CMS Woes: Zone Program Integrity Contractors (ZPICs) Criticized for Oversight in Fraud Investigations

George IndestBy George F. Indest III, J.D., M.P.A., LL.M., Board Certified by The Florida Bar in Health Law

Zone Program Integrity Contractors (ZPIC) are private companies or business entities, that have contracted with the Centers for Medicare and Medicaid Services (CMS). Their purpose is to carry out certain functions related to auditing for possible fraud, that Medicare regional carriers (now called Medicare Administrative Contractors or “MACs”) performed in the past. They are specifically charged by CMS to data mine, identify, and investigate potentially fraudulent behavior in Medicare providers.

Because of this, health care providers that receive a letter from the ZPIC often see it as a potential death sentence, and certainly an eye-opening event, because it involves investigating for fraudulent activity. However, in recent years CMS has been criticized about its oversight (actually, lack of oversight) of these fraud-detection contractors.

Taking a Closer Look at the ZPIC.

ZPIC audit letters are required to comply with regulations and guidelines established by CMS when it comes to making additional documentation requests (ADRs) for pre-payment and post-payment reviews, initiation of Medicare suspension of payments and other areas for which they have authority to investigate under the direction of CMS.

Studies have found many failures of their obligations to comply with guidelines and regulations adopted by CMS and the Department of Health and Human Services (HHS). There has been so much concern over their borderline “unethical behavior” and violations of Medicare regulations that the United States Senate Committee on Finance, as well as the Office of the Inspector General (OIG) of HHS, have both issued scathing reports on them. These reports often warn against what they see as destructive and harmful behavior toward physician practices and smaller medical businesses.

In 2012 a report was issued at the request of the Senate Finance Committee and included the following quote: “CMS and its contractors often cultivate an environment of mistrust and suspicion that all providers of certain services are inherently fraudulent. The sentiment is widely shared by anyone that has worked with CMS contractors in the area of program integrity and a similar environment is probable within the CMS Program Integrity Group. This type of environment leads investigators, contractors, and CMS to pursue providers in an aggressive manner, sometimes unfairly, based on little evidence or collaboration of any wrongdoing.”

According to the OIG: “Often the ZPIC contractors have had no experience in the areas of fraud and abuse for which they should be accountable. The result is a loss to CMS of fraud and abuse funds and providers, many of which are small – medium sized businesses, are forced to spend thousands of dollars to address unfounded audits and investigations.”

To read the OIG report to Congress in full, click here.

Make sure to visit our website’s ZPIC articles and documents section to learn more.

What To Do If You Are Notified of a ZPIC Audit.

When a physician, medical group or other health care provider receives a notice of an audit and site visit from a ZPIC, things happen fast with little opportunity to prepare. A ZPIC will routinely fax a letter to the practice shortly before the end of a business day the day before a site visit/audit to that practice. Auditors will request to inspect the premises, will photograph all rooms, equipment, furniture, and diplomas on walls. They will usually request copies of several patient records to review later. They will request copies of practice policies and procedures, treatment protocols, all staff licenses and certifications, drug formularies, medications prescribed, and medications used in the office. ZPIC auditors will inspect any medication/narcotic lockers or storage cabinets and will request drug/medication invoices and inventories. You will usually be contacted for follow-up information and documentation after the audit and will eventually be provided a report and, possibly, a demand for repayment of any detected overpayments.

For a checklist on what to do after you receive initial notification of a ZPIC audit, read our two-part blog. Click here for part one and click here for part two.

Don’t Wait Until It’s Too Late; Consult with a Health Law Attorney Experienced in Medicare and Medicaid Issues Now.

The attorneys of The Health Law Firm represent healthcare providers in Medicare audits, ZPIC audits and RAC audits throughout Florida and across the U.S. They also represent physicians, medical groups, nursing homes, home health agencies, pharmacies, hospitals and other healthcare providers and institutions in Medicare and Medicaid investigations, audits, recovery actions and termination from the Medicare or Medicaid Program.

For more information please visit our website at or call (407) 331-6620 or (850) 439-1001.

Additional Sources:

Waesch, Amanda; Cohen, Frank and Weiss, Sean. “The Truth about ZPICs – Why Oversight is Needed.” Brennan Manna & Diamond Law firm. (August 29, 2017). Web.

Carlson, Joe. “Review notes ZPIC oversight woes.” Modern Healthcare. (November 14, 2011). Web.

About the Author: George F. Indest III, J.D., M.P.A., LL.M., is Board Certified by The Florida Bar in Health Law. He is the President and Managing Partner of The Health Law Firm, which has a national practice. Its main office is in the Orlando, Florida, area. The Health Law Firm, 1101 Douglas Ave., Altamonte Springs, FL 32714, Phone: (407) 331-6620.

Key Words: Zone Program Integrity Contractors (ZPICs), ZPIC audit defense attorney, ZPIC defense lawyer, Medicare audit defense legal counsel, Medicare audit attorney, legal representation for ZPIC letters, legal representation for ZPIC audits, Medicare and Medicaid audits, legal representation for Medicare and Medicaid audits, health care fraud defense attorney, preparing for ZPIC audit, legal representation for health care fraud, Centers for Medicare and Medicaid (CMS), legal representation for CMS investigations, Office of Inspector General (OIG), health care professional defense attorney, legal representation for health care professionals, legal representation for fraud investigations, reviews for The Health Law Firm, The Health Law Firm attorney reviews, additional documentation requests (ADRs) for pre-payment and post-payment reviews, initiation of Medicare suspension of payments lawyer

“The Health Law Firm” is a registered fictitious business name of and a registered service mark of The Health Law Firm, P.A., a Florida professional service corporation, since 1999.
Copyright © 2017 The Health Law Firm. All rights reserved.



Responding to a Medicaid Audit: Important Tips You Should Know

6 Indest-2008-3By George F. Indest III, J.D., M.P.A., LL.M., Board Certified by The Florida Bar in Health Law

The Agency for Health Care Administration (AHCA), Office of Inspector General (OIG), Bureau of Medicaid Program Integrity, is the Florida agency responsible for routine audits of Medicaid health care providers. Each state has a similar state agency, though it may have a different name.  The agency’s job is to ensure that the Medicaid Program was properly billed for services. Health care professionals receiving large payments from Medicaid or who practice in areas that typically see the most abuse or fraudulent billings, are the ones most likely to be audited.  These include pediatricians, Ob/Gyns, family practice physicians and pediatric dentists.

A different state agency that may also conduct Medicaid audits is the state Medicaid Fraud Control Unit (MFCU).  However, by definition, the MFCU is investigating allegations that there is substantial fraud going on.  You should know that if you are contacted by the MFCU, this is a very serious matter.  This is not a routine audit.
However, on the “routine” audits conducted by the Medica agency, the Medicaid audit usually requests information in a questionnaire that the medical practice is required to complete. Additionally, copies of medical records (including x-rays and other diagnostic studies) on the list of Medicaid patients selected for the audit.

If AHCA (or the state Medicaid agency) determines that Medicaid overpaid for services, it will use a complex mathematical extrapolation formula to determine the repayment amount. The amount of the repayment to the Medicaid Program can be considerably greater than (30 to 100 times as much as) the actual amount of overpayment disclosed by the sample of records audited. Additionally, fines and penalties can be added by the Medicaid Program. However, you can eliminate or reduce the amount of any such repayment by actions taken both before and during the Medicaid audit.


General Practice Tips:
There are various ways to manage your practice that will help you in the event that you are selected for a Medicaid Audit.

1. Every patient record entry should be clearly dated and signed or initialed by the provider. Make sure this is always done.

2. When documenting in the patient’s record, make sure that you document exactly what services were needed and completed in order to support what was billed to Medicaid.

3. Communicate with the person responsible for your billing so that the actual services provided are billed for. Do not bill in advance for anticipated services needed as indicated in the appointment calendar or on a treatment plan.

4. Keep the patient records organized and ready for copying if necessary. Use only one sided documents and securely fasten small forms (prescriptions, telephone memos, small sticky notes) onto 8-1/2″ by 11″ paper. Scan all such documents into the patient record if using an electronic health record (EHR).

5. Services provided by a physician who is not enrolled in the Medicaid Program to a Medicaid patient may not be billed to or paid by the Medicaid Program. Therefore, never allow any other physician associated with your practice who is not enrolled as a Medicaid provider to provide services to Medicaid patients. Do not allow a new physician coming into your practice to treat Medicaid patients until he or she actually has received his or her Medicaid provider number. The group may not bill for the services nor may another physician bill for the services.

6. Ensure that all health care professionals’ licenses and permits are kept up to date. Ensure that all x-ray, clinical, lab and diagnostic equipment is permitted and kept up to date. Ensure that any CLIA license or exemption certificate is correct and kept up to date. Services billed by unlicensed personnel or services provided by improperly licensed facilities may not be paid by the Medicaid Program.

7. Use only standard abbreviations in your medical records, documentation, orders, and reports. While an abbreviation may seem common to you or your practice, if it is not a universally accepted abbreviation, the auditors may not recognize it.

8. Make sure all records are timely made, accurate and legible. Safeguard them and never let the original leave your office. Illegible records are treated as a non-record, and payment completely disallowed for an illegible note or order. A missing record, x-ray or chart entry will result in a complete repayment being directed for those services.

The Medicaid Audit:

If you are being audited, AHCA will send you a letter notifying you of the audit. AHCA will also supply you with a list of patients to be sampled a standard sample will include a list of anywhere from 30 to 150 patient names, depending on the size of the practice. Regular audits routinely request 30 to 50 patient records. The audit letter will also include a questionnaire to be completed (Medicaid Provider Questionnaire) and a “Certification of Completeness of Records” form to complete and return with the copies of the patient records. (Please note: this will be used against you in the future if you attempt to add to or supplement the copies of the records you provided).

It is crucial that you retain the services of an expert consultant or experienced health care attorney in correctly and accurately completing the questionnaire. The letter will also request that you provide copies of the patient records for the list of patients included with the letter. You will only be given a short time to provide these documents.

1. When receiving a notice of a Medicaid audit, time is of the essence. Be sure to calendar the date that the records need to be in the AHCA office and have the records there by that date. Note: the due date is not the last date on which you can mail the records but rather is the date that the records must be received at AHCA.

2. Obtain and review a copy of the claims you submitted and what Medicaid has paid on each of the patients being audited. This information can be found in the Medicaid portal, in your billing system, or in the Explanation of Benefits. Compare this information to the medical records to see if any issues may arise when AHCA reviews the records. (Keep this for your use, do not provide it as part of the audit records).

3. Provide a complete copy of the entire record, not just the parts from the period of time covered by the audit. Remember that other physician records obtained as history, including reports and consultations should be included. Consent forms, medical history questionnaires, histories, physicals, and other physicians’ orders, may be a crucial part of the record.

4. If you suspect that an issue may arise with a particular patient, prepare a separate explanation to submit with the patient’s file. AHCA will have an expert review the records, so an explanation in advance will help the expert to assess if there is in fact an issue. Any explanatory notes or other explanations should be clearly labeled as such and dated as of the date actually prepared, so there is no confusion as to whether or not it was part of the original record.

5. If your practice involves taking x-rays or using other diagnostic studies, these procedures are part of the patient’s record. If the x-rays are digital, they can be submitted on a compact disc. Be sure to include the number of x-rays on the compact discs in the Certification of Completeness of Records.
6. Complete the Medicaid Provider Questionnaire in its entirety to send with the patient records. Do not leave any section blank. Use “not applicable” or “none” if necessary. Attach all required documents. Consult with an experienced health law attorney to assist in completing the form.

To learn more about the Medicaid audit process and how The Health Law Firm can assist you, click here to watch our short video blog.

Don’t Wait Until It’s Too Late, Contact Health Law Attorneys Experienced in Handling Medicaid and Medicare Audits.

The Health Law Firm’s attorneys routinely represent physicians, medical groups, clinics, pharmacies, durable medical equipment (DME) suppliers, home health agencies, nursing homes and other healthcare providers in Medicaid and Medicare investigations, audits and recovery actions.
If you or your practice has been sent notice of a Medicaid or Medicare audit, please contact us at (407) 331-6620 or (850) 439-1001 or visit our website at for more information.

About the Author: George F. Indest III, J.D., M.P.A., LL.M., is Board Certified by The Florida Bar in Health Law.  He is the President and Managing Partner of The Health Law Firm, which has a national practice.  Its main office is in the Orlando, Florida, area.  The Health Law Firm, 1101 Douglas Ave., Altamonte Springs, FL 32714, Phone:  (407) 331-6620.

KeyWords: Legal representation for Medicaid audits, Medicaid audit defense attorney, health care fraud defense attorney, health care fraud investigation defense attorney, legal representation for health care fraud investigation, legal representation for health care fraud, Medicaid fraud defense attorney, legal representation for Medicaid fraud, legal representation for fraudulent billing, legal representation for submitting false claims to the government, legal representation for overbilling, health care fraud attorney, The Health Law Firm, reviews of The Health Law Firm attorneys, reviews of The Health Law Firm
“The Health Law Firm” is a registered fictitious business name of and a registered service mark of The Health Law Firm, P.A., a Florida professional service corporation, since 1999.Copyright © 2017 The Health Law Firm. All rights reserved.