Study guide
3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
Certified Clinical Documentation Specialist CCDS
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Eligibility Pathways and the 2,000-Hour Year 1.3 Allowed Resources and Test-Day Rules 1.4 Recertification, Fees, and How This Guide Maps the Eight Domains
2 IPPS Foundations
2.1 How IPPS Works and How CMS Updates It 2.2 MS-DRG Assignment, Relative Weights, and Grouping 2.3 Provider and Clinical Staff Documentation Duties under IPPS
3 Severity, CMI, Medical Necessity, and Oversight
3.1 CC versus MCC Recognition and CC Exclusion Lists 3.2 Case Mix Index and Why CDI Tracks It 3.3 Two-Midnight Rule, Medical Necessity of Setting, and Principal Diagnosis 3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
4 Nervous and Respiratory System CDI
4.1 Nervous System Conditions for CDI 4.2 Acute and Chronic Respiratory Failure, ABGs, and Ventilation Support 4.3 Pneumonia, COPD, PE, Pleural Effusion, and Respiratory Infections
5 Circulatory, Digestive, Hepatobiliary, Musculoskeletal, and Skin CDI
5.1 Circulatory Disorders 5.2 Digestive and Hepatobiliary Disorders 5.3 Musculoskeletal and Skin
6 Endocrine, Nutrition, Kidney, and Hematologic CDI
6.1 Diabetes, Dehydration, and Obesity 6.2 Malnutrition Criteria, Severity, and Audit Risk 6.3 AKI, CKD Staging, UTI, and Urinary Stones 6.4 Anemia, Coagulation, Sickle Cell, Lymphoma, and Leukemia
7 Infectious Disease, Other MDCs, and Clinical Indicator Tools
7.1 Sepsis, Severe Sepsis, Postoperative and Other Infections 7.2 Mental, Substance Use, Injuries/Toxicology, and HIV-Related Conditions 7.3 Medications, Diagnostic Tests, and Abbreviations as Clinical Indicators
8 Health Record Elements and Query Triggers
8.1 Which Record Elements Support Diagnosis and Procedure Codes 8.2 Attending versus Radiologist, Pathologist, and Other Providers 8.3 When a Physician Query Is Warranted 8.4 When Queries Are Not Appropriate
9 Query Timing, Verbal Queries, Formats, and Clinical Indicators
9.1 Concurrent, Retrospective, Pre-Bill, and Prospective Timing 9.2 Verbal Queries and Required Documentation 9.3 Open-Ended, Multiple-Choice, and Yes/No 9.4 Clinical Indicators and How to Source Them
10 Compliant Query Practice and Clinical Validation
10.1 Compliant versus Leading and Other Noncompliant Queries 10.2 ACDIS/AHIMA 2026 Guidelines for Achieving a Compliant Query Practice 10.3 Clinical Validation and Diagnoses without Clinical Support
11 CDI Program Metrics
11.1 Productivity, Query Volume, and Provider Response Rates 11.2 CMI, CC/MCC Capture, and High-Frequency DRGs 11.3 SOI/ROM as CDI Program Performance Metrics
12 Physician Metrics, PEPPER, Forecasting, and Public Data
12.1 Measuring Physician Documentation Performance 12.2 PEPPER, Forecasting, Hospital Financial Data, and Public Reporting
13 CDI Roles, Coder Collaboration, and Physician Education
13.1 Roles and Responsibilities of the CDI Specialist 13.2 Coder Roles Working with a CDI Department 13.3 Physician Education Tools, Forms, and Presentations
14 Provider Communication and DRG Reconciliation
14.1 Non-Confrontational Communication and When Verbal Beats Written 14.2 Working DRG versus Final DRG Reconciliation
15 Official Guidelines, Principal Diagnosis, and Secondary Diagnosis
15.1 Official Guidelines, Cooperating Parties, Updates, and AHA Coding Clinic 15.2 Principal Diagnosis Selection 15.3 Secondary Diagnosis Reporting Criteria
16 Sequencing, Coding Conventions, and POA Indicators
16.1 Sequencing When Two Diagnoses Equally Meet PD; Working DRG with Multiple Diagnoses 16.2 Integral Signs/Symptoms, the With Convention, and Uncertain Diagnoses 16.3 Present-on-Admission Indicator Assignment and Payment Impact
17 Hospital-Acquired Conditions, Disposition, and ICD-10-PCS Essentials
17.1 CMS Hospital-Acquired Condition Payment Provision 17.2 Discharge Disposition, Transfer Payment, Principal Procedure, and ICD-10-PCS Essentials
18 Ethics, Privacy, and Leading Queries as Compliance Failures
18.1 ACDIS Code of Ethics and CDI Goals beyond Reimbursement 18.2 HIPAA, Minimum Necessary, and Record Confidentiality 18.3 Leading Queries as a Compliance Failure
19 DRG Creep, OIG Oversight, PEPPER, and the False Claims Act
19.1 DRG Compliance, DRG Creep, and the OIG Work Plan 19.2 PEPPER Compliance Risks and the False Claims Act
20 Mortality Index, Observed-to-Expected Ratios, and Quality Data Sources
20.1 Documentation Impact on Mortality Index (SOI/ROM) 20.2 Mortality Reviews and Observed-to-Expected Ratios 20.3 Abstracted versus Claims-Based Quality Data
21 CMS Quality Programs, PSIs, and Infection versus Complication Codes
21.1 HVBP, HAC Reduction Program, HRRP, 30-Day Mortality, and Hospital IQR 21.2 PSI 90 Components and PSIs beyond the Composite 21.3 Healthcare-Associated Infections versus Complication Codes
3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
Key Takeaways Explain This Topic AI
Medicare Administrative Contractors (MACs) process claims, apply coverage rules, and perform medical review for their jurisdiction, including short-stay patient-status reviews under Targeted Probe and Educate as of September 1, 2025.
Recovery Audit Contractors (RACs) identify improper payments—overpayments and underpayments—often through automated claim edits or complex record review of approved issues.
The Comprehensive Error Rate Testing (CERT) program draws a statistically valid sample to measure the national Medicare fee-for-service improper-payment rate; missing records count as errors and identified overpayments can be recouped.
The HHS Office of Inspector General (OIG) is independent oversight: audits, evaluations, investigations, and a public Work Plan—not a day-to-day claims processor.
Distinguish clinical-validation denials, medical-necessity or level-of-care denials, and DRG-downgrade determinations; each attacks a different claim element and needs a different record defense.
Last updated: September 2026
3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
Quick Answer: MACs process and review claims for a jurisdiction. RACs find improper payments to recover. CERT measures the national improper-payment rate from a random sample. The OIG independently audits and investigates Department of Health and Human Services programs. A denial that says “this diagnosis is not clinically supported,” a denial that says “this should not have been inpatient,” and a determination that says “the MS-DRG is too high” are three different problems.
Domain I asks CDI specialists to understand who is looking at the claim and what they are allowed to change. Treating every additional documentation request as “a RAC” produces the wrong appeal letter and the wrong internal fix.
Four roles, four jobs
Body Who it is Core job What a hospital typically receives
Medicare Administrative Contractor (MAC) CMS’s geographic claims administrator Processes Part A/B claims, applies national and local coverage rules, conducts medical review and provider education Return-to-provider edits, additional documentation requests, Targeted Probe and Educate (TPE) rounds, redeterminations (first-level appeals)
Recovery Audit Contractor (RAC) CMS recovery-audit program contractor Identifies overpayments and underpayments on approved issues Discussion-period notices, complex record requests, automated recoupments on clear claim-data errors
Comprehensive Error Rate Testing (CERT) CMS improper-payment measurement program Draws a statistically valid random sample to publish the national Medicare fee-for-service improper-payment rate (Payment Integrity Information Act reporting) Record request on a sampled claim; failure to send records is an error; MACs recoup or repay what CERT finds
Office of Inspector General (OIG) Independent watchdog inside HHS Audits, evaluations, investigations; publishes a Work Plan ; can refer matters for civil or criminal enforcement Audit announcements, draft/final reports, investigative demands—not routine DRG grouping
Keep Unified Program Integrity Contractors (UPICs) in a side note only: they investigate suspected fraud, waste, and abuse and are not the same as a RAC. This section’s four-way comparison is the CCDS Domain I set you were asked to master.
MAC, in practice
The MAC is the contractor that already pays the claim. It applies Local Coverage Determinations (LCDs) and national coverage rules, and it can review before or after payment. Since September 1, 2025 , MACs—not Beneficiary and Family Centered Care QIOs—perform short-stay inpatient and patient-status reviews for acute care hospitals as part of TPE. A TPE letter about one-midnight chest-pain admissions is a setting conversation with the claims processor, usually in small claim samples with education between rounds. It is not an OIG investigation.
RAC, in practice
RACs exist because CMS wants a dedicated recovery function for improper payments. They work from approved issues and may use automated reviews (claim data alone) or complex reviews (medical record). Inpatient complex reviews commonly test patient status, MS-DRG validation, and high-cost diagnosis support. Historically, RAC findings of inpatient-versus-outpatient error were a reason CMS wrote the Two-Midnight Rule. A RAC change that removes an MCC and reassigns the family is often a DRG downgrade . A RAC change that says the entire stay should have been outpatient is a level-of-care denial. Read the determination letter before you write the query policy.
CERT, in practice
CERT is a measurement program. CMS samples claims submitted to MACs, requests records, and scores whether payment followed coverage, coding, and billing rules. The sample is designed to support a national improper-payment rate and contractor- and service-level rates. CERT is not a hospital-selected “gotcha” list, but a sampled error still can be recouped, and a high error rate in a service category informs later MAC and RAC focus. Insufficient documentation —including no record sent—is a classic CERT error category alongside medical necessity and incorrect coding. The operational CDI lesson is boring and important: know who stores the record and answer the CERT request on time.
OIG, in practice
The OIG does not assign MS-DRGs and does not publish relative weights. It reviews whether HHS programs, including Medicare, are vulnerable to waste or abuse. The public Work Plan is the advance notice of audit and evaluation topics. Inpatient themes that have appeared over the years include high-severity MS-DRG accuracy, inpatient care that belonged in a less intensive setting, and specific high-cost diagnoses. An OIG audit can lead to a report, a recommended refund, a corporate integrity agreement, or a referral under the False Claims Act . That pathway is not the same as a MAC TPE round. Later Domain VII sections return to DRG creep, the Work Plan, and false-claims risk; here, learn not to call a RAC letter “the OIG.”
Three denial patterns CDI must not conflate
Pattern What the reviewer accepts What the reviewer rejects Typical CDI / HIM defense
Clinical validation That some hospital encounter occurred That the diagnoses as coded are supported by the clinical picture (findings, treatment, course) Indicators in the record, provider linkage, and a compliant query history—not a code that exists only as a label
Medical necessity / level of care That some services may have been needed That the inpatient setting (or the billed intensity) was reasonable and necessary Two-Midnight expectation, hospital-level services, and a principal diagnosis that explains admission
DRG downgrade That inpatient admission can stand That the MS-DRG is correct—often after removing a CC/MCC, changing principal diagnosis, or applying exclusion-list logic Coding guidelines, current CMS CC/MCC and exclusion tables, and clinical support for the remaining codes
These patterns overlap in real letters. A contractor may say the malnutrition MCC is not validated and therefore the MS-DRG falls one tier. Classify the primary theory so the appeal attaches the right exhibits. A setting denial is not cured by a better MCC. A clinical-validation denial is not cured by a longer Two-Midnight paragraph. A downgrade that correctly applies Table 6K is not a “clinical” fight; it is a grouping fight you should have caught before billing.
HAC payment provision logic (claim-level CC/MCC stripping for selected conditions that were not present on admission) and the HAC Reduction Program (hospital-wide 1% cut for the worst Total HAC Score quartile) are not the same as these three denial patterns and are not taught here. If a letter mentions a HAC category, route it to those later rules instead of calling it a generic RAC downgrade.
Practices that attract all three letters
Severity without a clinical home. A query response adds “acute respiratory failure” while gases, saturation, and oxygen therapy never match that diagnosis. Expect clinical validation and a DRG downgrade.
Inpatient order without an expectation. The history and physical lists comorbidities and never states why medically necessary hospital care should span two midnights. Expect a MAC TPE or RAC status denial.
Principal diagnosis that does not occasion the admission. Coding a high-weight condition that was incidental, while the after-study reason for admission was a short observation-level event, invites both setting and DRG-validation findings.
Copy-forward problem lists. Yesterday’s resolved acute kidney injury is today’s unvalidated MCC.
Ignoring exclusion-list pairings. A capture-rate dashboard that counts a neutralized CC as a success trains the program to be surprised at reconciliation.
Treating CERT as optional mail. A sampled claim with no record is an improper payment in the national rate and a recoupment risk.
CMI quotas. Section 3.2’s lesson becomes a compliance lesson here: a numeric CMI campaign is how leading queries and unsupported MCCs get written.
Scenario set
MAC TPE. A 64-year-old with noncardiac chest pain, negative serial troponins, and discharge before the second midnight is billed inpatient. The MAC samples similar claims, asks for records, and educates on Two-Midnight documentation. The fix is admission-status process, not an MCC hunt.
RAC complex review. A 78-year-old’s claim groups to a three-tier family with MCC based on severe protein-calorie malnutrition. The record has a one-line query answer and no nutritional assessment, no intake data, and no treatment plan that matches that severity. The RAC leaves inpatient status intact and removes the MCC. That is a DRG downgrade built on clinical validation .
CERT sample. A routine pneumonia stay is drawn in the national sample. Health information management cannot locate the discharge summary in time. CERT scores an insufficient-documentation error. No one “targeted” the hospital; the sample was random. The operational failure is still real.
OIG Work Plan. A public Work Plan item focuses on inpatient MS-DRG coding at the highest severity levels. The hospital’s internal audit samples MCC-tier charts for clinical validation and exclusion-list errors before a federal auditor does. That is risk reduction, not an admission of fraud.
How CDI should phrase the internal briefing
Name the contractor, name the denial theory, name the claim element under attack, and name the record pages that answer that theory. “We got audited” is not a root cause. “The MAC TPE round is challenging one-midnight inpatient orders without a supported two-midnight expectation” is a root cause. “The RAC accepted inpatient status and reassigned the family because the only MCC failed clinical validation” is a root cause. Programs that can say those sentences write better queries, better physician education, and better appeals—and they stop using CMI as a substitute for any of the three.