RAC Audits were introduced in 2005 under a three state pilot program as part of an effort to improve the accuracy and efficiency of healthcare payments. Due to the success of the pilot project, in 2010, Congress expanded the program nationwide by passing legislation to allow Medicare to use Recovery Audit Contractors (RAC’s) to identify and correct improper payments. That said, an RAC Audit stands for Recovery Audit Contractor Audit. The RAC program is overseen by the Centers for Medicare & Medicaid Services (CMS) in the United States, and it’s purpose is to identify and recover improper payments made by Medicare and medicaid to healthcare providers and suppliers. RAC audit attorneys like those at Chapman Law Group help guide and defend providers from medicare audits and those alike.
RAC’s begin by conducting data analysis useing advanced tools to scrutinize Medicare claims for anomalies. This may include unusually high volumes of claims, inconsistent billing patterns, or discrepancies in coding practices. Once potential issues are flagged, claims are selected for further review. RAC’s review the documentation to assess compliance with CMS regulations. If overpayments are identified the funds are recouped, often through payment adjustments or direct recovery efforts. Conversely, underpayments result in reimbursement to the provider. Providers are notified of the audit results through a determination letter, which includes a detailed explanation of the findings. If the provider disputes the outcome, they have the right to an RAC audit appeal through a five-level Medicare appeals process, culminating in federal court review if necessary.
CMS contracted with RAC auditors for five regions in the United States and designated one for each area. The RAC auditor for Region 5 is dedicated to review of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) and Home Health / Hospice.
Above is a regional map of each company that CMS contracts to conduct RAC audits:
Recovery Audit Contractors are compensated ona contingency fee basis. This means they are paid a percentage of the overpayments or underpayments they identify and collect. RACs are not paid when the potential overpayment is first identified but are only paid when the money is actually recovered. The exact percentage of the recovered amount is set during the bidding process when the RAC is contracted by CMS. The RACs must return the fee if a payment is overturned at any level of appeal.
This payment model creates a financial incentive for RACs to thoroughly audit claims and uncover improper Medicare payments. RACs are audited by a RAC Validation Contractor and the RAC’s accuracy score is published annually.
RAC audits are typically triggered by billing trends and anomalies that suggest potential improper payments to medicaid and medicare providers. For example:
CMS also defines annual focus areas that guide RACs, often targeting areas with historically high error rates or significant financial impact, such as short inpatient stays or high-cost outpatient services.
Providers with a history of improper payments or frequent billing errors are at higher risk for audit scrutiny. Additionally, RAC audits may be triggered by provider-specific factors such as inadequate documentation, the use of modifiers to bypass edits (e.g., -25, -59) or claims for services that exceed Medicare coverage limits.
Automated reviews involve no direct interaction with the provider and are based solely on electronic data. The RAC uses software designed to detect these errors. These reviews target obvious errors, such as duplicate billing or incorrect application of coding rules.
Complex reviews require the submission of medical records. Providers are formally notified via an Additional Documentation Request (ADR), and they must respond within the specified time, typically 45 days.
All providers and suppliers that submit claims to medicare and medicaid are subject to RAC audits. This includes the broad range of healthcare organizations and professionals that participatie in the Medicare “Fee-for-Service” (FFS) program. RAC’s are also tasked with identifying improper payments across all Medicare Part A and Part B claims.
Inpatient – For inpatient settings RAC’s frequently assess the medical necessity of admissions, often scrutinizing short stays for compliance with the two-midnight rule. This rule states that “Inpatient admissions would generally be payable under Part A if the admitting practitioner expected the patient to require a hospital stay that crossed two midnights”. Diagnosis-Related Group (DRG) coding is another focus area, as errors in DRG assignments can lead to substantial payment discrepancies. These DRGs are a patient classification scheme which provides a means of relating the type of patients a hospital treats (i.e., its case mix) to the costs incurred by the hospital.
Outpatient – Outpatient claims, while less focused on admissions, are often reviewed for the appropriate bundling of services, compliance with outpatient prospective payment systems, and accurate coding of high-cost services like imaging or chemotherapy. Both inpatient and outpatient hospital audits share a reliance on documentation to justify medical necessity and accurate coding.
RAC programs often target Evaluation and Management (E/M) services, with the focus being on the accuracy of coding levels in relation to their documentation. Their goal is to evaluate whether the level of care billed matches the complexity and time spent on patient services rendered. Common issues include upcoding, unbundling, and misuse of modifiers like -25, which is used for significant, separately identifiable services. Physician audits also emphasize the necessity of ensuring that time-based billing (e.g., prolonged services) are well-documented. While physician practice audits are narrower in scope compared to a hospitals, meticulous documentation is still necessary, and hiring a third party RAC audit attorney to run an internal audit allows for early detection of any compliance issues.
Skilled nursing facilities face RAC audits primarily for errors in the Resource Utilization Group (RUG) system. RACs assess whether the level of care billed corresponds to the intensity and duration of services provided. Auditors also review the Minimum Data Set (MDS) documentation to ensure compliance with Medicare’s requirements. Inadequate documentation or discrepancies in patient assessments can result in significant findings.
For DME providers, RAC audits focus heavily on medical necessity and adherence to Medicare coverage policies. This includes verifying that equipment, such as orthotics or prosthetics, meets established criteria and is appropriately documented in the patient’s medical record, improper use of modifiers, exceeding supply limits, or billing for non-covered items are common audit findings in this category.
Home health providers face a unique scrutiny due to the patient’s homebound status, and the necessity for accompanied skilled nursing or therapy services. RAC’s evaluate whether the services align with the physicians plan of care, and whether the documentation supports the need for home health interventions. Frequent issues include inadequate documentation of patient progress, or failure to justify the frequency and duration of services.
Despite their differences, RAC audits share several commonalities across all healthcare settings.
RAC audits are subject to a three-year look-back period from the date the claim was initially paid. This means that RACs can review claims submitted and reimbursed within the past 36 months to identify potential overpayments or underpayments. In some cases, states may request and receive approval from CMS to extend the lookback period beyond three years. This occurs when the RAC requests and receives approval from the State, and the State requests and is granted an exception from CMS.
While Recovery Audit Contractors have broad authority to audit Medicare Part A and Part B claims, there are specific limitations on what they can review or access within a healthcare providers organization. These boundaries ensure that RAC’s operate within the CMS guidelines and do not overstep their regulatory authority.
RACs cannot request or review internal, proprietary documents that do not directly relate to the claims under review, such as:
These documents are considered part of the provider’s internal operations and fall outside the RAC’s scope of authority unless a direct connection to claim accuracy or medical necessity can be demonstrated.
RACs are not authorized to access peer review or quality assurance records that are protected under state and federal laws. These documents are often part of internal clinical quality improvement processes, which are shielded to encourage open discussion and analysis of care delivery. RACs are limited to reviewing the medical records, claims data, and relevant supporting documentation used to justify billed services.
RACs are only authorized to review claims submitted for Medicare Fee-for-Service (FFS) reimbursement. They cannot review records related to:
If an audit inadvertently includes non-Medicare claims, providers have the right to push back and request the exclusion of those records.
RACs are restricted to reviewing documentation and medical records directly tied to the claims under audit. This means:
For instance, if a claim is for an outpatient imaging service, RACs cannot request inpatient records or treatments from years prior unless directly relevant to that billed service. In some cases, states may request and receive approval from CMS to extend the lookback period beyond three years. This occurs when the RAC requests and receives approval from the State, and the State requests and is granted an exception from CMS.
RACs cannot review verbal conversations or internal communications between providers, staff, or administration that are not part of the official medical record. This includes:
Only formal medical documentation, such as physician notes, treatment orders, and progress reports, are subject to RAC review.
When interacting with RAC auditors, the goals is to ensure that the audit process proceeds smoothly while protecting your rights and interests. Doing so requires clear, professional, and compliant communication. Knowing the difference between what is appropriate versus inappropriate communication will avoid unintentional disclosures, missteps, or delays that could negatively impact the outcome.
The Recovery Audit Contractor (RAC) audit process is a multi-step procedure involving claim selection, notification, documentation review, determination of findings, recoupment, and appeals. Each stage is structured to identify and recover improper Medicare payments but also places a significant administrative and financial burden on healthcare providers. By understanding each phase, a healthcare provider can develop strategies to minimize disruptions effectively defend against audit findings, healthcare fraud allegations, and protect their organizations long term viability.
The RAC audit process begins with the identification of claims for review. This step is driven by advanced data analytics and discretionary contractor expertise. Recovery Audit Contractors use algorithms to examine claims for irregularities, inconsistencies, and patterns that suggest improper payments. This analysis focuses on areas where CMS has identified high risk for error or where significant amounts of reimbursement are concentrated. RACs are not permitted to review claims indiscriminately; instead, CMS approves specific target areas that align with historical trends of overpayment or billing abuse. (The details going over the scope of RAC audits, and what triggers RAC audits fit into this section, and create their own nuance as to how defense and/or appeals are handled in later sections.)
Once a claim is selected for audit, the RAC notifies the provider through formal channels. In automated reviews, RACs identify errors directly from claims data, requiring no additional input. These reviews typically target straightforward issues such as duplicate billing, coding mismatches, or claims that violate established payment policies. Providers can receive an overpayment notification letter of any and all errors along with a request for reimbursement of the incorrect payments.
In contrast, complex reviews involve Additional Document Requests (ADR), which are more labor-intensive and have strict deadlines.
A RAC typically notifies a provider of an audit by sending an “Additional Document Request” letter (ADR), which can be considered a “demand letter.” The letter will specify the claims under review, the suspected overpayment amount, and the timeframe for submitting requested medical records. Typically in this phase of the complex review under 42 CFR § 405.929 Post-payment review, a provider or supplier will be required to submit comprehensive documentation within 45 days of receiving the ADR. Requested records often include things like:
This tight deadline can places enormous pressure on providers with limited administrative staff and/or poor record keeping. Failure to respond to the demand letter within the 45 day timeframe results in an automatic denial of the claim, and a finding of overpayment.
Providers can however, mitigate risk by implementing comprehensive compliance programs and conducting internal audits done by specialized healthcare compliance attorneys. By establishing a designated team, you help ensure documentation requests are addressed promptly and accurately, as opposed to incomplete or unclear documentation which often leads to unfavorable findings, even if services themselves were legitimate.
Once documentation is submitted, RACs evaluate claims against Medicare’s coverage policies, coding requirements, and clinical standards. This phase scrutinizes three key areas:
Following the review, RACs issue a determination letter which outlines the audit findings. If errors are identified, the letter specifies the amount of overpayment and provides details of the findings. Providers who disagree with the findings must carefully examine the letter to identify areas of dispute, particularly where RACs may have misinterpreted documentation or applied policies incorrectly.
The recoupment process is initiated when an RAC determines that a provider or supplier has received an overpayment. Under 42 CFR § 405.371, Medicare contractors have the authority to offset or recoup payments in whole or in part. Recoupment, in this context, refers to the recovery of overpaid funds by reducing or withholding payments for future claims submitted by the provider. This method is the primary approach used by CMS to ensure reimbursement for identified overpayments, though providers may also choose to repay the overpayment directly.
Once formally notified, if the provider does not challenge the findings or resolve the overpayment, recoupment begins. This process can cause significant cash flow burdens, as offsetting future payments can create a financial strain on the business, especially for smaller practices or organizations operating with limited reserves. Providers must carefully evaluate the financial impact of recoupment and, if necessary, negotiate repayment plans with Medicare to mitigate disruptions. Installment agreements are an option in cases where recoupment would otherwise jeopardize the organization’s ability to operate or deliver care.
Individuals depicted or heard in the foregoing media appearance or images may no longer be current attorneys, employees, members or affiliates with Chapman & Associates, PC or The Chapman Law Group (the “Firm”), including Ronald W. Chapman, II who is no longer affiliated with the Firm. For a current listing of the attorneys and services available with the Chapman Law Group, please see
https://chapmanlawgroup.com/team.
In cases of credible allegations of fraud—a situation distinct from standard overpayment recovery—CMS or its contractors may suspend payments outright while the investigation is ongoing. Payment suspensions can occur based on reliable information suggesting that payments may not be correct, though exceptions exist. For example, CMS may decide not to suspend payments if doing so would compromise beneficiary access to care or jeopardize ongoing investigations conducted by federal prosecutors such as the Office of Inspector General (OIG) or the Department of Justice (DOJ).
While payment suspensions are reviewed every 180 days, they can remain in place for up to 18 months if investigations are unresolved. Extensions beyond this period require written justification, such as pending criminal or civil proceedings or ongoing administrative actions. For providers, prolonged suspensions add another layer of financial and operational uncertainty.
Yes, RAC (Recovery Audit Contractor) auditors have, in some instances, incorrectly applied outdated CMS regulations or guidance during the review process. While RACs are required to adhere strictly to current Medicare policies and CMS rules at the time the audited claim was submitted, mistakes can happen due to the complexity of regulatory updates and the evolving nature of Medicare guidelines. Areas where outdated regulations can be misapplied include but are not limited to:
While Recovery Audit Contractor (RAC) audits are broad in scope and apply to most Medicare Part A and Part B providers, there are certain safe harbors and statutory exceptions that limit RAC audit authority. These protections are designed to prevent undue burdens on providers and to ensure fair and reasonable audit practices.
RACs are prohibited from auditing claims that have already been reviewed or are under active review by another Medicare audit program. This includes claims reviewed by:
If a claim has been reviewed and resolved under one of these programs, it cannot be re-audited by a RAC. This statutory exception prevents duplicate reviews and protects providers from being audited multiple times for the same claim.
RACs are generally limited to auditing claims based on the paid date within a three-year look-back period. However, claims older than three years are not off-limits and CMS may expand this period in the event that there is suspected fraud, or new information surfaces that indicates incorrect records.
RACs cannot pursue recoupment for claims that are currently under active appeal. If a provider disputes a RAC finding and files an appeal, the recoupment process is paused until the appeal is resolved. This protection prevents providers from being forced to repay disputed overpayments before the appeal process has concluded.
RACs are specifically limited to reviewing claims submitted under Medicare Fee-for-Service (FFS) programs (Parts A and B). They are not authorized to audit claims submitted under Medicare Advantage (Part C), and Medicare Prescription Drug (Part D).
CMS places statutory caps on the volume of medical records that RACs can request from providers. The limits are based on the size of the provider and the type of claims being audited. For instance:
Yes, Recovery Audit Contractor findings can be appealed, and healthcare providers have a structured process to contest any unfavorable determinations. Appealing RAC findings is a right and safeguard to ensure fairness and accuracy in the Medicare audit process. RAC audits by their nature can sometimes result in incorrect findings due to misinterpretation of documentation, coding errors, or disagreements over medical necessity. Providers must be prepared to defend their claims through a formal appeals process to prevent unjustified recoupments.
The appeals process consists of five levels, each offering an opportunity for further review and reconsideration. Success at any level can result in the reversal of RAC findings. However, strict timelines and evidentiary requirements at each stage demand a proactive and well-documented approach.
While this stage offers a relatively straightforward opportunity to correct minor errors, such as coding mistakes or missing documentation, success rates are often low because the same contractor that initially processed the claim conducts the review.
To succeed at this level, providers need to submit comprehensive documentation and detailed arguments explaining why the RAC’s findings were incorrect. The QIC’s decision is based solely on the evidence submitted; therefore, providers should carefully compile all relevant records such as physician notes, treatment plans, coding explanations, and references to Medicare coverage guidelines.
The ALJ hearing can be conducted in person, via video conference, or by telephone, providing flexibility to providers. This is adventageous as the ALJ reviews the case independently, considering both the documentation and oral arguments presented. Providers who succeed at this level often do so by clearly articulating the clinical justification for their claims, and demonstrating compliance with Medicare policies. Thorough preparation, organized documentation, and strong compliance council can make a significant difference in the outcome.
The Appeals Council does not typically conduct a new review of the evidence; instead, it examines the ALJ’s decision for errors in interpretation or procedure. To succeed, arguments must be well reasoned, highlighting errors and inconsistencies in the ALJ’s findings. It is important to note that this stage is less likely to result in overturned decisions compared to the ALJ hearing.
The federal court review is a highly formal legal process that requires the expert legal counsel, preferably one who specializes in medicare provider appeals. The court will review the case based on medicare law, regulations, and evidence presented at previous levels. These federal court reviews are often time consuming and costly, but offer a final opportunity for providers to challenge RAC audit findings, particularly in cases involving substantial financial implications or complex regulatory issues.
Yes, conducting an internal assessment before being audited is the best way to identify overpayments and any other discrepancies. By reviewing billing, coding, and documentation processes proactively, a medical provider can pinpoint errors, such as improper use of modifiers, coding inaccuracies, or insufficient documentation for medical necessity. Healthcare professionals correcting these issues ahead of time not only reduce their likelihood of RAC audit findings but also demonstrates a commitment to medicare compliance regulations, which is encouraged under medicare’s guidelines, and can be taken into account in proceedings. Chapman Law Group can help guide healthcare professionals through the audit process and put plans in place to help prevent any legal violations.
If an internal audit reveals overpayments, providers are obligated to report and return those funds. Under CMS guidelines, overpayments must be reported and returned by 60 days after identification or the due date of any corresponding cost report. Providers can utilize the CMS Voluntary Self-Referral Disclosure Protocol (SRDP) to disclose actual or potential violations of the physician self-referral statute. Additionally, the OIG’s Self-Disclosure Protocol is available for reporting other types of overpayments, and timely self-disclosure can mitigate potential penalties.
If you’ve read this far, you now understand just how immense of a task it is to have to manage disputes of audits done by Recovery Audit Contractors, and correct any inaccuracies in medical billing. Hiring a knowledgeable healthcare attorney who specializes not just in healthcare compliance law, but healthcare fraud defense, and federal appellate law is crucial when dealing with these intricate government entities. Chapman Law Group is a healthcare defense law firm that has a long history of defending healthcare professionals nation wide. Defending healthcare providers against RAC audits is among one of our specialties, while our firm as a whole is specifically tailored to defending professionals in most areas of healthcare law.
We hope this article has brought you value, and has empowered you with knowledge that helps you take the next necessary steps in protecting your practice. Contact Chapman Law Group below via the contact form, or call button to discuss how we can help you with RAC audits, and any other healthcare legal matter you may have.
"*" indicates required fields
In 2022, prosecutors charged a pharmacy owner with $14.5 million Medicare kickbacks. They alleged they paid kickbacks to telemarketing …….
Following review of our physician’s compliance plan, the government choose to dismiss the investigation without taking any adverse action.
Instead of potentially facing charges under the False Claims Act, the provider was paid the governmental incentive for properly achieving meaningful use or the exclusions thereunder.
New healthcare business ventures can easily, sometimes unknowingly run afoul of Stark Law, Anti-Kickback, and the False Claims Act. Here’s how to be sure you are being fully compliant and not violating any state and federal laws.
Here’s why it’s important to take a closer look at whether your medical practice is staying compliant — and not engaging in kickbacks in health care.
Table of Contents DOJ Has Recovered $34 Billion Since 1986. Settlements Can Reach in the Millions. As a Licensed Medical Professional, What Should You Know?
