In less than a month, the Centers for Medicare & Medicaid Services (CMS) will complete its nationwide roll out of the Recovery Audit Contractor (RAC) program. Hospitals and other healthcare providers in the 25 states not yet subject to the RAC Program may begin to receive audit letters as early as August 1, 2009.[1] Providers should be prepared to respond to the RAC auditor’s requests and should have a process in place to ensure compliance with the strict deadlines for appealing alleged overpayments identified by the RAC auditor. Otherwise, they may face significant losses from RAC recoupment of Medicare reimbursement.

Brief History of the RAC Program

The RAC Program was created by The Medicare Modernization Act of 2003 as a demonstration program to identify improper Medicare payments, whether underpayments or overpayments. A RAC is essentially a bounty hunter and is paid on a contingency fee basis, receiving a percentage of all improper underpayments and overpayments it identifies. From March 2005 through March 2008, the RAC Demonstration Program operated in California, Florida, and New York. The program was extended into Arizona, South Carolina, and Massachusetts in 2007.

RACs use two methods to identify payment errors. The first method, propriety “data mining” software programs, requires no medical record review and identifies potential payment errors such as duplicate payments, missing modifiers that would affect payments, medical necessity, fiscal intermediaries’ (FI) mistakes, and payments for discontinued HCPC/CPT codes. The second method is complex medical record review.

In July 2008, CMS announced that RACs had corrected more than $1.03 billion in Medicare improper payments, $992.7 million (or approximately 96%) of which were overpayments collected from providers. The remainder represented underpayments repaid to providers. Inpatient hospitals were the provider category most affected by RAC audits, accounting for 85% of all overpayment collected.

Based on public comments regarding the demonstration program, CMS made several changes to the RAC program, including limiting the “look-back” period on claims and the number of medical records that a RAC can request from a particular provider in a given month.

The Tax Relief and Health Care Act of 2006 made the RAC program permanent and directed CMS to expand the program to all 50 states by 2010. CMS selected four RACs and two subcontractors, and all states are expected to be covered by the program by the end of this year.

The RAC jurisdictions are as follows:

Region A – Diversified Collection Services of Livermore, CA (subcontracting some audits to PRG-Shultz, Inc.), in Connecticut, Delaware, District of Columbia, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island, and Vermont.

Region B – CGI Technologies and Solutions, Inc. of Fairfax, VA (subcontracting some audits to PRG-Shultz, Inc.), in Illinois, Indiana, Kentucky, Michigan, Minnesota, Ohio, and Wisconsin.

Region C – Connolly Consulting Associates, Inc. of Wilton, CT (subcontracting some audits to Viant Payment Systems, Inc.), in Alabama, Arizona, Colorado, Florida, Georgia, Louisiana, Mississippi, New Mexico, North Carolina, Oklahoma, South Carolina, Tennessee, Texas, Virginia, and West Virginia.

Region D – HealthDataInsights, Inc. of Las Vegas, NV (subcontracting some audits to PRG-Shultz, Inc.), in Arizona, Arkansas, California, Hawaii, Idaho, Iowa, Kansas, Missouri, Montana, Nebraska, Nevada, North Dakota, Oregon, South Dakota, Utah, Washington, and Wyoming.

The RAC Audit

With respect to alleged overpayments (or underpayments) identified by the RAC’s data mining software, the provider will simply receive a notification letter from the RAC. If the provider disagrees with the finding, the provider must start the rebuttal and appeals process (see “The Rebuttal and Appeals Process” below). Otherwise, the RAC’s determination becomes final.

Once an overpayment has been identified by a RAC, the RAC communicates the decision to the FI, which adjusts the provider’s Medicare reimbursement to recoup the overpayment unless the provider either (a) accepts the RAC auditor’s findings and pays the FI the overpayment amount, or (b) files an appeal of the RAC auditor’s findings within 30 days. The rebuttal and appeals process is the only method available for the provider to recover monies determined by the RAC to be an overpayment and recouped by the FI. Otherwise, the RAC’s determination becomes final.

In the case of complex records reviews, the RAC requests medical records for specific cases, which the provider must provide within a 45-day period or the case will be deemed an overpayment. (Currently, only physical medical records are accepted by RAC auditors, who must pay a copying fee to the provider. Medical records on CDs or DVDs will eventually be accepted.) The RAC has 60 days in which to review the records and then issue an “all clear” or a denial letter. Again, if the provider disagrees with a denial, the provider must start rebuttal and appeals process. Otherwise, the RAC’s determination becomes final.

The RAC’s “look-back” period for claims is limited to three years or October 1, 2007, whichever is more recent. In response to complaints about the number of medical records being requested by RACs during the demonstration program, CMS has placed limits on the number of records that RACs may request under the permanent program:

  • Inpatient hospitals, inpatient rehabilitation facilities, skilled nursing facilities, and hospices – 10% of the average monthly Medicare claims (maximum 200) per 45 days per National Provider Identifier (NPI) number;
  • Other Part A billers – 1% of the average monthly Medicare episodes of care (maximum 200) per 45 days per NPI;
  • Physicians (including podiatrists and chiropractors):
    • Sole practitioner: 10 medical records per 45 days per NPI;
    • Partnership (2-5 individuals): 20 medical records per 45 days per NPI;
    • Group (6-15 individuals): 30 medical records per 45 days per NPI; and
    • Large group (16+ individuals): 50 medical records per 45 days per NPI;
  • Other Part B billers (DMS, laboratories, outpatient hospital) – 1% of the average monthly Medicare claim lines (maximum 200) per 45 days per NPI.

The Rebuttal and Appeals Process

The RAC program contains a structured method for a provider to rebut and appeal an adverse reimbursement determination. However, each step has its own rules and rigid time deadlines that must be met to avoid forfeiture of the appeal. A completely extended appeals process may exceed 435 days, so providers should undertake a cost-benefit analysis before electing to appeal the adverse determination of a claim. Elements to be considered may include:

  • Whether the dollar value of the recoupment justifies the cost of the appeall;
  • Whether there is clear Medicare guidance or criteria to support or rebut the RAC’s determination;
  • Whether the quality of the medical record and other documentation adequately supports the provider’s position;
  • Whether clinical support and input for the appeal are available;
  • Whether accepting the RAC’s determination may have a negative impact on the provider’s policies and procedures; and/or
  • Whether legal counsel should be retained.

Most of the appeals filed by providers during the RAC demonstration program challenged either the coding determination or underlying medical necessity determination made by the RAC. The success rate of providers who chose to appeal a RAC claims determination during the demonstration program was approximately 33.3%.

The Rebuttal. When a RAC decides to deny a Medicare claim, the provider has the option to submit a rebuttal directly to the RAC before beginning the appeals process. The rebuttal must be filed within fifteen days of the RAC’s determination. During the demonstration project, providers reported that the rebuttal process was less efficient and effective than the formal appeals process. However, the rebuttal process may be helpful if additional time is needed to determine whether to file an appeal with the FI.

First-Level Appeal. The first-level appeal (also called a redetermination) is filed with the FI that processed the Medicare claim. The provider must submit the appeal with 120 days of the RAC’s initial determination, and should raise all issues and include all relevant documents. Although a provider has 120 days in which to file the first appeal, it must file its first appeal within 30 days to avoid a Medicare recoupment action of the amount in dispute. The FI will sustain or modify the RAC’s determination with 60 days. A denial of claim is accompanied by a written explanation from the FI.

Second-Level Appeal. After an adverse FI determination, the provider has 180 days to file a request for reconsideration with the qualified independent contractor (QIC). Although a provider has 180 days in which to file the second appeal, it must file its second appeal within 60 days to avoid a Medicare recoupment action of the amount in dispute. Issues not raised in this appeal, and documents and evidence not submitted in this appeal, are excluded from any further level of appeal. The appearance of provider staff, clinical personnel, or legal counsel is optional. The QIC issues its decision within 60 days regarding the FI’s determination. If the overpayment is upheld at the second-level appeal, recoupment by Medicare is automatic, with interest back to the 31st day after the provider’s receipt of the original overpayment letter from the RAC auditor.

Third-Level Appeal. A provider has 60 days after an adverse QIC decision to appeal to an administrative law judge (ALJ). A hearing is limited to documentary evidence submitted at the QIC level. Oral testimony is important in the ALJ hearing and the judge may request that CMS or the FI participate as a party. The ALJ is required to issue a decision within 90 days from the date the hearing is requested, although cases involving the same issues may be consolidated, prolonging the decision date.

Fourth-Level Appeal. If a provider wishes to appeal an adverse decision by the ALJ, it must do so within 60 days by requesting a review by the Medicare Appeals Council (MAC). The appeal is limited to the record presented to the ALJ and, if requested, a brief by the provider supporting its position. There is no time frame specified for the MAC’s decision, although it will likely be received within 60 days following the review.

Fifth-Level Appeal. The final level of appeal is the option of filing a legal proceeding in federal district court, questioning the decision of the MAC and the findings of the ALJ. The evidence subject to review by the court is limited to the administrative record only. This appeal must be filed within 60 days after the MAC decision.

Lessons from the Pilot Program

In its June 2008 report, The Medicare Recovery Audit Contract (RAC) Program: An Evaluation of the 3-Year Demonstration, CMS issued its findings regarding experiences and effects on payment from the RAC program. This report sheds light on the most common reasons for overpayment identified by RACs, as well as the top services identified with overpayments by RACs. As a result, the report may help providers identify and quantify their own risk areas for the upcoming permanent RAC program. For example, two of the top services identified with overpayments by RACs for inpatient hospitals were surgical procedures in the wrong setting (medically unnecessary) and excisional debridement (incorrectly coded).


The American Hospital Association has implemented a survey, called RACTrac, which will begin collecting RAC data from member and non-member hospitals beginning no earlier than October 2009. RACTrac will generate quarterly reports on the RAC program’s effect on hospitals, as well as emerging trends, such as changes in the prevalent reasons for denials.

Preparing for Your RAC Audit

In preparing for the likelihood of an upcoming RAC audit, providers may wish to consider some or all of these steps:

  • Identify high-risk and high-volume services likely to be targeted, based on historical data from the demonstration program and ongoing RACTrac reports;
  • Designate a person or team to receive and respond to RAC audit requests for medical records; Implement a procedure to ensure that off-site medical records requested by the RAC may be produced within the required time period; and
  • Establish procedures to respond to and defend against RAC audits.

The permanent RAC program is fast approaching – along with its numerous requests for medical records, recoupment of Medicare payments, and chances to lose the opportunity to defend claims by missing deadlines.