) and FY 
Quarter identified per discrepant claim. 
  The UPIC shall add a column to Appendix A identifying the date of expenditure, 
in addition to the date of service. 
  The UPIC shall use the appropriate Federal Share Percentage for FY and 
Quarter. 
  The UPIC shall add a column to Appendix A identifying the Federal Share 
Total. 
  The UPIC shall sum total the Federal Share Total column at the bottom of the 
Appendix A.  
  (Example) 
Federal Share  Federal Share  Federal Share  Federal Share  Federal Share 
% (FY15)  % (FY16)  Amount (FY15)  Amount (FY16)  Total 
%  %  $  $  $ 
      Total  $ 
 
In calculation of the FFP, the UPIC shall consult the Federal Register for the applicable 
FMAP rate and shall monitor any changes to the FMAP as published in the Federal 
Register on an ongoing basis. The relevant FMAP table can be found quickly and directly 
by searching the internet for Federal Register FMAP rates for FY[year].  The Federal 
Register displays adjustments to the FMAP for states and territories periodically based 
on legislation, (i.e., the American Recovery and Reinvestment Act (2009) increased the 
FMAP for certain claims for services on or after October 1, 2008. In addition, The 
Patient Protection and Affordable Care Act (2010) allowed states to file a State Plan 
Amendment (SPA) to expand Medicaid to cover additional populations. The federal 
government financed the costs of these newly eligible beneficiaries at a different rate 
than those who were previously eligible.). 
 
The UPIC shall ensure that the calculations for each claim are accurate for each FY.  If, 
as a result of an appeal, the overpayment needs to be recalculated, the UPIC shall follow 
the methodology used in the original overpayment calculation. 
 
4.4 - State Appeal Process 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
The CMS does not dictate the process by which UPIC Medicaid review findings are 
appealed. Rather, appeal processes are determined by each state and are subject to the 
states Medicaid program requirements. 
 
It is the responsibility of the SMAs to defend review findings in an administrative appeal 
or judicial proceeding, although the UPIC may provide testimonial support and other 
assistance to the state to defend the review findings throughout administrative or judicial 
proceedings. 
 
It is recommended that the UPIC review each SMAs appeal process during the onset of 
any proposed investigation, so they understand the level of support needed and can plan 
appropriately should the SMA require support during the appellate process. 
 
The UPIC should alert the Medicaid BFL/COR to any situation where a state indicates a 
reluctance to defend FFR findings in an appeal. 
 
4.5 - Close-Out Letters 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
 
If the provider has been notified to begin an investigation/audit and the Medicaid  investigation/audit is later discontinued for reasons other than identification of an 
overpayment, or if the findings are insufficient to pursue, a close out letter will be issued 
to the provider. The close-out letter provides notification to the provider that the review 
has concluded and no further action on the part of the provider is necessary.  The UPIC 
is responsible for obtaining approval from CMS prior to issuing a close-out letter. Upon 
approval, the UPIC sends the close-out letter to the provider in question, sends a copy to 
the state, and uploads a copy to UCM.  A sample of the Close-Out Letter can be found 
at Appendix A. 
 
In addition, the UPIC will complete a summary of the investigation that is submitted to 
the SMA along with the letter to the provider, and a copy is uploaded to UCM.  This 
summary is not sent to the provider.  The Closing Summary template can be found at 
Appendix B. 
 
4.6 - Medicaid Settlement Negotiations 
(Rev.) (Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
Overpayment settlement negotiations are a function of the SMA. If the SMA and provider 
agree to a negotiated settlement, the SMA is still required to remit payment for the full 
FFP referred by CMS, in accordance with 42 CFR Part 433 Subpart F. 
 
The UPIC shall not participate in any discussions or review of the negotiated 
overpayment since this is the responsibility of the SMA. 
 
4.7 - Medicaid Payment Suspensions 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
Implementation of Medicaid payment suspensions is an SMA function and should be in 
accordance with 42 C.F.R.  455.23. Although UPICs may recommend the 
implementation of a Medicaid payment suspension based on a credible allegation of 
fraud, it is at the states discretion to take the appropriate action. 
 
4.8 - Terminations 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
If the UPIC identifies potential grounds for Medicaid termination, the UPIC shall notify 
the SMA so it can review the facts and consider the appropriate action. 
 
4.9 - Immediate Advisements 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
The UPIC shall follow the Medicare PIM guidelines at 4.9.1 - Immediate Advisements to 
the OIG/OI and notify the SMA of such advisements when they are assisting the state with 
a Medicaid investigation/audit. 
  4.10 - Fraud Referrals 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
Throughout the course of a Medicaid investigation/audit, should the UPIC identify 
potential Medicaid fraud, the UPIC shall discuss the matter with the COR/BFL to 
determine if a referral to LE is warranted.  If CMS agrees that a referral to LE is 
appropriate, the process for initiating and scheduling a Medicaid Major Case 
Coordination Meeting (Medicaid MCC) shall begin.  The Medicaid MCC Meeting is an 
opportunity for UPICs to discuss their proposed Medicaid fraud referrals with CMS, the 
SMA, and LE. The goal is to collaborate with all of the key decision makers, provide 
guidance on each proposed LE referral, and identify any proposed secondary actions.  
Note: All UPIC referrals of potential fraud shall be reviewed by the Department of 
Health and Human Services  Office of Inspector General (HHS-OIG) for determination 
and coordination with the states MFCU. State referrals of potential fraud will continue 
to follow state policy and be coordinated with the states MFCU. 
 
The UPIC does not need the SMAs approval for a LE referral but shall communicate 
with the state that suspected fraud has been identified and is being referred through CMS 
to HHS-OIG.  
 
Steps Before the Medicaid MCC Meeting: 
 
The UPIC shall finalize the MCC Pre/Post Meeting Report - Work Details (hereon 
referred to as the Executive Summary) within seven (7) calendar days. The UPIC shall 
notify CMS once these actions are complete. CMS will submit the Executive Summary to 
HHS-OIG for review of the possible referral.  Then, the following processes will take 
place: 
  HHS-OIG will coordinate a preliminary review of the Medicaid UPIC case with 
the states Medicaid Fraud Control Unit (MFCU) to determine if they are 
interested in the case. 
  HHS-OIG will communicate the results of the preliminary review to CMS.  
 
This initial review does not constitute the formal referral to law enforcement, and is, 
instead, a summary of the information for law enforcement to consider whether a formal 
referral is warranted and a Medicaid MCC Meeting needs to be held to collaborate with 
all parties.   
 
If either the HHS-OIG or MFCU is interested in the case, CMS will coordinate a 
Medicaid MCC meeting and assure participants include at a minimum: CMS/CPI, HHS-
OIGs Office of Investigations (HHS-OIG/OI), the states MFCU, UPIC, and applicable 
SMA Program Integrity Unit staff.  CMS will be responsible for scheduling the 
appointment at the agreed-upon time by all participants. CMS will also be responsible 
for establishing the agenda for the meeting. 
  Note: Attendance is optional for LE agencies if the cases are declined prior to the 
Medicaid MCC, and the case being presented is only subject to state administrative 
actions. 
 
The UPIC shall ensure all revisions and updates to the case are completed in the UCM 
three (3) days prior to the scheduled Medicaid MCC.   
 
Steps During the Medicaid MCC Meeting: 
 
The UPIC shall designate no more than two individuals to present cases during the 
Medicaid MCC meeting. The UPIC shall prepare and follow the guidance set forth in the 
Medicaid Executive Summary Tip Sheet (see Appendices to this manual) when presenting 
investigations/audits at the Medicaid MCC.   
 
The CMS/CPI Fraud and Investigations Group (FIG) Business Owner/Subject Matter 
Expert for UCM will record the discussion and primary and secondary actions identified 
during the Medicaid MCC and submit updates to the UCM for the MCC Pre/Post Report. 
 
Steps After the Medicaid MCC Meeting: 
 
Following the Medicaid MCC Meeting, when applicable, the UPIC shall submit a formal 
referral to the appropriate LE within seven (7) calendar days, unless otherwise advised 
by CMS. Referrals shall include all applicable information that the UPIC has obtained 
through its investigation/audit at the time of the referral. The UPIC shall utilize the LE 
Referral Template available in CMS IOM 100-08: Exhibit 16.1. Once the referral 
package is complete, the UPIC shall submit the referral to LE and copy CMS and the 
SMA Program Integrity Unit point-of-contact. Upon submission of the referral to HHS-
OIG/OI and/or MFCU, the UPIC shall request written and/or email confirmation from 
the respective law enforcement partner acknowledging receipt of the referral. The UPIC 
shall update UCM with the date the referral was sent, the name of the agent 
acknowledging receipt of the referral, and the date of receipt. In the event that written 
confirmation is not received, the UPIC shall notify CMS. Additionally, the UPIC shall 
refrain from implementing any additional administrative actions against the 
provider/supplier without CMS approval. If the UPIC has any questions related to LE 
referrals, the UPIC shall coordinate with CMS.  
 
UPICs will need to verify all action items discussed during a Medicaid MCC in UCM.  
The UPIC is responsible for the updating the completion of action items identified during 
a Medicaid MCC.  
 
In regards to cases declined by LE, the UPIC shall update UCM with the declination and 
notify CMS and the SMA within two (2) business days in order to move forward with any 
approved secondary administrative actions.  The UPIC will coordinate with the SMA in 
implementing any secondary administrative actions. 
 
  4.11 - Reporting State Vulnerabilities 
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23) 
 
During the course of project development and/or investigational/audit activities, the 
UPIC may become aware of vulnerabilities in a states policies that leave the Medicaid 
program at risk for fraud, waste, or abuse.  In these circumstances, the UPIC will follow 
the Medicare PIM Guidelines at 4.13  Vulnerabilities for reporting the information to 
the COR and BFL, along with completing the Vulnerability Template (required elements 
are described in the Medicare PIM at 4.13), which is then submitted to the Vulnerability 
Mailbox at CPIVulnerabilityIntake@cms.hhs.gov.  It is understood that not all aspects of 
the Vulnerability Template may be relevant to the Medicaid program or the SMA.  In 
these circumstances, the UPIC shall complete the Template to the best of their knowledge 
and may indicate Not Applicable or N/A for those elements that may not be relevant to 
Medicaid.  A copy of the Vulnerability Template may be found at Appendix M. 
 
In addition, a copy of the vulnerability report shall be submitted to the respective SMA 
for their review and shall be presented on a regularly scheduled monthly collaboration 
call.  The minutes of the meeting shall reflect the presentation/discussion of the 
vulnerability. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  Transmittals Issued for this Chapter 
 
Rev #  Issue Date  Subject  Impl Date  CR# 
R11948MP  04/13/2023  Updates of Publication (Pub.) 100-15,  05/15/2023  13141 
Including Revisions to Chapters 1 and 
2, and the Addition of Chapters 3, 4, 
5, and Appendices 
Back to top of Chapter