51 JFK Parkway, Short Hills, NJ 07078
RAC Audit Defense · Cotiviti · Performant · HMS · CMS Program Integrity

RAC Audit Defense Attorneys

Postpayment review, extrapolation challenges, 5-level Medicare appeals.

RACs (Recovery Audit Contractors) are CMS contractors that conduct postpayment review of Medicare and Medicaid claims for overpayment recovery on a contingency-fee basis. Cotiviti audits Regions 1, 2, and 3 (Northeast, Midwest, Southeast). Performant Recovery audits Region 5 (Home Health, Hospice, and DME nationwide).

HMS Federal Solutions has held regional contracts in prior cycles. A RAC audit notice arrives as an Additional Documentation Request (ADR) on a defined sample of paid claims, frequently followed by an extrapolated overpayment demand across the full claim population. Health Law Alliance defends RAC audits across hospitals, physicians, DME suppliers, and home health agencies.

Our defense framework focuses on the ADR response, the statistical extrapolation challenge, the contingency-fee incentive misalignment, and the 5-level Medicare appeals track through redetermination, reconsideration, ALJ hearing, the Medicare Appeals Council, and federal court.

5,000+
Federal & State Healthcare Matters
100+
Combined Years at DOJ, HHS-OIG & CMS Co's
5
Levels of Medicare Appeal Through Federal Court
24/7
Response, From Document Request to ALJ
RAC Audit Defense Hotline · Direct Line
(800) 345 - 4125
Speak with counsel who has defended RAC audits across Cotiviti, Performant, and HMS jurisdictions. Privileged. Available 24/7.
Former officials from the agencies investigating your matter
U.S. Department of Justice
DOJ
FBI
FBI
HHS OIG
HHS-OIG
DEA
DEA
OptumRx
OptumRx
McKesson
McKesson
NAMFCU
NAMFCU
U.S. Treasury
Treasury
The Stakes
A RAC audit compounds three exposures at once: cash flow, recoupment, and the criminal-referral pipeline

A RAC postpayment review with statistical extrapolation turns a 30-claim sample into a multi-million dollar recoupment demand across the full claim population. The RAC contractor is paid a contingency fee on every recovery it produces, which structurally aligns the contractor with finding error rather than the substantive merits of the claims. The 5-level Medicare appeals track is procedurally unforgiving and typically takes 18 to 36 months from the initial demand. The defense posture has to address all three from the ADR response forward.

  • Postpayment recoupment with extrapolation across the full claim population
  • Contingency-fee incentive misalignment
  • 5-level Medicare appeal track and 18-to-36-month resolution window
Case files binders
Case files
01
Postpayment recoupment with extrapolation across the full claim population

RAC review uses statistical extrapolation. The contractor reviews a sample (often 30 to 50 claims), calculates an error rate, and extrapolates the error rate across the full claim population for the audit window. A $50,000 sample finding can produce a $5M to $20M recoupment demand after extrapolation. CMS withholds payment on incoming claims to recoup the demand, which compounds the cash flow exposure. The largest dollar defense in most postpayment matters is the statistical methodology challenge: sample frame defects, sample size deficiencies, RAT-STATS application errors, and Cochran formula objections.

Recoupment Exposure
02
Contingency-fee incentive misalignment

RAC contractors are paid a percentage of every overpayment they identify and recover, with statutory limits and clawback obligations if the determination is overturned on appeal. The contingency-fee structure aligns the contractor with finding error rather than reaching the substantively correct billing determination. Defense framing should reflect this incentive misalignment in the appeal record, particularly at ALJ hearing, where the procedural and substantive defects in the contractor's findings are most likely to be addressed on the merits.

Structural Bias
03
5-level Medicare appeal track and 18-to-36-month resolution window

RAC overpayment determinations move through the 5-level Medicare appeals track: redetermination by the MAC, reconsideration by the QIC, ALJ hearing, the Medicare Appeals Council, and federal court. The full track typically takes 18 to 36 months, with CMS recoupment continuing through the appeal unless a recoupment-protection request is granted. The defense framework has to manage the cash flow consequences of the protracted appeal alongside the substantive merits.

Appeals Cost & Timeline
Why RAC Audit Defense Is Different
Four structural features make RAC audits fundamentally distinct from RAC, MAC, or commercial PBM audits

RACs operate under the CMS Program Integrity Manual, with their own statistical methodology, their own document request conventions, and their own referral authority to HHS-OIG and DOJ. Defense counsel that treats a RAC audit as a routine billing dispute misses the procedural posture and the realistic exposure.

Factor 01
RACs differ structurally from RAC, MAC, ZPIC, and SMRC contractors.
RACs (Recovery Audit Contractors) work on contingency and focus on postpayment overpayment recovery. MACs (Medicare Administrative Contractors) adjudicate claims and process payments rather than conducting program integrity work. ZPICs (Zone Program Integrity Contractors) were the predecessor to RACs and were largely consolidated into the RAC program in 2016. SMRCs (Supplemental Medical Review Contractors) conduct medical review of specific topics on direct CMS direction. RACs combine the program integrity function across Medicare and Medicaid in a specific geographic jurisdiction. The procedural framework, the statistical methodology, and the referral authority are different across all four contractor types.
Factor 02
Statistical extrapolation is the largest dollar issue.
RAC postpayment recoupment math turns on the extrapolation methodology. The CMS Program Integrity Manual requires RACs to use statistically valid sampling and the RAT-STATS software for extrapolation calculations. In practice, contractors make methodology choices (sample size, sample frame, point estimate vs. lower confidence bound) that defense counsel can challenge. A successful extrapolation challenge can reduce a multi-million dollar recoupment to the actual sample-claim amount, which is typically a small fraction of the extrapolated number. Statistical defense requires either an in-house defense expert or a retained statistician with healthcare claims experience.
Factor 03
The Medicare appeal track has 5 levels with strict deadlines.
Medicare appeals run through five levels: redetermination by the MAC (120-day deadline), reconsideration by a Qualified Independent Contractor (180-day deadline), Administrative Law Judge hearing (60-day deadline, historically with a multi-year backlog), Medicare Appeals Council review, and federal district court review under 42 USC § 405(g). Missing any deadline waives the appeal at that level. The redetermination and reconsideration are the most consequential procedural steps because the record built at those levels is the record the ALJ will review. Defense counsel that skips ahead misses the procedural foundation that supports the later appeal.
Factor 04
RAC contractor differences matter more than they appear.
Cotiviti (Regions 1, 2, 3 - Northeast, Midwest, Southeast), Performant Recovery (Region 5 - Home Health, Hospice, DME nationwide), and HMS Federal Solutions each have different ADR conventions, different statistical methodology preferences, and different denial rationales they tend to issue. Defense counsel that has worked with the specific contractor on prior matters knows the procedural patterns and the appeal record at QIC and ALJ that an unfamiliar counsel will not. The contractor identity is in the audit notice but is often missed because the notice arrives on CMS letterhead with the contractor name in smaller text.
"A RAC document request is the first procedural opportunity in the audit. The production response shapes everything that follows."
Protect Your Practice Now →
The HLA RAC Defense Process
A four-stage protocol built for the RAC document request, the extrapolation challenge, and the Medicare appeal track

Our bench includes a former Assistant U.S. Attorney with DOJ Director's Award recognition and senior healthcare-company counsel. We have defended RAC audits across Cotiviti, Performant, and HMS jurisdictions, produced statistical extrapolation reductions in postpayment matters, and coordinated RAC defense with parallel False Claims Act and criminal exposure. This is the protocol.

  • Document request response and audit scope evaluation
  • Initial determination engagement and statistical methodology challenge
  • Formal appeals: redetermination, QIC reconsideration, ALJ hearing
  • Parallel FCA and criminal coordination if the RAC refers
Conference room
Where defense is built
01
Document request response and audit scope evaluation

From the day the RAC notice arrives: evaluate the audit type (prepayment review, postpayment review, focused medical review), the contractor (Cotiviti, Performant, HMS), the dispensing or service window covered, and the document request as written. Most document requests can be narrowed through written response on scope and timing. We conduct a privileged pre-production review of every document before it leaves the practice, which preserves defenses for the appeal track and avoids producing material that becomes evidence in any subsequent FCA or criminal matter.

02
Initial determination engagement and statistical methodology challenge

When the RAC issues findings: respond on the substantive defense for each flagged claim and challenge the statistical methodology where postpayment extrapolation is used. The methodology challenge focuses on sample frame defects, sample size deficiencies, RAT-STATS application errors, and Cochran formula objections. A successful methodology challenge at this stage often reduces the recoupment demand by a meaningful percentage before the matter reaches the formal appeal track.

03
Formal appeals: redetermination, QIC reconsideration, ALJ hearing

The Medicare appeal track requires the right record at every level. We draft and file the redetermination request to the MAC within the 120-day window, prepare the QIC reconsideration with the substantive and statistical record, and present to the Administrative Law Judge with witness preparation, expert testimony where applicable, and a procedural record built to support the ALJ's decision. The record built at the redetermination and QIC stages is the record the ALJ reviews; defense counsel that skips ahead loses the procedural foundation.

04
Parallel FCA and criminal coordination if the RAC refers

When RAC findings produce a referral to HHS-OIG, the DOJ Civil Division, or the local U.S. Attorney's office: civil FCA defense (CID response, intervention or declination engagement, Rule 9(b) motion practice) and criminal defense (target letter response, attorney proffer, grand jury subpoena management) run in parallel with the RAC appeal. Our former-federal-prosecutor bench coordinates the RAC appeal, the civil FCA matter, and the criminal track as one matter to avoid locking in admissions in one forum that hurt the defense in another.

Common RAC Audit Triggers
The six patterns that put a RAC audit in motion

RACs use CMS-supplied data analytics to identify providers whose billing patterns deviate from peer comparables. The following triggers are the most common predicates for a RAC document request, prepayment review notice, or focused medical review.

01
Data analytics flags from peer comparator analysis.
CMS provides RACs with claims data and peer comparator analytics. Providers whose billing patterns fall in the top decile of their peer group on a specific code, code combination, or modifier usage face elevated RAC review frequency. Common high-risk patterns include high E/M code distribution (CPT 99214 and 99215 over 80% of visits), high modifier 25 utilization, high modifier 59 utilization, and outlier reimbursement per beneficiary on Part B drug administration.
02
Qui tam relator or whistleblower complaint referral.
A qui tam complaint filed with DOJ under seal can produce a RAC referral when the DOJ Civil Division wants the RAC's billing analysis to support the FCA case. Internal whistleblower hotline reports, when escalated outside the company, can produce the same referral pipeline. The RAC document request that follows often does not identify the underlying relator complaint, but the document scope tracks the relator's allegations closely enough that experienced defense counsel can identify the underlying matter.
03
Prior contractor findings (RAC, MAC, SMRC, CERT).
A RAC overpayment determination, a MAC medical review with high error rate, an SMRC focused review with adverse findings, or a CERT (Comprehensive Error Rate Testing) sample finding can produce a downstream RAC review. The RAC inherits the prior contractor's findings as the starting point for its own review and can expand the scope materially. Providers who have closed a prior contractor matter without a clean record should anticipate the RAC follow-up.
04
Specialty-specific enforcement initiatives.
RACs run focused enforcement initiatives targeted at specific specialties or service lines. Recent examples include skin substitute applications following the Apex Medical $309M FCA settlement, debridement coding following the Vohra $45M settlement, hospice eligibility review, home health face-to-face documentation, and remote patient monitoring billing. Providers operating in an initiative-targeted area face elevated RAC review regardless of individual billing patterns.
05
Medicare Drug Integrity Contractor (MEDIC) referral on Part D.
For Part D matters (pharmacies dispensing Medicare prescription drug benefit claims), the Medicare Drug Integrity Contractor identifies suspicious patterns and refers them to the RAC for parallel medical review. The MEDIC and RAC tracks coordinate, which means a Part D investigation at the pharmacy level can produce a RAC review at the prescriber level (or vice versa). Cross-track exposure is common in opioid, GLP-1, and specialty drug dispensing patterns.
06
State Medicaid Fraud Control Unit (MFCU) cross-referral.
State MFCUs investigate Medicaid fraud and refer matters to the RAC for parallel Medicare review when the provider participates in both programs. The MFCU investigation can produce a RAC review on the Medicare side that the provider did not anticipate. The state-federal coordination is increasingly tight, and defense counsel that handles only one side often misses procedural exposure on the other.
Recent RAC Defense Outcomes
Representative Case Results

Outcomes are summarized for confidentiality. Client names, precise geography, and identifying facts are redacted.

Case files Recoupment Reversed
Statistical Extrapolation Challenge Reduces RAC Demand by Substantial Margin.

Provider received a RAC postpayment review finding with statistical extrapolation across a multi-year claim window. Health Law Alliance challenged the contractor's sample frame, sample size methodology, and RAT-STATS application errors at the redetermination and QIC reconsideration stages. The extrapolated recoupment demand was reduced to the actual sample-claim amount, a small fraction of the original number. The procedural record built at the redetermination level supported the QIC's reduction without requiring an ALJ hearing.

Federal · Healthcare provider · 2024
Washington DC DOJ Declination
DOJ Declines Civil and Criminal Action After RAC Referral.

Healthcare company received a RAC referral that produced a Civil Investigative Demand from the DOJ Civil Division covering alleged $6M in false claims. Health Law Alliance produced documents under a negotiated rolling schedule, presented the factual rebuttal of the government's theory in a meeting with the line attorneys, and prepared a written submission addressing the materiality and falsity defects. DOJ declined both civil intervention and criminal referral. Pre-unsealing engagement, when the matter surfaces through other channels, is the highest-leverage window in any FCA matter.

National scope · Healthcare company · 2024
Federal courtroom Indictment Dismissed
Federal Healthcare Fraud Indictment Following RAC Referral Collapses.

Solo physician faced a multi-count federal indictment that included healthcare fraud counts following an upstream RAC referral to the local U.S. Attorney. Health Law Alliance filed responsive motions, built the procedural record, and challenged the government's theory through pre-trial motion practice; the indictment collapsed before trial. The RAC-to-criminal escalation risk is real in matters where the contractor's findings include intent evidence; a unified defense across the RAC appeal track and the parallel criminal track is the most efficient way to avoid the criminal exposure.

Northeast · Solo physician · 2025

Attorney advertising. Prior results do not guarantee a similar outcome. Case summaries are generalized for confidentiality and are not a substitute for legal advice on your specific matter.

The Firm
We Used to Work for Them.
Now We Fight for You.
Client Reviews
What Clients Say
  1. Anthony's background as a former federal prosecutor and executive for major healthcare companies provided a level of expertise and insight that made all the difference. His deep understanding of healthcare law, particularly in litigation and compliance matters, helped navigate complex legal issues with ease.
RAC Audit Defense FAQ
Frequently Asked Questions

Seven questions that come up on almost every first call. The answers below are general; specific situations require privileged consultation.

What is a RAC and how is it different from a RAC, MAC, or ZPIC? +
A RAC (Recovery Audit Contractor) is a CMS contractor responsible for Medicare and Medicaid program integrity work in a specific geographic jurisdiction. CMS established the RAC program under section 306 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, with permanent expansion under the Tax Relief and Health Care Act of 2006. RACs are different from Unified Program Integrity Contractors (RACs), which conduct both prepayment and postpayment program integrity review and have authority to refer matters to HHS-OIG and the DOJ for civil and criminal investigation; from Medicare Administrative Contractors (MACs), which adjudicate claims and process payments; and from Supplemental Medical Review Contractors (SMRCs), which conduct medical review of specific topics on CMS direction. The procedural framework, the appeal track, and the realistic exposure differ across all four contractor types.
Which RAC is auditing my pharmacy or practice? +
Three Recovery Audit Contractors cover the United States by region and service line. Cotiviti audits Regions 1, 2, and 3 (Northeast, Midwest, Southeast). Performant Recovery audits Region 5 (Home Health, Hospice, and DME nationwide). HMS Federal Solutions has held regional contracts in prior cycles. The audit notice itself identifies the contractor, but providers often miss the contractor identification because the notice arrives on CMS letterhead with the contractor name in smaller text. The contractor matters because each RAC has somewhat different document request conventions, different statistical methodologies, and a different working relationship with the local U.S. Attorney's office. Defense counsel that has worked with the specific contractor on prior matters knows the procedural patterns that an unfamiliar counsel will not.
Why does the RAC contingency-fee structure matter to my defense? +
RAC contractors are paid a percentage of every overpayment they identify and recover. The contingency-fee structure structurally aligns the contractor with finding error rather than reaching the substantively correct billing determination. Two defense consequences follow. First, the appeal record (particularly at QIC reconsideration and ALJ hearing) frequently shows that contractor-issued denials do not survive substantive review because the contractor erred on the side of denial to capture the contingency. Second, the contractor must repay the contingency on findings that are overturned on appeal, which influences settlement posture once a credible appeal is on file. Defense framing should reflect these dynamics in both the substantive briefing and the cost-of-appeal analysis.
How do I challenge a RAC's statistical extrapolation? +
Statistical extrapolation challenges focus on whether the RAC's methodology meets the CMS Program Integrity Manual standards and the relevant federal court precedent. Common defense angles include sample frame defects (the sample is drawn from a population that does not match the audit scope), sample size deficiencies (the sample is too small to support extrapolation at the cited confidence interval), RAT-STATS application errors (the contractor's use of the CMS-mandated statistical software), and Cochran formula objections (the formula used to calculate the point estimate or the lower confidence bound). A successful extrapolation challenge can reduce a multi-million dollar recoupment demand to the actual sample-claim amount, which is typically a small fraction of the extrapolated number. Statistical defense requires either an in-house defense expert or a retained statistician with healthcare claims experience.
What is the timeline for appealing RAC findings? +
The Medicare appeal track has five levels with strict statutory deadlines. Level 1 is the redetermination request to the MAC, due within 120 days of the initial determination. Level 2 is the reconsideration request to a Qualified Independent Contractor (QIC), due within 180 days of the redetermination. Level 3 is the Administrative Law Judge (ALJ) hearing, due within 60 days of the QIC reconsideration; the ALJ hearing has historically had a multi-year backlog, though CMS has worked to reduce it. Level 4 is the Medicare Appeals Council review. Level 5 is federal district court review under 42 USC § 405(g). Missing any deadline waives the appeal at that level and forecloses subsequent levels. The redetermination and reconsideration are the most consequential procedural steps because the record built at those levels is the record the ALJ will review.
Can RAC findings escalate beyond overpayment recovery? +
RACs are paid to identify overpayments and do not have the fraud-referral authority that UPICs, ZPICs, and HHS-OIG investigators carry. RAC findings stay inside the Medicare overpayment recovery framework in the ordinary course. That said, RAC findings that show patterns suggestive of intent (rather than billing error) can be referred to a UPIC or to HHS-OIG for separate program integrity review, and that secondary review can produce a Civil Investigative Demand or a False Claims Act qui tam matter. Counsel should evaluate the substantive findings for any pattern that could trigger a separate UPIC or OIG referral, and should structure the RAC appeal record so that admissions made in the appeal do not later be repurposed in a separate fraud-side matter.
When should I engage counsel in a RAC audit? +
Before responding to the document request. The RAC document request letter is the first procedural opportunity in the audit, and the production response shapes everything that follows: which documents the RAC reviews, what claim universe the sample is drawn from, what the realistic findings range will be, and whether the RAC sees patterns that escalate to criminal referral. A document production made without privileged counsel can produce material that becomes evidence in subsequent civil and criminal litigation, and the procedural defenses available later (extrapolation challenges, ALJ appeal arguments) can be foreclosed by an inadequate or over-inclusive production. The earlier counsel is engaged, the more leverage the defense has across the audit, the appeal, and any parallel matters.
Speak with RAC Audit Defense Counsel Today

A RAC document request is the first procedural opportunity in the audit — the production response shapes everything that follows

Before you produce documents to the RAC, before the contractor draws the sample for extrapolation, before the matter escalates to a DOJ Civil Division referral, have a privileged conversation with attorneys who defend RAC audits across Cotiviti, Performant, and HMS jurisdictions. Free, confidential, no retainer.

"The RAC sent a document request covering three years of claims. Health Law Alliance was on the call within two hours, walked us through the production framework, and ran a privileged pre-production review of every document before it left the practice. When the contractor's findings came back with extrapolation, the methodology challenge at the redetermination level reduced the recoupment demand to a small fraction of the original number. The procedural record built at the redetermination stage carried through the QIC reconsideration." - Practice administrator, multi-location practice (anonymized client, 2024)
RAC document request? The production response shapes everything.