RAC Audit: Triggers, Review Types, ADR Timelines, and the Five-Level Appeal

A RAC audit is a review of already-paid Medicare fee-for-service claims by a Recovery Audit Contractor, conducted to identify improper payments — overpayments and underpayments alike. The programme is legislatively mandated; CMS’s Program Integrity Manual describes the Medicare FFS Recovery Audit programme as “a legislatively mandated program (Tax Relief and Health Care Act of 2006) that utilizes RACs to identify improper payments paid by Medicare to FFS providers.”

What makes a RAC audit different from a routine claim denial is that it is a post-payment action: money already received is being reclaimed. That places the whole process inside Medicare’s reopening authority and, if contested, inside a five-level appeal path with filing deadlines that are short, specific and consequential. Every timeframe below is cited to the regulation or manual section that sets it. Where a figure is set by contract rather than by regulation — documentation-request limits in particular — that is said explicitly rather than glossed.

What Triggers a Review

RACs perform targeted rather than random review. The Program Integrity Manual sets boundaries on how targets are chosen, and two of them are worth knowing because they defeat common assumptions:

• MACs and RACs shall not target a provider for review solely based on the provider’s claim volume or payment size — and specifically, a RAC shall not choose a provider for review based only on the fact that the provider submits high-dollar or high-volume claims. Being large is not, by itself, a trigger.
• Targeting draws on systematic and ongoing analysis of claims and data, including data from RACs and the Comprehensive Error Rate Testing (CERT) programme, and on problem areas identified by CERT, RACs, the Office of Inspector General or the Government Accountability Office.

In practice, the issue rather than the provider is usually the starting point: CMS approves the specific issues a RAC may review, and the RAC then identifies claims matching that issue. The Program Integrity Manual also directs that contractors use screening tools and that identified problem areas be disclosed to the provider community — so a provider can generally find out which issues are open for review in its jurisdiction before a request arrives.

Automated Versus Complex Review

The distinction between the two review types determines whether records are requested at all, and it is defined in the Program Integrity Manual.

Automated review occurs, per PIM §3.3.1.3, “when a claim determination is made at the system level without a human review of the medical record, using available electronic information.” Its use is constrained: contractors must ensure automated denials are based on clear policy, defined as “a statute, regulation, NCD, or LCD that specifies the circumstances under which a service will always be considered non-covered, incorrectly coded, or improperly billed.” Medically Unlikely Edits — unit-of-service limits for a HCPCS/CPT code for one provider, one beneficiary, one date of service — are given as another example of an automated review. Automated edits may also address apparent typographical errors; the manual’s own illustration is 10,000 blood cultures for the same beneficiary on the same day.

The practical implication is that an automated finding is, by construction, one where the rule is not in dispute — the question is whether the claim matched it. Arguing clinical judgment against an automated denial is arguing the wrong point; the argument is either that the policy does not say what the contractor read it to say, or that the data was wrong.

Complex review is medical record review: per PIM §3.3.1.1, “requesting, receiving, and reviewing medical documentation associated with a claim,” and where medical necessity is the question, it “requires a licensed medical professional to use clinical review judgment to evaluate medical record documentation.” The manual defines clinical review judgment as a two-step process: synthesising all submitted record information into a longitudinal clinical picture of the patient, then applying that picture to the review criteria. This is where a complex-review response should be aimed — at the clinical narrative, not just the presence of individual documents.

The Additional Documentation Request and Its Deadline

Complex review begins with an Additional Documentation Request (ADR). The response deadline is set by regulation, not by contract, and it is the same for RACs, MACs, SMRCs and CERT:

Per 42 CFR §405.929, providers and suppliers have 45 calendar days to submit additional documentation in response to a MAC, RAC, SMRC or CERT request. Providers and suppliers have 30 calendar days to respond to a UPIC request.

42 CFR 405.929(b) is the source, and it confirms the structure directly: post-payment review is conducted under the reopening authority in §405.980, a contractor may issue an ADR in the course of it, and the provider has 45 calendar days to respond. A contractor may accept late documentation for good cause, which the regulation and manual both define by example as natural disasters, interruptions in business practices, or other extenuating circumstances the contractor deems sufficient. It is discretionary, not a right.

The consequence of missing it is unambiguous: per 42 CFR §405.930, contractors shall deny claims when the requested documentation is not received by the expected timeframe including any applicable extensions. A no-response denial is a denial on the merits of the record as it stands.

One structural detail that catches organisations with distributed record-keeping: the RAC requests documentation from the billing provider or supplier, and per PIM §3.2.3.3, “because the billing provider/supplier selected for review is the one whose payment is at risk, it is this billing provider/supplier who is ultimately responsible for submitting, within the established timelines, the documentation requested.” A contractor may separately send an ADR to third-party entities involved in the beneficiary’s care — other clinicians, providers or suppliers not submitting the claim — but may not solicit from a third party unless it first or simultaneously solicits the same information from the billing provider. If the record you need lives with a referring physician or an outside facility, chasing it is your obligation and your clock.

ADR volume limits are set by the RAC Statement of Work, not by regulation. CMS caps how many records a RAC may request from a given provider over a defined period, and has historically scaled those limits to provider size and to the provider’s own denial rate on prior reviews. Because those limits sit in the contract and CMS’s programme guidance rather than in the CFR or the Program Integrity Manual, this guide does not state a number — check the current RAC Statement of Work and the CMS Recovery Audit Program page for the limits applicable to your provider type and period.

The Discussion Period

Before a RAC finding becomes a formal overpayment demand, the RAC programme provides a discussion period — an opportunity to contact the RAC directly, present additional information and argue that the finding is wrong, without initiating an appeal. At the conclusion of post-payment review the contractor issues a Review Results Letter; PIM §3.6.4 states that MACs send one even where no overpayment is determined, and that “the RACs shall issue a Review Results Letter for all audits as outlined in their SOW requirements.”

Two things matter about the discussion period and are frequently confused. First, it is a programme feature defined in the RAC Statement of Work, not a right conferred by the appeals regulation — its length and mechanics come from CMS programme guidance rather than from 42 CFR part 405, and this guide therefore does not state a day count for it. Verify the current window from the CMS Recovery Audit Program page or the RAC’s own correspondence. Second, and critically, the discussion period does not extend any appeal deadline. The 120-day clock for a redetermination runs from receipt of the initial determination regardless of whether a discussion is under way. Treating a discussion as a pause is one of the most expensive mistakes available in this process.

The Five-Level Appeal Path

If the finding stands, it becomes a revised initial determination and enters the standard Medicare Part A/B claims appeal process at 42 CFR part 405 subpart I. Five levels, each with a filing deadline for the appellant and an adjudication deadline for the adjudicator. Every figure below is from the regulation.

1. Redetermination, by the MAC. File within 120 calendar days from the date the party receives notice of the initial determination (42 CFR 405.942(a)); receipt is presumed 5 calendar days after the date of the notice unless there is evidence to the contrary, and the request counts as filed on the date the contractor receives it. The contractor issues its redetermination or dismissal within 60 calendar days of receiving a timely request (405.950(a)) — extended by up to 14 calendar days for each additional evidence submission the appellant makes after filing.
2. Reconsideration, by a Qualified Independent Contractor (QIC). File within 180 calendar days from receipt of the redetermination notice (405.962(a)), again with the 5-day receipt presumption. The QIC issues its reconsideration within 60 calendar days (405.970(a)), with the same 14-day-per-submission extension. If the QIC cannot meet that deadline it must notify the parties and offer the appellant the opportunity to escalate to the next level.
3. Administrative Law Judge (ALJ) hearing, at the Office of Medicare Hearings and Appeals (OMHA). File within 60 calendar days after receipt of the QIC’s reconsideration notice (405.1002(a)(1)), and the amount in controversy requirement at 405.1006 must be met. That amount is not fixed: the regulation sets it as $100 as of July 2003, increased by the percentage increase in the medical care component of the CPI for all urban consumers from July 2003 to the July preceding the current year, rounded to the nearest $10, with changes published in the Federal Register. Look up the current-year figure rather than using $100. The adjudication period is 90 calendar days from receipt of the hearing request (405.1016(a)); for an appeal escalated because the QIC did not act, it is 180 calendar days (405.1016(c)).
4. Medicare Appeals Council review, at the Departmental Appeals Board. File within 60 calendar days after receipt of the ALJ’s or attorney adjudicator’s decision or dismissal (405.1102(a)(1)). The Council conducts a de novo review and issues a final decision, dismissal or remand within 90 calendar days of receipt of the request (405.1100(c)) — or 180 calendar days where the case was escalated from OMHA (405.1100(d)).
5. Judicial review in Federal district court (405.1136). Available to a party to a Council decision, or to an appellant who escalates when the Council does not complete its review in time, provided the amount in controversy meets 405.1006(c): $1,000 or more as of the same July 2003 baseline, adjusted by the same CPI method — so again, check the current-year figure. The action is filed in the district court where the party resides or has its principal place of business, or in the District Court for the District of Columbia if neither applies.

Two mechanics apply throughout. Filing deadlines can be extended for good cause at levels one through four, but only on a written request explaining why the appeal was not timely, and only at the adjudicator’s discretion — 405.942(b) sets the standard the other levels borrow. And each stage’s adjudication deadline is a deadline on the adjudicator, with the escalation right at 405.970 and 405.1016 as the appellant’s remedy when it slips.

The ALJ backlog is a real and changing condition

The 90-calendar-day adjudication period at 405.1016(a) is a regulatory requirement, not a description of observed practice. OMHA has for years carried an appeal inventory far in excess of its annual adjudication capacity, and actual waits at level three have been very substantially longer than 90 days — long enough that the backlog itself has been the subject of litigation and of successive departmental remediation plans. This guide deliberately does not state a current average wait, because that figure has moved considerably and repeatedly and was not verified against a primary source at the time of writing (23 August 2026). Check OMHA’s own published statistics for the current position before planning around a date. What is durable rather than volatile is the structural point: a provider that intends to appeal to level three should model a materially longer wait than the regulation implies, should confirm current adjudication times before relying on any timeline, and should understand the recoupment consequences described next, which do not pause while it waits.

When the Money Actually Moves

This is the part that changes what an appeal is worth, and it is set by 42 CFR 405.379, implementing section 1893(f)(2)(A) of the Act.

• Medicare contractors can begin recoupment no earlier than 41 days from the date of the initial overpayment demand (405.379(d)(1)). That window is why a redetermination filed promptly after the demand can stop recoupment before it ever starts.
• On receipt of a timely and valid request for a redetermination, the contractor shall cease recoupment; if recoupment has not yet begun, it shall not initiate it (405.379(d)(1)).
• If the redetermination affirms the overpayment in whole, recoupment may resume on the 60th calendar day after the date of the redetermination notice; if it affirms in part and reduces the overpayment, on the 60th calendar day after written notice of the revised amount (405.379(e)(1)).
• On receipt of a timely and valid request for reconsideration, recoupment must again cease, or must not begin (405.379(d)(3) and (e)(2)).
• The protection stops there. If the provider subsequently appeals to the ALJ, the Council or Federal court, “recoupment remains in effect” (405.379(d)(5)). Levels three, four and five do not suspend collection.
• Interest accrues throughout, in accordance with 42 CFR 405.378 (405.379(d)(9)). If the determination is reversed in whole or in part at any subsequent administrative or judicial level, adjustments are made both to the overpayment and to the amount of interest charged (405.379(d)(8)).

The consequence is a genuine cash-flow decision rather than a purely legal one: appealing through levels one and two defers collection at no cash cost beyond interest exposure, while appealing beyond level two means litigating with the money already recouped and a wait that is not reliably 90 days.

How Far Back a RAC Can Look

Because post-payment review is conducted under the reopening authority at 42 CFR 405.980, the reopening timeframes govern the look-back. A contractor may reopen an initial determination or redetermination on its own motion within 1 year for any reason; within 4 years for good cause as defined at 405.986; at any time where reliable evidence exists that the determination was procured by fraud or similar fault; at any time to correct a clerical error in a determination unfavourable to the party; and at any time to effectuate a decision issued under the coverage appeals process. A party may likewise request reopening within 1 year for any reason or within 4 years for good cause.

Those are the regulatory outer bounds. CMS separately restricts the RAC look-back by contract, and that contractual limit has historically been shorter than the regulatory maximum and measured from the date of payment rather than the date of the determination. Confirm the applicable look-back from the current RAC Statement of Work rather than assuming the 4-year regulatory figure applies to a RAC review.

Frequently Asked Questions

How long do I have to respond to a RAC ADR?

45 calendar days from the request, under 42 CFR 405.929(b)(1) and PIM §3.2.3.1. The contractor may accept late documentation for good cause — natural disasters, interruptions in business practices, or comparable extenuating circumstances — but that is discretionary. Under 42 CFR 405.930 the claim is denied if documentation is not received in time.

What is the difference between an automated and a complex RAC review?

An automated review reaches a determination at the system level without human review of the medical record, and must rest on clear policy — a statute, regulation, NCD or LCD specifying that a service will always be non-covered, incorrectly coded or improperly billed. A complex review involves requesting and reviewing the medical record, and where medical necessity is at issue it requires a licensed medical professional applying clinical review judgment.

Does the discussion period extend my appeal deadline?

No. The 120-calendar-day deadline for requesting a redetermination runs from receipt of the initial determination under 42 CFR 405.942(a) regardless of any discussion under way with the RAC. The discussion period is a RAC programme feature defined in the Statement of Work, not a tolling provision in the appeals regulation.

Will Medicare take the money back while I appeal?

Not during levels one and two, if you file timely. Recoupment cannot begin earlier than 41 days from the demand, must cease on a timely and valid redetermination request, and must cease again on a timely and valid reconsideration request. It resumes on the 60th calendar day after an affirming redetermination notice unless a reconsideration request intervenes. From the ALJ level onward, 42 CFR 405.379(d)(5) provides that recoupment remains in effect — and interest accrues throughout under 42 CFR 405.378.

What is the minimum amount needed to reach an ALJ hearing?

The amount in controversy at 42 CFR 405.1006(b) is $100 as of July 2003, indexed annually by the medical care component of the CPI-U and rounded to the nearest $10, with changes published in the Federal Register. For judicial review the baseline is $1,000, indexed the same way. Always use the published current-year figures, not the statutory baselines.

How far back can a RAC audit go?

The regulatory reopening limits at 42 CFR 405.980(b) are 1 year for any reason, 4 years for good cause, and no limit where there is reliable evidence of fraud or similar fault. CMS imposes a shorter contractual look-back on RACs specifically through the Statement of Work, so check that document rather than applying the regulatory maximum.

Can a RAC target my organisation just because we bill a lot?

No. The Program Integrity Manual directs that MACs and RACs shall not target a provider for review solely on the basis of claim volume or dollar value, and that a RAC shall not select a provider based only on the fact that it submits high-dollar or high-volume claims.

This guide summarises 42 CFR 405.379, 405.929, 405.930, 405.942, 405.950, 405.962, 405.970, 405.980, 405.1002, 405.1006, 405.1016, 405.1100, 405.1102 and 405.1136 as codified on 1 August 2026, and CMS Medicare Program Integrity Manual Pub. 100-08, Chapter 3, as published by CMS. Documentation-request limits, the discussion-period window and the RAC look-back are set by the Recovery Audit Statement of Work and CMS programme guidance rather than by regulation, and are described structurally here rather than quantified. Current ALJ adjudication times were not verified against a primary source at the time of writing. This is general reference material, not legal or billing advice for a specific appeal.

Related: see the Research Integrity & Compliance hub, the two-midnight rule for one of the most frequently reviewed inpatient-status issues, incident-to billing for a coverage test whose failure produces exactly the kind of systematic pattern post-payment review is designed to find, and the False Claims Act for how a billing error is characterised once intent or recklessness is alleged.