Medicare Medical Review: ADRs, TPE, and RAC Audits Explained

Published October 20, 2026

Medicare medical review is not a single audit program. CMS describes medical review as the collection and clinical review of medical records and related information to ensure that payment is made only for services that meet all Medicare coverage, coding, billing and medical necessity requirements. Depending on the review, a provider may hear from its Medicare Administrative Contractor (MAC), a Recovery Audit Contractor (RAC), the Supplemental Medical Review Contractor (SMRC), a Unified Program Integrity Contractor (UPIC) or another CMS reviewer.

Three terms come up repeatedly in provider operations: ADR, TPE and RAC. They are related but not interchangeable. An ADR is a request for records. TPE is a targeted MAC review-and-education process. A RAC audit is a post-payment review under the Recovery Audit Program, which looks for improper payments. Knowing which one you are dealing with determines the deadline, the contact and what can happen next.

An ADR is a request for documentation, not a type of audit

CMS says an additional documentation request is generated when documentation is necessary to support a Medicare claim, and that it is a request for medical record documentation to support payment of the items or services on the claim. CMS's Program Integrity Manual uses the term for all documentation requests associated with prepayment and post-payment review, and lists MACs, the CERT program, RACs, the SMRC and UPICs among the reviewers that issue them.

When responding, CMS calls it best practice to attach a copy of the ADR letter as the first page, so the documentation is matched to the right patient and claim. MACs accept records by mail, through esMD, through the MAC's provider portal, by fax, or on CD, DVD or USB, and reviewers are required to state in their ADR letters which submission methods they accept. Operationally, an ADR is a deadline-controlled documentation case: the team needs to know who requested the records, which claim is under review, exactly what was asked for, and when the response is due.

ADR response time depends on the reviewer

There is no single ADR deadline for every Medicare review. Under CMS's Program Integrity Manual (chapter 3, section 3.2.3.2), providers have 45 calendar days to respond to a MAC, RAC, SMRC or CERT request, whether the review is prepayment or post-payment, and 30 calendar days to respond to a UPIC. Contractors may accept documentation after those deadlines for good cause.

Missing the deadline is costly. Under federal rules, a claim can be denied when the requested documentation is not received, because the contractor has nothing to support payment. Capture the due date from the actual request rather than from a generic workflow, and track the submission evidence with it.

TPE is targeted review plus provider education

Targeted Probe and Educate is a MAC program aimed at providers and suppliers with high claim error rates or unusual billing practices, and at items and services with high national error rates. CMS's TPE page is blunt about its reach: most providers will never need TPE. MACs use data analysis to decide who is selected.

In a standard TPE round, the MAC reviews 20 to 40 of the provider's claims and supporting records. If it finds errors, it provides education, and the provider gets at least 45 days to make changes before another 20 to 40 claims are reviewed, for up to three rounds in total. For providers and suppliers with low billing volume, CMS runs a Low Biller Probe and Educate Program that reviews fewer than 20 claims per round, again for up to three rounds.

The "educate" part is the point. TPE is designed to find error patterns and correct future submissions, not just to deny the sampled claims, so results should be analyzed at the pattern level. CMS lists the most common TPE errors as a missing certifying-physician signature, encounter notes that do not support all elements of eligibility, documentation that does not establish medical necessity, and missing or incomplete initial certifications or recertifications. Fixing only the sampled claims misses the reason the program exists.

TPE can escalate if problems continue

Entering TPE is not the same as a fraud investigation or a RAC audit, but it can become more consequential. CMS says that problems that fail to improve after three rounds of education are referred to CMS for next steps, which may include 100 percent prepayment review, extrapolation, referral to a Recovery Auditor or other action. That is the strongest reason to treat a first TPE round as a process-improvement project rather than a claims dispute.

RAC audits focus on improper payments after the claim is paid

CMS's Medicare Fee-for-Service Recovery Audit Program exists to identify and correct improper payments, detecting and collecting overpayments and identifying underpayments to providers. RACs conduct both automated and complex post-payment reviews. Automated reviews happen at the system level; complex reviews require a qualified reviewer to examine the medical record, and to obtain it the RAC issues an ADR. The RAC contractors are currently Performant for Regions 1 and 2 and Cotiviti GOV Services for Regions 3 through 5, with Region 5 covering DMEPOS, home health and hospice nationwide.

Two limits shape every RAC audit. The look-back period is three years: under CMS's RAC statement of work, a RAC may not review a claim or identify an improper payment more than three years past the initial claim paid date, and it must wait at least 60 days after the claim was paid before sending an ADR. CMS also caps how many records a RAC can request. For institutional providers, the baseline annual limit is 0.5% of the provider's paid Medicare claims from a previous 12-month period, divided across eight 45-day cycles and adjusted over time by the provider's denial rate, with no requests more often than every 45 days. For physician practices, the cap depends on practice size, from 10 records per 45 days for the smallest practices up to 50 for practices with 50 or more practitioners, and CMS can authorize RACs to exceed it. DME suppliers have their own limit, set at 10% of paid claims by policy group.

An ADR does not automatically mean RAC

Because RACs use ADRs, teams sometimes treat the two as synonyms. They are not. MACs, the SMRC, RACs, UPICs and other Medicare contractors all issue additional documentation requests. Identify the contractor from the notice before deciding which process applies, because that determines the response instructions, deadline, contacts and possible next steps. A medical review queue should classify each case by both request type and reviewing entity.

The SMRC is another review pathway

CMS also uses a Supplemental Medical Review Contractor to conduct nationwide medical reviews of Medicaid, Medicare Part A and Part B, and DMEPOS claims, checking whether they follow coverage, coding, payment and billing requirements. The current SMRC, Noridian Healthcare Solutions, sends ADRs on claims selected for review and notifies CMS of any improper payments it identifies; the MAC may then adjust claims or recoup overpayments through the standard recovery process.

That is one more reason an article about "RAC audits" alone would be incomplete. Providers can face medical review that is neither a RAC audit nor TPE. The overarching category is Medicare medical review, and ADRs, TPE, RACs and the SMRC are different parts of it.

Documentation should answer the coverage issue, not fill pages

When an ADR arrives, the goal is not to send the largest possible chart. The response has to show why the billed item or service met Medicare's requirements. Depending on the service, that may mean orders, signed clinical notes, certifications, test results, treatment history, plans of care, procedure documentation or other records required by Medicare policy. The most common TPE errors (missing certifying signatures, eligibility not supported, medical necessity not established, missing certifications) are a good checklist for any ADR response. A strong response maps the issue under review to the supporting records and checks completeness before it is sent.

Track medical review as its own revenue cycle workflow

ADR and audit work should not be buried in ordinary claim follow-up notes. A structured record should capture the reviewing contractor, the program or review type, the claim and beneficiary, the request date, the response due date, the documents requested, the date submitted, the submission evidence, the determination, the amount at risk and any next-step or appeal deadline. When a reviewed claim comes back denied, CMS's standardized review reason codes and statements, which cover Part A, Part B and DME across prior authorization, prepayment and post-payment claim review and pre-claim review, help explain why.

The aim is to make every handoff reproducible. Someone taking over the case should be able to see what Medicare asked for, what was sent and when, and what happened next, without reconstructing the file. Claims that sit in review for weeks also tend to surface as a puzzling status in claim status follow-up; our explainer on what "pending medical review" means covers that side, and if a review ends in a denial you intend to contest, see our guide to writing an insurance appeal letter.

Medical review is a documentation test with financial consequences

ADRs, TPE and RAC audits all test whether the record supports what was billed, through different processes. An ADR asks for the documentation. TPE combines targeted review with education and repeated testing where needed. RACs examine paid claims for improper payments within a three-year look-back. The SMRC and UPICs add further review pathways.

Providers do not need to treat every review as the same event. They need a disciplined way to identify the reviewer, the deadline, the documentation requirement and the downstream consequence before they act.

FAQ

What is a RAC audit?

A RAC audit is a post-payment review by a Medicare Recovery Audit Contractor to identify improper payments, both overpayments and underpayments. RACs can review claims up to three years after the initial paid date, using automated reviews or complex reviews that require medical records requested through an ADR.

How long do I have to respond to a Medicare ADR?

Generally 45 calendar days for requests from a MAC, RAC, SMRC or CERT, and 30 calendar days for requests from a UPIC. Contractors may accept late documentation for good cause, but missing the deadline can lead to denial. Use the due date on the request itself.

What is a TPE audit?

Targeted Probe and Educate is a MAC review of 20 to 40 claims per round, followed by education, for up to three rounds. Providers get at least 45 days after education to make changes before the next round. Problems that persist after three rounds are referred to CMS for possible further action.

How many records can a RAC request?

CMS sets ADR limits by provider type. For institutional providers, the baseline is 0.5% of paid Medicare claims from a prior 12-month period, spread across 45-day cycles and adjusted by denial rate. For physician practices, the cap ranges from 10 to 50 records per 45 days depending on practice size.

Sources

All retrieved October 6, 2026.

Run a pilot on a real workflow.

Bring a representative batch, define the output schema, and validate ROI with your payer mix in 30 to 90 days.

Book a Demo
Superdial white logo
The communication layer for revenue cycle teams.
Workflows
Benefits Verification
Prior Authorization
Claim Status
Credentialing & Enrollment
Provider Data Management
Who We Serve
RCM Companies
Provider Groups
Orthopedics
Gastroenterology
Health Systems
Payers
Digital Health
Pharma
Company
Case Studies
Newsroom
Security
Blog
API Docs
Book a Demo
Careers