Medicaid Recovery Audit Contractors and What They Review

Sixteen states operated a Medicaid Recovery Audit Contractor program in fiscal year 2021, recovering $161.1 million in improper Medicaid payments for the federal government, according to a June 2023 Government Accountability Office review. A Medicaid RAC is a private contractor, paid on a contingency-fee basis, that reviews closed Medicaid claims for overpayments and underpayments. Congress created the program under Section 6411 of the Affordable Care Act, and it runs alongside a state's existing program integrity effort and a managed care plan's own fraud review, not instead of them. A provider receiving a RAC records request is often already inside more than one kind of review, and knowing which one is asking shapes the response.

The Medicaid RAC Program's Statutory Basis

States must establish a Medicaid RAC program under Section 1902(a)(42)(B)(i) of the Social Security Act, with implementing regulations at 42 CFR Part 455, Subpart F. A Medicaid RAC conducts postpayment review of claims already paid, looking for overpayments and underpayments, within a maximum three-year lookback period absent a state-specific CMS exception. States pay the contractor only out of amounts actually recovered, and CMS caps the contingency-fee rate eligible for federal matching funds at 12.5 percent; a state may pay a higher rate, but only from state-only funds or under a CMS-approved exception.

How a RAC Review Differs From the State's Own Program Integrity Review

A Medicaid RAC is a supplemental layer, not a replacement. States must keep their existing program integrity and Surveillance and Utilization Review efforts running at the same level after a RAC contract begins. Recovery of overpayments, not fraud investigation, is its prescribed scope of work. A RAC that suspects fraud must refer the matter to the state, which routes it to law enforcement, including the Medicaid Fraud Control Unit, HHS-OIG, or the FBI. That referral can carry consequences a routine finding does not, up to OIG exclusion from federal healthcare programs or exposure under the False Claims Act. A state can also impose a payment suspension while a credible fraud allegation is pending, a separate track covered in Medicaid Payment Suspensions Under 42 CFR 455.23.

How a RAC Review Differs From a Managed Care Plan's SIU

More than 80 percent of Medicaid beneficiaries were enrolled in managed care by 2020, and a managed care organization's own special investigations unit sits under a different authority than a state RAC program. Federal rules at 42 CFR Section 438.608 require the state's contract with each MCO to mandate arrangements that detect and prevent fraud, waste, and abuse. That obligation runs from the health plan under its own contract, not from a contingency-fee vendor auditing the state's claims data. Many states leave managed care outside RAC review: 20 of the 34 states fully exempt from the program in fiscal year 2021 cited a predominantly managed care population as the reason. See Medicaid Managed Care Plan Audits Versus State Audits.

Claim Scope and the Appeal Track

States retain wide latitude over what a RAC reviews. One state limited its program to speech therapy, optometry, and podiatry claims; others negotiated CMS exceptions extending the three-year lookback to five years, or in two cases to seven. A RAC finding does not create a separate appeal system. Federal regulations at 42 CFR Section 455.512 require the state to provide appeal rights under existing state law or administrative procedure, the same track used to contest a state program integrity finding. A recoupment demand that follows a RAC finding proceeds through that state process, and a provider who misses the state's audit appeal deadline can lose the right to contest the finding at all.

A Medicaid RAC's contingency fee depends on what it recovers, and its findings move through the same state appeal process a provider would use to contest any other Medicaid overpayment determination.

Why Early Legal Counsel Is Critical

It is critical that Medicaid providers promptly retain experienced healthcare defense counsel upon receiving a Medicaid RAC audit notice, a records request, or a state program integrity inquiry. Early legal intervention can protect the provider's rights, shape the documentation record before a sample of findings hardens into an extrapolated demand, avoid inadvertent admissions during the records exchange, and preserve every level of the state's appeal process before a deadline runs. Delaying representation can narrow the available defenses and increase the eventual exposure.

How Health Law Alliance Can Help

Health Law Alliance has handled 5,000+ matters across healthcare regulatory and audit defense over 25+ years, including Medicaid RAC, state program integrity, and managed care SIU reviews. If your practice has received a Medicaid RAC audit notice or a records request tied to a state program integrity or managed care review, contact Health Law Alliance's Medicaid audit defense attorneys for a free, confidential consultation before the state's appeal deadline runs.