CMS Fraud Defense Contracts RFI, Due Nov. 4, Would Move Fraud Lead Generation to CMS and Asks Whether Fixed Prices Should Replace the Cost-Plus Terms Behind $1.23B Obligated to UPICs Since 2016

What CMS Fraud Defense Contracts Change, and Whose Revenue Is Exposed

The Centers for Medicare & Medicaid Services (CMS), part of the Department of Health and Human Services (HHS), posted a request for information (RFI) titled “Fraud Defense Contracts” on Oct. 5, 2026. Responses are due Nov. 4, 2026, at 11 a.m. Eastern. The RFI carries a draft Statement of Objectives (SOO) for the CMS fraud defense contracts that would follow today’s Unified Program Integrity Contractors (UPICs). UPICs are the regional firms that investigate suspected Medicare and Medicaid fraud for CMS. Under the draft, CMS would find and rank the leads, and contractors would mainly build the cases CMS assigns.

The revenue stake is incumbent retention first. CoventBridge, SafeGuard Services, and Qlarant hold the five UPIC jurisdiction task orders, about $1.23 billion obligated since 2016. All five are cost-plus-award-fee, with current end dates between Oct. 31, 2026, and Nov. 30, 2027. The draft model removes lead generation from the contractor’s core job and asks how to price the rest fixed-price. For BD leads at the other firms that won UPIC contracts in 2016, and for new entrants such as commercial fraud-analytics firms, the stake is potential new-business capture. CMS is asking what keeps what it calls “nontraditional vendors” out, though no solicitation yet establishes access.

• The RFI is market research only. CMS states that “no contract will be awarded as a result.”
• Medicaid sits outside the draft SOO; CMS says it is still “considering the future Medicaid PI strategy.”
• The Oct. 13 amendment adds confidentiality and Freedom of Information Act instructions but keeps the Nov. 4 deadline.

How the Draft Model Differs From Today’s UPIC Work

The draft SOO moves the front end of fraud work to CMS. Today, UPICs develop leads as well as work cases through to suspensions, revocations, and referrals. CMS describes the new model as “a greater CMS role in lead development, prioritization, and direction of investigations.” CMS’s RFI tells respondents not to be “constrained by” the current UPIC statements of work or the Medicare Program Integrity Manual.

The draft lines up with CMS’s shift toward stopping payments before they go out. CMS’s Fraud Defense Operations Center (FDOC), launched in March 2025, describes its job as detecting threats in real time and shutting down inappropriate billing before Medicare pays it.

Contractors get a narrower job that CMS directs. A contractor would be paid to investigate, document, and support actions, not to find the fraud first. Proprietary analytics would need CMS approval.

Why the Fixed-Price Question Targets Cost-Plus Work

Every current UPIC task order is cost-plus-award-fee. The Investigations Medicare Drug Integrity Contractor (I-MEDIC) task order for Part C and Part D is cost-plus-fixed-fee. Executive Order 14402, signed April 30, 2026, makes “fixed-price contracts with performance-based considerations” the default. For HHS, a new non-fixed-price contract above $10 million needs the agency head’s written approval, a duty the agency head may delegate. Each jurisdiction order has obligated over $200 million, so similar-size successor orders would sit far above that line.

The Northeast task order is recorded as ending Oct. 31, 2026, with no options left. An extension may be signed but not yet reported, so don’t assume a coverage gap.

Question 25 puts three pricing questions to industry:

• Where fixed-price, fixed-unit-price, or hybrid structures fit, and what workload, systems-access, and service-level data a bidder needs to price them.
• What performance standards and incentives would keep outcomes timely and of good quality.
• Which tasks resist fixed pricing, and how to pay without rewarding “the volume of investigations, referrals, or administrative actions over their quality.”

Incumbents hold the workload data that answers this. Separately, question 7 asks what decision timelines, data access, and approvals CMS must commit to under a CMS-led model. Those commitments would likely also set much of the risk in any fixed price.

Competitive Landscape: Three Jurisdiction Incumbents, the Medical-Review Holder, and Commercial Fraud Firms

Seven firms won UPIC indefinite-delivery contracts in 2016. Three hold all five jurisdiction task orders, Noridian holds the national medical-review order, and three hold no task order.

• Incumbents: CoventBridge (USA) LLC, SafeGuard Services LLC, and Qlarant Integrity Solutions LLC. Qlarant also holds I-MEDIC, about $190.8 million obligated and running to Sept. 14, 2027. Question 6 asks whether Part C and Part D investigations should merge into fee-for-service work or stay separate, which bears directly on that order.
• Noridian Healthcare Solutions: the SMRC since 2018, under its UPIC contract, with about $407.4 million obligated and a current end date of May 9, 2027. Question 2a asks what medical-review capability should stay with contractors, and question 5 asks where handoffs involving the SMRC delay or weaken administrative actions.
• UPIC contract holders with no task order: Cotiviti Gov Services, StrategicHealthSolutions, and TriCenturion.
• Commercial entrants: question 26 asks what keeps “commercial special investigations unit (SIU) and analytics firms” from competing. SIUs are the fraud-investigation teams inside health insurers. CMS names no specific firms.
• Conflict-of-interest exposure: question 27 asks how to handle firms that also have “health plan, provider, or other CMS contractor business.” That covers firms with Medicare Administrative Contractor (MAC), health plan, or provider business. How CMS treats that overlap is open.

Question 3 weighs national specialty contractors by provider type, and question 4 asks what jurisdictional structure fits. If CMS carves out provider-type lanes, firms built around one provider type would likely gain ground on firms organized by region.

Which RFI Questions to Answer, by Position

The response form holds 28 numbered questions, several with sub-parts, with a 4,000-character limit per answer. Respondents may answer any subset, and “this is not a request for capability statements.” Work it in this order:

1. Read the six-page draft SOO and mark where it conflicts with how your teams work cases.
2. Answer question 28 (comments on the SOO by page and task area). The RFI also asks respondents to identify where the framework creates risk.
3. Answer the questions tied to your position, listed in the checklist below.
4. Leave out proprietary or sensitive information, as the Oct. 13 amendment asks. Mark any trade secrets you include under Freedom of Information Act Exemption 4, and email redactions and rationale to the contracting officer, copying the CMS FOIA office.
5. Email only the completed response form to contracting officer Jennifer Kuhn before 11 a.m. Eastern on Nov. 4.

• Incumbent capture leads: use aggregate, non-sensitive figures from your own operations to show where CMS approval steps would slow suspensions (questions 5, 7, and 8), and which tasks resist fixed pricing (question 25c).
• Other UPIC contract holders: argue for a national provider-type lane you can staff today (question 3).
• Commercial SIU and analytics firms: list concrete entry barriers (systems access, security authorization, past-performance rules) under question 26, and lead with investigators and clinical reviewers, since analytics need CMS approval.
• Clinical-review and investigator-staffing firms, whether small businesses or mid-market: answer questions 2a and 9 on medical-review scope and staff qualifications, then contact the incumbents (CoventBridge, SafeGuard Services, Qlarant) and the other UPIC contract holders (Noridian, Cotiviti Gov Services, StrategicHealthSolutions, TriCenturion).
• Firms with health plan or MAC business: answer question 27 before CMS writes the conflict rules without you.

What Would Change the Read for Bidders

I would treat the near-term action as a response, not a capture plan. No value, vehicle, set-aside, or schedule for the successor has been published, so pursuit budgets are premature. Incumbents should defend now with evidence, because the draft SOO sets out CMS’s direction to shrink the contractor’s front-end role. Other UPIC contract holders and commercial fraud firms should shape jurisdiction and pricing, and clinical-review, investigator-staffing, and small firms should settle teaming with a likely prime before any draft RFP.

Three events would move this to active pursuit: a draft RFP or forecast with a value and jurisdiction map, an industry day, or a separate Medicaid program-integrity acquisition. The read weakens if CMS keeps the work in-house, places it on an existing vehicle, or issues a final SOO that restores today’s UPIC scope.

FAQ

When are responses to the CMS Fraud Defense Contracts RFI due?

Responses are due Nov. 4, 2026, at 11 a.m. Eastern, unchanged by the Oct. 13 amendment. Email only the completed response form to contracting officer Jennifer Kuhn.

Is the UPIC recompete underway?

Not formally. The RFI is market research, and CMS says no contract will result from it. It does describe the successor model. Every jurisdiction task order has a current end date on or before Nov. 30, 2027, though options could extend Western to Dec. 31, 2027, and Southeast to Feb. 17, 2028.

Does Medicaid fraud work fall under this RFI?

Only as questions. The draft SOO covers Medicare program integrity. Question 11 asks how CMS, state Medicaid agencies, and Medicaid Fraud Control Units should split Medicaid work, which suggests a separate decision.

What happens to cases in progress during a transition?

The draft SOO requires transfer of active investigations, records, evidence, and pending actions “as directed by CMS.” Question 8 asks how to move in-flight cases and active suspensions safely, and on what timeline.

Who owns AI models a contractor builds under the new model?

CMS has not decided. Question 13 asks about explainability, human review before action, model validation, ownership, and portability at contract end.