Fourteen Days of Silence Opens a Medicaid Audit
CMS revised nine sections of the Medicaid Program Integrity Manual on Thursday and told its contractors the change does not affect providers. It gives your state Medicaid agency 14 calendar days to answer a UPIC vetting request, opens the investigation if nobody answers, and takes CMS out of reading your response to the findings. Effective October 5.
Transmittal 13945 landed on Thursday with the softest cover note CMS writes.
"These updates do not affect the provider and/or beneficiary populations. Rather, these updates are solely related to contractor technical processes and procedures."
Section IV, Provider Education: None. Impacted Contractors: None.
All thirteen business requirements sit in the UPIC column, and every one of the shared-system columns is blank.
Nine sections of the Medicaid Program Integrity Manual changed anyway, and one of them puts a timer on the only party that can stop a UPIC investigation of your practice before it opens.
"Who has to say anything before a Medicaid audit against you becomes real?"
The answer used to be nobody in particular, on no schedule. Effective October 5, it is your state Medicaid agency, inside 14 calendar days, and the default when nobody answers is that the investigation opens (chart below).
What the fourteen days actually buy
Chapter 3, section 3.4 is the vetting rule. Before a UPIC can turn a lead into an investigation, it runs the proposed target past both CMS and the State Medicaid Agency. The SMA can decline, and the manual is explicit about what happens then: "If the SMA declines pursuing the provider/scheme… then the proposed investigation shall be closed." A state that has already looked at you and found nothing can end it there.
That sentence survives 13945 untouched. What changed is the clock around it.
The version live on cms.gov today, stamped Rev. 12871 and issued in October 2024, gives the state no response deadline at all.
It tells the UPIC to log the vetting date and the state's answer in the UCM "State Involvement" tab, and it warns that "leads should not be closed due to delays in the state's response to vetting."
13945 adds three sentences: the state gets two weeks (14 calendar days), the UPIC "shall proceed with opening the investigation" if nothing comes back, and an extension is available only if the state asks before the due date and the CMS Medicaid Business Function Lead approves it.
So the gate is still there. It now closes on a timer, and the timer's default position is open.
The rest of this brief is for subscribers.
The impact tables, the code-level detail, and the rest of the analysis sit past this line.
$50 a month, or $500 a year.
Already a subscriber? Sign in