Quick Fix Summary
When that RAC audit letter arrives, set up a small team, grab the exact claims in question, and send a polite but complete response within 30 days. That’s really all it takes.
What’s Happening
A Recovery Audit Contractor (RAC) is just a private company CMS hires to hunt down overpayments and underpayments in Medicare Fee-for-Service claims. Even in 2026, CMS still lets RACs look back three years—so that old coding mistake from 2023 could suddenly become your problem today. RACs don’t just poke around randomly; they run algorithms that flag suspicious claims, usually ones with higher-than-average payments, weird diagnosis codes, or the same billing modifier used over and over. Once a claim gets flagged, the RAC sends a demand letter asking for money back—or sometimes just more paperwork to justify the payment.
How to Handle It Step by Step
- Lock down the claim file. In your billing system, export the exact claim numbers and dates from the RAC demand letter. If you use CMS’s Blue Button or a MAC portal, pull the raw claim files so nothing changes while you dig into it.
- Double-check the NPI and TIN on the letter. Make sure the service location and provider match your records—typos in these letters happen more often than you’d expect.
- Round up the supporting docs. Grab the full medical record, encounter notes, orders, labs, imaging, and any prior authorization forms. If the service happened in a facility, pull the UB-04 or 837-I claim image with the exact line item in question.
-
Do a quick internal audit. In Excel or Power BI, compare the billed CPT/HCPCS codes and modifiers against the documentation. Watch for:
- Missing physician signatures
- Dates of service that don’t match
- Diagnosis codes that don’t actually support medical necessity
- Write the response. Keep it short and to the point: “We reviewed claim #12345678 dated 06/15/2025. Our internal audit confirms the service was medically necessary and properly documented. No overpayment exists.” Attach the signed encounter note and any prior auth. Send it via certified mail within 30 days.
What If My Response Didn’t Work?
- Ask for an extended repayment plan. If the overpayment is real but you can’t swing the full amount, log in to the CMS RAC portal, fill out Form CMS-1450 (yes, it’s still the old form), and propose a 12-month zero-interest payment schedule.
- File a redetermination. In the portal, click “Appeal” and pick Redetermination (Level 1). Upload the same docs you sent the RAC plus a cover letter explaining why the service met LCD/NCD rules. Deadline: 120 days from the RAC’s final demand.
- See if you qualify for a Small Provider Exception. If your practice has fewer than 10 full-time employees, you can ask for a waiver from the usual 15-day response window. Call the CMS Hotline and ask for the Small Provider Liaison.
Prevention Tips to Stay Ahead
| Task | How to do it (as of 2026) | When to do it |
|---|---|---|
| Monthly coding huddle | 15-minute Zoom with coders and clinicians to review the top 10 codes that changed CCI edits or LCDs | First Monday of every month |
| Template cleanup | In your EHR, audit every note template that auto-fills a Level-4 E/M code. Delete the “HPI 4 elements, ROS 10 systems” boilerplate unless it’s actually documented | Quarterly, right after the LCD update |
| Pre-bill scrubber | Turn on the built-in Medicare scrubber in your clearinghouse; set the “RAC Risk Score” flag to high and reroute any claim that triggers a 99% or higher risk | Every claim before submission |
| Quarterly self-audit | Run the same RAC algorithms on your own data using CMS’s free Audit Data Analysis Tool; export the CSV and compare against last quarter’s results | Last week of March, June, September, December |
Here’s a little insider tip: In 2025, CMS quietly added a new “RAC Lookback Risk Score” to the 2026 PFS Final Rule. Practices scoring above 80 on this metric get audited twice as often, so run the tool before the end of each quarter and tackle the top three issues right away.
