RAC: the contingency-fee auditor and your appeal posture

What a RAC is — and why contingency fees shape it

A RAC is a contractor CMS pays to find improper Medicare payments after the fact. Recovery Audit Contractors review already-paid fee-for-service claims for both overpayments and underpayments, and they are compensated on a contingency fee — a percentage of what they recover 1Ref 1Centers for Medicare & Medicaid Services (2026).Medicare Fee for Service Recovery Audit Program.That Recovery Audit Contractors conduct post-payment review with a defined lookback and that the provider's appeal rights run through the five-level Medicare appeals process.. That incentive shapes their behavior toward high-volume, defensible findings. Reviews come in two forms: automated, decided from claims data without records, and complex, which requests your documentation to judge medical necessity or coding.

• Automated review — a data-driven denial for something the claim shows on its face, such as a duplicate or a coding-edit conflict; no records are pulled.
• Complex review — a records request to test whether the documentation supports the code and medical necessity.
• The incentive to remember — because the auditor keeps a share of recoveries, it pursues findings it expects to survive; a well-documented claim is your best deterrent.

The lookback and what a RAC targets in an office

A RAC reaches back a defined period and gravitates to the same office soft spots. Review is limited to a lookback window measured from when the claim was paid — the program's statement of work sets the current limit, historically three years — so check the current figure rather than assuming 1Ref 1Centers for Medicare & Medicaid Services (2026).Medicare Fee for Service Recovery Audit Program.That Recovery Audit Contractors conduct post-payment review with a defined lookback and that the provider's appeal rights run through the five-level Medicare appeals process.. In an office practice the recurring targets are E/M level selection, where a distribution skewed to high levels — your E/M bell curve — draws scrutiny under the 2021 time-or-MDM framework 2Ref 2Centers for Medicare & Medicaid Services (2023).Evaluation and Management Services Guide.That E/M office-visit levels are selected by medical decision making or total time under the 2021+ framework, the standard a RAC applies when it reviews E/M level selection..

• Signatures and authentication — a missing or illegible signature is a classic finding; Medicare lets an attestation cure it, but only if you catch it 3Ref 3Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires services to be authenticated by signature and that an attestation can cure a missing or illegible signature — a classic RAC finding..
• Incident-to — if you bill services incident-to under a supervising clinician, the RAC checks direct supervision and the initiating-service requirement set in the regulation 4Ref 4Office of the Federal Register (2026).42 CFR 410.26 — Services and supplies incident to a physician's professional services.The incident-to requirements — direct supervision, the employment or contract relationship, and the initiating-service requirement — a RAC checks when incident-to billing is under review..
• Telehealth code payability — whether a code billed as telehealth was actually on the Medicare telehealth list for that year 5Ref 5Centers for Medicare & Medicaid Services (2026).List of Telehealth Services.That CMS publishes the definitive annual list of codes payable as Medicare telehealth, the reference for whether a code billed as telehealth was payable..
• Duplicates and units — the automated findings that need no records at all.

When the letter arrives: the response sequence

Treat the first RAC letter as a hard deadline. Read whether it is an automated denial or a complex review requesting records, note which claims and dates are named, and calendar every stated deadline the day it arrives. If records are requested, respond as you would to any post-payment audit: a complete, organized, copied packet, on time, by a trackable method. Do not repay on receipt — a demand letter starts a process with appeal rights, not a verdict.

1. Identify the type — automated (no records) or complex (records requested); the response differs. 2. Calendar the dates — the records deadline first, then every appeal deadline once findings issue. 3. Respond completely — the full record behind each named claim, and never alter the chart to improve it. 4. Use the discussion period — a RAC discussion can resolve findings informally, but it does not replace or extend your appeal deadlines. 5. Appeal to preserve rights — file timely even while the discussion continues.

Your appeal posture: the five levels and the recoupment clock

Your defense is the Medicare appeals ladder, and its early rungs can pause the clawback. A RAC overpayment finding is appealable through the five-level Medicare appeals process, each level with its own filing deadline 1Ref 1Centers for Medicare & Medicaid Services (2026).Medicare Fee for Service Recovery Audit Program.That Recovery Audit Contractors conduct post-payment review with a defined lookback and that the provider's appeal rights run through the five-level Medicare appeals process.. Appealing at the first two levels within the stated window can suspend recoupment while the appeal is pending, so filing on time protects both the claim and your cash flow. Calendar each deadline the day the letter arrives, and appeal every claim you can genuinely defend.

Each rung has a shorter fuse than the last, and the printed deadline governs. The single most expensive mistake is letting a level lapse — an unappealed finding becomes final, and the recoupment resumes.

RAC vs TPE vs the fraud unit — know which one you got

Not every Medicare review is a RAC, and the difference changes your response. A RAC is a contingency-fee, post-payment recovery audit. Targeted Probe and Educate is run by your MAC, is educational, works in rounds, and is meant to correct rather than recover 6Ref 6Centers for Medicare & Medicaid Services (2026).Targeted Probe and Educate (TPE).That TPE is a MAC-run, education-focused review conducted in rounds — contrasted with a contingency-fee RAC recovery audit.. A Unified Program Integrity Contractor or a fraud referral is a different order of seriousness — potential fraud, not a coding disagreement. Identify the sender on the first letter, because it tells you whether you are being taught, billed, or investigated.

• RAC — money back, contingency-driven, post-payment; you appeal.
• TPE — education in rounds; you correct and pass a round to exit.
• UPIC or fraud referral — a program-integrity investigation; slow down and get counsel before you respond further.

What a RAC finding can cascade into

A single audit rarely stays a single audit. A confirmed overpayment can extend beyond the reviewed claims. Contractors may extrapolate an error rate across a larger sample, turning a handful of denied claims into a much larger takeback letter for overpayments. A pattern that suggests abuse can be referred for further action and, in the worst case, reach Medicare enrollment revocation. The Medicare Advantage analog — the radv-adjacent risk-adjustment review — follows similar logic on the plan side.

• Extrapolation — the reason a small sample matters; a low error rate on a defensible sample is your protection against it.
• Revocation — the far end of the cascade, usually reserved for patterns of abuse rather than a routine overpayment.
• The through-line — keep coding and documentation aligned with the record so no auditor has a pattern to extrapolate.