Pursuant to Section 6411 of the Patient Protection and Affordable Care Act (PPACA), on Sept. 14, the Centers for Medicare & Medicaid Services (CMS) published a final rule in the Federal Register (76 Fed. Reg. 57808) for the Medicaid Recovery Audit Contractor Program (Medicaid Program). The final rule on the Medicaid Program was announced at a cabinet meeting convened by Vice President Joe Biden along with an initiative to track state progress in reducing improper unemployment insurance payments.

The purpose of the Medicaid Program is to be “a measure for states to promote the integrity of the Medicaid program.” The final rule provides guidance to states on structuring their individual programs, funding rules and information on state payments to Medicaid Recovery Audit Contractors (RACs).

The federal government estimates the Medicaid Program will save $2.1 billion over the next five years. The Medicaid Program is but one example of the federal government’s more recent emphasis on cracking down on fraud and abuse in the health care industry. For health care providers, this means another level of government oversight.

The Medicaid Program as outlined in the final rule is based on the Medicare Recovery Audit Contractor Program but has its own nuances specific to the differences in how the Medicaid Program operates. The Medicare RAC program, according to CMS, has already recovered almost $670 million in improper payments in the year 2011 alone. The Medicaid Program under the final rule is to be effective Jan. 1, 2012.


The Medicare RAC program is older and was created under different legislation than the Medicaid Program — initially the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 and later made permanent by the Tax Relief and Health Care Act of 2006. Under that program, CMS contracts with private entities (the RACs) to review possible over- and underpayments between providers and the Medicare program. The Medicare RAC program has been largely successful for the federal government in terms of money recouped.

States generally administer the Medicaid Program. Section 6411 of the PPACA required states to establish programs by which they would contract with one or more Recovery Audit Contractors (Medicaid RACs) by Dec. 31, 2010, in order to identify underpayments and recoup overpayments. While required to establish programs by this date, the Medicaid RAC programs were not required to be implemented by Dec. 31, 2010.

On Nov. 10, 2010, CMS published its proposed rules for the Medicaid Program. In this proposed rule, CMS stated that, absent an exception, states were required to fully implement their programs by April 1, 2011. On Feb. 1, 2011, CMS published an informational bulletin delaying the April 1, 2011, start date in part to “ensure that states would be able to comply with the provisions of the final rule.”


The final rule reiterates the basic requirement that states enter into contracts with a RAC in order to identify under- and overpayments and to recoup overpayments. This is somewhat different from the Medicare program, which has RACs designated for particular regions of the country. Under the final rule, federal financing participation (FFP) is available to the states for administrative costs for operating and maintaining Medicaid RAC programs. The RAC must be able to demonstrate that it has the technical capacity to carry out the objectives of the Medicaid Program. Similar to a tweak made to the Medicare RAC program in response to provider complaints, absent a specific state exception, the RAC must have at least one full-time equivalent medical director who is either a doctor of medicine or a doctor of osteopathy. The RAC furthermore must employ certified coders unless the state determines that such are not necessary for an effective review of provider claims.

RACs are required to provide certain minimum customer service measures including the following: establishing a toll-free customer service number; compiling and maintaining provider-approved addresses and points of contact; accepting of provider submissions of electronic medical records; notifying providers of overpayment findings within 60 calendar days; and referring suspected fraud/abuse to the state in a timely manner. States may further impose additional requirements on RACs beyond those listed in the final rule.

Pursuant to the Social Security Act as revised by the PPACA, Medicaid RACs are to be paid only from amounts recovered by the RAC and are to be paid on a contingency fee basis. CMS, in the preamble to the final rule, noted that it understood that each state will have to tailor its individual RAC program to the characteristics of that state and its Medicaid program. Therefore, CMS declined to set a standard contingency fee percentage to be paid to RACs and left that discretion to the states. However, under the final rule, the federal government will not provide FFP for any amount of a contingency fee payment that exceeds the then-highest contingency fee rate paid to a Medicare RAC absent a specific case-by-case approval by CMS. According to CMS, the current highest paid rate for a Medicare RAC is 12.5 percent. Changes to the maximum rate will be published by CMS in the Federal Register. Under the final rule, states are also given discretion in determining the timing of the payment of the contingency fee to the RAC.

In addition to the overpayment detection aspect of the Medicaid Program, states are required under the final rule to adequately incentivize the RACs to detect underpayments. The exact compensation method for RACs to identify underpayments is left to the discretion of the states. Under the Medicare RAC program, RACs also currently receive a contingency fee for identifying underpayments. States are required under the final rule to notify providers of any underpayments identified by the RACs.

Furthermore, states are required to have an adequate appeals process in place to challenge any adverse findings by the RAC. One rule of the appeals process is that if an overpayment determination is overturned through the appeal, the RAC must return its contingency fee payment in a “reasonable” amount of time.

Providers may take some relief in that the final rule imposes certain limitations on the scope and nature of the audit that a RAC may conduct. Under the final rule, states must limit the number and frequency of medical records to be reviewed by the RAC, subject to the request for an exception by the RAC. Furthermore, absent special approval from the state, a RAC may not review a claim that is more than three years old, based upon the date of the claim and a RAC may not audit a claim that has been previously audited or is currently being audited by another entity.

The final rule does allow for states to seek to be excepted from some or all of the Medicaid RAC contracting requirements. For such an exception, the state must submit a written justification for the exception to CMS.

The final rule and Medicaid Program highlight that we are in a new era of increased government scrutiny and oversight of the health care industry.

Those readers interested in learning more about the Medicaid Program are encouraged to view the final rule in the Federal Register available at

is the president and founder of
Kalogredis Sansweet Dearden & Burke , a health care law firm, and Professional Practice Consulting Inc., a health care consulting firm, in Wayne, Pa. Among his areas of expertise are group practice arrangements, practice sales and mergers, doctor contract drafting and negotiation, tax and retirement planning for physicians, joint ventures, fraud and abuse matters, and evaluation of practice options for physicians. He can be contacted at 800-688-8314 or by e-mail at BKalogredis@KSDBHealthlaw.com.

is an associate at the firm. Her practice involves both litigation of health care related matters, including representation of licensees before the professional boards, and representing clients in health care transactions. Bayus graduated from Temple University’s Beasley School of Law in 2006. She may be reached at KBayus@KSDBhealthlaw.com.