Medicaid RAC audits: recovery auditors, lookback limits, and appeals
A Medicaid RAC audit is a review of paid claims by a private Recovery Audit Contractor that the state hires under 42 CFR 455.500 and the sections after it. The contractor keeps a percentage of what it recovers, may not reach back more than three years without the state's permission, owes providers its findings within 60 days, and its decisions can be appealed under state law.
On this page
How the program works
Section 1902(a)(42)(B) of the Social Security Act, added by the Affordable Care Act, tells each state to contract with one or more Medicaid RACs unless CMS excuses it. The federal rules come from a final rule published September 16, 2011, and sit at 42 CFR 455.500 to 455.518.
A RAC reviews claims the state paid under its Medicaid plan or a waiver, looking for overpayments to recoup and underpayments to report. States may leave managed care claims out of RAC review, which can put trips paid through a health plan or a capitated broker outside it. Trips the state pays directly, fee for service, are squarely in scope.
A RAC is paid only out of money it recovers, as a percentage of each overpayment, and the rate may not exceed the highest Medicare RAC contingency fee unless CMS approves a waiver. If a provider appeals and the finding is reversed at any level, the RAC returns the fee tied to that claim.
Limits that protect providers
Federal rules put these limits on every Medicaid RAC (42 CFR 455.506 and 455.508):
- Lookback. No claims older than three years from the claim date without state approval.
- No double audits. A RAC should not audit claims another entity has already audited or is auditing.
- Record caps. The state sets how many records a RAC may request and how often.
- Findings deadline. The RAC notifies providers of overpayment findings within 60 calendar days. Mississippi counts that from the preliminary findings letter.
- Access. A toll-free line in every letter, staffed 8:00 a.m. to 4:30 p.m. local time, and acceptance of records by CD, DVD, or fax on request.
- Qualified reviewers. At least one full-time medical director who is an MD or DO, plus certified coders unless the state decides they are not needed.
Which states run one
In fiscal year 2021, fewer than half did. GAO found that in that year 34 states and the District of Columbia did not take part in the RAC program. The reasons states gave, and a state could give more than one, were other program integrity work (25), no contractor they could hire (22), and a Medicaid population mostly in managed care (20). After GAO’s June 2023 report, CMS adopted written procedures dated October 3, 2023 that grant full exceptions for two years at a time.
Where a RAC operates, the process runs through its portal and letters. New York’s Office of the Medicaid Inspector General uses a contractor that handles record requests, draft audit reports, and final audit reports online. A provider that agrees with a final finding repays by check, a claim void or adjustment, an offset against future payments, or a withhold. Mississippi warns that ignored record requests become technical denials.
RACs, UPICs, and other auditors
| Auditor | Who it works for | What it does |
|---|---|---|
| Medicaid RAC | A contractor hired by the state | Reviews paid claims for overpayments and underpayments, within three years |
| UPIC | A CMS contractor, under Social Security Act section 1936 | Investigates and audits billing across Medicare and Medicaid with the state, and recommends overpayments, payment suspensions, or terminations |
| State program integrity unit or inspector general | The state | Audits under state law, on the state’s own lookback period |
| Medicaid Fraud Control Unit | A state unit, usually in the attorney general’s office | Investigates and prosecutes fraud |
A UPIC can recommend a payment suspension to the state or send a case to the HHS Inspector General for civil or criminal action. The Medicaid audit guide covers sampling, extrapolation, and the other auditors in more depth.
Appeals
Federal rules require every state to give providers appeal rights under state law or administrative procedures for an adverse RAC decision (42 CFR 455.512). The steps and deadlines are the state’s. In New York, the provider receives a preliminary findings letter or draft report listing each claim line and discrepancy, may send more documentation, and then gets the final report. Answer at the draft stage with complete trip logs, since that is the step built for sending more documentation.
Having records ready
A RAC letter lists claims by date, so the records have to be found by date. HealthRide’s trip log report exports each ride’s GPS-recorded miles, timestamps, and signatures as a CSV or PDF for any claim a reviewer asks about.
Frequently asked questions
- Is a RAC audit the same as a fraud investigation?
- No. A RAC looks for improper payments, both overpayments and underpayments, in claims that were already paid. It is still required to pass suspected fraud or abuse to the state, and the state must refer suspected fraud to its Medicaid Fraud Control Unit or another law enforcement agency. A records request from a RAC is a billing review until something suggests otherwise.
- How far back can a Medicaid RAC review my trips?
- Three years from the date of the claim, unless the state approves a longer look. Other auditors run on different clocks set by state law, so keep trip records for as long as your state and your broker contracts require.
- What happens if I do not send the records a RAC asks for?
- The claims are usually denied. Mississippi's Division of Medicaid calls these technical denials, and its administrative code treats failing to take part in an audit, or unduly delaying one, as abandoning it. The Division may then issue a final report at once, subpoena the records, end the provider agreement, or refer the case for prosecution. Send complete records before the deadline in the letter.
- Can a RAC find money the state owes me?
- Yes. Federal rules make states pay their RACs for finding underpayments too, and require states to tell providers about the underpayments a RAC identifies. New York, for example, has providers sign an approved agreement form to recover an underpayment its contractor finds.
