Emergency Response

RAC Audit Response: First 14 Days After the Letter

8 min read · Last reviewed May 23, 2026

A Recovery Audit Contractor (RAC) letter starts two clocks at once: a 45-calendar-day Additional Documentation Request (ADR) response window and a separate 30-day RAC discussion-request window (running from the review-results / informational letter, not from the demand letter). The 120-day Redetermination appeal clock at 42 CFR § 405.942 runs in parallel and is not extended by filing a discussion request. The first 14 days determine whether the practice fights the audit from a documented posture or from behind. Triage the claim list, pull every record, identify the legal theory of denial, and decide on counsel before drafting anything.

Day 0: identify which kind of RAC letter you have

RAC contact arrives in three forms under 42 CFR § 405.986 and the related CMS Statement of Work:

  • Automated review notice (no records requested) — the RAC identified an overpayment based on claim data alone (duplicate billing, services beyond LCD limits, code-pair conflicts). No documentation review; the demand letter follows.
  • Complex review with Additional Documentation Request (ADR) — the RAC requests medical records to assess medical necessity, coding accuracy, or signature compliance. 45 days to respond per the CMS ADR process.
  • Demand letter (overpayment determination) — the RAC has completed review and is demanding refund. The clock to file Redetermination under 42 CFR § 405.940 starts running.

Identify which letter you have before any other action. The downstream sequence differs.

The first 48 hours

In RAC defense the first 48 hours set the tempo. Treat the letter as a litigation hold trigger, not a billing question.

  1. Log every claim on the ADR. Date of service, CPT/HCPCS, units, modifier, provider, diagnosis, and the 45-day response deadline.
  2. Issue a litigation hold. Written notice to IT, billing, and clinical: do not delete email, do not purge audit logs, do not modify any record from the dates of service named.
  3. Pull the underlying charts. Every claim has a chart. Pull the chart, the order, the signature page, the time entries if applicable, and any prior auth or ABN.
  4. Identify counsel. A small ADR (under 20 claims) can be operationally managed; a complex review with high-dollar exposure or pattern selection warrants healthcare counsel from day one.
  5. Map each claim to its likely denial theory. The RAC's letter usually identifies the issue category (medical necessity, signature, time, coding). Each theory has a different defense.
  6. Calendar every clock. The 45-day ADR clock; the 30-day RAC discussion-request window from the review-results / informational letter; and, if a demand letter is in hand, the 30-day window to file Redetermination with recoupment pause and the 120-day window to file Redetermination without.

What the RAC is checking

Complex RAC review evaluates the same elements the MAC reviews in TPE, with three key differences: contingency-fee incentive, three-year look-back, and post-payment recovery rather than pre-payment hold.

The RAC's contingency-fee structure under the CMS RAC Statement of Work materially shapes review posture — RACs are paid a percentage of recovered overpayments. Practices should expect a stricter reading of documentation than a typical MAC pre-payment review.

Building the per-claim response

The RAC complex-review response package is structured per-claim, tabbed, and indexed:

  • ADR letter for the claim
  • Full chart documentation for the date of service
  • Signed and dated provider order, if applicable
  • Signed and dated encounter documentation
  • Time entries for time-based codes
  • Cross-reference documentation (lab, imaging, prior auth, ABN)
  • One-paragraph cover note tying the documentation to the LCD or NCD coverage criteria
  • HCPCS/CPT crosswalk if the coding decision is in question

Submit through the channel specified in the ADR (often the esMD electronic submission portal) with proof of submission. Late submission is auto-denial.

What to do during the discussion period

The RAC discussion-request window is generally 30 days from the review-results / informational letter that follows the ADR review (RAC region procedures may vary in mechanics, but 30 days is the operative window in current CMS guidance). The discussion period is informal and not part of the formal appeals process — it runs in parallel, not in lieu of, the appeal clocks. Filing a discussion request does not extend the 120-day Redetermination filing window or the 30-day window to file Redetermination with recoupment pause.

Use the discussion period to:

  • Submit additional documentation that was not in the original ADR response
  • Identify factual or coding errors in the RAC's review
  • Negotiate partial overturn on individual claims where documentation supports it
  • Build the record for the Redetermination filing if discussion fails

Discussion submissions do not extend the 30-day Redetermination filing window for recoupment pause under 42 CFR § 405.379. The recoupment-pause filing happens regardless of whether discussion is in progress.

The five-level appeals ladder

If the discussion period does not resolve the finding, the five-level Medicare administrative appeals process at 42 CFR § 405.940 is the formal channel:

  • Level 1 — Redetermination by the MAC. 120-day filing window; 60-day decision target. File within 30 days to pause recoupment.
  • Level 2 — Reconsideration by a Qualified Independent Contractor (QIC). 180-day filing window; 60-day decision target. Recoupment pause continues if filed within 60 days.
  • Level 3 — Administrative Law Judge (ALJ) hearing. 60-day filing window. Amount-in-controversy threshold adjusted annually; the current threshold is published in the Federal Register. Recoupment resumes regardless.
  • Level 4 — Medicare Appeals Council. 60-day filing window.
  • Level 5 — Federal district court. 60-day filing window; separate amount-in-controversy threshold.

Each level has its own filing rules and evidentiary standards. Counsel is functionally required from Level 3 onward and strongly advised from Level 1.

What not to do

  • Do not ignore the ADR. Non-response is auto-denial and forfeits the right to challenge on the merits.
  • Do not back-date or alter records. Late entries are permitted if clearly labeled per CMS signature guidance; fabrication exposes the practice to False Claims Act liability.
  • Do not submit a narrative response in lieu of the chart. The chart is the evidence; narrative is at most a roadmap.
  • Do not refund the demand without analyzing the basis. Many RAC findings are overturned at Redetermination or Reconsideration.
  • Do not delay the 30-day recoupment-pause filing. Missing this window means active Medicare payments are offset starting at day 41 from the demand letter.
  • Do not assume an RA demand of $0.10 is not worth fighting. RAC findings build cumulative records — a series of small denials creates a pattern that can trigger UPIC referral.

The 60-day overpayment overlap

If your records review during the RAC response identifies an additional overpayment the RAC did not catch, the 60-day refund clock at 42 USC § 1320a-7k(d) and 42 CFR § 401.305 runs independently. Self-identified overpayments must be refunded within 60 days of identification or the overpayment converts to False Claims Act exposure. Refund is processed through the MAC's standard overpayment channel, separate from any RAC response.

State-law overlay

Federal Medicare rules above. State law may add parallel obligations on the same records:

  • California: Medi-Cal program-integrity reviews operate independently and can request the same charts.
  • Texas: state HHSC-OIG runs Medicaid program-integrity audits that overlap on dual-eligible patients.
  • New York: the Office of the Medicaid Inspector General (OMIG) operates a parallel audit program.
  • Massachusetts: MassHealth program-integrity reviews overlap on dual-eligible patients and may request the same dates of service.

Practices billing any state Medicaid program should expect the underlying chart to be reviewed by more than one auditor.

Restraint about claims

No vendor or guide can promise a RAC outcome. RAC findings rest on the chart documentation at the time of service measured against the controlling LCD or NCD. The practice's job is to produce that documentation completely, on schedule, and to preserve appeal rights at every step. A well-organized, source-grounded response materially outperforms a scrambled one.

How d3rx fits

The d3rx compliance binder assembles the underlying program documentation a RAC response is built from — billing-compliance policies, signature standards, internal coding-review evidence, LCD/NCD tracker, and overpayment-refund log. The d3rx audit defense workflow walks the ADR triage, the per-claim tabbing structure, and the discussion-period sequencing alongside the appeal clocks. d3rx does not represent the practice in any Medicare proceeding and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.

Step 1 · Get the binder

Get the d3rx compliance binder for your practice

Pre-filled to address the gaps this guide coversRAC Audit Response: First 14 Days After the Letter. We will email you the section preview and your binder intake link.

No PHI required. We use your email to send the binder preview and intake link only.

Frequently asked

What is the difference between a RAC and a UPIC audit?

Recovery Audit Contractors operate post-payment under [42 CFR § 405.986](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.986) and are paid contingency fees for recoveries. Unified Program Integrity Contractors (UPICs) under the [Medicare Program Integrity Manual Chapter 4](https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c04.pdf) investigate potential fraud, can review on a much wider scope, and refer matters to OIG or DOJ. A RAC finding is a recovery dispute; a UPIC finding is a fraud investigation.

How far back can a RAC review claims?

The look-back period for RAC review is three years from the date of payment under the [CMS Statement of Work for the Recovery Audit Program](https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program). The look-back does not extend beyond the date of claim payment by more than 3 years, with limited exceptions for cases the RAC refers to investigation.

How many records can a RAC request at once?

RAC additional documentation request limits are described in the [CMS ADR limits guidance](https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/adr-limits) and scale by provider type and total Medicare claim volume. Limits are recalculated on a rolling 45-day cycle. A high-volume practice can receive several hundred ADRs in a single cycle.

Can we appeal a RAC overpayment determination?

Yes. The five-level Medicare administrative appeals process at [42 CFR § 405.940](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.940) applies: Redetermination (120 days), Reconsideration through a Qualified Independent Contractor (180 days), Administrative Law Judge hearing (60 days, subject to amount-in-controversy threshold), Medicare Appeals Council, and federal district court. The RAC discussion request is a separate, informal pre-appeal channel — generally due within 30 days of the review-results letter — and does not extend any appeal clock.

Does the RAC discussion period extend the appeal deadline?

No. The discussion period under the [RAC Statement of Work](https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program) runs in parallel with the Redetermination clock. If discussion fails to overturn the finding, the Redetermination filing deadline still runs from the demand letter date. Treat both clocks as live simultaneously.

If we lose the appeal, can we still recoup what was withheld?

If the Redetermination is filed within 30 days of the demand letter under [42 CFR § 405.379](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.379), CMS pauses recoupment of the disputed amount through the second level of appeal. After the second-level Reconsideration decision, recoupment resumes regardless of further appeal. Practices that miss the 30-day filing window face immediate offset from current Medicare payments.

Turn this into a review-ready binder

The Security Risk Analysis is where this guide becomes documentation you can actually hand to a reviewer — assembled into one review-ready binder. Source-grounded, citation-linked, and explicit about what it does and does not do.

Editorial process. This guide was drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and edited by the D3rx team for restraint and source fidelity. A named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged to verify citations — see the team page for status. Until that reviewer engagement is finalized, this page does not claim credentialed review.

This article is an administrative documentation aid. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program. References cited link to primary sources at HHS, OCR, CMS, the Code of Federal Regulations, NIST, and state regulators.

Authored by D3rx

D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.

Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.

Sources & Citations
  1. 42 CFR § 405.942https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.942
  2. 42 CFR § 405.986https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.986
  3. the CMS ADR processhttps://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/adr-limits
  4. 42 CFR § 405.940https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.940
  5. Local Coverage Determinationhttps://www.cms.gov/medicare-coverage-database/search.aspx
  6. Social Security Act § 1862(a)(1)(A)https://www.ssa.gov/OP_Home/ssact/title18/1862.htm
  7. Medicare Program Integrity Manual Chapter 3, Section 3.3.2.4https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf
  8. 42 CFR § 410.32https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.32
  9. CMS RAC Statement of Workhttps://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program
  10. esMD electronic submission portalhttps://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/electronic-submission-of-medical-documentation-esmd
  11. 42 CFR § 405.379https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.379
  12. CMS signature guidancehttps://www.cms.gov/regulations-and-guidance/guidance/transmittals/downloads/r327pi.pdf
  13. 42 CFR § 401.305https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-401/subpart-D/section-401.305

Sources verified as of May 23, 2026

Research Aid Notice

This guide is a plain-English summary maintained by D3rx for healthcare practice administrators. It is not legal advice, medical advice, or accounting advice. The authoritative source is the cited regulation or agency document. Always confirm with qualified counsel before acting on a specific compliance question affecting your practice.

Related Guides