This article originally appeared in ABA’s The Health Lawyer, November 21, 2025.

Recent developments signal a sharp escalation in federal efforts to fight healthcare fraud. Centers for Medicare and Medicaid Services (CMS) Administrator Dr. Mehmet Oz has declared his top priority is “to wage a war on fraud, waste, and abuse.”¹ In this environment, providers must brace for increased scrutiny and enforcement.

Given the administration’s stated priorities, audits by CMS’s Unified Program Integrity Contractors (UPICs) pose greater financial risk. UPIC audits pose substantial financial exposure, as they frequently rely on statistical sampling to extrapolate findings from a small set of reviewed claims across much larger claim populations. While statistical sampling can be a powerful auditing tool, it must meet stringent standards of validity, precision, and reliability to ensure that liability estimates are fair and defensible.

From the perspective of many healthcare providers, UPIC audits fall short all too often. Flawed sampling and extrapolation techniques can dramatically exaggerate overpayment findings, exposing providers to undue financial and legal risk.

This article outlines how legal teams can partner with statistical experts to challenge flawed UPIC audits. It highlights the core statistical principles that underpin valid sampling, common errors that arise during UPIC audits, and effective strategies to contest unreliable extrapolations.

At its core, this paper emphasizes a critical proposition: statistical extrapolation is not immune from challenge—and when UPIC audits fail to meet statistical standards, those challenges can prevail.

UPIC Audits in the Medicare and Medicaid Integrity Framework

UPICs are specialized auditors operating under Medicare’s Center for Program Integrity to detect and combat fraud, waste, and abuse in Medicare and Medicaid.² UPICs investigate billing issues, conduct data analysis and medical review, and identify improper payments for recoupment by Medicare Administrative Contractors (MACs).

UPICs decide which claims to audit by using advanced data analytics to flag suspicious billing patterns, such as unusually high billing frequencies for certain services compared to national or local averages.³ Other triggers include whistleblower reports, referrals from other agencies like the Office of Inspector General (OIG), and random compliance checks.

UPICs rely on statistical sampling and extrapolation. Instead of inspecting every claim, which is typically time- and cost-prohibitive, they examine a sample from the identified target claims population. The sampled claims are evaluated with respect to any overpayments. The findings from the sample are projected to the entire claim universe, leading to large repayment demands drawn from a small pool of claims. Because any flaw in the sample becomes magnified during extrapolation, this step is often central to appeals and affords providers a strong opening to challenge the results with their own statistical analysis.

Sampling rules appear in Chapter 8 of the Medicare Program Integrity Manual (MPIM).⁴ The manual offers broad instructions rather than detailed statistical methods, so it cites authoritative references, such as William Cochran’s Sampling Techniques and Paul Levy and Stanley Lemeshow’s Sampling of Populations.⁵ These texts underscore the complexity of sampling and caution that no “one-size-fits-all” approach exists for designing a reliable sample​.

Statistical Sampling and Extrapolation in UPIC Audits

Understanding how UPICs use statistical sampling is crucial for mounting an effective rebuttal. Statistical sampling involves drawing a subset of claims (the sample) from the total claims in question (the universe) in a manner that allows the results from the sample to be mathematically projected onto the full set. The extrapolation is the process of using the sample’s error findings (e.g., the average overpayment per claim in the sample) to estimate the total overpayment in the universe of claims.

But every step must follow sound statistical principles. A famous warning in Cochran’s textbook is that “Sampling demands attention to all phases of the activity: poor work in one phase may ruin a survey in which everything else is done well.”⁶ A precise extrapolation is meaningless if the sample was drawn from a flawed universe, and a well-defined universe is useless if the sample was biased or non-random. The sections that follow outline the key requirements of a valid sample and highlight common errors that undermine UPIC audits.

Core Requirements of a Statistically Valid Sample

Even for readers without a statistics background, it’s helpful to understand a few core concepts that determine whether a sample and its extrapolation can be trusted. A statistically sound sample should be valid, accurate, precise, and reliable:⁷

• Validity means the sample was selected using proper methods, like a random, probability-based approach that reflects the defined universe. Validity refers to the process, not the result. A sample can be valid but still too small or skewed to be meaningful. It’s the minimum threshold for reliability, but not enough on its own.
• Precision refers to the amount of random error in the estimate, often shown by the width of a confidence interval. A precise estimate doesn’t vary much—like a scale that always reports about the same weight. But precision doesn’t guarantee correctness; a scale can be precisely wrong by consistently showing a weight 20 pounds off. In sampling, low precision means wide margins of error and estimates with high uncertainty should be treated skeptically, especially when UPICs use them to justify large recoupments.
• Accuracy means the sample estimates the correct quantity without systematic bias. A biased sample—say, one that overrepresents high-dollar claims—may consistently overstate overpayments. Accuracy also concerns measuring the right thing. If an audit’s goal was to assess upcoding, but the review only checked for missing signatures, the results may be precise but not accurate for the intended purpose.
• Reliability depends on all three: a reliable estimate comes from a sample that is valid, accurate, and precise. If any one is missing, the extrapolation can’t be trusted.

UPIC audits can be challenged by showing that the sample was invalid, inaccurate, or imprecise, any of which undermines the reliability of the extrapolated overpayment. The next sections explore how these flaws commonly arise.

Common Flaws and Legal Challenges at Each Stage

1. Defining the Audit Universe

The first step in the sampling process is identifying the correct universe of claims.⁸ The audit universe determines what claims are reviewed and what extrapolation applies to. UPICs typically define it as all claims meeting specific criteria (e.g., certain services within a date range). A flawed universe definition undermines the audit from the outset.

The MPIM requires contractors to document this definition clearly, including CPT codes, date ranges, and provider identifiers.⁹ Findings can only be extrapolated to claims that are properly included in this documented universe.

Common errors in defining the universe include:

• Selection bias: Including only high-risk claims (e.g., high-dollar or flagged by modifiers) while omitting lower-risk or compliant claims, which inflates error rates.
• Scope mismatch: Including claims outside the audit period or failing to include all relevant claims.
• Duplicates: Allowing repeated claims in the universe, which increases the chance of selection and distorts results.
• Including claims that were part of previous audits: If the sample frame includes claims that were part of previous audits, then extrapolations from sample results will be inflated.

Flaws in universe definition are foundational. If the universe is biased, incomplete, or inaccurate, any extrapolation based on it can be challenged as unrepresentative and statistically unsound.

2. Selecting the Sampling Unit

The sampling unit is the item randomly selected for review—commonly a claim, line item, date of service, or patient. The unit must be appropriate to the audit scope and support independent selection.¹⁰

Common errors include:

• Improper clustering, like sampling patients without adjusting for claim volume per patient.
• Non-standard units: Using units that aren’t statistically independent (e.g., “penny sampling,” where fractions of payment are treated as units), which invalidates inference.

The unit must reflect the structure of the claims data and ensure independence across selections. If poorly chosen, the sampling unit can introduce systemic bias that contaminates both the sample and extrapolation.

3. Constructing the Sampling Frame

The sampling frame is the actual list of units from which the sample is drawn.¹¹ It must be complete, accurate, and free of duplicates.

Common errors include:

• Incomplete frames: Omitting eligible claims.
• Over-inclusive frames: Including ineligible or unrelated claims.
• Previously audited claims: Including claims already audited elsewhere, which the MPIM suggests should be excluded when constructing the sampling frame.

The frame must mirror the universe exactly. If it is inaccurate or inconsistent with the documented universe, the sample cannot be considered valid.

4. Determining the Sample Size

Sample size determines the precision and reliability of the audit’s results. Larger samples reduce uncertainty, while small samples—especially in variable claim populations—can yield wide confidence intervals and unstable overpayment estimates. Statistical texts and literature propose several alternative ways to derive a sample size algebraically.¹²

Common errors include:

• Undersized samples: Too small to produce valid confidence intervals or support reliable extrapolation.
• Boilerplate sizes: Applying a one-size-fits-all number (e.g., 30 claims), regardless of population characteristics.
• Overlooking precision: Even technically valid samples may produce confidence intervals too wide to support meaningful conclusions. An extrapolated lower bound with excessive uncertainty may not justify a large repayment demand.

Sample size must be tailored to the characteristics of the claim universe and the audit’s objectives. Statisticians should assess whether UPICs justified their sample size choices, used pilot samples to estimate variability, and achieved acceptable precision. If not, the reliability of any extrapolated overpayment is in doubt.

5. Choosing a Sampling Methodology

Sampling methodology defines how units are selected—whether through simple random sampling, stratified sampling, or another approach. The method must reflect the nature of the data and audit goals.¹³

Common errors include:

• Oversimplified sampling methods: Using simple random sampling in a heterogeneous universe, which risks poor representation of key claim types or years.
• Failure to correct for correlated sampling units: In many cases, claims can be clustered into an episode of care, which groups related services for a single patient over a specific period. Claims within the same episode are correlated and failing to adjust for the correlation may bias the results.

Methodology must match the audit’s structure and objectives. A mismatch between method and data undermines both the sample and any conclusions drawn from it.

6. Applying a Proper Random Selection Mechanism

No matter what sampling methodology is chosen, random selection of units is the cornerstone of statistical sampling. Probability sampling means each unit in the frame must have a known, non-zero chance of selection, typically achieved through randomization.¹⁴

Common errors include:

• Improper execution: Technical or coding errors in random number generation.
• Seed reuse: Using the same random seed across different audits, which can create systemic bias.
• Pseudo-random methods: In some audits, auditors claimed to perform random sampling but actually used block selections, such as reviewing all claims from a specific month. This approach does not satisfy the requirement that each unit has an equal and independent chance of selection.

Random selection must be rigorously documented and verifiable. The ability for others to replicate the sample draw by using a seed is typically viewed as proof of the randomness of a sample. Without proper randomization, the entire audit loses its statistical foundation and sample results are no longer suitable for extrapolation.

7. Extrapolating the Sample Results to the Universe

After the sample is drawn and reviewed, the final step is to extrapolate the findings. Extrapolation extends the sample findings to the full universe, estimating total overpayment, typically with a point estimate and confidence interval. The method must correspond to the sampling design and be accurately calculated.

Common errors include:

• Formula mismatch: Using formulas inappropriate to the chosen sample design. For example, using simple random formulas on stratified samples or vice versa.
• Mathematical errors: Arithmetic mistakes in variance, standard error, or bound calculations.
• Extrapolating from invalid samples: Attempting to extrapolate from non-random or improperly drawn samples, which voids statistical inference.

These issues underscore the importance of reviewing all calculations, verifying the application of correct formulas, and confirming that the sampling design was properly carried through to the extrapolation. Any mismatch between the sample design and the extrapolation method can provide strong grounds for challenging the audit’s conclusions.

Key Considerations in Challenging UPIC Extrapolations

In today’s escalating audit environment, healthcare providers must be prepared to evaluate UPIC extrapolations with rigorous scrutiny. Statistical sampling in audits is a highly technical area where errors can have significant financial consequences, particularly when extrapolation extends findings from a sample to thousands of claims.

A thorough review of UPIC methodology should examine each phase systematically: the universe definition, the sample’s validity and independence, the adequacy of the sample size, and whether appropriate formulas were applied in extrapolating results. Identifying technical deficiencies in these areas can form the basis for substantive appeals, demonstrating how methodological flaws may compromise the reliability of overpayment estimates.¹⁵

Misapplication of statistical extrapolation formulas can substantially affect calculated liability. However, extrapolation methodologies are subject to review and challenge.¹⁶ Healthcare providers facing extrapolated overpayment determinations should ensure they have access to the technical expertise necessary to evaluate the statistical validity of audit findings and, where appropriate, develop methodologically sound responses.

Importance of Statistical Literacy to Health Lawyers in UPIC Audits

A lawyer’s understanding of statistics is essential to challenge the integrity of the UPIC’s methodology. Lawyers need the ability to examine key areas of statistics, including:

• Sampling methodology, where the lawyer must evaluate if the UPIC’s sample was truly random and representative of the provider’s claims and recognize when an invalid sample can render the entire extrapolation of overpayment unreliable.
• Statistical validity, where the lawyer should question if the sample size was large enough to be statistically significant. A small sample may not provide useful or reliable information.
• Analysis of excluded data, where the lawyer needs to investigate what data was used versus what was left out. The omission of specific data can affect the statistic’s accuracy and lead to skewed and invalid results.
• Understanding the limitations, where the lawyer will assess the limitations of a statistic and determine if the findings are being misapplied to a provider’s specific situation.

Statistical literacy is also essential in developing case strategy, where a lawyer’s ability to critically analyze and challenge statistical findings will be a powerful tool in negotiations. Furthermore, evaluating a UPIC’s data allows the lawyer to better advise a client on their likelihood of success, potential settlement values, and overall strategy. Moreover, a lawyer can use statistical analytics proactively to help healthcare clients identify and correct billing trends that could trigger a UPIC audit. Lastly, in cases that advance to a higher-level appeals, such as hearings before an administrative law judge (ALJ), lawyers may need to present their own statistical analysis, which likely includes working with statisticians and subject matter experts to analyze the UPIC’s findings, conducting independent statistical reviews, and clearly explaining to the judge why the UPIC’s statistical conclusions are flawed.

Poor statistical literacy can have severe consequences for lawyers and their clients in UPIC cases when flawed findings are accepted. If lawyers cannot critically review a UPIC’s statistical methods, they may concede to an overpayment amount that is inaccurate and unfairly large. When an ineffective defense fails to challenge the statistical foundation of the UPIC’s conclusions regarding overpayments, it may allow an unsupportable extrapolation to become the basis for a significant recoupment demand.

Reach out to Stefan Boedeker and Okem Nwogu to discuss these topics and how StoneTurn can help.

To receive StoneTurn Insights, sign up for our newsletter.

¹ See Dr. Mehmet Oz, Administrator, CMS, Today We Declare War on Fraud, Waste, and Abuse, Fox News (Jan. 22, 2025), https://www.foxnews.com/video/6371929083112.

2 Ctrs. For Medicare & Medicaid Servs., Medicare Program Integrity Manual ch. 4, § 4.2.2 (2024), http://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/downloads/pim83c04.pdf.

³ Id. ch. 2.

⁴ Id. ch. 8. The OIG also publishes guidance on statistical sampling. See Off. of Inspector Gen, Federal Register: Provider Self-Disclosure Protocol, 63 Fed. Reg. 58,399 (Oct. 30, 1998), https://oig.hhs.gov/authorities/docs/selfdisclosure.pdf;

The OIG also issues a statistical program called RAT-STATS to facilitate a sampling-based claims review, which incorporates a detailed user manual. See “RAT-STATS – Statistical Software,” available at http://oig.hhs.gov/compliance/rat-stats/index.asp.

⁵ William G. Cochran, Sampling Techniques (3d ed. 1977); Paul S. Levy & Stanley Lemeshow, Sampling of Populations: Methods And Applications (3d ed. 1999).

⁶ Cochran, supra n. 3, at Chapters 1.3, 8.

⁷ Levy and Lemeshow, supra n. 3, at 20–22.

⁸ Ctrs. For Medicare & Medicaid Servs., supra ch. 8, § 8.4.3.2.

⁹ Id.

¹⁰ Id. ch. 8, § 8.4.3.2.2.

¹¹ Id. ch. 8, § 8.4.3.2.3.

¹² See, e.g., Cochran, supra n. 3, at 78–81, 105–107.

¹³ Ctrs. For Medicare & Medicaid Servs., supra ch. 8, § 8.4.4.1.

¹⁴ Id. ch. 8, § 8.4.2.

¹⁵ MPIM ch. 8, § 8.4.2 provides that when a “particular probability sampling design is properly executed, i.e., defining the universe, the sampling frame, the sampling units, using proper randomization, accurately measuring the variables of interest, and using the correct formulas for estimation, then assertions that the sample or that the resulting estimates are ‘not statistically valid’ cannot legitimately be made.” This statement, however, is expressly conditional. The provision presupposes that each foundational step (defining the universe and sampling frame, selecting the sample through proper randomization, accurately measuring the variables of interest, and applying the correct estimation formulas) has been carried out correctly. Consequently, if any of these steps are materially flawed, such as an incomplete or over-inclusive sampling frame or the use of an incorrect estimation formula, a challenge to the statistical validity of the extrapolation can legitimately be made.

¹⁶ Health Care Fin. Admin., Use of Statistical Sampling to Project Overpayments to Medicare Providers and Suppliers, HCFA Ruling No. 86-1 (Feb. 20, 1986), https://www.cms.gov/medicare/appeals-and-grievances/orgmedffsappeals/downloads/hcfar861v508.pdf.