Clinii logo with a purple dotted heart icon followed by the brand name in white text, representing healthcare technology and innovation.

What Are Recovery Audit Contractors (RACs)?

Recovery Audit Contractors (RACs) are private entities contracted by the Centers for Medicare & Medicaid Services (CMS) to identify and recover improper payments made to healthcare providers under the Medicare and Medicaid programs.
Their mission is to protect the fiscal integrity of federal healthcare funds by detecting overpayments and underpayments through retrospective claims review.

RACs operate under Section 1893(h) of the Social Security Act, which authorizes CMS to engage independent auditors to evaluate paid claims using medical record review, coding validation, and statistical sampling.

They analyze billing data, request documentation from providers, and determine whether payments complied with Medicare coverage, coding, and payment policies.

The RAC program functions alongside other CMS integrity contractors—such as Medicare Administrative Contractors (MACs), Comprehensive Error Rate Testing (CERT) contractors, and Zone Program Integrity Contractors (ZPICs)—to ensure that healthcare providers are reimbursed accurately and that federal funds are used appropriately.

Each RAC is assigned to a specific geographic region and payment type (e.g., inpatient hospital, outpatient, DME, or physician services) and is compensated on a contingency-fee basis tied to the amount of recovered overpayments.

RAC audits are an essential component of CMS’s Program Integrity Initiative, providing ongoing oversight that improves payment accuracy, deters fraud, and strengthens compliance across the healthcare system.

Key Components of Recovery Audit Contractors (RACs)

Recovery Audit Contractors (RACs) form a critical part of CMS’s Program Integrity framework, designed to identify and recover improper Medicare and Medicaid payments through retrospective claim reviews.

Each RAC operates within a designated geographic region under strict contractual oversight from CMS, conducting post-payment audits to ensure accuracy, compliance, and financial accountability across the healthcare reimbursement system.

1. RAC Program Purpose and Federal Mandate

  • The RAC program was established nationwide in 2010 under Section 1893(h) of the Social Security Act following successful pilot programs.
  • Its purpose is to:
    • Detect and correct overpayments to providers and suppliers.
    • Identify underpayments due to claim processing errors.
    • Promote provider education and compliance through audit findings.
    • Support CMS’s efforts to reduce the improper payment rate in Medicare and Medicaid.
  • RACs operate under the authority of CMS’s Center for Program Integrity (CPI).

2. Regional Structure and Contractor Organization

  • CMS divides the country into four Medicare RAC regions, each awarded to a private contractor via competitive procurement.
  • RACs are responsible for specific claim types, such as inpatient hospital, outpatient, physician services, and DMEPOS (Durable Medical Equipment, Prosthetics, Orthotics, and Supplies).
  • Medicaid RACs are administered at the state level, where states must contract at least one RAC organization following federal approval of their State Plan Amendment (SPA) for RAC implementation.

3. Core Audit Types and Review Categories

  • RACs perform two main categories of reviews:
    • Automated Reviews – Conducted electronically without medical record requests; identify clear payment errors (e.g., duplicate claims, incorrect coding).
    • Complex Reviews – Require submission of medical records for manual evaluation by clinical and coding professionals.
  • Additional review categories include:
    • Semi-Automated Reviews – Combine data analytics and limited documentation review.
    • Targeted or Issue-Specific Audits – Focused on high-risk claim types identified through CMS data analysis.

4. Review and Recovery Workflow

  • Issue Identification – CMS approves audit issues based on data analytics and policy alignment.
  • Provider Notification – RAC sends an audit notice (ADR – Additional Documentation Request) detailing records required for review.
  • Claim Review – Contractor evaluates medical necessity, coding accuracy, and payment validity.
  • Determination – If an overpayment is confirmed, RAC issues a Demand Letter to the provider outlining repayment and appeal rights.
  • Recoupment – Overpayments are recouped by the Medicare Administrative Contractor (MAC) through offset or refund.
  • Provider Appeal – Providers may appeal RAC findings through the five-level Medicare appeals process.

5. Oversight, Transparency, and Performance Standards

  • RACs operate under detailed CMS contracts defining accuracy targets, timeliness benchmarks, and provider service standards.
  • CMS monitors RAC performance through:
  • Quarterly Data Validation Reviews (DVRs) by independent auditors.
  • Provider satisfaction surveys assessing fairness and communication quality.
  • Error rate metrics that influence contract renewal and contingency fee eligibility.
  • All approved audit issues and recovery statistics are published on CMS’s RAC Program Data Portal to promote transparency.

6. RAC Coordination with Other CMS Contractors

  • RACs collaborate with:
    • MACs (Medicare Administrative Contractors) for claim adjustments and recoupment.
    • CERT (Comprehensive Error Rate Testing) contractors for error rate validation.
    • ZPICs / UPICs (Unified Program Integrity Contractors) for fraud referral and data sharing.
  • This coordination ensures non-duplicative reviews, data consistency, and streamlined provider oversight across the CMS integrity framework.
Table summarizing current Recovery Audit Contractor regions, example contractors, and their primary audit responsibilities.

How Recovery Audit Contractors (RACs) Work in Practice

Recovery Audit Contractors (RACs) function as CMS-authorized auditors that retrospectively review paid Medicare and Medicaid claims to identify overpayments, underpayments, and billing inconsistencies.

While their mandate centers on program integrity and payment accuracy, their work directly impacts provider compliance operations, revenue cycle performance, and audit risk management across healthcare systems.

Step 1: Issue Identification and CMS Approval

  • CMS approves all audit issues before RACs can begin reviewing provider claims.
  • Each issue must be supported by:
    • Statutory or regulatory authority (e.g., Medicare coverage or coding policy).
    • Data analysis demonstrating a measurable risk of payment error.
  • Once approved, RACs publish the issue on the CMS RAC Portal for provider visibility before initiating reviews.

Step 2: Provider Notification and Record Request

  • When a provider is selected for review, the RAC issues an Additional Documentation Request (ADR) identifying the claims under audit.
  • Providers are typically allowed 45 days to respond with the requested medical records, though extensions may be granted for cause.
  • The number of ADRs per provider is capped by CMS to prevent administrative overload, based on claim volume and provider type.

Step 3: Record Review and Determination

  • RACs conduct a detailed assessment of each claim for:
    • Medical necessity
    • Correct coding and modifier use
    • Duplicate billing or unbundling
    • Compliance with Medicare or Medicaid coverage criteria
  • The review may involve nurses, coders, or physicians specializing in the audited service category.
  • Once complete, the RAC issues a Review Results Letter, outlining findings, identified overpayments or underpayments, and the rationale.

Step 4: Provider Response and Discussion Period

  • Providers have a 30-day discussion period following receipt of the review results to present additional documentation or clarification.
  • If the provider disagrees with the RAC findings, they can request a discussion to resolve discrepancies before the claim proceeds to official recoupment.
  • Many disputes are resolved during this informal stage, avoiding escalation to the appeals process.

Step 5: Demand Letter and Recoupment

  • If an overpayment is confirmed after review or discussion, the RAC issues a Demand Letter specifying:
    • The dollar amount owed
    • The claim identifiers involved
    • The timeframe for repayment or offset
  • Medicare Administrative Contractors (MACs) manage the recoupment process on CMS’s behalf, applying offsets against future payments if necessary.
  • For underpayments, CMS authorizes corrective adjustments and reimbursement to the provider.

Step 6: Provider Appeals Process

  • Providers may appeal RAC determinations through the five-level Medicare administrative appeals process, which includes:
    • Redetermination by the MAC
    • Reconsideration by a Qualified Independent Contractor (QIC)
    • Hearing before an Administrative Law Judge (ALJ)
    • Review by the Medicare Appeals Council
    • Judicial review in U.S. District Court
  • Each stage has specific timeframes and evidentiary requirements.
  • CMS monitors RAC appeal overturn rates as part of contractor performance evaluation.

Step 7: Compliance Management and Risk Mitigation

  • To reduce RAC audit exposure, providers should:
    • Maintain robust internal audit programs.
    • Conduct coding and documentation reviews before claim submission.
    • Retain medical records for at least seven years as required by CMS.
    • Track audit correspondence to ensure timely responses and appeal filings.
  • Many organizations implement RAC readiness protocols within their compliance departments, ensuring efficient documentation retrieval and appeal handling.

Step 8: RAC Impact on Provider Operations

  • RAC activity influences key operational areas, including:
  • Revenue cycle timelines due to delayed payments during review.
  • Compliance staffing and cost burden for record retrieval and appeals.
  • Provider behavior, promoting improved documentation accuracy and coding discipline.
  • While burdensome, RAC oversight has led to measurable improvements in claim accuracy and payment compliance across Medicare and Medicaid.

RACs in Medicaid Billing, Reimbursement, and Fiscal Limitations

Recovery Audit Contractors (RACs) directly affect the financial flow of Medicare and Medicaid payments by identifying and recovering improper reimbursements.

Their findings trigger payment recoupments, appeals, and provider education efforts that collectively shape the accuracy, accountability, and timeliness of reimbursement processes.
Although RACs strengthen program integrity, their audits can also introduce cash flow disruptions and administrative costs for providers navigating complex review cycles.

How RACs Affect Medicare and Medicaid Reimbursement

  • RACs review paid claims retrospectively to determine if Medicare or Medicaid payments were made in compliance with coverage and billing regulations.
  • Overpayments identified by RACs are recouped from providers, typically through offsets against future claims or direct repayment.
  • Underpayments are adjusted and repaid to providers through the Medicare Administrative Contractors (MACs).
  • All identified overpayments and underpayments are reported to CMS’s Center for Program Integrity (CPI) for tracking and program monitoring.
  • RACs’ corrective actions promote billing accuracy and fiscal discipline, ensuring that federal funds are properly applied to allowable services.

RAC Payment Flow and Financial Oversight

  • Once a RAC determines an improper payment, it notifies CMS and the relevant MAC, which executes the financial transaction.
  • CMS requires RACs to maintain detailed tracking logs for each recovered or adjusted payment.
  • RACs are compensated on a contingency-fee basis, meaning their payment depends on the value of overpayments recovered.
  • This incentive model is designed to promote thorough auditing but also raises provider concerns about overreach and excessive documentation requests.
  • CMS mitigates these risks through strict accuracy thresholds—RACs must maintain audit accuracy rates above 95% to remain eligible for contract renewal.

Impact on Provider Cash Flow

  • Recoupment of identified overpayments can result in temporary revenue loss until appeals or reprocessing are resolved.
  • Providers may experience payment holds or offsets during ongoing audits, particularly for large-scale inpatient or DME claims.
  • Although RAC audits are retrospective, the financial impact is immediate, requiring providers to maintain sufficient cash reserves and audit reserves for potential repayments.
  • CMS allows providers to repay disputed amounts while continuing to appeal, minimizing interest accrual on confirmed overpayments.

Contingency Fee and Fiscal Integrity Safeguards

  • RAC contingency fees are typically between 8%–12.5% of the recovered overpayment amount, capped by CMS policy.
  • CMS funds RAC payments from the recovered federal share, not from provider repayments directly.
  • RAC compensation is withheld until after the provider’s appeal window has closed or the appeal decision is final, reducing incentives for premature or inaccurate findings.
  • Periodic Data Validation Reviews (DVRs) by CMS ensure that recovered funds are properly calculated and that RACs meet performance and accuracy targets.

Administrative and Compliance Costs for Providers

  • RAC audits impose measurable administrative costs, including:
    • Staff time for record retrieval, review, and appeals.
    • Compliance software and audit-tracking systems.
    • Legal or consulting fees for defense against disputed findings.
  • Larger health systems often create centralized RAC management teams to streamline communication with auditors and reduce operational disruption.
  • Smaller practices face higher relative burden, particularly when lacking dedicated compliance infrastructure.

Audit Timelines and Fiscal Limitations

  • RACs are authorized to review claims up to three years after the original payment date.
  • Time limits protect providers from indefinite exposure while ensuring CMS can recover funds for significant billing errors.
  • CMS caps the number of medical record requests RACs can make per provider per 45-day cycle to limit administrative strain.
  • RACs must complete complex reviews within 60 days of receiving medical records to ensure prompt financial resolution.

Key Takeaway

RACs are essential to maintaining financial integrity and reimbursement accuracy in federal healthcare programs, but their work introduces significant cash flow, administrative, and compliance challenges for providers.
Effective RAC management requires a balance between proactive audit readiness, timely appeals, and transparent communication with CMS and MACs.

When operated effectively, RAC oversight helps ensure that every Medicare and Medicaid payment is accurate, justified, and auditable.

How RACs Influence Quality, Access, and Equity in Medicaid Financing

While Recovery Audit Contractors (RACs) are primarily financial oversight entities, their audits have direct implications for care quality, administrative equity, and provider accountability within the Medicare and Medicaid ecosystems.

Through their work, RACs help uphold the accuracy, fairness, and transparency of payment systems — ensuring that federal dollars are used efficiently and that legitimate providers are not disadvantaged by systemic inconsistencies or improper payment flows.

Supporting Quality Through Payment Accuracy

  • RACs help maintain data integrity and payment precision, ensuring that reimbursements reflect services that are medically necessary and properly documented.
  • Accurate reimbursement promotes consistent care delivery, as providers can rely on clear billing standards and predictable payment outcomes.
  • By identifying recurring documentation or coding issues, RACs provide feedback loops that guide provider education, ultimately improving the accuracy and quality of clinical records.
  • Over time, this reduces claim denials and supports more effective use of healthcare resources across the Medicare and Medicaid populations.

Encouraging Provider Accountability and Compliance Culture

  • RAC audits reinforce the expectation that providers maintain complete and compliant medical documentation as a routine standard of care.
  • The program’s visibility and post-payment review model promote a culture of self-auditing within provider organizations.
  • Hospitals and health systems often use RAC findings to improve internal compliance programs, training, and audit readiness protocols.
  • By aligning billing accuracy with compliance best practices, RAC oversight indirectly supports clinical quality initiatives tied to documentation integrity.

Equity and Fairness in Audit Enforcement

  • CMS and its contractors are required to enforce RAC audits uniformly and transparently, regardless of provider type, region, or size.
  • Audit sampling methodologies and claim selections are designed to reduce bias and ensure equitable treatment across the provider landscape.
  • CMS monitors RACs through accuracy thresholds, provider satisfaction surveys, and independent data validation reviews to prevent overreach.
  • Providers maintain formal appeal rights at each level, ensuring due process and equitable treatment when disputing findings.
  • This layered oversight structure aims to balance program integrity enforcement with provider fairness and operational sustainability.

RACs and Health Equity Objectives

  • Although RACs are not directly clinical entities, their work supports CMS’s health equity framework by maintaining financial integrity in programs that serve vulnerable populations.
  • Recovering improper payments and ensuring fiscal accountability help preserve funds for essential safety-net services and underserved beneficiaries.
  • Transparent audit data published by CMS allows for public monitoring of regional payment accuracy, identifying potential inequities or systemic gaps in program administration.
  • By ensuring equitable enforcement of payment standards, RACs contribute to long-term financial sustainability that underpins access to care.

Transparency and Continuous Improvement

  • RAC operations are increasingly subject to public transparency, with CMS publishing audit issues, recovery statistics, and contractor performance data.
  • This visibility encourages accountability and consistency among both auditors and providers.
  • CMS uses RAC findings to refine its payment policies, claim edits, and educational guidance, directly improving program accuracy and reducing unnecessary administrative burden.
  • Over time, this creates a closed-loop improvement system, where audit insights drive regulatory and operational updates to strengthen the integrity of the healthcare payment system.

The Equity Imperative in Oversight

  • Equitable audit practices ensure that compliance enforcement does not disproportionately burden specific provider types, such as rural hospitals, critical access facilities, or smaller physician practices.
  • CMS’s ongoing modernization efforts—such as standardized issue lists, automated ADR tracking, and electronic document submissions—are designed to level the playing field across the provider community.
  • As part of CMS’s broader modernization agenda, RACs play a role in ensuring both fiscal accountability and procedural fairness, key pillars of a transparent, equitable payment system.

Frequently Asked Questions about RACs

1. What are Recovery Audit Contractors (RACs)?

Recovery Audit Contractors (RACs) are private entities contracted by the Centers for Medicare & Medicaid Services (CMS) to identify and recover improper payments made to healthcare providers.

They review Medicare and Medicaid claims after payment to detect overpayments, underpayments, and billing errors, ensuring that reimbursements comply with federal rules and documentation standards.

2. How does the RAC audit process work?

The RAC audit process includes:

  1. Issue approval by CMS based on policy and data analysis.
  2. Provider notification via an Additional Documentation Request (ADR).
  3. Medical record review by clinical and coding staff.
  4. Determination and discussion period, where providers can respond or clarify findings.
  5. Demand letter and recoupment if overpayments are confirmed.

Providers may appeal any RAC determination through the five-level Medicare appeals process.

3. What types of issues do RACs review?

RACs review claims across major categories such as:

  • Inpatient and outpatient hospital services
  • Physician and supplier claims
  • DMEPOS (Durable Medical Equipment, Prosthetics, Orthotics, and Supplies)
  • Home health, hospice, and skilled nursing services

Their reviews target improper payments related to medical necessity, coding accuracy, duplicate claims, or unbundling errors.

4. How are RACs compensated?

RACs are paid on a contingency-fee basis, earning a percentage (typically 8–12.5%) of the overpayments they successfully recover for CMS.

However, RACs only receive compensation once the provider’s appeal period has ended or the appeal is resolved in CMS’s favor, ensuring accuracy and fairness.

CMS also enforces minimum accuracy thresholds—RACs must maintain at least 95% audit accuracy to retain their contracts.

5. What are provider rights during a RAC audit?

Providers have the right to:

  • Receive notice of any audit and the issues being reviewed.
  • Submit complete medical records and supporting documentation.
  • Engage in a discussion period to challenge or clarify findings.
  • Appeal determinations through the full administrative review process.

CMS caps the number of medical record requests per provider to prevent administrative overload and ensure fair enforcement.

6. How do RACs differ from other CMS integrity contractors like CERT or ZPICs?

  • RACs focus on post-payment audits to recover overpayments and identify underpayments.
  • CERT (Comprehensive Error Rate Testing) contractors measure payment accuracy rates across the Medicare program.
  • ZPICs/UPICs (Unified Program Integrity Contractors) investigate potential fraud or abuse and refer cases for law enforcement action.

Together, these programs form CMS’s integrated integrity network, balancing financial recovery, error measurement, and fraud prevention.

7. How can providers prepare for a RAC audit?

To minimize audit risk, providers should:

  • Conduct regular internal audits of coding and billing accuracy.
  • Maintain complete and contemporaneous documentation for all billed services.
  • Track RAC-approved issues on the CMS RAC Portal to anticipate potential audit targets.
  • Develop a structured RAC response protocol within the compliance or revenue cycle team to manage ADRs and appeals efficiently.
loading...