RAC Audit Readiness

May 2025

Recovery Audit Contractors (RACs) operate on a contingency fee basis — they only get paid when they identify overpayments to recover. This creates a financial incentive to audit aggressively, and hospitals that are unprepared face both repayment demands and the administrative burden of managing appeals. Proactive RAC readiness isn't about gaming the system — it's about ensuring your coding and documentation accurately reflect the care you provided, so that legitimate claims survive scrutiny.

How RAC Audits Work

CMS contracts with four regional RACs to audit Medicare fee-for-service claims for overpayments and, less commonly, underpayments. Understanding the mechanics of RAC audits is the first step toward preparing for them:

• RACs conduct two types of reviews: automated reviews (no medical record requested — data analysis only) and complex reviews (medical records requested and reviewed by clinical staff)
• RACs are paid a contingency fee on overpayments collected — typically 9–12.5% depending on the RAC and claim type, which directly incentivizes aggressive audit activity
• Once a RAC identifies a potential issue, they send an Additional Documentation Request (ADR) — the hospital has 45 days to submit the records
• If the RAC determines an overpayment, the hospital has 120 days from the demand letter to file a redetermination, which is the first level of appeal
• The full appeals process has five levels: Redetermination → Reconsideration → ALJ Hearing → DAB Review → Federal Court

Because RACs are paid on what they recover, their review activity concentrates heavily on high-dollar, high-volume service lines where documentation vulnerabilities are most common.

High-Risk DRGs and Services RACs Target

RACs publish their approved audit topics — and historically, certain service lines draw far more review activity than others. Internal audit programs should prioritize the same areas RACs examine:

• Short inpatient stays (1–2 day): RACs question whether inpatient admission was medically necessary versus observation status, particularly for cases that resolve quickly
• Inpatient vs. outpatient status disputes: The two-midnight rule requires physicians to admit patients whose care is expected to span two midnights; shorter stays are presumed outpatient and subject to denial
• Sepsis coding: High-weighted DRGs attract close scrutiny; RACs look for documentation that meets Sepsis-3 criteria and supports the severity level coded
• Cardiac and orthopedic procedures: High-dollar surgical DRGs — including cardiac catheterization, spinal surgery, and joint replacements — are consistent RAC targets for both medical necessity and coding accuracy
• Medical necessity for specific procedures: RACs review whether documentation supports the level of intervention billed, not just that the procedure was performed
• Unbundling: Separately billing services that should be bundled into a global surgical package is a frequent automated review trigger
• Duplicate billing: The same service billed twice or by two providers for the same encounter — often identified through data analysis before any records are requested

Building RAC Readiness Before the ADR Arrives

Organizations that fare best under RAC scrutiny have one thing in common: they audit themselves first. A proactive readiness program addresses the vulnerabilities RACs look for before an ADR ever arrives:

• Internal audit program aligned with RAC targets: Audit the same DRGs and service lines that RACs historically target — before they do. Findings identified internally can be corrected prospectively without repayment demands
• Two-midnight rule compliance: Ensure admission decision documentation explicitly addresses expected length of stay and medical necessity — the physician's clinical reasoning must be visible in the record, not assumed
• Physician advisor program: A physician advisor who reviews inpatient admission decisions in real time catches status determination errors before discharge, when correction is still possible
• Medical record completion: Incomplete records — missing signatures, late attestations, unsigned orders — are among the easiest RAC wins. Ensure record completion within 30 days of discharge across all service lines
• CDI for high-risk DRGs: CDI specialists should focus concurrent review resources on the service lines RACs target most, ensuring documentation supports the diagnosis and severity level coded
• Monitor RAC approved issues list: CMS publishes active and retired RAC review topics — knowing what is currently being reviewed lets you prioritize internal audit resources toward the highest-exposure areas
• Staff education: Train coders, CDI specialists, and case managers on two-midnight rule application, medical necessity documentation standards, and inpatient admission criteria relevant to their service lines

Managing the Appeals Process Effectively

When RAC findings do occur, the appeals process offers meaningful recovery opportunities — but only for organizations that manage it systematically:

• Track ADR receipt dates meticulously — the 45-day response window is strict, and missing it forfeits the ability to contest the finding
• Organize medical records completely before submission — missing documentation is the primary reason hospitals lose RAC appeals at the early levels
• Use physician attestation letters strategically for medical necessity disputes — the treating physician's clinical judgment carries significant weight at the ALJ hearing level
• Overturn rates at the ALJ level historically exceed 60% for medical necessity denials — do not abandon meritorious appeals at lower levels simply because early decisions went against the hospital
• Engage an external expert reviewer for high-dollar cases — a credentialed specialist's independent opinion can be decisive when the clinical picture is complex

RAC audit readiness is not a one-time project — it is an ongoing program that requires alignment between case management, CDI, HIM, coding, and revenue cycle. The organizations that navigate RAC activity most successfully maintain internal audit programs calibrated to known RAC targets, invest in complete medical record documentation, and manage appeals systematically through every level. Ocean Health Executives supports this work through RAC readiness reviews, DRG audits, and targeted compliance consulting.