RAC Audit Response: First 14 Days After the Letter
8 min read · Last reviewed May 23, 2026
A Recovery Audit Contractor (RAC) letter starts two clocks at once: a 45-calendar-day Additional Documentation Request (ADR) response window and a separate 30-day RAC discussion-request window (running from the review-results / informational letter, not from the demand letter). The 120-day Redetermination appeal clock at 42 CFR § 405.942 runs in parallel and is not extended by filing a discussion request. The first 14 days determine whether the practice fights the audit from a documented posture or from behind. Triage the claim list, pull every record, identify the legal theory of denial, and decide on counsel before drafting anything.
Day 0: identify which kind of RAC letter you have
RAC contact arrives in three forms under 42 CFR § 405.986 and the related CMS Statement of Work:
- Automated review notice (no records requested) — the RAC identified an overpayment based on claim data alone (duplicate billing, services beyond LCD limits, code-pair conflicts). No documentation review; the demand letter follows.
- Complex review with Additional Documentation Request (ADR) — the RAC requests medical records to assess medical necessity, coding accuracy, or signature compliance. 45 days to respond per the CMS ADR process.
- Demand letter (overpayment determination) — the RAC has completed review and is demanding refund. The clock to file Redetermination under 42 CFR § 405.940 starts running.
Identify which letter you have before any other action. The downstream sequence differs.
The first 48 hours
In RAC defense the first 48 hours set the tempo. Treat the letter as a litigation hold trigger, not a billing question.
- Log every claim on the ADR. Date of service, CPT/HCPCS, units, modifier, provider, diagnosis, and the 45-day response deadline.
- Issue a litigation hold. Written notice to IT, billing, and clinical: do not delete email, do not purge audit logs, do not modify any record from the dates of service named.
- Pull the underlying charts. Every claim has a chart. Pull the chart, the order, the signature page, the time entries if applicable, and any prior auth or ABN.
- Identify counsel. A small ADR (under 20 claims) can be operationally managed; a complex review with high-dollar exposure or pattern selection warrants healthcare counsel from day one.
- Map each claim to its likely denial theory. The RAC's letter usually identifies the issue category (medical necessity, signature, time, coding). Each theory has a different defense.
- Calendar every clock. The 45-day ADR clock; the 30-day RAC discussion-request window from the review-results / informational letter; and, if a demand letter is in hand, the 30-day window to file Redetermination with recoupment pause and the 120-day window to file Redetermination without.
What the RAC is checking
Complex RAC review evaluates the same elements the MAC reviews in TPE, with three key differences: contingency-fee incentive, three-year look-back, and post-payment recovery rather than pre-payment hold.
- Coverage — does the service meet the Local Coverage Determination or National Coverage Determination for the diagnosis billed
- Medical necessity — does the chart support the service under Social Security Act § 1862(a)(1)(A)
- Documentation — provider signature per Medicare Program Integrity Manual Chapter 3, Section 3.3.2.4, date of service, time entries where required
- Coding — CPT/HCPCS, modifiers, units billed, place of service
- Order — diagnostic-service order per 42 CFR § 410.32
- Beneficiary eligibility on the date of service
The RAC's contingency-fee structure under the CMS RAC Statement of Work materially shapes review posture — RACs are paid a percentage of recovered overpayments. Practices should expect a stricter reading of documentation than a typical MAC pre-payment review.
Building the per-claim response
The RAC complex-review response package is structured per-claim, tabbed, and indexed:
- ADR letter for the claim
- Full chart documentation for the date of service
- Signed and dated provider order, if applicable
- Signed and dated encounter documentation
- Time entries for time-based codes
- Cross-reference documentation (lab, imaging, prior auth, ABN)
- One-paragraph cover note tying the documentation to the LCD or NCD coverage criteria
- HCPCS/CPT crosswalk if the coding decision is in question
Submit through the channel specified in the ADR (often the esMD electronic submission portal) with proof of submission. Late submission is auto-denial.
What to do during the discussion period
The RAC discussion-request window is generally 30 days from the review-results / informational letter that follows the ADR review (RAC region procedures may vary in mechanics, but 30 days is the operative window in current CMS guidance). The discussion period is informal and not part of the formal appeals process — it runs in parallel, not in lieu of, the appeal clocks. Filing a discussion request does not extend the 120-day Redetermination filing window or the 30-day window to file Redetermination with recoupment pause.
Use the discussion period to:
- Submit additional documentation that was not in the original ADR response
- Identify factual or coding errors in the RAC's review
- Negotiate partial overturn on individual claims where documentation supports it
- Build the record for the Redetermination filing if discussion fails
Discussion submissions do not extend the 30-day Redetermination filing window for recoupment pause under 42 CFR § 405.379. The recoupment-pause filing happens regardless of whether discussion is in progress.
The five-level appeals ladder
If the discussion period does not resolve the finding, the five-level Medicare administrative appeals process at 42 CFR § 405.940 is the formal channel:
- Level 1 — Redetermination by the MAC. 120-day filing window; 60-day decision target. File within 30 days to pause recoupment.
- Level 2 — Reconsideration by a Qualified Independent Contractor (QIC). 180-day filing window; 60-day decision target. Recoupment pause continues if filed within 60 days.
- Level 3 — Administrative Law Judge (ALJ) hearing. 60-day filing window. Amount-in-controversy threshold adjusted annually; the current threshold is published in the Federal Register. Recoupment resumes regardless.
- Level 4 — Medicare Appeals Council. 60-day filing window.
- Level 5 — Federal district court. 60-day filing window; separate amount-in-controversy threshold.
Each level has its own filing rules and evidentiary standards. Counsel is functionally required from Level 3 onward and strongly advised from Level 1.
What not to do
- Do not ignore the ADR. Non-response is auto-denial and forfeits the right to challenge on the merits.
- Do not back-date or alter records. Late entries are permitted if clearly labeled per CMS signature guidance; fabrication exposes the practice to False Claims Act liability.
- Do not submit a narrative response in lieu of the chart. The chart is the evidence; narrative is at most a roadmap.
- Do not refund the demand without analyzing the basis. Many RAC findings are overturned at Redetermination or Reconsideration.
- Do not delay the 30-day recoupment-pause filing. Missing this window means active Medicare payments are offset starting at day 41 from the demand letter.
- Do not assume an RA demand of $0.10 is not worth fighting. RAC findings build cumulative records — a series of small denials creates a pattern that can trigger UPIC referral.
The 60-day overpayment overlap
If your records review during the RAC response identifies an additional overpayment the RAC did not catch, the 60-day refund clock at 42 USC § 1320a-7k(d) and 42 CFR § 401.305 runs independently. Self-identified overpayments must be refunded within 60 days of identification or the overpayment converts to False Claims Act exposure. Refund is processed through the MAC's standard overpayment channel, separate from any RAC response.
State-law overlay
Federal Medicare rules above. State law may add parallel obligations on the same records:
- California: Medi-Cal program-integrity reviews operate independently and can request the same charts.
- Texas: state HHSC-OIG runs Medicaid program-integrity audits that overlap on dual-eligible patients.
- New York: the Office of the Medicaid Inspector General (OMIG) operates a parallel audit program.
- Massachusetts: MassHealth program-integrity reviews overlap on dual-eligible patients and may request the same dates of service.
Practices billing any state Medicaid program should expect the underlying chart to be reviewed by more than one auditor.
Restraint about claims
No vendor or guide can promise a RAC outcome. RAC findings rest on the chart documentation at the time of service measured against the controlling LCD or NCD. The practice's job is to produce that documentation completely, on schedule, and to preserve appeal rights at every step. A well-organized, source-grounded response materially outperforms a scrambled one.
How d3rx fits
The d3rx compliance binder assembles the underlying program documentation a RAC response is built from — billing-compliance policies, signature standards, internal coding-review evidence, LCD/NCD tracker, and overpayment-refund log. The d3rx audit defense workflow walks the ADR triage, the per-claim tabbing structure, and the discussion-period sequencing alongside the appeal clocks. d3rx does not represent the practice in any Medicare proceeding and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.
Step 1 · Get the binder
Get the d3rx compliance binder for your practice
Pre-filled to address the gaps this guide covers — RAC Audit Response: First 14 Days After the Letter. We will email you the section preview and your binder intake link.
No PHI required. We use your email to send the binder preview and intake link only.
Frequently asked
What is the difference between a RAC and a UPIC audit?
Recovery Audit Contractors operate post-payment under [42 CFR § 405.986](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.986) and are paid contingency fees for recoveries. Unified Program Integrity Contractors (UPICs) under the [Medicare Program Integrity Manual Chapter 4](https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c04.pdf) investigate potential fraud, can review on a much wider scope, and refer matters to OIG or DOJ. A RAC finding is a recovery dispute; a UPIC finding is a fraud investigation.
How far back can a RAC review claims?
The look-back period for RAC review is three years from the date of payment under the [CMS Statement of Work for the Recovery Audit Program](https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program). The look-back does not extend beyond the date of claim payment by more than 3 years, with limited exceptions for cases the RAC refers to investigation.
How many records can a RAC request at once?
RAC additional documentation request limits are described in the [CMS ADR limits guidance](https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/adr-limits) and scale by provider type and total Medicare claim volume. Limits are recalculated on a rolling 45-day cycle. A high-volume practice can receive several hundred ADRs in a single cycle.
Can we appeal a RAC overpayment determination?
Yes. The five-level Medicare administrative appeals process at [42 CFR § 405.940](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.940) applies: Redetermination (120 days), Reconsideration through a Qualified Independent Contractor (180 days), Administrative Law Judge hearing (60 days, subject to amount-in-controversy threshold), Medicare Appeals Council, and federal district court. The RAC discussion request is a separate, informal pre-appeal channel — generally due within 30 days of the review-results letter — and does not extend any appeal clock.
Does the RAC discussion period extend the appeal deadline?
No. The discussion period under the [RAC Statement of Work](https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program) runs in parallel with the Redetermination clock. If discussion fails to overturn the finding, the Redetermination filing deadline still runs from the demand letter date. Treat both clocks as live simultaneously.
If we lose the appeal, can we still recoup what was withheld?
If the Redetermination is filed within 30 days of the demand letter under [42 CFR § 405.379](https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.379), CMS pauses recoupment of the disputed amount through the second level of appeal. After the second-level Reconsideration decision, recoupment resumes regardless of further appeal. Practices that miss the 30-day filing window face immediate offset from current Medicare payments.
Turn this into a review-ready binder
The Security Risk Analysis is where this guide becomes documentation you can actually hand to a reviewer — assembled into one review-ready binder. Source-grounded, citation-linked, and explicit about what it does and does not do.
Editorial process. This guide was drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and edited by the D3rx team for restraint and source fidelity. A named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged to verify citations — see the team page for status. Until that reviewer engagement is finalized, this page does not claim credentialed review.
This article is an administrative documentation aid. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program. References cited link to primary sources at HHS, OCR, CMS, the Code of Federal Regulations, NIST, and state regulators.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
- 42 CFR § 405.942https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.942
- 42 CFR § 405.986https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.986
- the CMS ADR processhttps://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program/adr-limits
- 42 CFR § 405.940https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.940
- Local Coverage Determinationhttps://www.cms.gov/medicare-coverage-database/search.aspx
- Social Security Act § 1862(a)(1)(A)https://www.ssa.gov/OP_Home/ssact/title18/1862.htm
- Medicare Program Integrity Manual Chapter 3, Section 3.3.2.4https://www.cms.gov/regulations-and-guidance/guidance/manuals/downloads/pim83c03.pdf
- 42 CFR § 410.32https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-410/subpart-B/section-410.32
- CMS RAC Statement of Workhttps://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery-audit-program
- esMD electronic submission portalhttps://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/electronic-submission-of-medical-documentation-esmd
- 42 CFR § 405.379https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-405/subpart-I/section-405.379
- CMS signature guidancehttps://www.cms.gov/regulations-and-guidance/guidance/transmittals/downloads/r327pi.pdf
- 42 CFR § 401.305https://www.ecfr.gov/current/title-42/chapter-IV/subchapter-B/part-401/subpart-D/section-401.305
Sources verified as of May 23, 2026
This guide is a plain-English summary maintained by D3rx for healthcare practice administrators. It is not legal advice, medical advice, or accounting advice. The authoritative source is the cited regulation or agency document. Always confirm with qualified counsel before acting on a specific compliance question affecting your practice.
Related Guides
Related across the archive
- ComplianceMedicare TPE Audit: The 45-Day Response WindowReceived a Medicare TPE letter from your MAC? You have 45 days from the ADR per claim. Sequence the response, address probe errors, and avoid Round 2.
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
- ComplianceOCR Investigation Letter: Your 30-Day Response PlaybookReceived an OCR HIPAA investigation letter? The first 30 days set the trajectory. Confirm the docket, freeze logs, route through counsel, and produce a tabbed response.
- CompliancePayer Pre-Payment Review: 14-Day Response TemplateA commercial payer pre-payment review holds your claims and gives 14 days to respond. Pull every chart, map to payer policy, and protect appeal rights.
- ComplianceAdditional Documentation Request (ADR): How to Respond Inside the WindowMedicare ADR response windows are contractor-specific (45 days for MAC/SMRC/RAC, 30 days for UPIC). Miss the window and the claim auto-denies. Here is the procedure that actually works.
- ComplianceThe Medicare 60-Day Overpayment Rule: How to Comply (and What Triggers Worse)The 60-day clock starts at identification. Miss it, and the overpayment becomes a False Claims Act violation. Here is the actual procedure.
- ComplianceOIG Self-Disclosure Protocol: When to Use It, When to Hold BackThe OIG SDP is a powerful resolution tool but it is not the right move for every matter. Here is how the 2021-amended SDP works and when counsel uses it.
- GlossaryMedical NecessityThe standard requiring that services be reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member.