Recovery Audit Contractor (RAC)
A Recovery Audit Contractor (RAC) is a private contractor CMS uses to review already-paid Medicare fee-for-service claims and identify improper payments — both overpayments to recover and underpayments to correct. Authorized by section 1893(h) of the Social Security Act (42 U.S.C. § 1395ddd(h)), Recovery Auditors work by region, conduct post-payment review, and are paid on a contingency basis from the amounts recovered. The Recovery Auditor identifies the improper payment, but the Medicare Administrative Contractor adjusts the claim, issues the demand, and recovers the money.
Updated
A Recovery Audit Contractor — usually shortened to RAC, and referred to by CMS as a Recovery Auditor — is a private company CMS contracts with to find and correct improper payments in Medicare fee-for-service. Its mission runs in both directions: it identifies overpayments that Medicare should recover and underpayments that a provider is owed. The program's authority is section 1893(h) of the Social Security Act, codified at 42 U.S.C. § 1395ddd(h), under which the Secretary contracts with recovery audit contractors to identify underpayments and overpayments and recoup overpayments for services paid under Medicare.
Recovery Auditors work by geographic region and review claims after they have been paid — post-payment review. Some of that review is automated, applying rules to claims data; some of it is complex, meaning a human reviewer examines the medical record, which the Recovery Auditor requests through an Additional Documentation Request. What sets a RAC apart financially is that it is paid on a contingency basis — a share of what it recovers rather than a flat fee — and that fee is returned if the finding is later overturned on appeal.
In practice
In practice, a Recovery Auditor does not adjust a practice's claims or send it a check. The RAC identifies the improper payment and refers it; the Medicare Administrative Contractor (MAC) then adjusts the claim, issues the demand letter, and carries out any recoupment, typically by withholding the amount from future payments. A RAC determination is appealable through the same Medicare appeals process as any other claim determination, and filing a timely appeal generally pauses recoupment while the appeal is pending.
The specific limits on a Recovery Auditor — how far back it may look, and how many records it may request at once — are set by CMS, scaled to a provider's size and claim volume, and revised over time. Those figures come from current CMS guidance rather than from any fixed rule, so a practice confirms the limit in effect rather than assuming a number.
Commonly confused with
- Medicare Administrative Contractor (MAC): A MAC processes and pays Medicare fee-for-service claims, conducts first-level and its own medical review, and — for Recovery Audit findings — issues the demand letter and performs the recoupment. The RAC identifies the improper payment; the MAC is the entity that adjusts the claim and collects.
- Comprehensive Error Rate Testing (CERT): CERT measures the Medicare fee-for-service improper payment rate from a statistically valid random sample of claims across the program. It is measurement of the program's error rate, not a contractor that targets a provider to recover money the way a RAC does.
- Unified Program Integrity Contractor (UPIC): A UPIC investigates potential fraud, waste, and abuse across Medicare and Medicaid — a benefit-integrity function. A RAC reviews already-paid claims for improper payments; it is not a fraud investigator, and the two have different purposes and consequences.