Recovery Audit Contractors (RACs) exist to identify and correct improper Medicare payments. For hospital leaders, that means a steady stream of demand letters across DRG validation, medical necessity, and coding accuracy — and real revenue at stake on each one.
RAC activity is not going away. The organizations that fare best are not the ones that avoid review; they are the ones that are prepared for it.
How RAC Reviews Work
RAC reviews generally fall into two categories. Automated reviews use data analysis to flag clear billing errors without requesting records. Complex reviews request the medical record and involve a manual examination of documentation against the billed claim. Complex reviews are where most of the meaningful dollars — and most of the winnable appeals — live.
Common targets include DRG validation (was the principal diagnosis sequenced correctly?), medical necessity (was the level of care supported?), and coding accuracy.
Building Your Defense
Documentation is everything
Nearly every RAC determination comes down to what the record supports. Clear, complete documentation that ties the care provided to the care billed is the single strongest defense a hospital has.
Track and triage every demand letter
Missed deadlines forfeit appeals that would otherwise succeed. Maintain a disciplined log of every demand letter, its deadlines, and its status — and triage by dollar value and defensibility.
Know the appeal levels and deadlines
The Medicare appeals process moves through several levels, beginning with redetermination and reconsideration before reaching an administrative law judge. Each level has its own strict deadline. Knowing them — and meeting them — is non-negotiable.
Build a compelling, well-supported appeal
A strong appeal does more than disagree. It walks the reviewer through the documentation, cites the applicable guidance, and makes the case that the original billing was appropriate. Experience with how reviewers read these cases makes a measurable difference.
Be Proactive, Not Reactive
The most resilient organizations treat RAC readiness as an ongoing discipline, not a fire drill. Pre-audit reviews surface vulnerabilities before a contractor does, and targeted education closes the documentation gaps that generate denials in the first place. The result is fewer findings — and a stronger position on the ones that do arrive.