Recovery Audit Contractor (RAC) Audits in 2026: Current Review Topics and Response Timelines

Recovery Audit Contractors, known as RACs or Recovery Auditors, identify and correct improper payments in Medicare fee-for-service. Unlike Medicare Administrative Contractors (MACs), which process claims and conduct routine medical review, RACs review claims after they have been paid and are compensated on a contingency fee basis based on the improper payments they identify. RAC reviews can lead to overpayment demands, and in some cases, underpayment corrections.

The RAC program has changed in recent years. CMS awarded new contracts, and as of 2025 and 2026, RAC Regions 3, 4, and 5 are handled by Cotiviti GOV Services LLC, while Regions 1 and 2 are handled by Performant. CMS also continues to publish proposed and approved RAC review topics, with new proposed topics added as recently as October 2026.

This article explains how RAC audits work in 2026, the current RAC regions and contractors, how review topics are proposed and approved, current topic examples, additional documentation request (ADR) limits, response timelines, the discussion period, and how to appeal. It is educational and does not replace advice from qualified professionals.

What Are Recovery Audit Contractors?

CMS describes Recovery Auditors as tasked with identifying and recovering Medicare overpayments and identifying underpayments. The Recovery Audit Program was made permanent and expanded nationwide under Section 1893(h) of the Social Security Act.

Key features of RAC reviews include:

• RACs generally review claims on a postpayment basis.

• RACs use the same Medicare policies as MACs, including national coverage determinations, local coverage determinations, and CMS manuals.

• Review topics must be approved by CMS before widespread review and are posted on CMS and RAC websites.

• RACs conduct automated reviews, which do not require medical records, and complex reviews, which require medical records.

• RACs are required to employ staff such as nurses, therapists, certified coders, and a physician medical director.

• CMS uses an independent validation contractor to audit the accuracy of RAC determinations.

Current RAC Regions and Contractors

According to CMS's Recovery Audit Program webpage, the current RAC regions are:

• Region 1, Performant: Connecticut, Indiana, Kentucky, Massachusetts, Maine, Michigan, New Hampshire, New York, Ohio, Rhode Island, and Vermont.

• Region 2, Performant: Arkansas, Colorado, Iowa, Illinois, Kansas, Louisiana, Missouri, Minnesota, Mississippi, Nebraska, New Mexico, Oklahoma, Texas, and Wisconsin.

• Region 3, Cotiviti GOV Services LLC: Alabama, Florida, Georgia, North Carolina, South Carolina, Tennessee, Virginia, West Virginia, Puerto Rico, and the U.S. Virgin Islands.

• Region 4, Cotiviti GOV Services LLC: Alaska, Arizona, California, the District of Columbia, Delaware, Hawaii, Idaho, Maryland, Montana, North Dakota, New Jersey, Nevada, Oregon, Pennsylvania, South Dakota, Utah, Washington, Wyoming, Guam, American Samoa, and the Northern Mariana Islands.

• Region 5, Cotiviti GOV Services LLC: nationwide review of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS), home health, and hospice.

CMS explains that RACs in Regions 1 through 4 perform postpayment review of Medicare Part A and Part B claims, while the Region 5 RAC is dedicated to DMEPOS and home health and hospice. CMS also noted that Performant, which previously handled Region 5 reviews, remains under contract to support the program from an administrative and appeals perspective for that region, and that Region 5 providers can rely on the review completion date and the RAC's name on the review results letter to identify which contractor to contact.

Providers should confirm current contractor information using CMS's Recovery Audit Program webpage and Review Contractor Directory, as contractor assignments can change.

How RAC Review Topics Are Proposed and Approved

RACs cannot review any issue they choose. CMS explains that it posts proposed and approved RAC topics, updated monthly, including:

• The name of the review topic.

• A description of what is being reviewed.

• The states or MAC regions where reviews will occur.

• The review type, complex or automated.

• Provider types.

• Affected codes.

• Applicable policy references.

According to CMS's RAC statement of work, RACs submit proposed topics with supporting documentation, such as a review topic summary, policy references, edit parameters, and affected codes, which CMS reviews before approval. RACs may rely on references such as national and local coverage determinations, CMS coding policies, CMS technical direction, CMS manuals, and coding guidance.

CMS-Required Reviews

CMS also notes that it often receives referrals of potential improper payments from MACs, UPICs, and federal investigative agencies such as OIG and the Department of Justice, and that at its discretion, CMS may require RACs to review claims based on these referrals. CMS states that these CMS-required RAC reviews are conducted outside of the established ADR limits.

Current Review Topic Examples

Approved Topics

CMS's Approved RAC Topics list contains well over one hundred topics. Examples of long-standing approved topics include:

• Inpatient hospital MS-DRG coding validation (complex review, inpatient hospitals).

• Cataract removal medical necessity and documentation requirements (complex review, ambulatory surgical centers and outpatient hospitals).

• Sacral neurostimulation medical necessity and documentation requirements.

• Bariatric surgery medical necessity and documentation requirements.

• Inappropriate billing of home visit evaluation and management codes during a hospital inpatient stay (automated review).

• Durable medical equipment billed while a beneficiary is an inpatient (automated review).

• Ankle-foot and knee-ankle-foot orthoses, spinal orthoses, patient lifts, and other DMEPOS medical necessity and documentation reviews.

• Annual wellness visit excessive units (automated review).

• Evaluation and management coding issues, such as new patient visits and office visits billed for hospital inpatients (automated review).

Recently Proposed Topics

CMS's Proposed RAC Topics list included the following topics proposed on October 20, 2026:

• Intraosseous basivertebral nerve ablation: medical necessity and documentation requirements (complex review, ambulatory surgical centers and outpatient hospitals, in specified MAC jurisdictions).

• Home health services related to the terminal diagnosis billed during a hospice episode of care (automated review, home health agencies).

• Silicone breast prostheses within the reasonable useful lifetime: excessive units (automated review, DME suppliers).

• Lower limb prosthetics: coverage of additions billed with an initial or preparatory prosthesis (automated review, DME suppliers).

Because topics are updated monthly, providers should check the CMS Approved and Proposed RAC Topics pages and their RAC's website regularly for topics affecting their services.

The RAC Look-Back Period

According to CMS materials, RACs generally may look back three years from the claim paid date. CMS has also described a shorter, six-month look-back period for inpatient patient status reviews when the claim is submitted within three months of the date of service. Under CMS's ADR limit methodology, RACs that choose to review a provider using an adjusted, risk-based ADR limit must use a six-month look-back period, while those using the baseline limit may review under a three-year look-back period, with CMS approval.

The RAC statement of work also states that RACs shall delay sending ADRs until at least 60 days after the claim paid date.

ADR Limits

CMS limits the number of medical records RACs may request. For institutional providers, CMS's methodology includes:

• A baseline annual ADR limit of one-half of one percent of the provider's total number of paid Medicare claims from a previous 12-month period.

• ADR letters sent on a 45-day cycle, with the annual limit divided by eight to set the maximum number of claims per cycle.

• Limits diversified across claim types based on the types of bills the provider was paid for in the previous year.

• After three 45-day cycles, CMS calculates a denial rate and adjusts the ADR limit. Providers with high denial rates can face higher limits, while providers with very low denial rates, zero to three percent, may have no reviews for three cycles.

CMS has also stated that it will consider allowing RACs to use extrapolation to estimate overpayments for providers with persistently or excessively high denial rates, or moderate denial rates with significant overpayment amounts.

CMS-required reviews based on referrals are conducted outside these limits.

Response Timelines

Responding to an ADR

Under CMS's Medicare Program Integrity Manual, providers generally have 45 calendar days to submit documentation in response to a RAC ADR. Contractors may accept late documentation for good cause, but providers should not rely on this. Failure to respond typically results in the claim being denied.

RAC Review Time

The Program Integrity Manual states that when a RAC receives requested documentation within 45 calendar days of the ADR date, the RAC shall make and document its review determination and communicate the results to the provider within 30 calendar days of receiving the documentation.

The Discussion Period

After the RAC issues review results, providers may request a discussion. CMS has explained that:

• The discussion period gives providers an opportunity to submit additional information to substantiate their claims and allows the RAC to review it without the provider having to file an appeal.

• RACs must wait 30 days after sending review results to allow for a discussion request before sending the claim to the MAC for adjustment.

• RACs must confirm receipt of a discussion request within three business days.

• Providers do not have to choose between a discussion and an appeal. However, if the RAC is notified that the provider has filed an appeal, the RAC will stop the discussion period.

CMS has cautioned providers not to confuse the discussion period with the appeals process. If you disagree with a RAC determination, file a timely appeal.

Appeals

RAC overpayment determinations are processed through the MAC, and providers may appeal through the Medicare fee-for-service appeals process:

• Redetermination by the MAC, generally requested within 120 days of receiving the demand letter.

• Reconsideration by a Qualified Independent Contractor, generally within 180 days of the redetermination decision.

• Administrative Law Judge hearing, generally within 60 days of the reconsideration decision.

• Medicare Appeals Council review.

• Judicial review in federal district court.

Under Section 1893(f)(2) of the Social Security Act and 42 CFR 405.379, filing a redetermination request within 30 days of the demand letter, and a reconsideration request within 60 days of the redetermination decision, can limit recoupment while those appeals are pending.

CMS has also stated that RACs must wait until the second level of appeal is exhausted before receiving their contingency fee, and that RACs must return contingency fees when determinations are overturned on appeal.

How to Respond to a RAC ADR

1. Log the ADR immediately and calendar the 45-day deadline.

2. Identify the review topic, which should match an approved topic posted by CMS or the RAC.

3. Review the coverage, coding, and documentation requirements for the topic.

4. Gather complete records for each claim.

5. Review records for completeness, legibility, signatures, and accuracy.

6. Organize the submission with a cover sheet.

7. Submit using the RAC's accepted methods, such as the Electronic Submission of Medical Documentation system, and keep proof.

8. Track results, consider a discussion request, and file timely appeals when appropriate.

Automated vs. Complex Reviews: How to Respond

RACs conduct two main types of review, and each calls for a slightly different response.

Automated Reviews

Automated reviews use claims data to identify improper payments without requesting medical records. Common examples include excessive units, services billed during an inpatient stay, and incorrect coding combinations. Even though no records are requested, providers receive review results and can request a discussion or file an appeal. When responding to an automated review finding:

• Verify whether the claim data used by the RAC is accurate.

• Check whether an exception, modifier, or circumstance justifies the billing.

• Determine whether the finding reflects a systemic billing issue that should be corrected.

• Appeal if the finding is incorrect.

Complex Reviews

Complex reviews require medical records and involve clinical or coding review. When responding to a complex review ADR:

• Submit complete records that support medical necessity, orders, and coding.

• Include records from before and after the date of service when they help show the patient's condition.

• Organize the submission so reviewers can easily find key information.

• Track the review result and respond within discussion and appeal deadlines.

A Sample RAC Response Workflow

1. Intake: Log the ADR or review result, identify the topic and deadline, and assign responsibility.

2. Topic check: Confirm that the topic appears on CMS's approved list or is a CMS-required review.

3. Retrieval: Gather all relevant records and billing data.

4. Clinical and coding review: Confirm that documentation supports the claim as billed.

5. Quality check: Confirm completeness, signatures, and legibility.

6. Submission: Submit before the deadline and save proof.

7. Results: Review the determination and decide whether to request a discussion, appeal, or both.

8. Learning: Use the findings to improve documentation and billing processes.

Region 5 Considerations for Home Health, Hospice, and DMEPOS

Region 5 is unique because it covers DMEPOS, home health, and hospice claims nationwide. Providers in these sectors should:

• Monitor Region 5 topics closely. For example, the October 2026 proposed topics included an automated review of home health services related to the terminal diagnosis billed during a hospice episode, and automated reviews of certain prosthetic and breast prosthesis claims.

• Coordinate between hospice and home health agencies when patients transition between services, to avoid billing overlaps.

• Confirm which contractor to contact for older reviews, since CMS has explained that Performant continues to support Region 5 administrative and appeals work for reviews it previously conducted.

• Keep in mind that these sectors are also subject to heightened scrutiny through other programs, including UPIC reviews and enrollment moratoria.

Using RAC Findings to Improve

RAC findings are a valuable source of information. CMS has long advised providers to track denied claims, look for patterns, and determine what corrective actions are needed to avoid improper payments. Organizations can use RAC results to update documentation templates, refine coding guidance, retrain staff, add billing edits, and adjust internal audit plans. Improving accuracy can also lower a provider's denial rate, which affects future ADR limits.

Preparing for RAC Audits

Monitor Review Topics

Check CMS's Approved and Proposed RAC Topics pages monthly and identify topics that affect your services.

Audit Your Own Claims

Conduct internal audits of claims affected by approved topics, using the same criteria the RAC will use. Address errors and evaluate overpayment obligations under the 60-day rule at 42 CFR 401.305.

Track ADR Activity

Maintain a log of RAC ADRs, results, discussion requests, and appeals. Watch your denial rate, since it affects your ADR limit.

Strengthen Documentation

Focus on documentation of medical necessity, orders, and coding accuracy, especially for complex review topics.

Use the RAC Provider Portal

RACs maintain provider portals that, according to CMS's statement of work, include information such as the provider's ADR limit, ADR letter dates, documentation receipt dates, review outcomes, discussion period information, and appeal outcomes.

Hospitals and Inpatient Claims

Inpatient hospital claims have long been a major focus of RAC review, including MS-DRG coding validation and medical necessity of inpatient admissions. CMS has described a six-month look-back period for patient status reviews when claims are submitted within three months of the date of service. Hospitals should focus internal audits on DRG coding accuracy, clinical validation of documented diagnoses, documentation supporting inpatient admission decisions, and correct billing of services during inpatient stays. CMS's RAC statement of work describes clinical validation as a clinical review of the medical record to determine whether the patient truly has the documented conditions, which makes clear and consistent physician documentation especially important.

Common Mistakes to Avoid

• Missing the 45-day ADR deadline.

• Sending incomplete records.

• Relying on the discussion period instead of filing a timely appeal.

• Missing the 30-day window to limit recoupment.

• Ignoring automated review findings, which do not require records but can still be appealed.

• Failing to check whether the review topic was approved by CMS.

• Not using RAC findings to improve internal processes.

Frequently Asked Questions

Which RAC covers my state?

According to CMS, Performant covers Regions 1 and 2, and Cotiviti GOV Services LLC covers Regions 3, 4, and the nationwide Region 5 for DMEPOS, home health, and hospice. Confirm using CMS's Recovery Audit Program webpage.

How far back can a RAC review claims?

Generally three years from the claim paid date, with shorter look-back periods in certain circumstances, such as patient status reviews and reviews under adjusted ADR limits.

How long do I have to respond to a RAC ADR?

Generally 45 calendar days.

Is the RAC discussion period the same as an appeal?

No. It is an informal opportunity to provide additional information. File a timely appeal if you disagree with a determination.

Can RACs review any topic they want?

No. RAC review topics must be approved by CMS, although CMS may require RACs to review claims based on referrals from other contractors or federal agencies.

Do RACs receive a fee even if I win my appeal?

CMS has stated that RACs must wait until the second level of appeal is exhausted before receiving their contingency fee and must return contingency fees when determinations are overturned on appeal.

Conclusion

RAC audits remain an important part of Medicare program integrity in 2026. With new contractors in several regions, monthly updates to proposed and approved review topics, ADR limits tied to denial rates, and strict response and appeal timelines, providers need to stay informed and organized. By monitoring review topics, auditing their own claims, responding to ADRs on time with complete documentation, using the discussion period appropriately, and filing timely appeals, providers can protect their revenue and reduce future RAC exposure.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in Medicare audit readiness and response, including RAC audits. We help providers monitor RAC review topics, conduct internal audits aligned with approved topics, manage ADRs, review records before submission, prepare discussion requests and appeals, and strengthen documentation practices. If you would like help preparing for or responding to RAC audits, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Medicare Fee for Service Recovery Audit Program. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medicare-fee-service-recovery-audit-program

• Centers for Medicare & Medicaid Services. Approved RAC Topics. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medicare-fee-service-recovery-audit-program/approved-rac-topics

• Centers for Medicare & Medicaid Services. Proposed RAC Topics. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medicare-fee-service-recovery-audit-program/proposed-rac-topics

• Centers for Medicare & Medicaid Services. Statement of Work for RAC Regions 3 Through 5 (April 28, 2025). https://www.cms.gov/files/document/rac-sow-regions-3-5-april-28-2025.pdf

• Centers for Medicare & Medicaid Services. Statement of Work for RAC Region 1. https://www.cms.gov/files/document/rac-sow-region-1-march-26-2021.pdf

• Centers for Medicare & Medicaid Services. Recovery Audit Program ADR Limits for Institutional Providers. https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Downloads/ADR-Limits-Institutional-Provider-Facilities-January-29-2018.pdf

• Centers for Medicare & Medicaid Services. Recovery Auditing in Medicare Fee-for-Service for Fiscal Year 2016, Report to Congress. https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/downloads/fy-2016-medicare-ffs-report-congress.pdf

• Centers for Medicare & Medicaid Services. The Recovery Audit Program and Medicare. https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/downloads/the-recovery-audit-program-and-medicare-slides-051313.pdf

• Centers for Medicare & Medicaid Services. Review Contractor Directory, Interactive Map. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/review-contractor-directory-interactive-map

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. Original Medicare (Fee-for-Service) Appeals. https://www.cms.gov/medicare/appeals-grievances/fee-for-service

• U.S. Social Security Administration. Social Security Act, Section 1893, Medicare Integrity Program. https://www.ssa.gov/OP_Home/ssact/title18/1893.htm

• Electronic Code of Federal Regulations. 42 CFR 405.379, Limitation on Recoupment of Provider and Supplier Overpayments. https://www.ecfr.gov/current/title-42/section-405.379

• Electronic Code of Federal Regulations. 42 CFR 401.305, Requirements for Reporting and Returning of Overpayments. https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-A/part-401/subpart-D/section-401.305