RAC stands for Recovery Audit Contractor, a private company hired by the Centers for Medicare & Medicaid Services (CMS) to find and correct improper payments in the Medicare system. These contractors review claims that have already been paid to hospitals, doctors, and other healthcare providers, looking for overpayments that need to be returned and underpayments that should be reimbursed. The program operates in all 50 states and has recovered billions of dollars since its inception.
How the RAC Program Works
Congress created the RAC program through the Medicare Modernization Act of 2003, which directed CMS to use audit contractors to investigate Medicare claims. It started as a three-year demonstration project and became a permanent nationwide program after that pilot corrected more than $1.03 billion in improper payments. About 96% of those corrections were overpayments collected from providers, while the remaining 4% ($37.8 million) were underpayments returned to providers who had been shortchanged.
CMS divides the country into five regions, each assigned to a contracted company. Currently, Performant Recovery handles Region 1 and the national durable medical equipment territory, Cotiviti covers Regions 2 and 3, and HMS Federal Solutions manages Region 4. These contractors are paid on a contingency basis, meaning they earn a percentage of the overpayments they successfully identify and collect. That financial incentive is one reason the program draws scrutiny from providers who feel it encourages aggressive auditing.
What RAC Auditors Look For
RAC reviews focus on claims where Medicare may have paid incorrectly. Common targets include billing errors, services that weren’t medically necessary, incorrect billing codes, and claims where the documentation doesn’t support the level of care billed. RACs can look back up to three years from the date a claim was paid.
One of the biggest ongoing audit targets involves short inpatient hospital stays. Under Medicare’s two-midnight rule, implemented in 2014, hospital stays not expected to span at least two midnights generally shouldn’t be billed as inpatient admissions. A report from the HHS Office of Inspector General found that hospitals were still billing for many short inpatient stays that were potentially inappropriate under this rule, with Medicare paying almost $2.9 billion for these stays. The OIG specifically recommended that CMS direct RACs to increase their focus on these claims.
How Providers Get Audited
When a RAC identifies a claim it wants to review, it sends the provider an Additional Documentation Request, or ADR. This is a formal request for medical records and other supporting documents. Providers then have 45 days to respond. CMS caps the number of records a RAC can request to prevent providers from being overwhelmed with audit demands.
For most hospitals and institutional providers, the baseline limit is 0.5% of total paid Medicare claims from the previous 12-month period, divided into eight 45-day cycles. Skilled nursing facilities and inpatient rehabilitation facilities face a slightly higher baseline of 1% of paid claims. These limits aren’t fixed, though. CMS adjusts them based on each provider’s denial rate. A provider with a denial rate between 0% and 3% gets a break: no reviews for the next three 45-day cycles. On the other end, a provider with a denial rate above 91% can see their review limit jump to ten times the baseline, meaning up to 5% of all paid claims for general providers or 10% for skilled nursing and rehab facilities.
This risk-based scaling means providers with clean track records face minimal disruption, while those with high error rates get scrutinized more heavily.
The Appeals Process
Providers who disagree with a RAC’s findings can appeal. For most Medicare claims, the appeals process has multiple levels. The first level is a redetermination, which must be filed within 30 calendar days of receiving the improper payment notice. If the provider disagrees with that decision, they can request a reconsideration (Level II) within 15 calendar days of the Level I decision.
Appeals have historically been a significant part of the RAC landscape. During the program’s early years, a large percentage of RAC determinations were overturned on appeal, which fueled criticism that contractors were casting too wide a net. The appeals backlog also became a major issue, with cases sometimes waiting years for resolution at higher appeal levels.
Why RAC Matters for Healthcare Organizations
For hospitals and health systems, RAC audits represent both a financial risk and an administrative burden. When an overpayment is identified, the money is recouped from future Medicare payments, sometimes before the appeals process is complete. This can create cash flow problems, particularly for smaller facilities. Responding to documentation requests also requires dedicated staff time to pull records, compile supporting evidence, and manage appeal filings.
Many healthcare organizations have responded by creating internal compliance teams specifically focused on RAC preparedness. These teams review claims before they’re submitted, flag potential issues with documentation or coding, and monitor which types of claims are being targeted in their region. Some hospitals use the same data analytics approaches that RACs use, essentially auditing themselves to catch errors before a contractor does.
The program’s broader effect on healthcare has been to push providers toward more precise documentation and coding practices. Whether a claim involves inpatient versus outpatient status, the medical necessity of a procedure, or the correct use of billing modifiers, the RAC program creates a financial consequence for getting it wrong.