RAC Audit Targets for Skilled Nursing Facilities

Skilled nursing facilities face an audit program run by contractors who identify improper payments for recovery, one that has grown from a modest pilot into a recovery machine pulling in over $2 billion in fiscal year 2021 alone, and SNFs are at the very top of the list of care settings drawing scrutiny. This piece walks through what auditors actually target when they open a claim file, why those specific areas recur, and what a facility can build now to stay ahead of the next request letter.

RAC audits are post-payment reviews carried out by private contractors that CMS authorizes and pays on contingency: the contractor's fee comes out of whatever it recovers (or, less often, whatever underpayment it identifies and returns). That contingency structure matters: it gives contractors a direct financial stake in finding errors, which is part of why the program has scaled so fast. From $75.4 million recovered in fiscal year 2010, the program jumped to $797.4 million in fiscal year 2011, then to $986.2 million in just the first six months of fiscal year 2012. Contractors generally reach back about three years from a claim's pay date, and they review claims by episode of care rather than in isolation, so a single admission can pull several claims into one review at once.

The contractor landscape shifted again on April 28, 2025, when CMS awarded Cotiviti GOV Services LLC the new RAC contracts for Regions 3, 4, and 5. Cotiviti was expected to start active reviews in summer 2025, while Performant stays on for administrative and appeals functions tied to Region 5. According to Alicia Cantinieri of Zimmet Healthcare Services Group, speaking to Skilled Nursing News, audit request volume is heavy right now, with contractors concentrating on claim years 2022 and 2023 and moving forward from there.

None of this is happening in a vacuum. National improper payment rates for nursing homes climbed from 7.79% in 2021 to 17.2% in 2024, and per Cantinieri, SNF errors still lead every other care setting tracked. That is not a blip in the data, it is a trend line, and it is feeding a broader CMS effort to root out fraud, waste, and abuse across post-acute care. Skilled nursing facilities are the focal point of a structural escalation in how closely Medicare payments get checked after the fact, not a temporary tightening cycle. They are the focal point of a structural escalation in how closely Medicare payments get checked after the fact.

PDPM coding and medical necessity: the highest-stakes target in the current audit cycle

The payment model tied to patient characteristics replaced the old RUG-based system in October 2019, and a federal oversight office has since built a formal audit series (SRS-A-25-010) asking one blunt question: do payments made under that model actually match what Medicare requires? The answer, at least at the first facility reviewed, was not encouraging.

The Pinnacle audit, first in that OIG series, found noncompliance in 99 of 100 sampled claims. Overpayments in the sample totaled $1.1 million for calendar years 2020 through 2021, and OIG extrapolated that number across the facility's full claim population to estimate at least $31.2 million in overbilling. Ninety-nine out of a hundred is not a sign of one bad coder or one bad month. It points to something systemic in how the facility's documentation supported (or failed to support) its billing.

OIG identified three recurring problems at Pinnacle. Medical records did not support the reimbursement rate code the facility had assigned. Some services went to residents who did not actually need skilled nursing care. And some claims simply did not meet Medicare's documentation requirements, full stop. Three different failure points, but they all trace back to the same root: what is written in the chart didn't match what was billed.

The full SRS-A-25-010 series covers eight projects total, with announcements rolling out between June 2025 and April 2026, meaning Pinnacle is the first of multiple facilities that will work through the same review process. This is a program, with a schedule, working through facilities one at a time, not a one-time enforcement action against a single bad actor. It is a program, with a schedule, working through facilities one at a time.

Alyssa Friedman, a partner at Abrams Fensterman and a former Medicaid fraud prosecutor, told McKnight's that current regulatory attention also lands on SNFs billing high-intensity services for younger residents with severe behavioral health or mental illness diagnoses, along with facilities that appear to overuse intravenous therapy. Those are narrower slices of the PDPM universe, but they follow the same logic as the Pinnacle findings: high-dollar codes draw high-dollar scrutiny. At Pinnacle, 99 of 100 claims reviewed had some kind of documentation issue. If that ratio holds anywhere close to true at the next handful of facilities in the series, documentation gaps aren't the exception at those SNFs, they are close to the rule.

MDS accuracy: how a single coding inconsistency becomes the audit trigger

PDPM payment starts with the Minimum Data Set (MDS) assessment, and the whole payment calculation only works if that assessment actually reflects the patient sitting in the bed. Inaccurate coding on the MDS is one of the most direct paths to an overpayment finding, because everything downstream, the rate code, the reimbursement level, the case-mix classification, gets built on top of it.

CMS has gotten more aggressive about comparing MDS data directly against the clinical record to catch mismatches. RAC and UPIC review priorities now overlap heavily with SNF data validation work, especially around therapy minutes, the clinical justification for skilled nursing, and Section GG functional scoring. The common denial drivers appearing in reviews aren't dramatic. Missing certifications. Clinical notes that are too thin to support the code billed. MDS entries that don't line up cleanly with the chart. None of that necessarily rises to fraud, but it produces the same improper payment finding either way.

In September 2025, CMS launched something new: the SNF Validation Program, the first audit process built specifically to check whether MDS data matches the underlying clinical record. Healthcare Management Solutions, LLC (HMS) runs the program. Starting in fiscal year 2026, CMS randomly selects up to 1,500 SNFs a year for review. Each selected facility has to submit documentation for up to 10 MDS assessment records, and the turnaround window is tight: 45 calendar days from notice to submission.

January 1, 2026 marked the official start of the SNF VBP Data Validation Process, and by mid-January CMS had begun uploading selection notices into iQIES for the facilities chosen. Missing the response window brings a consequence beyond a denied claim. A SNF that fails to respond receives a non-compliance notification and takes a 2% cut to its Annual Payment Update the following fiscal year. That is a facility-wide payment penalty triggered by a paperwork failure, not a billing dispute.

The measures under validation right now include the percentage of residents with falls causing major injury, the pressure ulcer and pressure injury rate, Drug Regimen Review with follow-up, Discharge Function scores, Discharge to Community rates, and Transfer of Health Information. MDS accuracy is the engine driving PDPM payment integrity, and everything covered in the next two sections, consolidated billing and stay eligibility, sits downstream of whether that engine is running clean.

Consolidated billing: when separately billed services become an overpayment

Section 4432(b) of the Balanced Budget Act sets a simple-sounding rule with complicated edges: a SNF has to submit all Medicare claims for all services its residents receive during a covered Part A stay, with a short list of specific exceptions. Physical, occupational, and speech-language pathology therapy also gets bundled into the SNF's billing even during non-covered stays, which surprises facilities that assume the bundling rule only applies to Part A coverage periods.

The exceptions matter as much as the rule. Physician professional services and certain other services listed in the Medicare guidance (sections 20.1 through 20.3) stay excluded from the bundle. Get the classification wrong in either direction, treat an excluded service as bundled or a bundled service as excluded, and it produces an error either way.

RAC Region D, run by HealthDataInsights, has SNF consolidated billing on its CMS-approved list of audit issues, and RAC Region B carries the same issue as a current approved target, according to reporting from RACmonitor. The scrutiny doesn't stop at the SNF's own claims either. Vendors, outside therapy groups, durable medical equipment suppliers, that bill Part B items separately when those services should have run through the SNF's consolidated bill can get pulled into the same audit. The facility is the primary target, but the review can reach outward to its suppliers.

Andrew Wachler, managing partner at Wachler & Associates, points to two situations as the most common consolidated-billing flashpoints: residents who didn't actually meet Medicare Part A eligibility requirements, and therapy that wasn't medically necessary in the first place. A vendor contract that looks completely routine on paper, the outside therapy group the facility has used for years, the equipment supplier down the road, can turn into an overpayment finding fast if nobody at the SNF has mapped that relationship against the bundling rules recently.

Qualifying hospital stay and therapy documentation: eligibility and time-based billing under review

Before any biller gets near a rate code, Medicare Part A coverage for a SNF stay depends on a threshold fact: did the resident have a qualifying inpatient hospital stay of at least three consecutive calendar days beforehand? Admission and discharge dates need to be documented and verified right at the point of SNF admission, and auditors check this before they even get to the more complex billing questions. It's the gate everything else walks through.

That documentation has to be sitting there, ready to produce, not reconstructed after the fact. Therapy documentation follows a similar logic on the other side of the stay: records of therapy services and time need to actually support whatever reimbursement rate code got billed. Under the old RUG-based system, that meant checking minutes against RUG thresholds directly. PDPM changed the mechanics, but auditors still look hard at therapy time records, since PDPM assessments still reference functional and therapy categories that trace back to how much therapy actually happened.

For legacy claims still inside the three-year lookback window, heavy use of high-intensity RUG levels is a pattern that draws closer scrutiny from auditors reviewing legacy claims. Facilities with that utilization pattern in their claim history benefit from reviewing the underlying records proactively rather than waiting for a request letter to show up.

Missing or late-filed physician certification of the need for skilled care recurs as a denial driver across the reviewed claims. What's notable across this section is that eligibility and therapy-time failures usually aren't intentional upcoding. They're procedural lapses, a date not logged, a certification signed a week too late. But procedural lapses and intentional upcoding produce the exact same financial exposure on the back end, and eligibility gaps happen to be some of the easiest errors for automated claims analysis to catch, since they appear in structured data fields rather than buried in narrative notes.

Related-party cost reporting and other OIG financial reviews targeting SNF cost reports

Cost reports open up a different kind of exposure. OIG reviews Medicare payments made to related parties under a standard rule: the allowable cost to the SNF should equal the related organization's actual cost, and it should not exceed what comparable services, facilities, or supplies would cost if purchased from an unrelated party in the open market.

Incomplete or inaccurate related-party disclosures distort allowable costs in ways that produce compliance findings on their own, independent of anything happening at the claims level. OIG has found SNFs that overstated allowable costs by failing to properly identify or adjust for related-party transactions, with extrapolated overpayment estimates reaching into the millions.

Beyond related-party issues specifically, OIG's active workplan for nursing homes covers several other financial review areas beyond related-party transactions, spanning billing accuracy, reimbursement integrity, and cost-report compliance. Thirteen active OIG workplan items currently target nursing homes, some running since 2023 and carried forward into the 2024 through 2026 review cycles.

What does this mean for a facility with a complicated ownership picture? A SNF tied to a management company, a related real estate entity, a therapy subsidiary under common control, carries layered cost-report risk that a claims-level compliance program alone simply does not reach. Fixing MDS accuracy and PDPM coding doesn't touch a related-party cost misstatement sitting three layers deep in the annual cost report.

Staffing data and quality measures: two newer audit vectors that extend beyond billing

Payroll-Based Journal data, the direct care staffing hours nursing homes electronically submit to CMS every quarter, has become its own audit target. OIG set out to check whether reported hours are accurate and whether they actually meet regulatory staffing ratios. Findings expected in 2025 ended up published in June 2026 instead, but the delay doesn't change the direction: staffing hours submitted quarterly are now something CMS checks against reality, not just data it collects and files.

Quality-of-care measures sit alongside PBJ as a second newer front. OIG's active workplan includes falls with major injuries and antipsychotic medication use, both its prevalence and any negative impact, along with reporting accuracy for long-term care beneficiaries. Falls got added to the workplan in 2024 and both items remain active through the 2025 and 2026 review cycles.

Notice how these connect back to earlier sections. Falls with major injuries and Drug Regimen Review with follow-up are both measures the SNF Validation Program is checking against clinical records right now. A discrepancy caught in a validation audit doesn't necessarily stay contained to that one program. It can open a broader OIG inquiry that reaches into staffing data or quality reporting.

Staffing and quality reporting errors aren't billing errors in the traditional sense. Nobody is upcoding a rate. But they carry real reimbursement consequences, Annual Payment Update reductions, adjustments tied to a quality-linked payment model, and they can flag patterns that pull claims-level auditors in for a closer look. The audit perimeter for SNFs has widened. Reviewers now cross-reference payroll data, quality measures, and MDS submissions against each other, looking for the places where the numbers don't agree, extending well beyond claims and cost reports. They're cross-referencing payroll data, quality measures, and MDS submissions against each other, looking for the places where the numbers don't agree.

What the appeal rate reveals about unfiled challenges

Providers win most appeals that are filed, yet few denials are ever appealed. Per 2019 CMS data, providers won 56% of appeals at the first level, Medicare Administrative Contractor redetermination, 33% at the second level of review, and 37% at the third level of review before an administrative hearing officer. Providers who appeal, in other words, win more often than they lose at the very first stage.

Now consider what the other side of the picture shows. Andrew Wachler of Wachler & Associates has noted that only 22.5% of cases in the RAC demonstration project were ever appealed. Most denials that got challenged were overturned, and most denials never got challenged at all. That gap between the win rate and the appeal rate is where a lot of recoverable money quietly disappears, uncontested, simply because nobody filed the paperwork.

Timing complicates this further. UPIC appeals run on a tighter clock than other contractor types, 30 calendar days instead of the 45-calendar-day window other contractors allow. Missing that window ends the right to appeal, no matter how strong the underlying case would have been.

None of this works without a structured internal response protocol: knowing immediately which contractor sent the request, which appeal level applies, and exactly when the clock runs out. That is not optional back-office process. A valid denial that gets challenged can be overturned; a valid denial that gets written off simply because the deadline slipped past unnoticed cannot.

Building a compliance posture that addresses what auditors look for

The broader pattern across all of these audit vectors points in the same direction: proactive compliance systems protect reimbursement and reduce denial exposure, but only if internal communication actually supports the documentation being produced. Monitoring iQIES daily for notifications isn't an extra step, it's baseline operational hygiene at this point, given how much is now flowing through that system.

Each risk area covered above maps to a specific internal control. For MDS accuracy: quarterly mock MDS audits, cross-checking assessments against the clinical record before submission, and assigning someone specific to watch iQIES Provider Preview Reports rather than hoping someone notices. For PDPM coding: reviewing medical records prospectively for the factors that actually support a given rate code, instead of only catching problems after the claim has already gone out. For consolidated billing: mapping every vendor and therapy contract against the bundling rules so nobody is guessing which services are excluded. For qualifying stays: building a verification checklist directly into the admission workflow, so the three-day stay requirement is verified on day one, not discovered missing during an audit two years later. For related-party cost reporting: disclosing every related-party transaction and keeping documentation on hand showing that prices charged don't exceed what an unrelated party would have charged for the same service. For PBJ staffing: validating submitted hours against actual payroll records before, not after, each quarterly submission goes out the door.

Routine internal audits do a lot of the heavy lifting here, and facilities without the internal bandwidth to run them consistently benefit from an outside partner with real depth in skilled nursing regulatory work. What should that external relationship actually look like? Familiarity with PDPM mechanics, MDS coding, consolidated billing exceptions, the structure of SNF cost reports, and the particular contractual landscape of whichever RAC region the facility sits in. This is a narrow, specialized regulatory environment. A general healthcare billing review, however thorough, is not built to catch what a facility-specific SNF review catches, because the rules governing PDPM, MDS validation, and consolidated billing don't resemble the audit logic used anywhere else in healthcare billing.