DowncodedCMS Publishes the List of Everyone Allowed to Audit You
The Review Contractor Directory names, for all 56 states and territories, every contractor that can send your practice a records request: the MACs, the Recovery Auditors, the program integrity contractors, with addresses, fax numbers and whether each one takes electronic submission. Ten regional audit territories, seven companies, and three maps that do not line up.
An additional documentation request arrives on letterhead you half recognize, from a company you are fairly sure is not your MAC, asking for records on claims you closed two years ago.
The first question is not what they want. It is whether they are allowed to ask.
CMS answers that on one page, free, for every state and territory, and almost nobody in a billing office has opened it.
What the directory actually holds
The Review Contractor Directory is a state picker sitting on top of the full contact record for every contractor CMS lets review your claims. Pick your state and you get the stack.
The A/B MAC. The DME MAC. Home Health and Hospice. The Railroad Retirement Board specialty MAC. The Recovery Auditor for your region, plus the separate national Recovery Auditor that owns DME and home health everywhere. The Unified Program Integrity Contractor for your jurisdiction.
In 26 of the 56 entries there is an Indian Health row on top of that.
Each one comes with a mailing address, a phone number, a fax number where one exists, an email, a website, and the line that matters most operationally: whether that contractor accepts esMD transactions. 55 of the 56 entries flag at least one contractor that does.
CMS is direct about what the list means. In its own words:
"You may receive correspondence from one or several of these contractors in your state."
Several. The directory is the only place CMS puts them side by side.
Ten territories, seven names
The two audit programs on the page carve the country into ten regional territories. Recovery Audit Regions 1 through 4, the Region 5 national DME and home health region, and five UPIC jurisdictions: Northeast, Southeastern, Midwest, Western, Southwestern.
Ten territories resolve to seven companies (chart below).
Performant Recovery is named in 54 of the 56 entries, because holding Region 1 and the national DME and home health region puts it almost everywhere. Its records department is a street address in San Angelo, Texas, and that is the address on the page for both roles.
Cotiviti holds Regions 2 and 3, which is 24 entries, all routed to the same Conshohocken office. HMS Federal Solutions holds Region 4, the largest single region at 20 entries.
On the integrity side, SafeGuard Services is named on both the Northeast and Southeastern jurisdictions, 21 entries between them. Qlarant is named on the Western jurisdiction, and the Southwestern rows list the same Easton, Maryland corporate office.
CoventBridge runs the Midwest at 9. Michigan alone names AdvanceMed.
So the sender of a records request is very likely one of six or seven organizations nationally, and the directory tells you which one before you spend a morning on the phone.
Three maps, and they do not nest
Here is the part worth writing down.
Your MAC jurisdiction, your Recovery Audit region, and your UPIC jurisdiction are three different maps drawn over the same practice, and none of them contains the others.
Texas sits in A/B MAC Jurisdiction H with Novitas, in Recovery Audit Region 2 with Cotiviti, and in the Southwestern UPIC jurisdiction.
Alabama sits in Jurisdiction JJ with Palmetto GBA, in Recovery Audit Region 3, also Cotiviti, and in the Southeastern UPIC.
California takes DME MAC Jurisdiction D from Noridian, Recovery Audit Region 4 from HMS, and the Western UPIC from Qlarant.
Region 4 covers 20 entries, the Western UPIC 16, the Midwest UPIC 9 against Region 2's 14.
Knowing one tells you nothing about the other, which is why a multi state group cannot answer "who audits us" with a single name.
Two entries, the District of Columbia and Indiana, carry no regional Recovery Audit row at all.
Final Thoughts
None of this changes a denial or wins an appeal. It changes the first twenty minutes of a records request, which is the part that usually goes to guesswork.
Bookmark the page, pull your state, and put the seven rows into whatever your ADR intake looks like now, with the esMD flag next to each. When the next letter lands, the routing decision is a lookup instead of a discussion.
Free, current, and nobody has to sell it to you first.
Thanks for reading.