Types of Medicare Audits Explained: MAC, TPE, RAC, SMRC, UPIC, CERT, and OIG Reviews Compared

Medicare providers can receive records requests and audit letters from many different organizations, often with confusing acronyms: MAC, TPE, RAC, SMRC, UPIC, CERT, and OIG. Each has a different purpose, different procedures, and different consequences. Knowing who is asking for records, and why, is the first step in responding correctly.

Medicare audits matter because the stakes are significant. CMS reported that the fiscal year 2025 Medicare fee-for-service improper payment rate was 6.55 percent, representing $28.83 billion in improper payments, with most improper payments falling into two categories: insufficient documentation and documentation that did not sufficiently demonstrate medical necessity. CMS's program integrity contractors use audits to measure, prevent, and recover these improper payments.

This article explains the major types of Medicare audits and reviews, compares their purposes and processes, describes key deadlines, and offers practical guidance for preparing and responding. It is educational and does not replace advice from qualified professionals.

Why There Are So Many Medicare Auditors

Medicare is a large and complex program, and CMS uses different contractors for different program integrity functions. In general:

• Some contractors process claims and conduct routine medical review to prevent improper payments.

• Some identify and recover improper payments after claims are paid.

• Some focus on nationwide issues identified by CMS.

• Some investigate potential fraud.

• Some measure the overall improper payment rate.

• The HHS Office of Inspector General (OIG) performs independent audits, evaluations, and investigations.

The Medicare Program Integrity Manual, CMS Publication 100-08, provides instructions to these contractors. Chapter 3 explains that, under federal regulations, providers and suppliers generally have 45 calendar days to submit documentation in response to a request from a Medicare Administrative Contractor (MAC), Recovery Audit Contractor (RAC), or the Supplemental Medical Review Contractor (SMRC), and 30 calendar days to respond to a Unified Program Integrity Contractor (UPIC) request. Contractors may accept late documentation for good cause, but providers should never assume that late records will be accepted.

1. Medicare Administrative Contractor (MAC) Medical Review

What It Is

MACs are the contractors that process Medicare fee-for-service claims in each jurisdiction. In addition to processing claims, MACs conduct medical review to make sure that claims meet Medicare coverage, coding, and payment rules.

How It Works

MACs use data analysis to identify providers, services, or items that present a risk of improper payment. Medical review can be:

• Prepayment, where claims are reviewed before payment, usually through an Additional Documentation Request (ADR).

• Postpayment, where claims are reviewed after payment, which can result in overpayment determinations.

MACs also use automated edits that deny claims without manual review when claims clearly do not meet requirements.

Response Deadline

Providers generally have 45 calendar days to respond to a MAC ADR. If no response is received, the claim is typically denied.

Possible Outcomes

Claims may be paid, partially paid, or denied. Denied claims can be appealed through the Medicare claims appeal process, beginning with a redetermination request to the MAC.

2. Targeted Probe and Educate (TPE)

What It Is

TPE is a MAC medical review strategy that combines claim review with one-on-one education. CMS states that MACs use data analysis to identify providers with high claim error rates or unusual billing practices, and items and services with high national error rates that are a financial risk to Medicare. CMS emphasizes that most providers will never need TPE and that providers whose claims are compliant will not be chosen.

How It Works

According to CMS:

• A TPE round generally involves review of 20 to 40 claims per provider or supplier, per item or service.

• After each round, providers are offered individualized one-on-one education. Education may also be provided during a round when easily fixable errors are identified.

• Providers are given at least 45 days after education to make improvements before the next round begins.

• TPE can continue for up to three rounds.

• If problems fail to improve after three rounds, the MAC refers the provider to CMS for next steps, which may include 100 percent prepayment review, extrapolation, referral to a Recovery Auditor, or other action.

• CMS manual instructions state that MACs shall refer suspected fraudulent providers to the UPIC at any time during the TPE process.

CMS also operates a Low Biller Probe and Educate Program for providers with lower claim volumes, using fewer than 20 claims per round.

Why It Matters

TPE offers an opportunity to correct errors with education. However, failure to improve can lead to significant consequences, and CMS instructions provide that non-responses to ADRs count as errors when calculating error rates.

3. Recovery Audit Contractors (RACs)

What They Are

RACs, also called Recovery Auditors, identify and correct improper payments in Medicare fee-for-service. RACs are paid on a contingency fee basis and generally review claims after payment.

How They Work

• RACs use the same Medicare policies as MACs, including national coverage determinations, local coverage determinations, and CMS manuals.

• Review topics are approved by CMS before widespread review and are posted on RAC websites.

• RACs perform automated reviews, which do not require medical records, and complex reviews, which do.

• The RAC look-back period is generally three years from the claim paid date, and CMS has described a six-month look-back period for patient status reviews when the claim was submitted within three months of the date of service.

• CMS sets ADR limits for RACs based on the number of Medicare claims a provider was paid in a previous period. For institutional providers, the baseline annual ADR limit is one-half of one percent of total paid claims, adjusted based on denial rates.

• CMS has stated that RACs should complete complex reviews and notify providers within 30 days of receiving documentation.

The Discussion Period

RACs offer a discussion period after review results. CMS has stated that RACs must wait 30 days to allow for a discussion request before sending the claim to the MAC for adjustment, and that providers do not have to choose between a discussion and an appeal. However, CMS has cautioned providers not to confuse the discussion period with the appeals process. If a provider disagrees with a RAC determination, it should file a timely appeal.

4. Supplemental Medical Review Contractor (SMRC)

What It Is

The SMRC performs nationwide medical reviews focused on vulnerabilities identified by CMS internal data analysis, the CERT program, professional organizations, and federal oversight agencies such as OIG.

How It Works

The SMRC evaluates medical records and related documents to determine whether claims were billed in compliance with Medicare coverage, coding, payment, and billing rules. SMRC reviews often focus on specific topics, services, or provider types selected by CMS.

Response Deadline

Providers generally have 45 calendar days to respond to SMRC documentation requests.

Possible Outcomes

Findings may lead to overpayment determinations, which are processed through the MAC and can be appealed.

5. Unified Program Integrity Contractors (UPICs)

What They Are

UPICs investigate potential fraud, waste, and abuse in Medicare and Medicaid. Their role is different from contractors focused on routine improper payment review.

How They Work

UPICs may:

• Request medical records and other documentation.

• Conduct interviews with providers, staff, and beneficiaries.

• Conduct site visits.

• Perform medical review and develop overpayments.

• Recommend payment suspensions to CMS.

• Recommend revocations.

• Refer cases to HHS-OIG and law enforcement.

Response Deadline

Providers generally have 30 calendar days to respond to a UPIC documentation request, which is shorter than the 45 days allowed for MACs, RACs, and the SMRC.

Why It Matters

A UPIC request may indicate concerns about potential fraud. Providers should treat UPIC requests as high priority and consider involving experienced legal counsel.

6. Comprehensive Error Rate Testing (CERT)

What It Is

The CERT program measures the Medicare fee-for-service improper payment rate. Each year, it reviews a statistically valid stratified random sample of Medicare fee-for-service claims to determine whether they were paid properly.

How It Works

• CMS states that the CERT program selects a stratified random sample of approximately 37,500 claims per reporting period, effective for reporting year 2025 and later.

• An independent medical review contractor reviews sampled claims.

• If a provider fails to submit medical records, the claim is counted as an improper payment.

• CERT notifies MACs of improper payments, and MACs recoup overpayments and repay underpayments.

• Providers have the right to appeal CERT improper payment determinations.

Key Results

CMS reported the fiscal year 2025 Medicare fee-for-service improper payment rate at 6.55 percent, or $28.83 billion, compared with 7.66 percent, or $31.70 billion, in fiscal year 2024. By claim type, CMS reported improper payment rates of 6.67 percent for Part A providers excluding hospital inpatient prospective payment system claims, 8.44 percent for Part B providers, and 3.15 percent for hospital inpatient prospective payment system claims. CMS emphasizes that the improper payment rate is not a fraud rate.

Why It Matters

Even though CERT measures error rates rather than targeting specific providers, a failure to respond results in a denial and recoupment. CERT findings also shape CMS's medical review priorities.

7. HHS Office of Inspector General (OIG) Audits and Reviews

What They Are

OIG is an independent oversight agency within HHS. OIG conducts audits, evaluations, and investigations of HHS programs, including Medicare and Medicaid.

How They Work

• OIG audits may focus on specific providers or on categories of services across many providers.

• OIG audits often use statistical sampling and may recommend that providers refund estimated overpayments.

• OIG evaluations examine program vulnerabilities and make recommendations to CMS.

• OIG's Office of Investigations investigates potential fraud and works with the Department of Justice.

Why It Matters

OIG audit findings can lead to repayment recommendations, and OIG investigations can lead to civil, criminal, or administrative actions, including exclusion from federal health care programs.

Comparing the Audit Types

The following summary highlights the key differences:

• Purpose. MACs, TPE, RACs, and the SMRC focus on identifying and correcting improper payments. CERT measures improper payment rates. UPICs investigate potential fraud. OIG provides independent oversight, audits, and investigations.

• Timing. MAC reviews and TPE can be prepayment or postpayment. RAC and SMRC reviews are generally postpayment. CERT reviews claims from a defined reporting period. UPIC and OIG reviews can involve any time period relevant to their inquiry.

• Selection. MAC, TPE, RAC, SMRC, and UPIC reviews are usually targeted based on data analysis or other information. CERT uses random sampling. OIG audits may be targeted or based on statistical sampling of service categories.

• Response time. Generally 45 days for MACs, RACs, and the SMRC; 30 days for UPICs; and as specified in the request for CERT and OIG.

• Education. TPE includes one-on-one education. RACs offer a discussion period. Other reviews provide results letters and appeal rights.

• Risk level. CERT and routine MAC reviews generally focus on compliance with payment rules. TPE failures can lead to escalated actions. UPIC and OIG investigations may indicate potential fraud concerns and carry higher risk.

Related Review Programs

Providers may also encounter related CMS programs:

• Prior authorization for certain items and services, such as some durable medical equipment and hospital outpatient services.

• Review Choice Demonstrations, which allow certain providers in specific states to choose among review options. CMS has expanded the Inpatient Rehabilitation Facility Review Choice Demonstration to additional states, including California and Texas.

• State Medicaid audits and Medicaid Fraud Control Unit investigations, which operate under state programs.

• Medicare Advantage plan audits, conducted by plans under their contracts.

Why Responding to Every Request Matters

Across all audit types, one rule is consistent: failing to respond almost always results in denial. CMS's CERT program counts claims without submitted records as improper payments, and TPE instructions count non-responses as errors. Because many audit letters are sent to correspondence addresses or electronic portals, organizations should make sure that mail and portal notifications are monitored and routed promptly to the responsible staff.

How to Respond to Any Medicare Audit

Identify the Requester

Read the letter carefully to determine which contractor sent it, the type of review, the claims involved, and the deadline. Confirm that the request is legitimate by checking contact information against official sources.

Calendar the Deadline

Record the response deadline immediately and set reminders. Remember that UPIC deadlines are generally shorter.

Assemble Complete Records

Gather all documentation supporting each claim, including orders, certifications, plans of care, progress notes, test results, signature attestations, and proof of delivery, as applicable.

Review Before Sending

Check records for completeness, legibility, correct patient identification, and signatures. Consider including a cover letter that organizes the documentation.

Submit and Keep Proof

Use the submission method specified, such as electronic submission of medical documentation where available, and keep proof of delivery and a copy of everything sent.

Track Results and Appeal When Appropriate

Track review results, analyze denial reasons, and file timely appeals when you believe a denial is incorrect.

Escalate When Needed

Involve legal counsel for UPIC requests, OIG investigations, payment suspensions, or any request that suggests potential fraud concerns.

Audits Can Overlap

Providers sometimes receive requests from more than one contractor at the same time, or in close succession. CMS uses data systems such as the Recovery Audit Data Warehouse to help prevent different contractors from reviewing the same claims, but providers may still face overlapping activity involving different claims, services, or time periods. For example, a provider might be in a MAC TPE round for one service, receive a RAC request for older claims, and be selected for CERT review of a single claim. Keeping a central log helps the organization manage all requests and identify patterns.

What an Audit Letter Typically Includes

Most Medicare audit and documentation request letters include:

• The name of the contractor and the type of review.

• The claims, beneficiaries, and dates of service under review.

• The documentation requested.

• The response deadline and submission instructions.

• Contact information for questions.

Reading each element carefully helps prevent mistakes, such as sending records to the wrong contractor or missing a requested document.

Building an Audit Tracking Log

A central audit log is one of the simplest and most effective tools for managing Medicare reviews. A useful log records:

• The date each request was received.

• The contractor and review type.

• The claims and dates of service involved.

• The response deadline.

• The staff member responsible.

• The date records were submitted and proof of delivery.

• The review outcome and amount at issue.

• Appeal deadlines, filing dates, and results.

Reviewing the log regularly with leadership and the compliance committee helps identify trends, such as recurring denial reasons or repeated selection for the same service, and supports timely corrective action.

How to Prepare Before an Audit

• Maintain an effective compliance program consistent with HHS-OIG's General Compliance Program Guidance.

• Conduct regular internal audits of high-risk and high-volume services.

• Review CMS comparative data, such as the Program for Evaluating Payment Patterns Electronic Report (PEPPER), where available.

• Monitor CERT and OIG findings for your service types.

• Train staff on documentation requirements.

• Establish a written audit response process with clear responsibilities.

• Track all ADRs and results in a central log.

Frequently Asked Questions

Which Medicare audit is the most serious?

UPIC and OIG investigations generally carry the highest risk because they may involve potential fraud. However, any audit can lead to significant overpayments, and TPE failures can escalate to prepayment review, extrapolation, or referrals.

How long do I have to respond to a Medicare ADR?

Generally 45 calendar days for MAC, RAC, and SMRC requests, and 30 calendar days for UPIC requests. Always follow the deadline stated in the letter.

Is the RAC discussion period the same as an appeal?

No. CMS has cautioned providers not to confuse the RAC discussion period with the appeals process. File a timely appeal if you disagree with a determination.

Can I be selected for CERT even if my billing is accurate?

Yes. CERT uses random sampling, so any provider can be selected. Responding promptly with complete records is essential.

What happens after three failed TPE rounds?

The MAC refers the provider to CMS for next steps, which may include 100 percent prepayment review, extrapolation, referral to a Recovery Auditor, or other action.

Do RACs review claims before payment?

RACs generally review claims after payment. The RAC look-back period is generally three years from the claim paid date, with a shorter look-back period for certain patient status reviews.

Can I appeal CERT findings?

Yes. CMS states that providers, suppliers, and beneficiaries have the right to appeal any improper payment determination made by the CERT program, and final appeal decisions are reflected in the improper payment rate calculation.

Who should handle a UPIC request?

UPIC requests should be handled promptly by the organization's compliance leadership, with the involvement of experienced legal counsel, because UPICs investigate potential fraud and may recommend payment suspensions or referrals.

Conclusion

Medicare uses a range of contractors and oversight bodies to protect program dollars, each with a distinct role. MACs and TPE focus on preventing and correcting errors with education, RACs and the SMRC identify and recover improper payments, CERT measures the improper payment rate, UPICs investigate potential fraud, and OIG provides independent oversight. Understanding who is asking for records, why, and how quickly a response is required helps providers respond effectively and protect their revenue.

Providers that maintain strong documentation, conduct internal audits, track audit activity, and respond promptly and completely are best positioned to handle any type of Medicare audit.

How HealthBridge Can Help

HealthBridge is a healthcare management consulting firm that specializes in Medicare audit readiness and response. We help providers identify the type of audit they are facing, organize and review documentation before submission, track deadlines, analyze denial patterns, prepare appeals, and build internal audit programs that reduce future risk. If you would like help preparing for or responding to any Medicare audit, please get in touch with us. We will be happy to help you with this topic.

References

• Centers for Medicare & Medicaid Services. Medicare Program Integrity Manual, Chapter 3. https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf

• Centers for Medicare & Medicaid Services. Targeted Probe and Educate. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/medical-review-and-education/targeted-probe-and-educate-tpe

• Centers for Medicare & Medicaid Services. Targeted Probe and Educate (TPE) Questions and Answers. https://www.cms.gov/files/document/updated-tpe-qas.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-08, Transmittal 819. https://www.cms.gov/Regulations-and-Guidance/Guidance/Transmittals/2018Downloads/R819PI.pdf

• Centers for Medicare & Medicaid Services. CMS Manual System, Pub. 100-20 One-Time Notification, Transmittal 2239. https://www.cms.gov/Regulations-and-Guidance/Guidance/Transmittals/2019downloads/R2239OTN.pdf

• Centers for Medicare & Medicaid Services. Comprehensive Error Rate Testing (CERT). https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert

• Centers for Medicare & Medicaid Services. CERT Background. https://www.cms.gov/data-research/monitoring-programs/improper-payment-measurement-programs/comprehensive-error-rate-testing-cert/background

• Centers for Medicare & Medicaid Services. Fiscal Year 2025 Improper Payments Fact Sheet. https://www.cms.gov/newsroom/fact-sheets/fiscal-year-2025-improper-payments-fact-sheet

• Centers for Medicare & Medicaid Services. MLN Connects Newsletter for January 29, 2026. https://www.cms.gov/training-education/medicare-learning-network/newsletter/mln-connects-newsletter-january-29-2026

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Comprehensive Error Rate Testing Data. https://data.cms.gov/provider-compliance/fee-for-service-error-rate-improper-payment/medicare-fee-for-service-comprehensive-error-rate-testing

• Centers for Medicare & Medicaid Services. Recovery Auditing in Medicare Fee-for-Service for Fiscal Year 2016, Report to Congress. https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/downloads/fy-2016-medicare-ffs-report-congress.pdf

• Centers for Medicare & Medicaid Services. Recovery Audit Program ADR Limits for Institutional Providers. https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Recovery-Audit-Program/Downloads/ADR-Limits-Institutional-Provider-Facilities-January-29-2018.pdf

• Centers for Medicare & Medicaid Services. The Recovery Audit Program and Medicare. https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/downloads/the-recovery-audit-program-and-medicare-slides-051313.pdf

• Centers for Medicare & Medicaid Services. Statement of Work for RAC Region 1. https://www.cms.gov/files/document/rac-sow-region-1-march-26-2021.pdf

• Centers for Medicare & Medicaid Services. Medicare and Medicaid Program Integrity Report to Congress 2023. https://www.cms.gov/files/document/fy2023-medicare-and-medicaid-report-congress.pdf

• Centers for Medicare & Medicaid Services, Center for Program Integrity. Crushing Fraud: Annual Report 2025. https://www.cms.gov/files/document/crushing-fraud-annual-report.pdf

• Centers for Medicare & Medicaid Services. Medicare Fee-for-Service Compliance Programs. https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs

• U.S. Department of Health and Human Services, Office of Inspector General. General Compliance Program Guidance. https://oig.hhs.gov/compliance/general-compliance-program-guidance