3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
Key Takeaways
- Medicare Administrative Contractors (MACs) process claims, apply coverage rules, and perform medical review for their jurisdiction, including short-stay patient-status reviews under Targeted Probe and Educate as of September 1, 2025.
- Recovery Audit Contractors (RACs) identify improper payments—overpayments and underpayments—often through automated claim edits or complex record review of approved issues.
- The Comprehensive Error Rate Testing (CERT) program draws a statistically valid sample to measure the national Medicare fee-for-service improper-payment rate; missing records count as errors and identified overpayments can be recouped.
- The HHS Office of Inspector General (OIG) is independent oversight: audits, evaluations, investigations, and a public Work Plan—not a day-to-day claims processor.
- Distinguish clinical-validation denials, medical-necessity or level-of-care denials, and DRG-downgrade determinations; each attacks a different claim element and needs a different record defense.
3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
Quick Answer: MACs process and review claims for a jurisdiction. RACs find improper payments to recover. CERT measures the national improper-payment rate from a random sample. The OIG independently audits and investigates Department of Health and Human Services programs. A denial that says “this diagnosis is not clinically supported,” a denial that says “this should not have been inpatient,” and a determination that says “the MS-DRG is too high” are three different problems.
Domain I asks CDI specialists to understand who is looking at the claim and what they are allowed to change. Treating every additional documentation request as “a RAC” produces the wrong appeal letter and the wrong internal fix.
Four roles, four jobs
| Body | Who it is | Core job | What a hospital typically receives |
|---|---|---|---|
| Medicare Administrative Contractor (MAC) | CMS’s geographic claims administrator | Processes Part A/B claims, applies national and local coverage rules, conducts medical review and provider education | Return-to-provider edits, additional documentation requests, Targeted Probe and Educate (TPE) rounds, redeterminations (first-level appeals) |
| Recovery Audit Contractor (RAC) | CMS recovery-audit program contractor | Identifies overpayments and underpayments on approved issues | Discussion-period notices, complex record requests, automated recoupments on clear claim-data errors |
| Comprehensive Error Rate Testing (CERT) | CMS improper-payment measurement program | Draws a statistically valid random sample to publish the national Medicare fee-for-service improper-payment rate (Payment Integrity Information Act reporting) | Record request on a sampled claim; failure to send records is an error; MACs recoup or repay what CERT finds |
| Office of Inspector General (OIG) | Independent watchdog inside HHS | Audits, evaluations, investigations; publishes a Work Plan; can refer matters for civil or criminal enforcement | Audit announcements, draft/final reports, investigative demands—not routine DRG grouping |
Keep Unified Program Integrity Contractors (UPICs) in a side note only: they investigate suspected fraud, waste, and abuse and are not the same as a RAC. This section’s four-way comparison is the CCDS Domain I set you were asked to master.
MAC, in practice
The MAC is the contractor that already pays the claim. It applies Local Coverage Determinations (LCDs) and national coverage rules, and it can review before or after payment. Since September 1, 2025, MACs—not Beneficiary and Family Centered Care QIOs—perform short-stay inpatient and patient-status reviews for acute care hospitals as part of TPE. A TPE letter about one-midnight chest-pain admissions is a setting conversation with the claims processor, usually in small claim samples with education between rounds. It is not an OIG investigation.
RAC, in practice
RACs exist because CMS wants a dedicated recovery function for improper payments. They work from approved issues and may use automated reviews (claim data alone) or complex reviews (medical record). Inpatient complex reviews commonly test patient status, MS-DRG validation, and high-cost diagnosis support. Historically, RAC findings of inpatient-versus-outpatient error were a reason CMS wrote the Two-Midnight Rule. A RAC change that removes an MCC and reassigns the family is often a DRG downgrade. A RAC change that says the entire stay should have been outpatient is a level-of-care denial. Read the determination letter before you write the query policy.
CERT, in practice
CERT is a measurement program. CMS samples claims submitted to MACs, requests records, and scores whether payment followed coverage, coding, and billing rules. The sample is designed to support a national improper-payment rate and contractor- and service-level rates. CERT is not a hospital-selected “gotcha” list, but a sampled error still can be recouped, and a high error rate in a service category informs later MAC and RAC focus. Insufficient documentation—including no record sent—is a classic CERT error category alongside medical necessity and incorrect coding. The operational CDI lesson is boring and important: know who stores the record and answer the CERT request on time.
OIG, in practice
The OIG does not assign MS-DRGs and does not publish relative weights. It reviews whether HHS programs, including Medicare, are vulnerable to waste or abuse. The public Work Plan is the advance notice of audit and evaluation topics. Inpatient themes that have appeared over the years include high-severity MS-DRG accuracy, inpatient care that belonged in a less intensive setting, and specific high-cost diagnoses. An OIG audit can lead to a report, a recommended refund, a corporate integrity agreement, or a referral under the False Claims Act. That pathway is not the same as a MAC TPE round. Later Domain VII sections return to DRG creep, the Work Plan, and false-claims risk; here, learn not to call a RAC letter “the OIG.”
Three denial patterns CDI must not conflate
| Pattern | What the reviewer accepts | What the reviewer rejects | Typical CDI / HIM defense |
|---|---|---|---|
| Clinical validation | That some hospital encounter occurred | That the diagnoses as coded are supported by the clinical picture (findings, treatment, course) | Indicators in the record, provider linkage, and a compliant query history—not a code that exists only as a label |
| Medical necessity / level of care | That some services may have been needed | That the inpatient setting (or the billed intensity) was reasonable and necessary | Two-Midnight expectation, hospital-level services, and a principal diagnosis that explains admission |
| DRG downgrade | That inpatient admission can stand | That the MS-DRG is correct—often after removing a CC/MCC, changing principal diagnosis, or applying exclusion-list logic | Coding guidelines, current CMS CC/MCC and exclusion tables, and clinical support for the remaining codes |
These patterns overlap in real letters. A contractor may say the malnutrition MCC is not validated and therefore the MS-DRG falls one tier. Classify the primary theory so the appeal attaches the right exhibits. A setting denial is not cured by a better MCC. A clinical-validation denial is not cured by a longer Two-Midnight paragraph. A downgrade that correctly applies Table 6K is not a “clinical” fight; it is a grouping fight you should have caught before billing.
HAC payment provision logic (claim-level CC/MCC stripping for selected conditions that were not present on admission) and the HAC Reduction Program (hospital-wide 1% cut for the worst Total HAC Score quartile) are not the same as these three denial patterns and are not taught here. If a letter mentions a HAC category, route it to those later rules instead of calling it a generic RAC downgrade.
Practices that attract all three letters
- Severity without a clinical home. A query response adds “acute respiratory failure” while gases, saturation, and oxygen therapy never match that diagnosis. Expect clinical validation and a DRG downgrade.
- Inpatient order without an expectation. The history and physical lists comorbidities and never states why medically necessary hospital care should span two midnights. Expect a MAC TPE or RAC status denial.
- Principal diagnosis that does not occasion the admission. Coding a high-weight condition that was incidental, while the after-study reason for admission was a short observation-level event, invites both setting and DRG-validation findings.
- Copy-forward problem lists. Yesterday’s resolved acute kidney injury is today’s unvalidated MCC.
- Ignoring exclusion-list pairings. A capture-rate dashboard that counts a neutralized CC as a success trains the program to be surprised at reconciliation.
- Treating CERT as optional mail. A sampled claim with no record is an improper payment in the national rate and a recoupment risk.
- CMI quotas. Section 3.2’s lesson becomes a compliance lesson here: a numeric CMI campaign is how leading queries and unsupported MCCs get written.
Scenario set
MAC TPE. A 64-year-old with noncardiac chest pain, negative serial troponins, and discharge before the second midnight is billed inpatient. The MAC samples similar claims, asks for records, and educates on Two-Midnight documentation. The fix is admission-status process, not an MCC hunt.
RAC complex review. A 78-year-old’s claim groups to a three-tier family with MCC based on severe protein-calorie malnutrition. The record has a one-line query answer and no nutritional assessment, no intake data, and no treatment plan that matches that severity. The RAC leaves inpatient status intact and removes the MCC. That is a DRG downgrade built on clinical validation.
CERT sample. A routine pneumonia stay is drawn in the national sample. Health information management cannot locate the discharge summary in time. CERT scores an insufficient-documentation error. No one “targeted” the hospital; the sample was random. The operational failure is still real.
OIG Work Plan. A public Work Plan item focuses on inpatient MS-DRG coding at the highest severity levels. The hospital’s internal audit samples MCC-tier charts for clinical validation and exclusion-list errors before a federal auditor does. That is risk reduction, not an admission of fraud.
How CDI should phrase the internal briefing
Name the contractor, name the denial theory, name the claim element under attack, and name the record pages that answer that theory. “We got audited” is not a root cause. “The MAC TPE round is challenging one-midnight inpatient orders without a supported two-midnight expectation” is a root cause. “The RAC accepted inpatient status and reassigned the family because the only MCC failed clinical validation” is a root cause. Programs that can say those sentences write better queries, better physician education, and better appeals—and they stop using CMI as a substitute for any of the three.
Which description correctly separates MAC, RAC, CERT, and OIG roles?
A contractor accepts that inpatient admission was appropriate but removes an MCC it finds unsupported and reassigns the claim to the with-CC MS-DRG. This is best classified as:
Which practice is most vulnerable to a clinical-validation denial?