States are required to establish and implement Medicaid Recovery Audit Contractors (RAC) programs pursuant to Section 6411of the Patient Protection and Affordable Care Act of 2010 (PPACA).1 On September 16, 2011, the Centers for Medicare & Medicaid Services (CMS) issued a final rule for states to implement this requirement (the Final Rule).2 The effective date of the Final Rule is January 1, 2012. The U.S. Department of Health and Human Services (HHS) estimates that the Medicaid RAC program will save $2.1 billion over five years, $900 million of which will be returned to the states.3  

Medicare RAC Predicate

States have a certain level of discretion in implementing Medicaid RAC programs. However, under the Final Rule, generally speaking, these programs will operate similarly to the Medicare RAC program. Medicare RACs are private entities that contract with CMS to identify overpayments and underpayments and recoup the former. The Medicare RAC program began as a three-year demonstration program under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003.4 During this demonstration period, CMS contracted with RACs to review Medicare claims in New York, Florida, California, Arizona, Massachusetts and South Carolina. CMS reports that from 2005 through 2008, Medicare RACs uncovered over $1 billion in improper payments, 96 percent of which were overpayments. Medicare RACs were permanently authorized under the Tax Relief and Health Care Act of 2006 (TRHCA).5 TRHCA directed CMS to expand the Medicare RAC program nationwide as of January 1, 2010.

Medicaid RACs

As amended by Section 6411(a) of the PPACA, the Social Security Act now applies the RAC process to Medicaid:

[T]he State shall [...] establish a program under which the State contracts (consistent with State law and in the same manner as the Secretary enters into contracts with recovery audit contractors under section 1893(h) [...]) with 1 or more recovery audit contractors for the purpose of identifying underpayments and overpayments and recouping overpayments [...].6

The Final Rule implements and provides guidance to states concerning this requirement. As in the Medicare RAC program, Medicaid RACs will be paid on a contingency fee basis. States have discretion to set contingency rates, but CMS will not provide federal financial participation for any amount of a state’s contingency fee in excess of Medicare’s then-current highest rate unless the state requests, and CMS grants, an exception to this limit. Of the four regional Medicare RACs currently operating, the highest contingency rate is 12.5 percent. 7 Note that under the Final Rule, Medicaid RACs can be paid only from amounts actually recovered. In other words, Medicaid RACs will have to return any contingency-fee payments where the underlying claim determination is overturned at any stage in the appeal process, which states must make available to providers under their Medicaid RAC programs.  

State Requirements

State requirements under the Final Rule include the following:

  • States must coordinate the recovery audit efforts of the Medicaid RACs with other auditing entities.8
  • States must refer suspected fraud and/or abuse cases to Medicaid Fraud Control Units (MFCUs) or other appropriate law enforcement agencies.
  • States must set limits on the number and frequency of medical records to be reviewed by Medicaid RACs, subject to requests by the RACs for exceptions.
  • States must adequately incentivize the detection of underpayments and notify providers of any that are identified by the Medicaid RACs (Medicare RACs are paid the same contingency fee for overpayments and underpayments).
  • States must provide Medicaid providers with appeal rights with respect to adverse Medicaid RAC determinations.  

Requirements Applicable to Medicaid RACs

Under the Final Rule, State programs must set forth the following requirements for Medicaid RACs:

  • Each Medicaid RAC must hire a medical director who is a Doctor of Medicine or Doctor of Osteopathy (1.0 minimum FTE).
  • RACs must hire certified coders unless the state determines that certified coders are not required for the effective review of Medicaid claims.
  • RACs must work with the state to develop an outreach program to providers, including notification of audit policies and procedures, and must publish a list of issues they will review.
  • RACs must provide, at minimum, such customer-service measures as toll-free telephone numbers, acceptance of electronic medical records on CD/DVD or via facsimile at the providers’ request, and provider notification of overpayment findings within 60 days.
  • RACs must limit the look-back review period to three years from the date of the claim unless the state approves otherwise.
  • RACs should not audit claims that have already been audited or are currently being audited by another entity

Status of Medicaid RACs in Georgia

The Georgia Department of Community Health (DCH) is currently preparing a request for proposals by prospective Medicaid RACs. DCH expects this process to be complete within six to eight weeks.  


The Final Rule implements requirements under the PPACA regarding state Medicaid RAC programs. As indicated above, regulations set forth under the Final Rule go into effect on January 1, 2012. The Final Rule is available by clicking here.9