Who Audits Wound Care Providers — and What Each Audit Type Actually Means
Not all Medicare audits are the same. The word "audit" covers everything from a routine documentation request to a federal fraud investigation. The difference between those two things is significant — in scope, in consequence, and in how a provider should respond. Wound care providers billing skin substitutes are currently facing all of them.
Multiple Medicare contractors have independent authority to review skin substitute claims. [1] Most reviews begin because claims data identifies a pattern that doesn't match coverage, coding, or payment rules — utilization spikes, outlier payment amounts, unusually high frequency compared with peers, or billing that concentrates in a specific site of service. [2] The starting point is almost always data, not a complaint.
Here is what each type of review is, what authority governs it, and what providers can expect when it arrives.
Medicare Administrative Contractor (MAC)
What it is: MACs are the primary Medicare claims processors. CMS divides the country into jurisdictions and contracts with a MAC to handle claims processing, coverage determinations, provider education, and medical review in each region. [3] For most wound care providers, the MAC is the first entity they interact with — through claims processing and through the initial levels of any appeals process.
What it reviews: MACs conduct routine medical review to ensure claims meet coverage, coding, and billing requirements under the applicable Local Coverage Determination. [3] They also issue Additional Documentation Requests (ADRs) — formal requests for records supporting a specific claim or set of claims. An ADR is typically a data-driven selection, not a randomized one, and it is frequently the first indication that a practice's billing pattern has triggered scrutiny. [4]
Who operates in wound care: Novitas Solutions covers Texas and several mid-Atlantic states. Qlarant serves as the UPIC for several jurisdictions and has been among the most active contractors in skin substitute reviews. [5] CGS and Palmetto GBA cover much of the Southeast and Midwest. The specific MAC for a practice depends on geography.
Response window: CMS contractors including Novitas and Qlarant typically give providers 30 days from the date of the letter to respond to a records request. Failure to respond results in a determination that an overpayment was made. [5]
Recovery Audit Contractor (RAC)
What it is: RACs are Medicare Fee-for-Service compliance contractors whose mission, as defined by CMS, is "to identify and correct Medicare improper payments through the efficient detection and collection of overpayments made on claims of health care services provided to Medicare beneficiaries, and the identification of underpayments to providers." [6] RACs are paid on a contingency fee basis — they receive a percentage of improper payments identified — which structures their incentives toward finding overpayments.
What it reviews: RAC issues are vetted through CMS's "new issue" approval process and typically concentrate on payment errors, documentation insufficiency, or noncompliance with coverage and coding requirements. [1] For skin substitutes, RAC reviews have focused on medical necessity documentation, application counts exceeding LCD parameters, and coding accuracy. [4]
What triggers it: Utilization outliers. Elevated billing frequency compared with peers, high per-patient costs, or patterns that suggest systematic billing errors all surface through data analytics. CMS explicitly describes data analysis as "an essential first step in identifying potential billing or payment problems, including finding statistical outliers or patterns within claims that suggest improper billing." [2]
**Important distinction from UPICs:** RACs focus on improper payments. They do not have the same fraud referral authority as UPICs. A RAC audit is an administrative payment review; a UPIC audit can become a federal investigation.
Unified Program Integrity Contractor (UPIC)
What it is: UPICs are the primary program integrity contractors. Their mandate extends beyond identifying billing errors — they are charged with identifying suspected fraud, waste, and abuse, and developing cases for administrative action and law enforcement referral when appropriate. [7] CMS's Medicare Program Integrity Manual, Chapter 4, describes UPIC program integrity managers as holding authority to "guide PI activities and establish, control, evaluate, and revise fraud-detection procedures." [7]
What it reviews:
UPICs conduct medical review, data analysis, and
fraud investigations. They have authority to request medical records, conduct interviews, perform site visits, and refer cases to OIG's Office of Investigations. [7] The UPIC is the contractor that can hand a case to federal law enforcement. In that sense, a UPIC audit is categorically different from a MAC or RAC review.
What a UPIC demand actually looks like:
A UPIC audit demand circulated in wound care compliance circles in 2025 ran to 39 line items. Beyond standard medical record requirements, the demand included all invoices for skin substitutes and wound care products over the prior 12 months, all order forms, any rebate agreements with distributors or manufacturers, and marketing materials presented to the practice by industry representatives. [8] The auditor is not reviewing the claim in isolation. They are reviewing the commercial structure around the claim.
Who operates in wound care:
Qlarant is the UPIC for Jurisdiction 3 (Midwest) and has been among the most active contractors in skin substitute reviews. [5] Novitas, while primarily a MAC, operates in jurisdictions where its reviews have also been heavily active on skin substitute claims.
The referral path:
UPICs maintain formal communication with OIG, DOJ, state Medicaid agencies, other Medicare contractors, and other organizations. [7] A UPIC investigation that finds evidence consistent with fraud or Anti-Kickback Statute violations will be referred. The DOJ's June 2025 national healthcare fraud takedown — the largest in department history, charging 324 defendants in connection with over $14.6 billion in alleged fraud — specifically identified illegal kickbacks from graft distributors to providers as a primary mechanism. [9] Those cases began as program integrity reviews.
Supplemental Medical Review Contractor (SMRC)
What it is:
CMS contracts with a single national SMRC — currently StrategicHealthSolutions, LLC — to conduct nationwide medical reviews of Medicare Part A/B and DMEPOS claims. [10] Unlike MACs, which review claims within a jurisdiction, the SMRC conducts reviews across the entire country on topics selected by CMS. [10]
What it reviews:
SMRC reviews are CMS-directed. The topics selected typically reflect areas where utilization, cost, or billing patterns suggest elevated risk at a national level. [1] The SMRC does not target individual providers based on their local patterns — it reviews claims nationally for a specific service line or billing issue that CMS has identified as a priority.
What it means for wound care:
When CMS directs the SMRC to review a category, it signals that the category has reached a level of concern at the national policy level, not just in individual jurisdictions. Skin substitutes, given the OIG's September 2025 report designating them as "particularly vulnerable to questionable billing and fraud schemes," [11] are a logical candidate for SMRC-directed review.
Comprehensive Error Rate Testing (CERT)
What it is:
CERT is not a targeted audit program. It is CMS's mechanism for measuring the Medicare FFS improper payment rate by reviewing a statistically valid random sample of processed claims each year. [12] The FY 2025 Medicare FFS estimated improper payment rate was 6.55 percent, representing $28.83 billion in improper payments. [12]
How it works:
When a claim is selected for CERT review, the contractor requests supporting documentation from the billing provider. Reviewers assess whether the documentation supports what was billed and whether Medicare coverage, coding, and payment rules were met. If the record is insufficient — including if documentation is simply not submitted — the claim may be counted as a total or partial improper payment. [13]
What makes it consequential:
CERT is a measurement program, not a fraud investigation. But its findings shape MAC education priorities and can spotlight service lines that later become targeted by other reviewers. [13] A high CERT error rate in a service category is a data point that informs where program integrity resources go next. For wound care, the documentation gaps that CERT identifies — insufficient conservative care evidence, missing wound measurements, inadequate medical necessity support — are the same gaps that RACs and UPICs are actively targeting in directed reviews.
OIG and DOJ: When Administrative Becomes Criminal
The audit types above are all administrative. They result in payment denials, recoupment demands, and in serious cases, exclusion from Medicare. The OIG and DOJ represent a different tier. The OIG's Office of Investigations receives referrals from UPICs and conducts independent investigations. When evidence supports it, cases are referred to DOJ for civil False Claims Act prosecution or criminal charges. [14]
DOJ prosecutors investigating wound care fraud under the False Claims Act typically issue a Civil Investigative Demand (CID). Under 31 U.S.C. § 3729-3733, a CID can require a practice to produce documentary materials for inspection and copying, answer written interrogatories, and give oral testimony. [14] Notably, wound care False Claims Act investigations can expand to cover other provider billing practices beyond the original scope of the inquiry. [14]
The cases that have produced criminal convictions in this space — including Arizona providers sentenced to 14 and 15.5 years in federal prison for $1.2 billion in fraudulent skin substitute claims [15] — began as program integrity reviews that escalated through referral to law enforcement. The progression from administrative audit to federal prosecution is not a different process. It is the same process, further along.
The Five-Level Appeals Process
When a claim is denied — whether through MAC review, a RAC finding, or a UPIC demand — providers have the right to appeal through a five-level administrative process established by the Social Security Act. [16]
Level 1 — Redetermination:
Conducted by the MAC. Providers have 120 days from the date of the initial determination to file. The MAC has 60 days to issue a decision. [17]
Level 2 — Reconsideration:
Conducted by a Qualified Independent Contractor (QIC), which is separate from the MAC that issued the denial. Providers have 180 days from the redetermination decision to file. The QIC has 60 days to decide. [17] This is a critical stage: the record closes at the second level. Evidence not submitted by the close of QIC review generally cannot be introduced at later levels. Legal counsel familiar with the appeals process should be involved before or at this stage. [4]
Level 3 — Administrative Law Judge (ALJ) Hearing:
The first opportunity to present before an independent adjudicator not employed by a Medicare contractor. Providers must have at least $180 in dispute (as of 2025) to request an ALJ hearing. [17] The ALJ can review the full record, hear testimony, and issue a binding decision. ALJ proceedings routinely take 12 to 15 months or longer from the time of request. [4]
In one documented wound care case, a clinician who received three consecutive denials from a UPIC and MAC — on grounds that the amniotic products applied were not homologous use, were experimental and investigational, and were not reasonable and necessary — pursued the process through ALJ review. The ALJ issued a 40-page ruling that methodically rejected each of the contractor's positions, finding the products were supported by peer-reviewed human trials and that FDA approval was not the applicable standard for HCT/P products regulated under Section 361 of the Public Health Service Act. The process required specialized legal support and 14 months of active effort. [18]
Level 4 — Medicare Appeals Council (MAC Review):
Either party can appeal an ALJ decision to the Medicare Appeals Council, the appellate body within the Departmental Appeals Board of HHS. [16]
Level 5 — Federal Court:
Providers with at least $1,830 in dispute (2025 threshold) who are dissatisfied with the Council's decision may seek judicial review in U.S. District Court. [17]
The financial structure of this process creates risk independent of its outcome. Providers purchase skin substitute products in advance, at costs that can run thousands of dollars per unit. When Medicare initiates recoupment — which typically continues during the appeals process — there is no mechanism to recover those product costs from manufacturers or distributors. The American Professional Wound Care Association documented cases where entire payment streams were frozen on the basis of a small number of disputed claims, where extrapolation methodologies multiplied alleged overpayments far beyond the original audit sample, and where billing privileges were revoked on the basis of three claims — all under timely appeal at the time. [19]
The audit environment in wound care is not a single thing. It is a layered system of contractors with different authorities, different triggers, and different consequences — operating simultaneously on the same billing population. Understanding which type of review has arrived, what it can and cannot do, and what the response window actually requires is the starting point for navigating it.
*Bionavix works exclusively with private practice wound care providers — podiatrists, vascular specialists, dermatologists, general surgeons, reconstructive plastic surgeons, and mobile wound care companies. Our focus is indication-driven product matching and audit-defensible practice. If you're reassessing your exposure in the current environment, we're worth talking to.*
References
[1] HMP Global Learning Network. "Medicare Audits of Skin Substitutes (CTPs): Who Reviews Claims — and What Triggers an Audit." February 17, 2026. https://www.hmpgloballearningnetwork.com/site/wounds/special-article/medicare-audits-skin-substitutes-ctps-who-reviews-claims-and-what
[2] Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual (PIM), Chapter 2 (data analysis; outlier identification).
https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c02.pdf
[3] Centers for Medicare & Medicaid Services. "Medicare Administrative Contractors (MACs)."
https://www.cms.gov/medicare/medicare-contracting/medicare-administrative-contractors
[4] Frier Levitt. "Frier Levitt's Success at an ALJ Hearing Highlights the Importance of Understanding Medicare Wound Care Audits."
https://www.frierlevitt.com/articles/frier-levitts-success-at-an-alj-hearing-highlights-the-importance-of-understanding-medicare-wound-care-audits/
[5] HCH Lawyers. "Qlarant, Novitas Audits Escalate as Medicare Skin Substitutes Spending Hits $1.6 Billion." July 2025.
https://www.hchlawyers.com/blog/2025/july/qlarant-novitas-audits-escalate-as-medicare-skin/
[6] Centers for Medicare & Medicaid Services. "Medicare Fee for Service Recovery Audit Program."
https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medicare-fee-service-recovery-audit-program
[7] Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual (PIM), Chapter 4 (UPIC program integrity functions).
https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c04.pdf
[8] Kelso, M. "UPIC Auditors Demand Skin Substitute Invoices & Rebate Agreements." Guest Blog, CarolineFifeMD.com, March 2025.https://carolinefifemd.com/2025/03/18/skin-substitute-invoices/
[9] U.S. Department of Justice. "National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud." June 30, 2025.
https://www.justice.gov/opa/pr/national-health-care-fraud-takedown-results-324-defendants-charged-connection-over-146
[10] Centers for Medicare & Medicaid Services. "Supplemental Medical Review Contractor (SMRC)."
https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-and-education/supplemental-medical-review-contractor-smrc
[11] U.S. Department of Health & Human Services Office of Inspector General. "Medicare Part B Payment Trends for Skin Substitutes Raise Major Concerns About Fraud, Waste, and Abuse." OEI-BL-24-00420. September 2025.
https://oig.hhs.gov/documents/evaluation/10939/OEI-BL-24-00420.pdf
[12] Centers for Medicare & Medicaid Services. "Comprehensive Error Rate Testing (CERT)."
https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert
[13] HMP Global Learning Network. "What is CERT?" March 12, 2026.https://www.hmpgloballearningnetwork.com/site/wounds/special-article/what-cert
[14] Liles Parker PLLC. "Responding to Wound Care Audits and Skin Substitute Audits in 2026." January 2026.
https://www.lilesparker.com/2025/12/11/responding-to-wound-care-audits-and-skin-substitute-audits-in-2026/
[15] U.S. Department of Justice. "Wound Graft Company Owners Sentenced for $1.2B Health Care Fraud and Agree to Pay $309M to Resolve Civil Liability Under the False Claims Act." December 12, 2025.
https://www.justice.gov/opa/pr/wound-graft-company-owners-sentenced-12b-health-care-fraud
[16] U.S. Department of Health & Human Services. "Medicare Appeals Backlog Primer."
https://www.hhs.gov/sites/default/files/dab/medicare-appeals-backlog.pdf
[17] Centers for Medicare & Medicaid Services. "Medicare Parts A & B Appeals Process." MLN006562.
https://www.cms.gov/files/document/mln006562-medicare-parts-b-appeals-process.pdf
[18] Fife, C. "Here Comes the Judge! Part 2 of the Incredible Journey of a Skin Substitute Audit." Guest Blog by Michael Crouch.
CarolineFifeMD.com, November 2025.https://carolinefifemd.com/2025/11/17/skin-substitute-audit-part-2/
[19] Sykstus, B.M. "When Compliance Is Not Enough: Skin Substitute Audits, Due Process, and the Limits of Federal Oversight." American Professional Wound Care Association, 2025.
https://www.apwca.org/news/13593553