The Recovery Audit Contractor (RAC) program was designed to identify and correct Medicare improper payments, but for years it operated as a blunt instrument—one that too often punished compliant providers while rewarding aggressive, error-prone auditing. It still does. But in recent years, CMS has implemented teeny tiny reforms that acknowledge these imbalances. Yet for hospitals and health systems navigating an already overburdened appeals process, these teeny tiny changes represent only the beginning of what true accountability demands.

I have written a lot about the overzealousness of RAC auditors. It appears that CMS recognizes the aggressiveness of RACs and the burdens on providers a teeny tiny bit. CMS has slightly pulled back the reins of RACs, but only slightly.

What CMS Has Done Right – But More Is Needed

The RAC look-back period for patient status reviews is now limited to six months from the date of service, provided the hospital submits its claim within three months of that date. It does not necessarily establish a six-month jurisdictional limitation on the MAC’s current TPE short-stay review authority. This is yet another reason to know whether your auditor is acting as a RAC or a MAC; the rules differ.

RACs can no longer collect a contingency fee until after the second level of appeal is exhausted. This reform purports to strike at the perverse incentive structure that allows auditors to profit from denials that were later reversed. But does it? Remember the 2^nd level reviews are rubber-stamps, like the first. As of April 2025, RACs are now required to employ a Contractor Medical Director, which is an M.D. or D.O., and CMS “encourages” them to maintain a panel of specialists available for consultation—hoping that clinical decisions are evaluated by qualified clinicians, not just billing analysts. Only as of last year RACs must hire at least one doctor. That baffles me. Since the inception of RACs until last year, audits of doctors were conducted by only billing specialists. Now the billing specialist may have one M.D. to ask guidance. Don’t confuse this for peer review, which should be required.

Why These Reforms Don’t Go Far Enough

While these changes represent a positive step, in my mind, they fail to fully rebalance a system that still places disproportionate financial and administrative burdens on providers. Provider advocates have called for deeper structural reforms—and their arguments are compelling. What else should be done to even the playing field?

First, RACs should not be permitted to recoup payments from providers until after a denial is upheld by an Administrative Law Judge (ALJ). Or how about until the appeal is exhausted? Taking reimbursements from a provider that has not been proven to be an overpayment violates due process. Correspondingly, RACs should not receive contingency fees until final adjudication. Given that RAC denials are frequently overturned at the ALJ level, delaying payment only until after the second level of appeal provides inadequate incentive for auditors to limit inappropriate denials. Providers should not be forced to fund the government’s cash flow while awaiting justice.

RACs should face meaningful penalties when their post-payment denials are overturned at a significant rate at the ALJ level. Accountability cannot be a one-way street; auditors who consistently get it wrong should bear consequences proportional to the disruption they cause.

RACs should be prohibited from issuing determinations on claims when they miss their own review deadlines. Timeliness standards must apply equally to all parties.

Finally, for now, CMS should establish an independent ombudsman to receive and investigate provider complaints about RAC conduct and require RACs to publish transparent data on denial and overturn rates by provider type.

The Path Forward

Providers are not asking for immunity from oversight—they are asking for fairness. A system that profits from denials before they are validated, that shifts financial risk entirely onto hospitals, and that lacks meaningful consequences for auditor error is not a system designed to protect the Medicare trust fund. CMS has taken teeny tiny, mini-encouraging steps. Now it must finish the job.