Recovery Audit Contractor

The Washington State Health Care Authority (HCA) is seeking a Recovery Audit Contractor (RAC) through RFP No. 2024HCA14 to audit payments made to Apple Health (Medicaid) providers and identify improper payments, including overpayments and underpayments. The procurement covers auditing fee-for-service claims across multiple Washington counties, with potential future expansion to Managed Care Organization claims. Minimum qualifications for bidders include three years of experience with RAC services and Medicaid claims auditing. The contractor must provide key staff including a Medical Director, Program Manager, Technical Point of Contact, coding specialists, audit staff, and customer service representatives. Evaluation criteria will be based on a 1,000-point system: 650 points for the written proposal, 300 points for the cost proposal, and 50 points for Executive Order 18-03 certification. Proposals are due on March 21, 2025, by 2:00 p.m. Pacific Time, with only email submissions accepted. A pre-proposal conference is scheduled for March 3, 2025, at 12:00 p.m. Pacific Time, and the initial contract period will run from April 21, 2025, through September 30, 2026, with options to extend for up to four additional one-year periods.

The RFP does not explicitly specify set-aside designations or restrictions for disadvantaged enterprises. Compensation for the RAC will be structured as a contingency fee percentage based on fully validated and collected overpayments, with specific percentages to be negotiated. In fiscal year 2024, HCA's fee-for-service expenditures totaled $8.5 billion, with ADSA-H claims representing 41.05% and ADSA-D claims representing 25.15% of the total. The contractor must comply with extensive data security requirements, including completing a Security Design Review by June 1, 2025, and implementing access authentication systems that meet WaTech Policy 141.10 Security Standards. Contractors will be required to maintain specific insurance coverage, including data breach response coverage for the contract term plus three years following termination. While no incumbent vendor is mentioned, the RFP emphasizes integration with existing state authentication systems like Enterprise Active Directory and SecureAccess Washington. Bidders must also provide a Diverse Business Inclusion Plan and comply with various state security and IT standards.