Hospital billing audit readiness: how to prepare for RAC, MAC and UPIC reviews

Who audits a hospital's Medicare claims?

Six kinds of reviewer matter to a hospital: the MAC, the RAC, the UPIC, the CERT contractor, the SMRC and the HHS Office of Inspector General (OIG). The first five are CMS contractors that review claims under chapter 3 of the Medicare Program Integrity Manual (PIM). The OIG is a separate HHS office and is not governed by that chapter.

The RAC description comes from CMS: RACs review claims on a post-payment basis to detect and correct past improper payments, and an automated review happens at the system level while a complex review needs a qualified person to read the medical record.

Why was my hospital chosen?

PIM section 3.2.1 says a MAC may review any claim at any time, but it focuses on services that pose the greatest financial risk to Medicare. The manual lists the reasons a MAC may pick a target: high volume of services, high cost, a dramatic change in how often a service is used, high-risk problem-prone areas, and data from the RAC, CERT, OIG or Government Accountability Office showing vulnerability.

The same section says a MAC or RAC must not pick a provider for review solely because it uses an electronic health record or answers requests through esMD. It also says a MAC must not deny a service simply because a claim fails one screening-tool criterion, since the reviewer has to make an individual determination on each claim.

CERT works differently. CMS says CERT reviews a statistically valid stratified random sample of Medicare fee-for-service claims each year. For fiscal year 2025 CMS reports an overall improper payment rate of 6.55 percent, or $28.83 billion, with 3.15 percent for hospital inpatient prospective payment system claims, 6.67 percent for other Part A providers and 8.44 percent for Part B providers.

What is the difference between prepayment and post-payment review?

Prepayment review happens before Medicare pays the claim, and post-payment review happens after. PIM section 3.2 says prepayment review always ends in an initial determination, while post-payment review ends either in no change to the initial determination or in a revised determination that finds an overpayment or underpayment.

On the prepayment side, the MAC runs coded system edits that pay, deny or suspend all or part of a claim. A suspended claim waits for a trained clinician or claims analyst, who may ask you for records. The edits can key on type of bill, revenue codes, occurrence codes, condition codes and value codes, so a hospital claim can be pulled for the same fields you code on the UB-04.

Under 42 CFR 405.929(a), post-payment review is conducted under the reopening authority in 405.980. The manual adds that a high error rate or possible overutilization found through data analysis is sufficient cause to reopen claims.

Extrapolation is the part a hospital finance team should plan for. A small sample can turn into a demand for a much larger amount, because the error rate in the sample is projected across the universe of similar claims. That is why the response to the sample claims needs the same care as a response to a large audit.

What is Targeted Probe and Educate, and what happens in a round?

Targeted Probe and Educate (TPE) is a MAC program in which the MAC reviews a small set of your claims for one service, teaches you what it found, and reviews again. CMS says its purpose is to help providers reduce claim denials and appeals through one-on-one help, and that most providers will never need it.

Easily cured errors can be fixed during a probe. The manual gives two examples: missing documentation that can be sent in, and a missing signature that can be resolved with a signature attestation. CMS also runs a Low Biller Probe and Educate program for providers with lower claim volumes, which reviews fewer than 20 claims per round for up to three rounds.

TPE letters carry a reminder that 42 CFR 424.535(a)(8)(ii) lets CMS revoke Medicare billing privileges when a provider shows a pattern or practice of submitting claims that fail to meet Medicare requirements. Treat a TPE letter as a compliance event for the whole department and not as a routine records request.

What is an ADR, and how long do we have to respond?

An additional documentation request (ADR) is the reviewer's written request for the records that support a claim, and you have 45 calendar days to answer a MAC, RAC, SMRC or CERT request and 30 calendar days to answer a UPIC request. The deadline comes from 42 CFR 405.903 for prepayment review and 405.929 for post-payment review, and the two rules use the same numbers.

A contractor may accept records after the deadline for good cause. The rule defines good cause as situations such as natural disasters, interruptions in business practices, or other extenuating circumstances the contractor accepts. CMS encourages providers to contact the MAC if they need more time, so ask before the deadline passes.

What happens if we do not respond in time?

The contractor can deny the claim. PIM 3.2.3.8 tells reviewers to deny it as not reasonable and necessary, using group code CO, CARC 50 and RARC M127, which is described as missing patient medical record for this service. That denial can also trigger the appeal path, but the cleaner fix is to answer on time.

PIM 3.2.3.9 covers late records. A MAC may reopen a claim when the records arrive within a reasonable number of days, generally 15 calendar days after the denial date, and it then has 60 calendar days to make a new determination. A RAC does not reopen. It considers late records if they come before it issues a demand letter and keeps them for the appeal if they come after.

What does the ADR letter contain?

PIM 3.2.3.4 requires the MAC, RAC, CERT and SMRC letters to carry the same parts: an introduction naming CMS and the program, the reason for selection, the action you must take, the date the reply is due, the consequences of not replying, instructions, accepted submission methods, a contact for questions, and a list of attachments. Read the reason for selection first, because it tells you which claims are under review and why.

The manual says reviewers must accept paper, fax, CD or DVD, esMD and the contractor's web portal. UPICs and the I-MEDIC may also use Kiteworks, a secure file-sharing system. CMS advises putting a copy of the ADR letter on top of the packet so the pages match the right patient and claim, and says the response may include documents from before the review period.

CMS sends the ADR to the practice address on file with Medicare and asks you to keep your Medical Review Correspondence Address current in PECOS. A hospital that moved its mailroom or opened a new site and never updated that address can miss the clock before anyone reads the letter. The enrollment side of that is in our guide to credentialing new locations.

Records cost money to copy. The manual says MACs, the SMRC, CERT and UPICs are not required to pay for records. RACs must pay: no more than $15.00 per record sent by mail, fax or CD or DVD, and no more than $27.00 per record sent through esMD, which includes a $2.00 transaction fee. Providers paid under a Medicare reimbursement system, such as Critical Access Hospitals, receive no payment.

What should we do in the first week after an ADR arrives?

Log it, find out who sent it, and start collecting the record the same day. The sequence below is a workable order, built around the deadlines above.

What documentation belongs in an audit packet?

Send the pieces the ADR asks for, and make sure they show who treated the patient, what that clinician found and decided, and when. PIM 3.2.3.1 says reviewers must name only the individual pieces of documentation needed, so a packet should answer the letter and not reproduce the whole chart.

PIM 3.2.3 defines additional documentation broadly. It includes clinical evaluations, physician evaluations, consultations, progress notes, physician office records, hospital records, nursing home records, home health agency records, records from other healthcare professionals and test reports. It also includes notes from suppliers, labs and ambulance companies and any records a biller holds that the reviewer needs to reach a conclusion.

Several rules in the manual shape what you send:

• The submitted information must corroborate the beneficiary's medical documentation and confirm that Medicare coverage criteria were met (PIM 3.3.2.1).
• Reviewers must consider entries made by physicians and licensed or certified medical professionals, and CMS does not prohibit templates, so information captured in a template is considered (PIM 3.3.2.1.1).
• The date and author of any amendment, correction or delayed entry should be identifiable, and the change should be clearly and permanently marked (PIM 3.3.2.5).
• Reviewers may look at records from before and after the service to see the patient's clinical condition (PIM 3.2.3).
• If the treating clinicians are outside your hospital, the billing provider is still the one responsible for submitting what the contractor asked for, on time (PIM 3.2.3.3).

Include a copy of the claim as billed so that your own reviewer and the contractor work from the same lines. For an emergency department claim, add the documents that support the facility level, which your written level criteria should already point to. Our ED facility level coding page covers how that level is set.

The Printable checklist at the end of this guide turns these points into twelve items you can hand to the person assembling the packet.

How do signature rules affect an audit response?

A record entry with no signature, or one the reviewer cannot read, can sink a claim that is otherwise supported, and PIM section 3.3.2.4 gives you two ways to fix it. A signature log identifies an illegible signature, and a signed attestation statement covers a missing one. The rule applies to MACs, UPICs, the SMRC, CERT and RACs.

When a reviewer asks whether you want to send an attestation or log, you have 20 calendar days from the phone call or from receipt of the letter, and CERT is excluded from that period. The review is extended by 15 calendar days once the attestation or log arrives. An attestation must be signed and dated by the author of the entry and identify the beneficiary, and it cannot be used to backdate something that had to be signed before an event.

Our signature requirements page has the full rule, including handwritten and electronic signatures and scribe entries. Fixing signatures before an ADR arrives is far easier than doing it inside a 20 day window.

How does the 60-day overpayment rule connect to an audit?

An audit finding is evidence, and once you know about an overpayment the 60-day clock in 42 CFR 401.305 can start. The rule requires you to report and return an overpayment by the later of 60 days after the date it was identified or the date any corresponding cost report is due. Our 60-day overpayment rule page explains the definition of identified, the pauses and the 6 year lookback.

The practical effect is that a finding on sampled claims raises a question about all similar claims you billed the same way. If a results letter says a hospital coded a service wrongly in the sample, the next step is to ask whether the same error sits in claims outside the sample. A documented review with dates is your record of when you identified the issue.

This guide is not legal advice. Have counsel review how a finding affects your reporting duty before you decide whether something is identified, and before you respond to a UPIC or OIG request.

How do we respond to findings and appeal?

Read the results letter first, then decide between a rebuttal, a repayment plan and an appeal. Each path has its own deadline, and they can overlap.

A revised determination binds all parties unless a party files a written request for redetermination, under 42 CFR 405.984(a). The five levels of appeal, their deadlines and the 2026 and 2027 amount in controversy are on our Medicare appeal levels page.

A RAC finding follows the same Part 405 subpart I appeal path for claims paid under Parts A and B once a revised determination is issued, and the RAC's demand letter states where and how to file. No official CMS page lays out a RAC discussion period with a fixed number of days, so check the RAC's letter and its provider portal for that step.

Do not wait for the appeal deadline to gather evidence. Keep a copy of the exact packet you sent, because the next reviewer starts from the claim record and the documents you submitted.

How often should a hospital audit itself, and what should it review?

No regulation sets an audit interval for a hospital, and the HHS-OIG guidance names an annual audit as the minimum for small entities. The OIG General Compliance Program Guidance (2023) is voluntary and nonbinding. It says audits may use internal or external auditors who know federal and state health care rules, that small entities should audit at least annually, and that claims reviews should include a review of medical necessity by an appropriately credentialed clinician.

For physician practices, the OIG's 2000 compliance guidance suggests a baseline audit and then periodic audits at least once each year, and gives five or more records per federal payor, or five to ten per physician, as a basic sample guide with no set formula. A hospital should size its sample from its own claim volume and risk, and a larger sample gives more comfort.

Where do audit target ideas come from?

No official list ranks the most common ER audit targets, so we do not publish one. These public sources show where reviewers are looking:

For inpatient claims, a DRG validation review compares the DRG on the claim with what the record supports, so start with the DRGs PEPPER flags and read our MS-DRG page. Coders should work from the documentation, and unclear diagnoses need a query to the physician before billing.

How do we track audit outcomes?

Keep one log with a row for every request, and review it on a set schedule so patterns show up. The columns below work for MAC, RAC, UPIC and CERT requests alike.

Sort the log by root cause each quarter. If four of ten denials come from missing signatures, the fix sits in the front-end workflow, not in the audit team. Our denial management playbook shows how the same coding applies to payer denials.

How Nucleus Align handles audit readiness

Billing and coding audits is one of our 22 services, and it is paid work. Our team includes AAPC and AHIMA certified coders, and we read claims against the medical record so that errors are found before a contractor finds them. Our billing and coding audits page describes what we review.

Denials worked within 48 hours means the denial data that feeds your audit log stays current. Every client has a Business Associate Agreement with us, our staff have HIPAA training and NDAs, and every system uses two-step login. Hospitals can read how we support them on the hospitals page.

We are a billing and coding team and not a law firm. For a UPIC or OIG matter, your counsel leads. To talk through your audit readiness, book a call.