RAC Audit Target Areas for Physician Practices in 2024 and 2025

Recovery Audit Contractor activity in 2024 and 2025 is not scattered or random. It follows a published list of approved topics, and a physician practice that tracks that list can see most of its exposure coming before a single chart gets pulled.

How RAC audits work

The RAC program was written into law by the Tax Relief and Health Care Act of 2006, and it runs continuously. There is no season when it is active and no season when it isn't: any practice billing Medicare sits inside its reach at all times, on a rolling three-year lookback from the date each claim was paid. Reviews come in three forms. Automated review needs no medical record at all: the billing data alone is enough to flag an error. Semi-automated review starts with the data, but it can escalate to a record request. Complex review requires the full chart from the start. All three exist because CMS pays RAC contractors on contingency: a RAC collects a share of whatever improper payments it identifies. This one fact shapes almost everything about how these audits run. A contractor paid this way has a direct financial reason to chase the claim types that produce the most recoverable dollars per hour of review, so high-volume codes and high-reimbursement procedures draw more attention than one-off anomalies buried in a small practice's claim history. Auditors paid a salary have no comparable stake in the outcome of any single file; auditors paid on recovery do. RACs also do not operate alone. Medicare Administrative Contractors, a federal oversight office, Program Safeguard Contractors, and the Supplemental Medicare Review Contractor, run by a separate contracted vendor, all conduct their own reviews at the same time, on the same claims pool. A practice can face more than one of these bodies at once over the same billing pattern.

How CMS selects and publishes approved RAC audit topics

RAC contractors don't pick claims to review by instinct. They run proprietary software against Medicare's claims data to surface billing patterns, and if the error rate is high enough to justify the cost of a review, CMS approves it as a legitimate audit target and puts it on the public record. The CMS Approved RAC Topics page and the Proposed RAC Topics page are both updated on an ongoing basis, and together they tell a practice, in plain terms, what the federal government has decided is worth looking for right now. That list, alongside the OIG Work Plan, works as an early-warning system, but most practices underuse it. A practice that reads both documents every quarter and checks its own claim mix against what's listed carries a fundamentally different risk posture than one that only learns it's a target when an additional documentation request arrives in the mail. The first practice can fix a documentation gap before it becomes a pattern across hundreds of claims. The second is already explaining a pattern after the fact. The sections that follow walk through the specific topics CMS has approved for active review in 2024 and 2025, and what each one demands of a practice's documentation.

Evaluation and management coding levels as the highest-volume RAC target for physician practices

No approved topic touches more physician practices than evaluation and management coding. E/M services sit at the center of nearly every specialty's billing, and the reason RAC software keeps returning to this category is structural: a practice that routinely bills high-level E/M codes across a large share of its visits produces exactly the kind of statistical outlier that automated review tools are built to catch. The errors auditors find tend to come from three specific documentation habits. One is charting-software cloning, where exam findings get copied from a prior visit into a new note, making the encounter look more clinically complex than the actual visit supports. Templates that auto-populate can also generate a higher code level than the encounter justifies. A third is automatically generated patient histories that read as more thorough than the exam that actually happened. Each of these is a shortcut built into modern charting software, and each leaves a documentation trail that doesn't match the billed code.

A leading physician trade association has pushed back on how these audits get conducted, and the objection deserves a hearing. Choosing an E/M level involves physician judgment about the complexity of a given visit, and RAC reviewers are not required to be the same specialty as the physician whose chart they're reviewing. A cardiologist's assessment of a complex visit may not read the same way to a reviewer without cardiology training, and the AMA has flagged that mismatch as a real risk to fair review. That objection hasn't gone away even as the E/M coding framework itself has changed over time. Still, the practical reality for a billing office doesn't change because the objection is valid: the audits are happening, and documentation that clearly supports the level billed is the only defense that holds up regardless of who reviews it. A practice doesn't get flagged because one chart looks wrong. It gets flagged because several physicians in the same group consistently land on the highest available code, and that pattern, not any single visit, is what trips the review.

Annual wellness visits and preventive service codes as an active 2024–2025 approved RAC target

CMS has an approved topic open right now that targets annual wellness visits and initial preventive physical examinations, built around three specific codes: G0402, G0438, and G0439. The problem driving this review is frequency. Medicare allows each of these services only under specific timing rules, and CMS has confirmed that practices are billing them outside those windows often enough to justify active review. G0438, the initial annual wellness visit, is billable only once in a patient's lifetime. G0439, the subsequent annual wellness visit, cannot be billed within twelve months of a prior AWV. If you get either of those rules wrong, even by a few weeks, the claim turns into a clean, rule-based error, so automated review can catch it without a human touching the chart.

There's a second layer to this review that practices tend to miss. Lab work ordered during a wellness visit, vitamin D testing being a common example, has its own separate medical necessity requirements, apart from whatever justified the visit itself. A RAC reviewing an AWV claim will also check whether the ancillary tests billed alongside it met their own coverage criteria, so a clean wellness visit code can still generate an overpayment finding if the attached lab order wasn't medically justified on its own terms. This target area carries a particular kind of exposure for primary care and internal medicine, where wellness visits run through high-volume, repeatable workflows. If a scheduling or coding error affects one patient, it rarely stays isolated. The same template, the same front-desk process, and the same billing rule get applied across hundreds of similar visits, and a single systemic mistake multiplies into audit exposure that looks much larger in aggregate than any one claim would suggest.

Kyphoplasty, vertebroplasty, and anesthesia for chronic pain injections as targeted specialties in 2024–2025

Interventional pain management has its own active front. Performant Recovery, Inc., the RAC contractor covering Regions 1 and 2, has been sending additional documentation requests to pain practices over kyphoplasty and vertebroplasty claims. The local coverage determination governing these procedures spells out a specific, numeric pain threshold a patient must meet before the procedure counts as medically necessary, and that is where the vulnerability sits. For a non-hospitalized patient, the documented pain score must be five or greater on the NRS or VAS scale. For a hospitalized patient, the threshold rises to eight or greater. These are fixed numbers, and an LCD written this specifically becomes, in practice, a checklist a reviewer can run down line by line. If the chart doesn't contain a documented score that clears the threshold, the claim is a recoverable overpayment regardless of whether the procedure itself was clinically appropriate.

Anesthesia billed for chronic pain injections, epidural steroid injections and facet blocks among them, is drawing the same kind of attention through a different mechanism. At least one anesthesia group has already gone through a Targeted Probe and Educate audit, triggered specifically because of a high volume of anesthesia claims attached to these pain blocks. The Medicare Administrative Contractor's position in that case was that payment for anesthesia alongside these procedures is questionable under the governing LCDs, and the volume of billing itself, not any individual chart, was what triggered the review. What ties kyphoplasty, vertebroplasty, and pain-block anesthesia together as targets is the same combination every time: high reimbursement per procedure, a local coverage determination with specific necessity criteria built into it, and a documentation burden that practices meet inconsistently across their patient population. None of this points to intentional misbilling. It points to a documentation standard that is easy to miss and expensive to miss repeatedly.

Peripheral vascular procedures in office-based labs as a 2026 dual-front enforcement action with roots in 2024–2025 billing patterns

The newest and fastest-moving target area involves peripheral vascular procedures performed in office-based labs, and you can trace it directly back to billing patterns that built up through 2024 and 2025. The structural driver is reimbursement design: physician payment for a vascular procedure performed in an OBL runs higher than the physician-only, facility-rate payment for the same procedure in a hospital outpatient department. Total Medicare spending per procedure is often still higher in the hospital setting once you add in the separate facility fee, but that combined figure doesn't change what the individual physician faces when deciding where to perform the case. A federal oversight office looked at who was using OBLs most heavily and found a specific pattern among a subset of high-volume practitioners: these physicians treated more than four times the average number of Medicare patients and performed double the average number of procedures per patient. That ratio alone is enough to flag a practitioner for review, independent of whether any individual procedure was clinically warranted.

What makes this moment different from the specialty-specific targeting already underway is that two enforcement mechanisms landed on the same group of practitioners at once. The OIG's referral and the RAC program's expansion of approved catheter placement topics happened in parallel. Vascular surgeons, interventional cardiologists, and interventional radiologists working in OBLs are now facing scrutiny from two federal review bodies simultaneously, each working from its own data and its own authority. Primary care practices sit downstream of this, even when they don't perform the procedures themselves. Patients with peripheral artery disease or diabetes-related vascular complications usually show up in a primary care office first, and federal reviewers are now asking whether conservative treatment was attempted and documented before a referral for intervention occurred. That question reaches back into primary care charts even when the procedure happened somewhere else. The OIG's recommendation in response to its own findings was monitoring. The incentive that created this pattern in the first place is still in place, which is a reasonable basis to expect audit pressure in this area to continue rather than taper off.

RAC audit software and high-risk billing patterns

Every target area covered above gets found the same way: through software that scans claims data across an entire population of providers before any single claim is pulled for review. The audit starts with an aggregate pattern, not an individual chart, and the categories RAC software is built to flag are consistent across the program, covering duplicate payments, fiscal intermediary errors, medical necessity questions, and coding accuracy. A handful of specific patterns occur across nearly every approved topic area. Upcoding is the most direct: a practice that routinely bills the highest available code within a category, whether that's an E/M level, a procedure code, or a preventive service code, stands out against the regional and specialty peer average that RAC software measures everything against. Billing volume itself is a second pattern: procedure counts or visit frequencies well above what peers in the same specialty and region report, the same signature the OIG found among high-volume OBL practitioners. Modifier use is a third: consistent application of modifier 25 or similar modifiers that expand reimbursement becomes visible as a pattern once the same modifier appears on a high share of same-day procedure claims. A fourth is medical necessity mismatch, where the service or the setting billed doesn't line up with the severity of the condition documented in the chart, a pattern that runs through everything from wellness-visit lab orders to kyphoplasty pain scores to OBL referral decisions.

Common RAC triggers converge on five categories: upcoding and coding errors, lack of medical necessity, insufficient documentation, duplicate or unwarranted billing, and irregular billing patterns generally. In 2025, Medicare auditors leaned further into AI tools, so they can now process claims volume at a scale no manual review team could match, and the population-level pattern detection described throughout this piece is getting faster and more precise, not slower. A practice that wants to see its own risk profile before a RAC does should ask the same questions the software asks: does our E/M distribution skew high against our specialty peers, does our AWV billing respect the frequency rules tied to G0402, G0438, and G0439, does our modifier use look consistent with the volume of same-day procedures we bill, and does our documentation, chart by chart, actually support the code level attached to it. Those four questions cover most of what CMS has already told the industry it's looking for.