100-15 Medicaid Program Integrity Manual: Chapter 4 – Reporting Investigational Findings and Making Referrals

Medicaid Program Integrity Manual
Chapter 4 - Reporting Investigational
Findings and Making Referrals
Table of Contents
(Rev. 13945; Issued: 09-03-26)
Transmittals for Chapter 4
4.1 	Documentation of Investigations/Audits and Medical Review Findings
4.2 	Overpayment Assessment
4.2.1 	Overpayment Assessed from Medical Review
4.2.2 	Overpayment Assessed Solely by Data Analysis
4.3 	Overpayment Resolution Process
4.3.1 	Calculation of Federal Financial Participation (FFP) Based on State’s Date
of Expenditure
4.4 	State Appeal Process
4.5 	Close-Out Letters
4.6 	Medicaid Settlement Negotiations
4.7 	Medicaid Payment Suspensions
4.8 	Terminations
4.9 	Immediate Advisements
4.10 	Fraud Referrals
4.11 	Reporting State Vulnerabilities

4.1 – Documentation of Investigations/Audits and Medical Review
Findings
(Rev.13945; Issued: 09-03-26; Effective: 10-05-26; Implementation: 10-05-26)
All investigations/audits and medical review findings must be supported by adequate
documentation. Adequate documentation consists of documents obtained by the
investigator during the course of the investigation/audit or medical review and should be
part of the investigation/audit working file. The working paper file contains evidence
accumulated throughout the investigation/audit to support the work performed, the results
of the investigation/audit, including adjustments made, and all findings made by the
reviewer. All documents relevant to investigative/audit findings shall be uploaded to
UCM.
Examples of documents are:
1.Copies of federal and/or state policies and regulations.
2.Copies of medical/financial records to support the finding.
3.Copies of state generated remittance advices which support the claim payment or
credit adjustment.
4.Correspondence, such as Provider Notification Letters and Record Request
Letters/Lists.
5.Investigator’s notes regarding the investigation.
6.Miscellaneous memoranda that pertain to the investigation.
4.2 - Overpayment Assessment-Reserve for future use
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
4.2.1 - Overpayment Assessed from Medical Review
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
When assessing potential Medicaid overpayments, the UPIC shall ensure the necessary
state law and/or SMA overpayment methodologies and requirements are followed at all
times. Upon completion of the medical review, the UPIC determines if there is a
potential overpayment.
4.2.2 - Overpayment Assessed Solely by Data Analysis
(Rev. 13494; Issued: 12-23-25; Effective: 01-26-26; Implementation:01-26-26)
In certain instances, in collaboration with the SMA, the UPIC may identify overpayments
based solely on data analysis from claims or financial payments. In these instances, the

UPIC shall collaborate with the state to validate the analysis and to ensure the policy
interpretation is accurate. Additionally, the UPIC shall coordinate with each individual
SMA and the COR/BFL team to determine a state specific dollar threshold for action on
overpayments based solely on data analysis. Data driven overpayments that meet the
dollar threshold, once reviewed and approved by CMS, shall be vetted in accordance with
Chapter 3.3 of this manual prior to submitting the overpayment to the SMA by CMS
through a Final Findings Report (FFR). All data analysis identified overpayments that fall
below the state specified threshold will be sent to the SMA by the UPIC to take whatever
action they deem necessary (i.e., collection of overpayments, identification of program
vulnerabilities, necessary policy updates, automated edits, etc.).
4.3 – Overpayment Resolution Process
(Rev.13945; Issued: 09-03-26; Effective: 10-05-26; Implementation: 10-05-26)
Upon identification of an overpayment based on a Medicaid investigation/audit, an Initial
Findings Reports (IFR) is sent to the Medicaid BFL for review and approval. Once the
BFL has approved the IFR, the UPIC will send the IFR to the SMA within 180 days of
the Medicaid Investigation Start Date for review and comments for 30 calendar days. The
180-day time frame is based on normal progression of the investigation/audit with no
cause for delay or circumstances outside UPIC control, unless otherwise specified by
CMS. All delays shall be documented in the Unified Case Management (UCM) system.
If the state disagrees with the findings of the UPIC, which results in monetary changes to
the Appendix A, the UPIC will revise the IFR and incorporate any other grammatical or
narrative corrections identified by the state and document the changes in the UCM, the
document will remain an IFR. If there are monetary changes, the UPIC shall inform the
BFL to determine the next step. If the state’s comments speak to the body of the report
and are primarily grammatical or corrections to cited regulations, terminology, etc., the
document will remain an IFR, and the UPIC will make any necessary corrections.
The IFR may then be transmitted by the UPIC to the provider for review and comments
for 30 calendar days, if required by the SMA. The UPIC will review the provider’s
responses, if any, to determine if adjustments to the findings are necessary. If no
adjustments are made to the findings, resulting in no monetary changes to the Appendix
A, the UPIC will produce an FFR. If adjustments to the findings, which result in
monetary changes to the Appendix A, are necessary, the UPIC will make the revisions in
a revised IFR (RIFR) and the RIFR is sent to CMS and the state, this time with a 15-day
review and comment period. The Medicaid BFL, the UPIC, and, if necessary, the state
will reconcile any issues with the RIFR, after which the UPIC produces an FFR and
completes the FFR – State Transmittal Letter and submits both to CMS for approval
within 13 months of the Medicaid Investigation Start Date. The 13-month time frame is
based on normal progression of the investigation/audit with no cause for delay or
circumstances outside UPIC control, unless otherwise specified by CMS. All delays shall
be documented in the UCM system. CMS, upon approving the FFR, sends the FFR and

State Transmittal Letter to the state. The FFR – State Transmittal Letter (Appendix E)
can be found in the Appendices. Versions of the FFR – State Transmittal Letter are
available for FFS and/or managed care investigations/audits, where the managed care
overpayments can be recouped (Appendix E); FFS and managed care investigations/
audits when the managed care overpayments are not recoupable, but the FFS are
(Appendix F); and managed care-only investigations/audits when there are only managed
care overpayments that are not recoupable (Appendix G).
The FFR identifies the total overpayment amount paid to the provider and specifies the
amount of Federal Financial Participation (FFP) that the state must return to CMS. It is
the state’s responsibility to adjudicate the review findings with the provider. The state has
one year from the date the overpayment is identified to recover or attempt to recover the
overpayment from the provider before the federal share must be refunded to CMS. Under
CMS’s regulations, the date of discovery of overpayments begins on the date that CMS
first notifies the SMA in writing of the overpayment and specifies a dollar amount subject
to recovery. (See 42 C.F.R. § 433.316).
Sometimes a 100% overpayment is identified because the provider or supplier does not
provide the contractor with the required medical record documentation to conduct a post-
payment medical review. A 100% overpayment means that all the claims in the
contractor’s selected sample are considered to be improperly billed and paid based on the
documentation received (or lack thereof). Therefore, they are fully denied through post-
payment review. In these instances, the UPIC shall consult with its BFL and SMA on any
potential 100% overpayment determinations prior to initiation of state overpayment
reporting actions or notice to the provider/supplier. If approved, the UPIC shall
coordinate the overpayment reporting actions with the SMA. If denied, the UPIC shall
follow the instructions provided by its Medicaid BFL.
In certain instances, the SMA may require an update to the FFR, based on updated
analysis by the state, resulting in a downward adjustment in the amount of an
overpayment due to an appeal decision from an administrative law judge, informal
hearing decision, issues identified within the referenced policy, etc. In these instances, the
UPIC shall notify CMS of the discrepancies and discuss a proposed resolution. If it is
determined that an update to the FFR is necessary, CMS and the UPIC shall collaborate
to draft a Revised FFR (RFFR), along with the FFR Addendum – State Transmittal Letter
(Appendix H), which CMS shall submit to the SMA upon completion. The UPIC will
edit the OPT financial information in UCM on the original OPT record, upload the RFFR
and FFR Addendum – State Transmittal Letter, and notify the BFL via email.

4.3.1 – Calculation of Federal Financial Participation (FFP) Based on
State’s Date of Expenditure
(Rev.13945; Issued: 09-03-26; Effective: 10-05-26; Implementation: 10-05-26)
The UPIC shall calculate the FFP amount for each discrepant claim line identified based
on the Federal Medical Assistance Percentage (FMAP) in place at the time of the state
Medicaid agency’s date of expenditure (i.e., the date the state Medicaid agency paid the
applicable claim). The total overpayment amount shall be entered into Appendix A of the
FFR. The UPIC shall comply with the following directions when preparing FFRs for all
assigned Medicaid investigations/audits.
• 	The UPIC shall add columns to Appendix A identifying the “Federal Share
Percentage” and “Federal Share Amount” for each Fiscal Year (FY) and FY
Quarter identified per discrepant claim.
• 	The UPIC shall add a column to Appendix A identifying the date of expenditure,
in addition to the date of service.
• 	The UPIC shall use the appropriate “Federal Share Percentage” for FY and
Quarter.
• 	The UPIC shall add a column to Appendix A identifying the “Federal Share
Total.”
• 	The UPIC shall sum total the “Federal Share Total” column at the bottom of the
Appendix A.
(Example)
In calculation of the FFP, the UPIC shall consult the Federal Register for the applicable
FMAP rate and shall monitor any changes to the FMAP as published in the Federal
Register on an ongoing basis. The relevant FMAP table can be found quickly and directly
by searching the internet for “Federal Register FMAP rates for FY [year].” The Federal
Register displays adjustments to the FMAP for states and territories periodically based on
legislation, (i.e., the American Recovery and Reinvestment Act (2009) increased the
FMAP for certain claims for services on or after October 1, 2008. The UPIC may also
contact the SMA for the applicable FMAP rate. In addition, The Patient Protection and
Affordable Care Act (2010) allowed states to file a State Plan Amendment (SPA) to
expand Medicaid to cover additional populations. The federal government financed the
costs of these newly eligible beneficiaries at a different rate than those who were
previously eligible.).

The UPIC shall ensure that the calculations for each claim/claim line and financial
payments are accurate for each FY. If, as a result of an appeal, the overpayment needs to
be recalculated, the UPIC shall follow the methodology used in the original overpayment
calculation.
4.4 – State Appeal Process
(Rev.13945; Issued: 09-03-26; Effective: 10-05-26; Implementation: 10-05-26)
The CMS does not dictate the process by which UPIC Medicaid review findings are
appealed. Rather, appeal processes are determined by each state and are subject to the
state’s Medicaid program requirements.
It is the responsibility of the SMAs to defend review findings in an administrative appeal
or judicial proceeding, although the UPIC may provide testimonial support and other
assistance to the state to defend the review findings throughout administrative or judicial
proceedings.
It is recommended that the UPIC review each SMA’s appeal process during the onset of
any proposed investigation/audit, so they understand the level of support needed and can
plan appropriately should the SMA require support during the appellate process.
The UPIC should alert the Medicaid BFL/COR to any situation where a state indicates a
reluctance to defend FFR findings in an appeal.
The UPIC will notify CMS of any changes to the overpayment amounts resulting from
hearing decisions.
4.5 – Close-Out Letters
(Rev.13945; Issued: 09-03-26; Effective: 10-05-26; Implementation: 10-05-26)
If the provider has been notified of the initiation of an investigation/audit and the
Medicaid investigation/audit is later discontinued, or if the findings are insufficient to
pursue, a close out letter will be issued to the provider. The close-out letter provides
notification to the provider that the review has concluded and no further action on the
part of the provider is necessary. The UPIC is responsible for obtaining approval from
CMS prior to issuing a close-out letter. Upon approval, the UPIC sends the close-out
letter to the provider in question, sends a copy to the state, and uploads a copy to UCM.
A sample of the “Close-Out Letter” can be found at Appendix A.
In addition, the UPIC will complete a summary of the investigation/audit that is
submitted to the SMA along with the letter to the provider, and a copy is uploaded to

UCM. This summary is not sent to the provider. The “Closing Summary” template can be
found at Appendix B.
4.6 - Medicaid Settlement Negotiations
(Rev.) (Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
Overpayment settlement negotiations are a function of the SMA. If the SMA and
provider agree to a negotiated settlement, the SMA is still required to remit payment for
the full FFP referred by CMS, in accordance with 42 CFR Part 433 Subpart F.
The UPIC shall not participate in any discussions or review of the negotiated
overpayment since this is the responsibility of the SMA.
4.7 - Medicaid Payment Suspensions
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
Implementation of Medicaid payment suspensions is an SMA function and should be in
accordance with 42 C.F.R. § 455.23. Although UPICs may recommend the
implementation of a Medicaid payment suspension based on a credible allegation of
fraud, it is at the state’s discretion to take the appropriate action.
4.8 - Terminations
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
If the UPIC identifies potential grounds for Medicaid termination, the UPIC shall notify
the SMA so it can review the facts and consider the appropriate action.
4.9 - Immediate Advisements
(Rev. 12871; Issued: 10-11-24; Effective: 11-14-24; Implementation: 11-14-24)
The UPIC shall follow the Medicare PIM guidelines at 4.9.1 - Immediate Advisements to
the HHS-OIG/OI and notify the SMA of such advisements when they are assisting the
state with a Medicaid investigation/audit.
4.10 - Fraud Referrals
(Rev. 12871; Issued: 10-11-24; Effective: 11-14-24; Implementation: 11-14-24)
Throughout the course of a Medicaid investigation/audit, should the UPIC identify
potential Medicaid fraud, the UPIC shall discuss the matter with the COR/BFL to
determine if a referral to LE is warranted. If CMS agrees that a referral to LE is
appropriate, the process for initiating and scheduling a Medicaid Major Case
Coordination Meeting (Medicaid MCC) shall begin. The Medicaid MCC Meeting is an
opportunity for UPICs to discuss their proposed Medicaid fraud referrals with CMS, the

SMA, and LE. The goal is to collaborate with all of the key decision makers, provide
guidance on each proposed LE referral, and identify any proposed secondary actions.
Note: All UPIC referrals of potential fraud shall be reviewed by the Department of Health
and Human Services – Office of Inspector General (HHS-OIG) for determination and
coordination with the state’s MFCU. State referrals of potential fraud will continue to
follow state policy and be coordinated with the state’s MFCU.
The UPIC does not need the SMA’s approval for a LE referral but shall communicate
with the state that suspected fraud has been identified and is being referred through CMS
to HHS-OIG.
Steps Before the Medicaid MCC Meeting:
The UPIC shall finalize the MCC Pre/Post Meeting Report - Work Details (hereon
referred to as the Executive Summary) within seven (7) calendar days. The UPIC shall
notify CMS once these actions are complete. CMS will submit the Executive Summary to
HHS-OIG for review of the possible referral. Then, the following processes will take
place:
• 	HHS-OIG may coordinate a preliminary review of the Medicaid UPIC case with
the state’s Medicaid Fraud Control Unit (MFCU) to determine if they are
interested in the case.
• 	HHS-OIG will communicate the results of the preliminary review to CMS.
This initial review does not constitute the formal referral to law enforcement, and is,
instead, a summary of the information for law enforcement to consider whether a formal
referral is warranted and a Medicaid MCC Meeting needs to be held to collaborate with
all parties.
CMS will coordinate a Medicaid MCC meeting and assure participants include at a
minimum: CMS/CPI, HHS-OIG’s Office of Investigations (HHS-OIG/OI), the state’s
MFCU, UPIC, and applicable SMA Program Integrity Unit staff. CMS will be
responsible for scheduling the appointment at the agreed-upon time by all participants.
CMS will also be responsible for establishing the agenda for the meeting.
Note: Attendance is optional for LE agencies if the cases are declined prior to the
Medicaid MCC, and the case being presented is only subject to state administrative
actions.
The UPIC shall ensure all revisions and updates to the case are completed in the UCM
three (3) days prior to the scheduled Medicaid MCC.
Steps During the Medicaid MCC Meeting:
The UPIC shall prepare and follow the guidance set forth in the Medicaid Executive

Summary Tip Sheet (see Appendices to this manual) when presenting investigations/
audits at the Medicaid MCC.
The CMS/CPI will record the primary and secondary actions identified during the
Medicaid MCC to be resolved as case decisions in UCM (NexGen).
Steps After the Medicaid MCC Meeting:
Following the Medicaid MCC Meeting, when applicable, the UPIC shall submit a formal
referral to the appropriate LE within seven (7) calendar days, unless otherwise advised by
CMS. Referrals shall include all applicable information that the UPIC has obtained
through its investigation/audit at the time of the referral. The UPIC shall utilize the “LE
Referral Template” available in CMS IOM 100-08: Exhibit 16.1. Once the referral
package is complete, the UPIC shall submit the referral to LE and copy CMS and the
SMA Program Integrity Unit point-of-contact. Upon submission of the referral to HHS-
OIG/OI and/or MFCU, the UPIC shall request written and/or email confirmation from the
respective law enforcement partner acknowledging receipt of the referral. The UPIC shall
update UCM with the date the referral was sent, the name of the agent acknowledging
receipt of the referral, and the date of receipt. In the event that written confirmation is not
received, the UPIC shall notify CMS. Additionally, the UPIC shall refrain from
implementing any additional administrative actions against the provider/supplier without
CMS approval. If the UPIC has any questions related to LE referrals, the UPIC shall
coordinate with CMS.
UPICs will need to verify all action items discussed during a Medicaid MCC in UCM.
The UPIC is responsible for the updating the completion of action items identified during
a Medicaid MCC.
Regarding cases declined by LE, the UPIC shall continue with the IFR/FFR if an
overpayment has been identified. If no overpayment was identified, the UPICs shall refer
the case to the state for any administrative actions the state finds necessary and close the
case within seven (7) calendar days of the Medicaid MCC.
4.11 - Reporting State Vulnerabilities
(Rev. 11948; Issued:04-13-23, Effective: 05-15-23; Implementation: 05-15-23)
During the course of project development and/or investigational/audit activities, the
UPIC may become aware of vulnerabilities in a state’s policies that leave the Medicaid
program at risk for fraud, waste, or abuse. In these circumstances, the UPIC will follow
the Medicare PIM Guidelines at 4.13 – Vulnerabilities for reporting the information to
the COR and BFL, along with completing the Vulnerability Template (required elements
are described in the Medicare PIM at 4.13), which is then submitted to the Vulnerability
Mailbox at CPIVulnerabilityIntake@cms.hhs.gov. It is understood that not all aspects of
the Vulnerability Template may be relevant to the Medicaid program or the SMA. In
these circumstances, the UPIC shall complete the Template to the best of their knowledge

and may indicate “Not Applicable or N/A” for those elements that may not be relevant to
Medicaid. A copy of the Vulnerability Template may be found at Appendix M.
In addition, a copy of the vulnerability report shall be submitted to the respective SMA
for their review and shall be presented on a regularly scheduled monthly collaboration
call. The minutes of the meeting shall reflect the presentation/discussion of the
vulnerability.

Transmittals Issued for this Chapter
Rev # 	Issue Date 	Subject 	Impl Date 	CR#
R13945MPI 	09/03/2026 	Updates to Chapter 3, Chapter 4, and
Chapter 5 in Publication (Pub.) 100-
15, Including Updates to the Vetting
Process and the Creating
Overpayment Records Process
10/05/2026 	14548
R13494MPI 	12/23/2026 	Updates of Chapters 1-5 in
Publication (Pub.) 100-15, Including
Updates to the Guidance
Terminology, Existing Definitions,
and Details to Standing Guidance
01/26/2026 	14275
R12871MPI 	10/11/2024 	Updates of Chapter 1, Chapter 2,
Chapter 3, Chapter 4, and Appendices
in Publication (Pub.) 100-15,
Including Auditing of Program
Integrity Activities in Managed Care
Plans
11/14/2024 	13720
R11948MPI 	04/13/2023 	Updates of Publication (Pub.) 100-15,
Including Revisions to Chapters 1
and 2, and the Addition of Chapters
3, 4, 5, and Appendices
05/15/2023 	13141
Back to top of Chapter