A UPIC overhaul: CMS takes the wheel?

The Centers for Medicare & Medicaid Services (CMS) may be preparing one of the most significant changes to Medicare fraud enforcement in years. Under a newly released draft contractor model, CMS would take direct control over which providers and suppliers become targets of Medicare fraud investigations, reducing the traditional lead-generation role of Unified Program Integrity Contractors (UPICs). Instead, contractors would primarily conduct CMS-directed investigations and help build administrative and enforcement cases. Combined with CMS’s broader Comprehensive Regulations to Uncover Suspicious Healthcare (CRUSH) initiative, the proposal signals a future of more centralized, data-driven, and potentially faster Medicare enforcement. Although the proposal remains in the comment stage, providers, health systems, and healthcare investors should take notice now. If finalized, the model could affect how quickly investigations are opened, payment suspensions are imposed, and enforcement actions are pursued.

CMS published the fraud defense contracts request for information (RFI) on the System for Award Management website on October 5, 2026, and comments are due by 11:00 am EST on November 4, 2026. If you have questions about the fraud defense contracts RFI or would like assistance preparing and submitting comments to CMS, please contact a member of the McDermott Will & Schulte team.

What’s changing?

On October 5, 2026, CMS released an RFI on future fraud defense contracts, accompanied by a draft statement of objectives (SOO). The proposal would significantly alter the current relationship between CMS and the contractors responsible for Medicare program integrity investigations. Under the draft model:

• CMS would decide who gets investigated. Perhaps the most significant proposed change is that CMS would become “the primary driver of proactive data analysis, lead generation, prioritization, and law enforcement vetting.” Rather than independently developing many investigations, contractors would largely receive assignments from CMS.
• Contractors would build cases, not choose them. Once CMS identifies and approves a matter for review, contractors would conduct claims analysis, perform medical review, collect evidence, conduct interviews and onsite visits, and support the administrative or enforcement actions supported by the facts.
• Independent contractor investigations could become the exception. The draft SOO indicates that CMS would not eliminate contractor-generated leads altogether. However, contractors could pursue those leads only as capacity allows and only after CMS review, law enforcement vetting, and approval.
• CMS wants contractors involved through appeals and hearings. The proposed contractor responsibilities extend beyond traditional investigative activities. Contractors would support rebuttals, administrative appeals, hearings, witness testimony, and litigation support efforts.
• CMS would gate technology and artificial intelligence (AI). The SOO contemplates tighter CMS oversight of investigative technologies. Contractors would need CMS approval before using non-approved tools, external datasets, AI technologies, or other forms of automation.

Why it matters

The proposal itself does not change Medicare regulations or provider obligations. Nevertheless, the draft SOO may provide one of the clearest indications yet of where CMS wants Medicare fraud enforcement to go next. Several themes stand out:

• Investigations could start earlier and move faster. CMS’s emphasis on centralized lead generation and taking “timely action to prevent continued fraudulent payments” suggests a model focused less on retrospective audits and more on identifying and stopping questionable billing activity earlier in the payment cycle. For providers, that could mean less time between the emergence of a billing pattern and government scrutiny.
• Specialized contractors may know your industry better than ever. CMS is actively exploring whether certain investigations should be handled by contractors focused on specific provider sectors, such as hospice, home health, laboratories, or durable medical equipment suppliers. Specialization may improve consistency and accuracy. It also may result in investigators with deeper familiarity with provider-specific billing trends, operational practices, and risk indicators.
• Contractor involvement may mean more preparation for appeals. Under the draft model, contractor involvement would not end when an investigation is completed. Contractors could support the government through rebuttals, appeals, hearings, and witness testimony. As a result, providers should assume that documents, correspondence, interview statements, and other materials created early in an investigation could become part of a broader enforcement record.
• Problems in one program may follow providers into others. CMS is actively seeking input on integrating MA and Part D investigations with fee-for-service activities. Coupled with broader CRUSH proposals, this could increase information sharing across programs and make it more difficult for providers facing scrutiny in one area to operate unaffected in another.
• Contractor turnover could create new risks. The SOO suggests that CMS would require contractors to support the transfer of active investigations, pending administrative actions, and case files when contracts change hands. Although such transitions would be intended to preserve continuity, they could introduce uncertainty, create inconsistent positions, and complicate communications for affected providers.

Background: UPICs and the CRUSH initiative

CMS has long relied on private contractors (today primarily UPICs, and previously Zone Program Integrity Contractors) to investigate suspected fraud and to impose or recommend payment suspensions, revocations of Medicare billing privileges, and referrals to law enforcement. For many providers, an additional documentation request, medical review, or onsite visit from a UPIC is often the first indication of a significant program integrity matter.

CMS Deputy Administrator and Chief Operating Officer Kimberly Brandt has described the fraud defense contracts RFI as an opportunity to evaluate whether the agency’s longstanding contractor structure remains appropriate for increasingly sophisticated fraud schemes and to further CMS’s shift away from a traditional “pay-and-chase” approach.

The fraud defense contracts RFI should also be viewed alongside CMS’s February 2026 CRUSH initiative. The CRUSH RFI sought stakeholder input on a broad range of program integrity reforms, including:

• Expanded payment suspension authority.
• Enhanced enrollment screening and revocation authorities.
• Stronger identity-proofing requirements.
• Potential citizenship or residency requirements for certain owners.
• Shorter claim-submission deadlines for high-risk services.
• Increased scrutiny of laboratory and genetic testing arrangements.

Taken together, CRUSH and the fraud defense contracts RFI address two related questions: what enforcement authorities CMS may ultimately have and how the agency intends to deploy them.

What CMS is asking stakeholders

While the fraud defense contracts RFI response form includes 28 questions and numerous subparts, CMS appears particularly interested in stakeholder feedback regarding:

• Centralization and specialization. Whether medical review, law enforcement requests, and site verifications should be centralized, and the advantages and disadvantages of national specialty contractors for specific provider types.
• Contractor handoffs. Where handoffs among UPICs, Medicare Administrative Contractors, Recovery Audit Contractors, and the Supplemental Medical Review Contractor might delay or weaken administrative actions.
• Integrations of MA, Part D, and Medicaid investigations. Whether MA and Part D investigations should be integrated with fee-for-service investigations, and whether Medicare and Medicaid investigations should be separated.
• Speed of administrative action. What barriers delay payment suspensions, revocations, and Office of Inspector General exclusion referrals, and how findings should feed back into prepayment edits and enrollment screening.
• Provider safeguards and false-positive prevention. How the model should limit false positives and unnecessary provider burden and protect beneficiary access to care when a provider is suspended or revoked.
• Contracting incentives. How fixed-price and performance-based contracts can avoid rewarding the volume of investigations, referrals, or administrative actions over their quality.
• AI governance and conflicts of interest. How CMS should address explainability, human review before any action, and model validation, as well as organizational conflicts of interest for firms that also have health plan or provider business.

CMS does not limit RFI participation to prospective contractors. Many questions specifically seek input regarding provider burden, false positives, continuity of care, and due process concerns, making providers, suppliers, health systems, and trade associations particularly well positioned to contribute.

Implications for providers, health systems, and investors

The fraud defense contracts RFI does not change any legal requirements today. However, organizations that could be affected by a more centralized, technology-driven program integrity model may want to use this opportunity to evaluate how prepared they are for faster investigations; greater use of data analytics; and closer coordination across Medicare, MA, Medicaid, and law enforcement partners.

Providers: Prepare for faster, more data-driven investigations

For hospices, home health agencies, physician practices, and other providers, the most immediate risk is not necessarily a change in the rules, but a change in how quickly potential issues are identified and acted upon.

• Understand your risk profile. Use internal claims and utilization data to identify billing patterns that may appear anomalous to CMS analytics, such as unusual lengths of stay, live discharge rates, referral concentrations, or use of high-cost codes. Where appropriate, consider conducting privileged compliance reviews with counsel.
• Develop a response framework before you need it. Identify who will receive contractor requests; coordinate record production; oversee communications; and manage onsite visits, interviews, and attestation requests. A well-defined process can prevent small issues from becoming larger enforcement concerns.
• Invest in contemporaneous documentation. If CMS succeeds in moving investigations earlier in the payment cycle, medical necessity and coverage support will need to be readily available. Strong documentation is also essential to preserving defenses in any subsequent appeal.
• Maintain complete records of active reviews. Providers currently subject to UPIC reviews, payment suspensions, or other program integrity actions should ensure that all submissions, correspondence, and supporting materials are carefully organized and preserved in anticipation of potential contractor transitions.

Health systems: Consider enterprise-wide exposure

Hospitals and integrated health systems may be affected not only by investigations of their own operations but also by increased coordination across affiliated providers, employed physician groups, and post-acute networks.

• Evaluate risk from an enterprise-wide perspective. Greater integration of fee-for-service, MA, Part D, Medicaid, and state enforcement activities could create a more comprehensive view of provider relationships and billing patterns.
• Consider engaging in the rulemaking process. Hospitals and their trade associations may be particularly well positioned to comment on false positives, administrative burden, due-process protections, and continuity-of-care concerns when enforcement actions affect providers serving vulnerable patient populations.

Investors: regulatory diligence may matter more than ever

For private equity sponsors and other healthcare investors, the fraud defense contracts RFI suggests that CMS is exploring tools that could increase both operational and ownership-level scrutiny.

• Investors should expect regulatory diligence to become even more important. In addition to traditional regulatory diligence, investors may wish to examine a target’s history of additional documentation requests, prepayment reviews, audits, payment suspensions, enrollment actions, and law-enforcement inquiries, as well as claims patterns that could attract heightened analytical review.
• Open program integrity issues may become more expensive deal risks. Open investigations, audits, or payment suspensions may warrant special indemnities, escrow arrangements, holdbacks, or tailored interim operating covenants. Investors should also evaluate the extent to which representations and warranties insurance will cover known program integrity risks.
• Ownership structures could face greater scrutiny. Several CRUSH-related proposals contemplate enhanced screening of owners and managing employees. Investors should consider how ownership structures, control arrangements, and investor disclosures may be evaluated under a more rigorous enrollment framework.
• Build additional regulatory time into transactions. Ongoing enrollment scrutiny, moratoria, and heightened review of ownership changes may affect transaction timelines, particularly in sectors already receiving significant CMS attention.

The McDermott difference

We regularly represent providers, health systems, and investors in UPIC and other Medicare audits, payment suspensions, revocations, and overpayment appeals, and in diligence and structuring of healthcare transactions. If you are interested in responding to the fraud defense contracts RFI, are currently facing a Medicare audit or payment suspension, or are evaluating how these developments may affect a pending or planned transaction, please contact one of the authors or your regular McDermott Will & Schulte lawyer. We will continue to monitor the RFI and the CRUSH rulemaking and provide updates as additional information becomes available.