Jonathan L. Swichar
Daniel R. Walworth

At a Glance

Providers should undertake four steps to prepare for a RAC audit:

  • Undertake a self-assessment.  
  • Resolve potential overpayments and false claims implications.  
  • Set a reserve.  
  • Prepare for a timely response to record requests.  

The threat: A potentially costly and burdensome recovery audit contractor (RAC) audit led by aggressive auditors with a financial incentive to ferret out any overpayments of Medicare claims.

The best defense: Get to work on preparing for a RAC audit now-before the auditor comes knocking.

The RAC program has already proven to be a financial boon to the Centers for Medicare & Medicaid Services (CMS) during the three-year pilot program set up to detect and correct improper payments in the Medicare program. Now, at the start of the nationwide rollout of the program, one thing is certain: Anyone who bills Medicare could face scrutiny.

Although there is no "one-size-fits-all" approach to RAC audit preparations, the pilot program provides some prudent strategies healthcare providers should consider. At the minimum, providers should immediately begin to identify and monitor areas that may be subject to review and undertake some form of self-assessment of potential overpayments. They should also consider setting aside a reserve for estimated overpayment amounts and, where appropriate, tapping that reserve to resolve potential overpayments.

Undertaking a Self-Assessment

To minimize the potential sting of a RAC audit, providers should identify issues that could be the subject of the audit and consider performing a self-assessment to uncover potential overpayments.

Fortunately, under the Medicare Modernization Act of 2003, providers aren't forced to read tea leaves to determine what areas and issues might be subject to RAC review. Each region's RAC must identify and communicate which issues and areas they have targeted for review. These issues, posted on each region's RAC's website, will help guide providers in determining the scope of any self-assessment.

RAC audits may include automated procedures and computerized programs to identify potentially errant coding and billing. In addition to these "automated" RAC audits, RAC auditors might undertake more "complex" reviews of medical records to determine potential overpayments. The type of audit used will depend upon the potential overpayment issues being evaluated. If such issues can be resolved from the face of the billing records, for example, an automated review is appropriate. If review of the underlying medical records is necessary to assess whether a potential overpayment has occurred, then a "complex" review is required.

Things to consider: Given the potential pitfalls for a provider that fails to reconcile overpayments properly and expeditiously, providers might wish to consider involving outside counsel to determine the scope and extent of a self-assessment.

Resolving Potential Overpayments and False Claims Implications

If an improper payment is identified, simply sweeping it under the rug could expose the provider to civil penalties or criminal charges for false claims. A small, but significant, provision contained in the Affordable Care Act dramatically changes the way in which a provider should handle overpayments-and, in turn, the way in which a provider should address potential overpayments in preparation for a RAC audit.

Under this new law, a provider must now return overpayments that it has "identified" within 60 days. Together with the 2009 Fraud Enforcement Recovery Act, which provides for violations of the False Claims Act when a provider "knowingly and improperly avoids or decreases an obligation" to pay the federal government funds owed, the 60-day obligation presents a thorny potential for False Claims Act liability.

The key, as-yet-unanswered question about this new obligation, however, is what "identify" means: What triggers the 60-day repayment obligation and its potential for liability under the False Claims Act? Because this provision is so new, providers should be wary of what are, at this point, murky waters. Some commentators have suggested that it means a specific overpayment for a specific amount has been identified by the provider itself or by a third party. Commentators also have suggested that as long as a provider is still actively attempting, in good faith, to determine whether it has made an overpayment and, if so, what the amount is, no overpayment has yet been "identified" and the false claims act obligations have not been triggered.

Things to consider: Even if the potential overpayments a provider discovers in a self-assessment have not been determined with the specificity and certainty required to trigger False Claims Act implications, it will often be in the provider's best interests to voluntarily disclose those potential overpayments to the financial intermediary. Voluntary disclosure may lead to a more favorable resolution than could be reached with a RAC that has substantial incentives to maximize the overpayment amount collected.

Setting a Reserve

After identifying potential areas of overpayment, providers should consider setting a reserve for corresponding amounts of potential overpayments identified during a self-assessment. However, setting aside a reserve can be problematic. Many questions could arise regarding how to justify or categorize the amount of a reserve if it is not tied directly to specific instances of overpayments. The answers to those questions could have significant implications and will need to be tailored to each provider's situation.

Things to consider: Identifying specific overpayments and setting aside a reserve without trying to resolve potential overpayments can be dangerous and set a False Claims Act trap for the unwary. This step could transform well-meaning efforts at prevention and compliance into potential liabilities.

Preparing for a Timely Response to Record Requests

Don't be caught without the means to defend against an audit simply because documents were not readily available. Being prepared to respond with the requisite agility-but without grinding operations to halt-requires foresight, planning, and a clear-eyed appraisal of existing record-keeping practices.

As part of any "complex" self-assessment, a provider should rectify any document retention and access issues it uncovers. But that assessment should also aim to ensure that the provider will be able to respond to a RAC additional documentation request, to avoid becoming a casualty of poor recordkeeping and being held liable for overpayments simply as a result of inadequate or untimely responsiveness to records requests. Such a harsh and unnecessary outcome is not merely theoretical. Of the $992.7 million in overpayments collected during the RAC pilot program, 8 percent of RAC denials were the result of a failure to provide any, or sufficient, documentation.

Waiting until a receipt of a records request from a RAC to begin is unsound. Among the ways to prepare to respond are the following:

  • Pulling and auditing records from Oct. 1, 2007 (the start of the look-back period), forward
  • Identifying all of key custodians of records and creating a clearly defined map of the location of all of records
  • Making sure all off-site medical records and documents are easily accessible and indexed
  • Having a centralized, formalized protocol for responding to a RAC's records request, including a designated RAC audit response team and point person

Things to consider: RACs do not have an unfettered ability to flood a provider with document requests (the provider's size limits the number of documents that can be requested, and CMS has established limits on the number of claims for which medical records may be requested by the RACs at any one time). Responding to RAC records requests during a "complex" review can, nevertheless, be a burdensome and distracting process. Having procedures in place to respond can minimize the intrusion, distraction, and burden of responding to these requests.

Early Preparation Is Key

Because auditors are paid on a contingent fee basis, the RAC program provides substantial incentives for auditors to aggressively review the appropriateness of previously submitted claims. The pilot program established that RACs are able to identify improper payments-and do so profitably and in an administratively feasible manner. With that momentum gained from the pilot program, all healthcare providers should now make sure they are familiar with the RAC program and prepare for the possibility of an audit as quickly as possible.

Jonathan L. Swichar, JD, is a partner, Duane Morris LLP, Philadelphia (

Daniel R. Walworth, JD, is an attorney, Duane Morris LLP, Philadelphia ( 


Publication Date: Monday, January 03, 2011

Login Required

If you are an existing member, please log in below. Username and password are required.



Forgot User Name?
Forgot Password?

If you are not an HFMA member and would like to access portions of our content for 30 days, please fill out the following.

First Name:

Last Name:


   Become an HFMA member instead