A RAC audit is a review of Medicare claims conducted by private contractors hired by the Centers for Medicare & Medicaid Services (CMS) to identify improper payments. RAC stands for Recovery Audit Contractor. These auditors look at claims that have already been paid to healthcare providers and flag overpayments that need to be returned to Medicare, as well as underpayments that Medicare owes back to providers. Congress made the program permanent in 2006, and it now covers all 50 states.
How RAC Audits Work
RAC auditors use two approaches: automated reviews and complex reviews. Automated reviews happen at the system level, meaning software scans claims data for clear-cut billing errors without anyone looking at a patient’s medical chart. Examples include a provider billing for home visits during a patient’s hospital stay, or billing glucose monitor supplies as a separate charge when they should be bundled with the monitor itself. These errors follow straightforward rules and don’t require clinical judgment.
Complex reviews are different. A qualified reviewer, often a nurse or certified coder, examines the actual medical record to determine whether a service was medically necessary or coded correctly. When a RAC initiates a complex review, the provider receives an Additional Documentation Request (ADR), a formal letter asking for the medical record and any supporting documentation for the claim in question. The reviewer then evaluates whether the documentation supports the service that was billed.
What RAC Auditors Typically Target
CMS maintains a public list of approved RAC topics, and the pattern is revealing. Many of the most common audit targets involve medical necessity reviews for procedures like cataract removal, bariatric surgery, and cardiac imaging scans. These are complex reviews where the auditor reads through clinical documentation to decide if the procedure was justified for that particular patient.
Inpatient hospital coding validation is another major target. This involves checking whether a hospital stay was assigned the correct billing code, which directly affects how much Medicare pays. Auditors also look at durable medical equipment claims, including items like ankle-foot braces, blood glucose monitors, and continuous passive motion devices billed without a corresponding knee replacement surgery. CMS also receives referrals from federal investigative agencies like the Office of Inspector General and the Department of Justice, and can direct RAC auditors to review those claims outside of normal limits.
Limits on How Many Claims Can Be Audited
RAC auditors can’t request unlimited records. CMS caps the number of claims each auditor can review from a given provider. For most hospitals and facilities, the baseline limit is 0.5% of total paid Medicare claims from the prior 12 months. Skilled nursing facilities and inpatient rehabilitation facilities have a slightly higher baseline of 1%.
These requests go out in 45-day cycles. The annual limit is divided by eight to determine how many claims a RAC can request in any single cycle. So a hospital with 10,000 paid claims in the prior year would face a baseline of 50 ADRs annually, spread across those cycles.
Here’s the critical detail: the limit adjusts based on your denial rate. If a provider’s denial rate from previous RAC reviews falls between 0% and 3%, that provider gets no reviews for the next three cycles. If the denial rate climbs above 50%, the request limit can multiply by six times the baseline. At a denial rate above 91%, it jumps to ten times the baseline. This system rewards clean billing and escalates scrutiny for providers with persistent errors.
What Happens If You Disagree
Providers who believe a RAC determination is wrong can appeal through a five-level process. Each level has its own deadline and review body.
- Level 1: Redetermination. A written appeal filed within 120 days of the initial decision. The Medicare contractor that processed the original claim reviews it again.
- Level 2: Reconsideration. If the first appeal fails, you have 180 days to request review by a qualified independent contractor, a separate entity with no connection to the original decision.
- Level 3: Administrative Law Judge hearing. Filed within 60 days of a failed reconsideration. This is the first level where you get a hearing before a judge.
- Level 4: Medicare Appeals Council review. This review takes place within the Departmental Appeals Board of the U.S. Department of Health and Human Services. You have 60 days from the judge’s decision to file.
- Level 5: Federal court. The final option, filed within 60 days of the Appeals Council determination.
Historically, providers have had significant success at the Administrative Law Judge level, which is one reason the appeals process matters. A RAC determination is not the final word.
How RAC Auditors Get Paid
RAC contractors work on a contingency fee basis, meaning they earn a percentage of the overpayments they identify and collect. This structure is worth understanding because it creates a financial incentive to find errors. If a provider successfully appeals and the overpayment determination is reversed, the RAC must return its fee. This built-in correction encourages accuracy, but critics argue the contingency model still pushes auditors toward aggressive claim reviews.
How to Prepare for a RAC Audit
The most practical thing any provider can do is treat documentation as the first line of defense. Complex reviews hinge entirely on whether the medical record supports the service that was billed. If a procedure’s medical necessity isn’t clearly documented in the chart, the claim is vulnerable regardless of whether the care was appropriate.
Tracking your own denial rates matters too, since those rates directly control how many future ADRs you’ll receive. Providers with denial rates under 4% face half the normal review volume, and those under 3% get a temporary pause from reviews altogether. Running internal audits on high-risk claim types, particularly inpatient stays and medical necessity for procedures on CMS’s approved topics list, can catch problems before a RAC auditor does.
When an ADR arrives, respond within the deadline with complete records. Missing the response window typically results in an automatic overpayment determination, putting you in the position of having to appeal a decision that was made without your documentation even being reviewed.