Skip to Main Content

Part D RAC Audit Process

The CMS Center for Program Integrity (CPI) serves as CMS' focal point for all national and state-wide Medicare and Medicaid programs and CHIP integrity fraud and abuse issues. Identifying and preventing improper payments in Medicare Parts C and D is central to that work. CMS/CPI manages the Medicare Part D RAC program as a component of that goal.

This page will assist you in understanding the audit process. On this page we address:

There can be as many as nine steps to complete an audit. See below for a graphical display of the process. Click to enlarge: Infographic Audit Process [PDF, 951KB]

 RAC Audit. The Part D RAC identifies underpayments and overpayments and recoups overpayments. Step 1. The RAC obtains the audit scope and documentation. Step 2. The RAC reviews the prescription drug event records or other required data. Step 3. 60-90 days. The RAC issues a request for information, if applicable. The Plan Sponsor action required. Step 4: the RAC prepares the improper payment review package. DVC Validation. The DVC is an independent reviewer who ensures overpayment determinations are accurate and unbiased. Step 5. The DVC performs data analysis. Step 6. The DVC creates a validation findings file. Step 7. The DVC collaborates with the RAC if the RAC rejects the DVC’s findings. RAC Notification. Step 8. The RAC sends Notice of Improper Payment. The Plan Sponsor Action required. Step 9. The RAC refers potential Fraud, Waste and Abuse to the National Benefit Integrity Medicare Drug Integrity Contractor, if applicable.

What are the roles and responsibilities of a Part D Recovery Audit Contractor?

RAC Icon

The Part D RAC employs a model similar to the one used in the Medicare Parts A and B RAC program to audit Part D plan sponsors. The Part D RAC:

  • Reviews previously paid individual Medicare claims (prescription drug events) to sponsoring organizations and pharmacies to determine overpayment and underpayment
  • Provides information to CMS to help prevent future improper payments
  • Refers any potential fraud findings identified during the auditing process to the Medicare Drug Integrity Contractor.

RACs are paid on a contingency basis. They only collect payment improper payments recovered by CMS. Sponsors may appeal RAC findings (see the Part D RAC Appeals section). Should a sponsor appeal a RAC finding, the RAC will not receive payment until the appeal process has been completed and the audit finding upheld.

What are the roles and responsibilities of a Part D Data Validation Contractor?

DVC Icon

In order to ensure the integrity of the Part D Recovery Audit Contractor (RAC) program, CMS has implemented a Data Validation Contractor (DVC) program. Through the DVC, CMS is able to perform an important, independent quality check that:

  • Confirms the RAC's improper payment findings
  • Measures the RAC's accuracy rate

Specifically, the DVC analyzes PDE records identified by the RAC to contain improper payments. Results that both the RAC and DVC concur on are considered validated. For those RAC findings the DVC disagrees with, the DVC must provide a rejection reason and explanatory comments, including their recovery calculations. The RAC may either accept or reject the DVC's analysis findings. If rejected, the DVC must collaborate with the RAC to attempt resolution. CMS is the final decision maker to resolve disagreements on improper payment findings between the Medicare Part D DVC and RAC.

Further, the DVC must validate the RAC's improper payment findings before the RAC is permitted to actively pursue overpayments from sponsors.

Audit Process: Steps and Responsibilities

One

Step 1: The RAC Obtains Audit Scope and Documentation

CMS/CPI determines the specific criteria on which the Part D RAC must review audit packages. To direct the RAC's review, CMS/CPI mandates review of files that fall within a particular year and contract for a particular plan. CMS/CPI further defines the audit scope to include the exact audit issue to be reviewed. Additional audit topics may be proposed to reflect results of studies that have been highlighted as problem areas by the U.S. Department of Health and Human Services (HHS), the HHS Office of the Inspector General and the U.S. Government Accountability Office.

CMS further defines the audit scope to include the level of review required, complex or automated, as defined below:

Automated Review: A review completed based upon available PDE records where approved processes are considered to be acceptable without further review of prescription or other documentation.

Complex Review: A review determined to require response to a Request for Information (RFI) from the plan sponsor to adequately validate compliance with CMS policy and applicable laws. RFIs may include requests for prescriptions, prior authorizations or other documentation as required to address the specific issue under audit.

Two

Step 2: The RAC Reviews PDE record or other required data

The Part D RAC employs proprietary automated review software algorithms to review all PDE records and identify overpayments and underpayments.

Three

Step 3: The RAC Issues Request for Information (if applicable)

The Medicare Part D RAC will allow the plan sponsor a period of 60 or 90 days (90 days if prescriptions are requested) to provide additional information to refute all or some of the RAC’s findings. The RAC will not factor into the improper payment calculation any documentation it receives after this timeframe, and the RAC will render a decision based only on the data and the PDE records that plan sponsors submit during the appropriate timeframe. Once the RAC finalizes a decision and the DVC validates and concurs with this decision, plan sponsors will receive a Notification of Improper Payment (NIP).

Four

Step 4: The RAC Prepares Improper Payment Review Package (IPRP)

An Improper Payment is defined as any payment to the wrong provider for the wrong services or in the wrong amount. The IPRP contains the audit issue, audit year and contract number along with supporting documentation identifying the impacted PDE records that support improper payment findings.

Five

Step 5: The DVC Performs Data Analysis

In order to ensure the integrity of the Part D Recovery Audit Contractor (RAC) program, CMS has implemented a Data Validation Contractor (DVC) program. The DVC is an independent reviewer to protect the integrity of the Medicare Part D RAC program and ensure that improper payment determinations are accurate and unbiased before issuing the NIPs to plan sponsors. The DVC is also responsible for measuring the Part D RAC’s accuracy rate on CMS’ behalf.

Six

Step 6: The DVC create validation findings file

For those RAC findings the DVC disagrees with, the DVC must provide a rejection reason and explanatory comments, including their recovery calculations. Further, the DVC must validate the RAC's improper payment findings before the RAC is permitted to actively pursue overpayments from sponsors.

Seven

Step 7: Resolve DVC/RAC disputes

The Medicare Part D DVC and the RAC collaborate to resolve differences. In the event that the DVC disagrees with RAC’s findings, they reject them. In this case, the RAC may either accept or reject the DVC’s decision. If rejected, the DVC must collaborate with the RAC to attempt resolution. CMS is the final decision maker to resolve disagreements on overpayment findings between the Medicare Part D DVC and RAC.

Eight

Step 8: The RAC sends Notification of Improper Payment (NIP)

If a plan sponsor receives a Notification of Improper Payment (NIP), the Medicare Part D RAC has determined an overpayment to the plan sponsor. The NIP indicates the audit issue being reviewed, the applicable laws, the amount of the overpayment, how it was calculated and the plan sponsor’s appeal rights. The Improper Payment Exception Report, an encrypted file sent with the NIP, will include the PDE records associated with the identified improper payment.

CMS will make an interim adjustment to the plan sponsor’s monthly payment in the amount owed, which the Plan Payment Report will reflect after the 45-day accept/reject period for CMS Administrator Review requests. It is the responsibility of the plan sponsor to delete the PDE records identified in the Improper Payment Exception Report to correct any errors identified by the RAC within 90 days of the NIP or final appeal decision.

If the affected PDE records are deleted within the required timeframe, the interim adjustment will be credited back to the plan sponsor.

The NIP provides the Part D RAC’s contact information, including a phone number and e-mail address for specific questions about the overpayment determination. If the plan sponsor disagrees with the overpayment determination, they have the right to appeal. (See Appeals Process for more information.)

Nine

Step 9: The RAC refers potential Fraud, Waste and Abuse to the National Benefit Integrity Medicare Drug Integrity Contractor (NBI Medic) (if applicable)

The purpose of the National Benefit Integrity Medicare Drug Integrity Contract (NBI MEDIC) is to detect and prevent fraud, waste and abuse (FWA) in the Medicare Advantage (Part C) and Prescription Drug Coverage (Part D) programs on a national level. The contractors monitor and analyze various types of data to detect patterns of fraud, waste, and abuse across the country and to identify for further investigation plans, providers, and beneficiaries possibly engaged in such activities.