What Is a Medicaid RAC Audit? How State Recovery Auditors Check NEMT Claims

A RAC audit is about money paid in error, not about fraud. The contractor is hunting for claims paid too much, paid twice, or paid when they should not have been, and it earns a share of every dollar it brings back. If it sees signs of fraud, it must hand the case to the state, which refers it to the Medicaid Fraud Control Unit (42 CFR 455.506 and 455.508).

How a Medicaid RAC works

The Affordable Care Act (section 6411) amended section 1902(a)(42)(B) of the Social Security Act to make states hire recovery audit contractors for Medicaid. CMS’s rules, in effect since January 1, 2012, are in 42 CFR part 455, subpart F. Each state must contract with one or more RACs unless CMS approves an exception through the state plan (42 CFR 455.502 and 455.516).

The pay model shapes everything else. A RAC is paid only from amounts it recovers, as a percentage of each overpayment. If you appeal and the finding is reversed at any level, the RAC must return its fee on that claim (42 CFR 455.510). North Carolina goes further: its law bars paying a RAC any fee before all your appeal rights are used up, and bases the fee on the final overpayment (G.S. 108C-5.1).

Federal rules also set a floor for how a RAC treats you (42 CFR 455.508):

• It must employ trained medical reviewers and at least one full-time medical director who is a doctor of medicine or osteopathy, unless CMS excuses the state.
• It must put a toll-free number in every letter, answered from 8:00 a.m. to 4:30 p.m. in your time zone.
• It must accept your records on CD or DVD, or by fax, if you ask.
• It must tell you its overpayment findings within 60 calendar days.
• It may not review claims more than 3 years old without state approval, and should not audit claims another auditor has already reviewed or is reviewing.

The state, in turn, must limit how many records a RAC can request and how often (42 CFR 455.506(e)).

Which states use a RAC, and which NEMT claims it reaches

Many states have none working. GAO found that in fiscal year 2021, only 16 states took part in the Medicaid RAC program, while 34 states and the District of Columbia did not. The reasons states gave included other program integrity work, not being able to hire a RAC, and having most members in managed care (GAO-23-106025, June 28, 2023). Under procedures dated October 3, 2023, CMS grants a full exception for two years at a time and contacts the state six months before it runs out.

Where RACs do work, they recover real money. States reported $176.5 million in federal-share recoveries from their Medicaid RACs in fiscal year 2024, according to CMS’s report to Congress of September 2025. Four states show the range as of October 2026:

State	Who runs the RAC contract	Status
New York	Office of the Medicaid Inspector General	Active. A new contract started in 2025, and RAC recoveries topped $35 million that year.
Illinois	Office of Inspector General, Department of Healthcare and Family Services	Under contract, with a posted dispute process
Mississippi	Division of Medicaid, Office of Program Integrity	Contract in place. None of its posted audit topics, the latest approved January 21, 2021, covers transportation.
Arizona	AHCCCS	All RAC activity on hold since September 13, 2024

Even in a state with a RAC, it may never see your claims. It reviews claims the state Medicaid program paid, and states may leave managed care claims out (42 CFR 455.506). So if you bill the state directly, as ambulette, taxi, and livery companies do under New York’s fee-for-service Medicaid, a RAC can reach your trips. If a broker or health plan pays you, it reaches your trips only if your state includes managed care claims in RAC review.

The topics also differ by state. New York’s 2026 Work Plan says its RAC projects have mostly checked whether other insurance should have paid first. In 2026 it adds Medicare data to find claims where a Medicare payment for a member with both programs was not reported to Medicaid.

How a RAC finds overpayments

RACs work from the state’s paid claims data. Mississippi’s RAC FAQ (July 2019) describes three kinds of review:

1. Automated. The RAC decides from claims data alone, without records, and only when it is certain the claim was wrong.
2. Semi-automated. The data points to an error, but you get a chance to send records before any money is taken back.
3. Complex. A reviewer reads your records, and the RAC must send you the results within 60 days of receiving them.

New York’s RAC uses automated and complex reviews. It looks for payments made in error, duplicate payments, wrong amounts, services Medicaid does not cover, wrong codes, coverage or eligibility errors, and services that were not ordered or not performed. A wrong code that does not change what you were paid is not an improper payment, Mississippi’s FAQ says.

A NEMT billing example

Here is a hypothetical. You bill your state fee-for-service, and an automated review flags 14 wheelchair van legs that were each paid twice: same rider, same date, same A0130 base code. Each leg was paid $50, so the letter claims a $700 overpayment and lists every claim line.

You pull the trip records. Twelve legs really were billed twice when a rejected batch was resubmitted, so you repay $600. The other two show different pickup addresses and times: the rider went to dialysis and then, an hour later, to a second appointment across town. Those were separate trips. You dispute them with the trip logs, the GPS trace, and both appointment confirmations. An automated finding rests only on claims data, so records made at the time of the ride can overturn it.

The 3-year limit, and why your records must last longer

A RAC may not review claims more than 3 years old, counted from the date of the claim, unless the state approves (42 CFR 455.508(f)). If a letter lists claims older than that, ask the RAC in writing whether the state approved reaching back that far.

The 3-year limit binds only the RAC. Your state’s own auditors can go further. In New York, for example, claims can be audited for six years from the date of service or billing, whichever is later, with no limit where fraud is involved (18 NYCRR 517.3(b)). A UPIC audit follows the state’s period too. Keep every trip record for the longest period any payer or law requires. See NEMT record retention.

Deadlines in a RAC audit

Each state sets its own clock. The dispute process posted by Illinois’s inspector general, as of October 2026, runs this way, in calendar days:

1. Records request. You have 30 days to send the records.
2. Follow-up. If nothing arrives, a second letter gives you 15 more days.
3. Technical denial. If records still do not arrive, a technical denial letter follows, with payment agreement instructions due in 60 days.
4. Review. Once records arrive, the review is completed within 45 days, and a preliminary findings letter lists any claims with findings.
5. Dispute. You have 30 days from the preliminary findings letter to dispute, with added records.
6. Final findings. With no dispute, a final findings letter follows, with payment due in 60 days.

Illinois also tells providers not to make payment adjustments after the RAC audit letter arrives. Mississippi’s FAQ (July 2019) gives 30 calendar days to send records, sends a reminder after that, and issues a demand letter if records are still missing after 45 days.

How to appeal a RAC finding

Federal rules make every state give providers appeal rights under state law or administrative procedures (42 CFR 455.512). The path looks different in each state:

• Illinois. Start with a dispute to the RAC within 30 calendar days of the preliminary findings letter, explaining which findings you contest and adding the records that support you.
• Mississippi. File a rebuttal request with the RAC, one form for each automated audit issue or each complex review decision (rebuttal request form). If you are still not satisfied, request an administrative hearing (FAQ, July 2019).
• North Carolina. An adverse Medicaid determination is appealed as a contested case at the Office of Administrative Hearings. The general deadline to file is 60 days from notice unless another law sets a different one (G.S. 150B-23). You carry the burden of proof, and the office must decide within 180 days of filing (G.S. 108C-12).
• New York. The RAC sends a preliminary findings letter or draft audit report listing each claim line, and you may answer it with more records before the final audit report. If the findings stand and you agree, you can repay by check, by voiding or adjusting the claims, or through an offset or withhold of future payments.

To work an appeal, follow these steps:

1. Read the letter closely. Note whether the review was automated or complex, which claim lines it lists, and every deadline.
2. Sort the claims. Agree on the ones that really were wrong. Dispute only those your records can prove.
3. Send records made at the time of the ride. Do not add to an old record. Explain any gap in a cover letter instead.
4. Ask how collection works during the dispute. In some states money keeps coming out of your payments while you appeal. See Medicaid recoupment.
5. Escalate on time. If the RAC upholds its finding, request the state hearing before its deadline. The claim appeal guide covers building the evidence file.
6. Fix the cause. A duplicate found by a RAC usually points to a billing process that will repeat it. See Medicaid program integrity for the other offices that may follow up.