A RAC audit is a post-payment review of Medicare claims conducted by private contractors hired by the Centers for Medicare & Medicaid Services (CMS) to identify and recover improper payments. The program was created by federal law in 2003, tested through a pilot that uncovered more than a billion dollars in incorrect payments across just three states, and eventually rolled out nationwide. If you work in healthcare billing, hospital administration, or physician practice management, RAC audits are one of the most consequential oversight mechanisms you’ll encounter, and understanding how they operate can save significant time, money, and frustration.
Where the Program Came From
Congress authorized the Recovery Audit Contractor program through the Medicare Prescription Drug, Improvement, and Modernization Act of 2003. The idea was straightforward: CMS would hire outside contractors, pay them on a contingency basis, and task them with combing through Medicare claims to find payments that should not have been made or payments that should have been higher. A few years later, the Tax Relief and Health Care Act of 2006 made the program permanent and required CMS to roll it out to every state no later than 2010.1PubMed Central. CMS’s Recovery Audit Contractor Initiative
Before the national rollout, CMS ran a pilot project in three states. That pilot identified more than $1 billion in incorrect payments, the overwhelming majority of which were overpayments that hospitals and providers had to return to the Medicare Trust Fund.2Journal of the American Geriatrics Society. RAC attack–Medicare Recovery Audit Contractors: what geriatricians need to know Those results made the program’s expansion politically easy to justify. For hospitals, however, the pilot was a warning signal. The scale of recoveries meant that virtually every Medicare-billing provider would face scrutiny once the program went national.
What RAC Auditors Actually Look For
RAC auditors review Medicare Part A and Part B claims after payment has already been made. They are not looking at claims before they’re paid, which is a separate process handled by Medicare Administrative Contractors. Instead, RACs go back through claims that have already been settled and ask whether the payment was correct. This means a hospital or physician practice can receive a demand letter months or even years after the original service was provided.
The audit focuses on two main areas. The first is documentation of medical necessity for inpatient admission. When a patient is admitted to a hospital as an inpatient rather than kept under outpatient observation, the hospital bills Medicare at a substantially higher rate. RAC auditors examine whether the clinical documentation actually justified an inpatient stay. The second major focus is the three-day qualifying stay for skilled nursing facility care, which matters greatly for older adults who need rehabilitation or extended nursing after a hospitalization.2Journal of the American Geriatrics Society. RAC attack–Medicare Recovery Audit Contractors: what geriatricians need to know Beyond these headline issues, RACs also review claims for duplicate billing, incorrect coding, and services that were not covered under the patient’s benefit category.
An important point that sometimes gets lost: RAC audits are not exclusively about clawing money back from providers. The program is also designed to identify underpayments, cases where Medicare paid less than it should have. In practice, though, the vast majority of identified errors are overpayments. This imbalance is partly structural. RAC contractors are paid a percentage of what they recover, so they have a financial incentive to find overpayments rather than underpayments. Providers sometimes point to this incentive as a fundamental flaw in the program’s design.
How the Two Types of Review Work
RAC audits fall into two categories: automated reviews and complex reviews. The distinction matters because they operate very differently and carry different implications for your practice or facility.
Automated reviews do not require medical records. The RAC contractor runs Medicare claims data through software that flags clear-cut billing errors. These are things like duplicate payments for the same service on the same date, claims submitted for services that are never covered by Medicare, or billing codes that are logically inconsistent with each other. Because no chart review is involved, automated reviews can process enormous volumes of claims quickly. If you receive a demand based on an automated review, the error is usually apparent from the claim itself.
Complex reviews are the ones that cause the most headaches. Here, the RAC contractor requests the patient’s actual medical records and has a clinician review them to determine whether the documentation supports the service billed. These reviews typically focus on inpatient admission status, since the question of whether a patient truly needed an inpatient stay versus outpatient observation is inherently a matter of clinical judgment. CMS limits the number of medical records a RAC can request from any single provider during a given period to prevent the process from becoming completely unmanageable, but even with those limits, the administrative burden is substantial.
What Happens After a Claim Is Flagged
When a RAC auditor determines that a payment was improper, the contractor sends a letter to the provider explaining the finding and the amount to be recouped. What happens next depends on whether the provider agrees with the determination.
The first opportunity to push back is the discussion period. This is an informal window where the provider can contact the RAC directly and present additional documentation or argue that the determination was wrong. Research at three academic medical centers found that about a third of all settled contested claims were resolved during this discussion period in the provider’s favor.3PubMed. Recovery Audit Contractor audits and appeals at three academic medical centers That is a significant number, and it’s worth noting that these favorable outcomes during the discussion period are not captured in federal appeals data. In other words, the official statistics on RAC determinations may understate how often providers successfully contest audit findings.
If the discussion period does not resolve the issue, the provider can enter the formal appeals process. Medicare appeals have five levels, starting with a redetermination by the Medicare Administrative Contractor and potentially ending at the federal court level. The process is designed to be thorough, but thoroughness comes at a cost: the average time to work through appeals was roughly a year and a half in a study of academic medical centers, with significant variation.3PubMed. Recovery Audit Contractor audits and appeals at three academic medical centers
Faced with those timelines, many providers make a pragmatic choice. The same study found that almost half of all settled contested cases were withdrawn by hospitals and rebilled under Medicare Part B rather than endure the appeals process.3PubMed. Recovery Audit Contractor audits and appeals at three academic medical centers Part B reimburses at a lower rate than Part A inpatient billing, so the hospital still takes a financial hit, but a smaller and faster one than potentially losing an appeal after months of waiting. This rebilling strategy has become a common response, particularly for cases where the inpatient-versus-outpatient question is genuinely ambiguous.
The Two-Midnight Rule and Inpatient Status Disputes
The single biggest friction point between RAC auditors and hospitals has been the question of when a patient should be classified as an inpatient versus kept under outpatient observation status. This matters for hospitals because inpatient stays are reimbursed at higher rates, and it matters for patients because their out-of-pocket costs and eligibility for post-acute care can change dramatically depending on their status.
In 2013, CMS introduced the two-midnight rule to try to bring some clarity to this chronic dispute. Under the rule, if a physician expects that a patient will need hospital care spanning at least two midnights, the admission generally qualifies as an inpatient stay. If the expected stay is shorter than two midnights, the patient should typically be treated under outpatient observation status. CMS also initially pulled RAC contractors back from reviewing short inpatient stays, recognizing that the new rule needed time to take effect before aggressive post-payment auditing resumed.4Journal of Hospital Medicine. Changes to inpatient versus outpatient hospitalization: Medicare’s 2-midnight rule
The two-midnight rule did not end the controversy. Hospitals argued that clinical judgment should drive admission decisions, not an arbitrary time threshold. Patient advocates noted that observation status often left patients paying higher copays for services that felt, from the patient’s perspective, exactly like being hospitalized. And RAC auditors eventually resumed reviewing these cases, armed with the two-midnight benchmark as a clearer standard against which to measure claims. The rule reduced some of the ambiguity, but the fundamental tension between clinical flexibility and billing standardization persists.
The Administrative Cost of Being Audited
Beyond the direct financial impact of returned overpayments, RAC audits impose real operational costs on healthcare providers. Responding to record requests means pulling charts, copying documentation, assigning staff to coordinate responses, and potentially hiring outside consultants to handle appeals. For smaller practices, this can be an outsized burden relative to the amounts at stake.
Research examining Medicare audits more broadly found that monitoring does increase providers’ administrative costs, but that these costs are mostly incurred upfront and include investments in technology to assess the medical necessity of care.5PubMed Central. Monitoring for Waste: Evidence from Medicare Audits In other words, the initial adjustment to operating under RAC scrutiny is expensive, but over time, the systems providers build to protect against audit findings become part of their normal workflow. Hospitals that invest in clinical documentation improvement programs, utilization review teams, and real-time status determination software tend to fare better in audits because they generate stronger documentation from the start rather than trying to reconstruct justifications after the fact.
This dynamic creates an uneven playing field. Large academic medical centers and health systems can absorb the upfront investment and staff entire departments dedicated to audit response. Smaller community hospitals and independent physician practices often cannot. The result is that the administrative burden of the RAC program falls disproportionately on providers with fewer resources, even though the billing errors the program targets are distributed across providers of all sizes.
Why Providers Win More Often Than You Might Expect
The public narrative around RAC audits often focuses on the billions of dollars recovered by the program, which can create the impression that the contractors are almost always right. The reality is more nuanced. When providers actually contest RAC determinations, they win or reach favorable outcomes at rates that would surprise most people outside the billing world.
The discussion-period resolution rate of roughly one in three contested cases being decided in the hospital’s favor before formal appeals even begin suggests that a meaningful share of RAC determinations do not survive initial scrutiny.3PubMed. Recovery Audit Contractor audits and appeals at three academic medical centers And at higher levels of appeal, particularly before administrative law judges, overturn rates have historically been even higher. This has created a peculiar dynamic: RAC contractors identify overpayments, CMS recoups the money, providers appeal, and a substantial portion of the money eventually flows back to providers. The cycle ties up resources on all sides and has led to periodic backlogs in the appeals system.
For providers, the takeaway is that contesting a RAC determination is often worth the effort, but only if you have the documentation and the organizational capacity to see it through. The lengthy appeals timelines mean that even a successful appeal can leave a provider without that revenue for well over a year. Cash-flow considerations drive many of the decisions about whether to appeal or simply rebill at a lower rate.
How Providers Reduce Their Audit Exposure
The most effective defense against RAC audits is not the appeals process but the documentation that prevents adverse findings in the first place. Hospitals and practices that perform well in RAC audits share several common practices.
- Real-time utilization review: Rather than waiting until discharge to determine whether a patient’s stay qualifies as inpatient, case managers review each case while the patient is still in the hospital. If the documentation does not support inpatient status under the two-midnight rule or other applicable criteria, the patient’s status can be changed before the claim is ever submitted.
- Clinical documentation improvement: Physicians are coached on how to document the medical necessity of their decisions in language that will hold up under audit review. This does not mean inflating documentation but rather ensuring that the clinical reasoning reflected in the chart matches the severity and complexity of the patient’s condition.
- Internal auditing: Many hospitals now run their own pre-billing audits using criteria similar to what RAC contractors apply. Claims that look vulnerable get flagged and reviewed before submission, reducing the pool of claims that might attract RAC attention after payment.
- Tracking audit patterns: RAC contractors tend to focus on specific claim types and diagnoses during particular review cycles. Providers that track what the RACs in their region are targeting can adjust their documentation and billing practices proactively.
These strategies represent exactly the kind of upfront investment that research has identified as a key response to audit oversight.5PubMed Central. Monitoring for Waste: Evidence from Medicare Audits The goal is to build the cost of compliance into routine operations rather than treating each audit as a crisis to be managed after the fact.
RAC Audits Beyond Medicare Fee-for-Service
The original RAC program was designed for traditional Medicare fee-for-service claims. But the concept has expanded. CMS has implemented similar recovery audit programs for Medicare Advantage, Medicaid, and even some parts of the Medicare Part D prescription drug program. State Medicaid agencies have their own RAC programs, sometimes using the same contractors that work on the federal side and sometimes hiring different firms.
Medicaid RAC audits operate under somewhat different rules than their Medicare counterparts. Each state has latitude in how it structures its Medicaid RAC program, what types of claims are reviewed, and how the appeals process works. Providers who operate across state lines may find themselves subject to multiple Medicaid RAC programs with inconsistent procedures, on top of the federal Medicare RAC program. This layering of audit programs means that a single hospital might face recovery audits from several different contractors simultaneously, each looking at different payer streams and applying different criteria.
The expansion of the RAC model reflects a broader trend in healthcare payment oversight. Payers across the spectrum, including private insurers, have adopted post-payment audit programs inspired by the Medicare RAC structure. For providers, the practical implication is that the documentation and compliance infrastructure built to survive Medicare RAC audits ends up serving double duty. The clinical documentation that satisfies a Medicare RAC reviewer is generally the same documentation that will hold up under a commercial payer’s retrospective review. Providers who treat RAC compliance as a Medicare-only concern and neglect their commercial payer documentation are missing the larger picture.
What Patients Should Know
RAC audits are primarily a provider-facing program, but they can affect patients in indirect and sometimes direct ways. The most tangible patient impact comes from the inpatient-versus-observation status question. If a RAC audit retroactively changes your hospital stay from inpatient to outpatient observation, the hospital’s billing changes, and your financial responsibility can change with it. Under Medicare Part A, inpatient stays have one cost-sharing structure. Under Part B, outpatient observation has a different one, often with higher out-of-pocket costs for the patient. And critically, observation days do not count toward the three-day inpatient stay required to qualify for Medicare-covered skilled nursing facility care.
Patients generally have no involvement in the RAC audit itself and may not even know it happened. But if you received care at a hospital that subsequently had claims overturned, and if that affected your status classification, you could receive revised billing statements or find that a downstream benefit you expected is no longer available. This is one of the reasons patient advocacy groups have been vocal about the observation-status issue. From the patient’s bed, there is no perceptible difference between being an inpatient and being under observation, but the financial consequences can be stark.