The envelope looks routine until you open it. Inside sits a Recovery Audit Contractor letter, and your practice now has a clock running. What you do in the next 45 days decides whether this becomes a paperwork exercise or a five-year legal fight.

Recovery Audit Contractors work for CMS under a mandate that dates to the Tax Relief and Health Care Act of 2006. Their job is narrow. Find improper Medicare payments, overpayments and underpayments alike, and route them back through the system. Every physician practice billing Medicare Part B is fair game.

Hospitals get more headlines. Physician practices absorb just as much scrutiny, often with fewer compliance staff to manage it. A solo practitioner and a forty-provider group face the identical 45-day clock and appeal ladder. Size buys no extra time.

What Is a RAC Audit Letter, and Why Did a Practice Receive One?

A RAC audit letter flags a specific billing pattern CMS has approved for review, and it names the claims under scrutiny. Contractors like Cotiviti run software against claims data, or a certified coder flags documentation gaps. Practices land on the list through data mining, not personal targeting.

Nothing about the letter is personal. RAC software scans millions of claims for statistical outliers. High-dollar procedures, unusual modifier use, duplicate billing, and mismatched units all trigger a flag. A practice with clean documentation and a below-average denial rate still gets pulled sometimes, simply because its specialty sits inside an approved review issue.

Every approved review issue appears on the RAC’s public website before audits begin. A compliance officer who checks that list quarterly can spot which billing patterns are under active scrutiny in their region and self-audit those exact codes first. That single habit turns a defensive posture into a preventive one.

What Are the First 45 Days After the Letter Arrives?

The response deadline is fixed. A practice has 45 days from the date on an Additional Documentation Request to submit medical records, and extensions require contacting the RAC directly before that deadline expires. Missing the window triggers an automatic denial of the underlying claim, with no exceptions for staffing gaps.

Speed matters more than most administrators expect. Records must reach the correct address, with the correct contact name, and confirmation of receipt should be tracked in writing. A designated RAC coordinator prevents the letter from sitting in a general inbox while the clock runs. CMS caps the reimbursement rate for submitted records at $25 per record, a figure unchanged since 2012.

A RAC may request an on-site visit to review charts in person. A practice can decline that access without penalty, and the auditor cannot treat refusal as grounds for an overpayment finding. The RAC must instead request copies in writing, which creates a clean paper trail.

What Is the Difference Between an Automated and a Complex RAC Review?

An automated review runs claims through software alone and never requests records; the RAC flags a clear-cut coding violation, such as impossible unit quantities. A complex review adds human judgment. A coder or clinician requests documentation before deciding whether the claim was paid correctly.

Automated reviews move fast because no records exchange hands. Duplicate claims, quantity limits, and mutually exclusive procedure codes fall here. Complex reviews take longer and carry more risk, since a nurse or physician reviewer weighs medical necessity against the actual chart. A practice with weak documentation habits should expect more complex reviews than automated ones.

A third, hybrid path exists too. The RAC spots a pattern but cannot resolve it through software alone, so it sends an informational letter inviting context before any formal finding. Responding here, before a complex review opens, is the cheapest way to close an issue.

What Happens After a Practice Submits Its Records?

The RAC issues a review results letter once its reviewer finishes the assessment, stating whether the claim stands as billed or gets reclassified as an overpayment. A favorable result closes the matter. An unfavorable result triggers a formal demand letter and starts the discussion period.

That discussion period runs 15 calendar days from the date on the demand letter, giving the practice one more informal chance to present missing documentation before recoupment begins. It is not an appeal, but many disputes resolve here without ever reaching a formal appeal level. Practices that skip this step lose a low-cost opportunity to fix a simple documentation oversight.

CMS built in a timing safeguard too. A RAC must wait before instructing a Medicare Administrative Contractor to adjust payment, giving the discussion period time to run. That pause exists so a practice is not recouped against before it has had a real chance to respond.

What Happens If the RAC Demands Repayment?

A demand letter gives three paths: pay the full amount in one lump sum, accept an offset against future Medicare payments, or apply for an extended repayment schedule. Choosing to appeal instead preserves every option while the case proceeds through the Medicare appeals structure.

Silence is the worst option. An unanswered demand letter converts into an automatic offset against future claims, sometimes without further notice. A practice manager should never assume a demand letter is negotiable through a phone call. Every dispute needs a written redetermination request filed on time.

An extended repayment schedule deserves a closer look. Spreading a demand over monthly installments protects cash flow, but interest accrues the entire time. A practice weighing repayment against appeal should run both numbers first, since a strong appeal can eliminate the balance while a repayment plan only defers it.

What Are the Five Levels of Medicare Appeal Open to a Practice?

Medicare’s appeal ladder runs five levels: redetermination by the Medicare Administrative Contractor, reconsideration by a Qualified Independent Contractor, a hearing before an Administrative Law Judge, review by the Medicare Appeals Council, and finally judicial review in federal district court. Each level replaces the last reviewer with a fresh, independent decision-maker.

Each level carries its own deadline and, at the ALJ stage, a minimum dollar threshold. For 2026, a claim must have at least $200 remaining in controversy to reach an ALJ hearing, and at least $1,960 to reach federal court. Redetermination requests are due within 120 days of the denial; reconsideration requests within 180 days of an unfavorable redetermination. Practices that track every date on a shared calendar rarely lose an appeal to a missed filing window alone.

Overturn rates make the case for appealing rather than paying. A meaningful share of RAC determinations that reach a formal hearing get reversed once an independent reviewer examines the same chart. That pattern justifies building an appeal habit rather than defaulting to repayment. Smaller claims below the ALJ threshold can often be combined to clear the minimum.

What Financial and Legal Risks Follow a RAC Determination?

An unresolved RAC overpayment carries False Claims Act exposure once a practice knows about it and fails to return it within the required window. Extrapolated findings compound the exposure, since a small sample of denied claims can multiply into a demand covering years of billing.

Extrapolation is where real financial damage happens. A RAC statistician reviews a sample, calculates an error rate, and applies that rate across the full universe of similar claims going back as far as three years. Challenging the sampling methodology, the confidence interval, and the claim universe definition often reduces a six-figure demand substantially. A practice should never accept an extrapolated figure at face value without an independent statistical review.

RACs historically work under a contingency-fee model, earning a cut of every dollar recovered. That structure rewards volume, not accuracy, which is exactly why so many determinations get overturned once an ALJ reviews the same evidence with no financial stake in the outcome. Understanding that incentive shapes how aggressively a practice should push back before writing a check.

How Should a Practice Prepare Before the Next Letter Arrives?

Quarterly internal audits, focused on the same high-risk areas RACs target, catch problems before a contractor does. Medical necessity documentation, time-based service logs, and modifier accuracy top that list. A written response protocol with named owners in billing, compliance, and clinical staff turns a crisis into a routine task.

Building that team before a letter arrives changes everything about how the response unfolds. Finance handles the financial-impact analysis and repayment math. Clinical staff reviews the chart against the RAC’s stated concern. Compliance owns the appeal timeline. Health information management pulls and organizes the records. Without a designated owner in each seat, a 45-day deadline evaporates in internal handoffs before anyone drafts a response.

CMS is not slowing down. The agency faces an early-2026 deadline to finish a backlog of Medicare Advantage Risk Adjustment Data Validation audits stretching back to 2018, and fee-for-service RAC activity continues alongside it. Practices treating audit-readiness as a standing operational function, not a reaction to a single envelope, hold the advantage when the next letter arrives.