ZPIC / I-MEDIC Audit Response: What's Different from UPIC

If you received a ZPIC or I-MEDIC letter, treat it as a program-integrity investigation and engage healthcare counsel before responding. ZPIC is the legacy Medicare FFS program-integrity contractor (now consolidated into UPIC); I-MEDIC is the Investigations Medicare Drug Integrity Contractor for Part C and Part D provider, prescriber, and pharmacy fraud, waste, and abuse. Both operate under CMS Pub. 100-08, Chapter 4 authority and can refer matters to OIG, DOJ, and law enforcement, with payment suspension available under 42 CFR § 405.371.

ZPIC, UPIC, and I-MEDIC — sorting the contractor landscape

The first question to answer with counsel: which contractor sent this, and what authority are they exercising. The labels matter because the appeal lanes are different.

• ZPIC (Zone Program Integrity Contractor) — the legacy FFS program-integrity contractor structure. CMS consolidated ZPICs into UPICs from 2017 through 2020. Active ZPIC matters are rare in 2026, but the label still appears on older overpayment demands and on Administrative Law Judge dockets where matters predate the transition.
• UPIC (Unified Program Integrity Contractor) — the current FFS and dual-eligible program-integrity contractor. Five regions cover Parts A, B, DME, Home Health and Hospice, and Medicaid in many states. See the separate UPIC audit response guide for the FFS-lane procedure.
• I-MEDIC (Investigations Medicare Drug Integrity Contractor) — the CMS contractor responsible for investigating provider, prescriber, and pharmacy fraud, waste, and abuse in Medicare Advantage (Part C) and the Medicare Prescription Drug program (Part D). Authority sits under 42 CFR § 422.500 for Part C and 42 CFR Part 423 for Part D. I-MEDIC focuses on provider/prescriber/pharmacy conduct; CMS Center for Program Integrity (CPI) and the separate PPI MEDIC handle plan-sponsor program audits.

A letter that comes through a Medicare Advantage plan or a Part D plan sponsor with reference to "program integrity," "PDE data review," or a CMS contractor named in the body is almost always I-MEDIC. A letter referencing FFS Parts A or B claims directly to CMS is UPIC. A letter that pre-dates 2020 referencing "Zone Program Integrity" is ZPIC.

What is materially different from a UPIC matter

Practices that have walked a UPIC matter sometimes assume ZPIC and I-MEDIC will be procedurally identical. They are not. The differences that change response strategy:

1. Data source. I-MEDIC's primary input is Prescription Drug Event (PDE) data submitted by Part D plan sponsors to CMS, not direct claim submissions. By the time the letter arrives, the contractor has already run prescribing pattern analysis. The narrative must address the underlying clinical pattern, not just the documentation.
2. The plan sponsor sits in the middle. Part C and Part D contracts run between CMS and the plan sponsor. The plan sponsor often initiates contact at the contractor's direction. Counsel must decide whether to communicate through the plan, through the contractor directly, or through both.
3. Appeal structure runs through the plan. FFS appeals under 42 CFR Part 405, Subpart I move from MAC redetermination through QIC reconsideration, ALJ, and the Medicare Appeals Council. Part C and Part D appeals under 42 CFR Part 422, Subpart M and 42 CFR Part 423, Subpart M generally move through the plan, then an Independent Review Entity, then ALJ. The practice may not have direct standing — appeals sometimes move through the plan sponsor.
4. Compliance Program Effectiveness review at the plan level. CMS Center for Program Integrity and PPI MEDIC audit plan-sponsor compliance programs under the Medicare Managed Care Manual, Chapter 21 and the parallel Part D manual. I-MEDIC's provider-side investigations frequently surface conduct that feeds into the plan-level program audit at the next cycle.
5. DEA overlap on Part D. A high-dose opioid or controlled-substance pattern in Part D data routinely triggers parallel DEA interest under 21 CFR Parts 1300-1317. Counsel must run the response with that parallel exposure in mind.

First 24 hours

`` Hour 0–4 Date-stamp the letter. Log the contractor, the named investigator title, the regulatory citations on the letter, the response deadline, and the claim or PDE list referenced. Hour 4–12 Engage outside healthcare counsel. Begin the privileged track. Hour 12–24 Issue a written litigation hold to every workforce member, IT, billing, and pharmacy or clinical vendors. Preserve EHR audit logs, prescribing logs, dispensing records, plan-sponsor communications, and prior-authorization correspondence. ``

Specific moves:

1. Confirm the contractor authority. Read the letterhead, the cited regulatory authority, and the contact's title. "Senior Investigator" or "Program Integrity Investigator" is a different posture than a plan medical-review analyst.
2. Identify the named claims, PDEs, or beneficiaries. Reconcile against the EHR and the prescribing or dispensing system. Pull the relevant records; do not edit them.
3. Identify the data-analysis basis. The letter usually telegraphs the pattern — high-dose chronic opioid prescribing, off-formulary patterns, polypharmacy outside specialty norms, dispensing volume against prescriber NPI. The narrative response must address that pattern with clinical documentation.
4. Inventory the plan sponsor relationship. Pull every plan-sponsor contract, prior-authorization correspondence, and grievance-and-appeal communication tied to the named beneficiaries.
5. Brief leadership under privilege only. No casual discussion. No unencrypted internal email speculating about the contractor's theory.

What NOT to touch

This list is the difference between a civil matter and a criminal referral.

• Do not amend, late-date, or "clean up" the medical record. Any amendment must follow the practice's records policy as a clearly identified addendum with date and signature. Back-dated entries discovered on review escalate civil overpayment matters into criminal fraud referrals and put the prescriber's DEA registration at risk.
• Do not delete prescribing logs, dispensing records, or PDMP query records. The litigation hold extends to every system involved in the prescribing chain.
• Do not refund or self-disclose without counsel coordination. An uncoordinated refund can become an admission. The OIG Self-Disclosure Protocol is a viable tool for some matters but requires deliberate strategy.
• Do not communicate with the plan sponsor informally. Plan-sponsor compliance teams have their own reporting obligations to CMS under 42 CFR § 422.503 and 42 CFR § 423.504. Statements made on a casual call get reported upstream.
• Do not contact the beneficiary about the investigation. Witness tampering exposure is independent and severe.
• Do not refuse a properly scoped document request or site visit. Refusal escalates the matter. Counsel can scope the visit and require it in writing; counsel cannot block legitimate program-integrity authority.

Document production strategy

Standard ZPIC and I-MEDIC document requests include:

• Patient medical records for sampled beneficiaries
• Prescribing records and electronic prescribing logs
• Dispensing records and inventory documentation (for pharmacies)
• PDMP query documentation
• Treatment plans and informed-consent documentation for chronic regimens
• Provider DEA registration and state prescribing license records
• Compliance program documentation
• Training records, including DEA, state prescribing law, and FWA training
• Prior-authorization correspondence with the plan sponsor
• Financial records tied to the alleged scheme

Production is Bates-numbered, indexed against the contractor's document list, and accompanied by a cover letter from counsel that describes the production and asserts privilege over the legal-communications track. Documents withheld for privilege go on a log; they are not produced.

Statistical sampling and extrapolation

ZPIC, UPIC, and I-MEDIC contractors regularly extrapolate from sampled claims or PDEs to a larger universe. The standards live in CMS Pub. 100-08, Chapter 8, § 8.4. Common grounds for challenge:

• Sample size insufficient for the universe size
• Universe definition includes claims outside the alleged pattern
• Sampling not properly random or stratified
• Contractor failed to provide the sampling materials needed to verify methodology
• Extrapolation calculation not at the lower-bound 90% confidence interval as required

Successful extrapolation challenges in Departmental Appeals Board decisions have materially reduced demand amounts. Counsel may engage a statistical expert during the response window, not after the ALJ stage.

The appeal track — Part C and Part D specifics

Recoupment and remedial actions in Part C and Part D follow the appeal structure in 42 CFR Part 422, Subpart M and 42 CFR Part 423, Subpart M:

• Level 1: Plan sponsor reconsideration. Tight deadlines, often 60 days from initial determination.
• Level 2: Independent Review Entity (IRE). The plan auto-forwards if the plan upholds an adverse determination.
• Level 3: Administrative Law Judge — amount-in-controversy threshold applies.
• Level 4: Medicare Appeals Council.
• Level 5: Federal district court.

Provider standing in the Part C and Part D appeal lanes is more constrained than in FFS appeals. Counsel must confirm at the outset whether the provider has direct standing or is appealing through the plan as the named party. Missing that distinction has eliminated viable challenges on procedural grounds in published ALJ decisions.

Outcomes and escalation paths

A ZPIC or I-MEDIC matter can resolve as:

• No finding — uncommon; document the closure
• Educational letter — finding without overpayment demand
• Overpayment demand with or without extrapolation — appealable
• Payment suspension under 42 CFR § 405.371
• Recommendation of revocation of Medicare billing privileges under 42 CFR § 424.535
• Plan-level remedial action — termination from the plan network, recoupment, or CAP imposed on the plan sponsor that flows to the provider
• OIG referral for Civil Monetary Penalties under 42 CFR Part 1003
• DEA enforcement running in parallel on prescribing patterns
• DOJ referral for civil False Claims Act action or criminal prosecution

The escalation path is largely set by what the contractor sees in the practice's response posture.

State-law overlay

State medical and pharmacy boards routinely receive notice of federal program-integrity findings through NPDB and state cross-reporting. Many state boards require self-reporting of federal enforcement actions within a defined window. State Medicaid Fraud Control Units run parallel investigations on dual-eligible patients. State controlled-substance authorities (CURES in California, E-FORCSE in Florida, the Texas PDMP) may open their own files based on the federal pattern.

Counsel maps the federal response strategy against state board self-reporting deadlines, state controlled-substance authority interest, and any parallel Medicaid Fraud Control Unit activity from day one — not after the federal matter resolves.

Restraint about outcomes

No vendor or guide can promise a ZPIC or I-MEDIC outcome. The most predictable variable is the quality and timeliness of the counsel-led response: a documented preservation track, a narrative that addresses the underlying pattern, a Bates-numbered production, and a strategically timed refund or self-disclosure where appropriate. None of that guarantees a result; all of it materially improves the posture.

This guide is not legal advice. Consult outside healthcare counsel before responding to any ZPIC, UPIC, or I-MEDIC contact.

How d3rx fits

The d3rx compliance binder assembles the source-grounded documentation a program-integrity response is built from — prescribing protocols, PDMP query evidence, training logs, FWA program records, DEA registration tracker, BAA inventory. The d3rx audit defense workflow walks the first 48 hours, the litigation hold, the contractor log, and the tab-by-tab production structure. d3rx does not represent the practice in any ZPIC, I-MEDIC, OIG, DEA, or DOJ proceeding and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.