What Is Medical Auditing?

Medical auditing is a systematic performance assessment within a healthcare organization. Most healthcare elements can be audited, but many audits look at components of payer reimbursement processes to evaluate compliance with payer guidelines and federal and state regulations. By identifying errors and devising remedial actions to eliminate them, the medical audit serves a vital role in a healthcare organization’s compliance plan.

Medical audits provide a mechanism to:

• Review quality of care provided to patients;

• Educate providers on documentation guidelines;

• Determine if organizational policies are current and effective;

• Optimize revenue cycle management;

• Ensure appropriate revenue is captured; and

• Prepare for and respond to federal and payer audits, malpractice litigation, and health plan denials.

Federal Scrutiny and Compliance Enforcement

Law requires the Centers for Medicare & Medicaid Services (CMS) — the largest single healthcare payer in the U.S. — to protect the two Medicare trust funds, which include the Hospital Insurance Trust Fund and the Supplementary Medical Insurance Trust Fund. The U.S. Government Accountability Office (GAO) continues to identify Medicare improper payments as a high-risk area. Medicare fee-for-service improper payments have been measured in the tens of billions of dollars annually, with insufficient or missing documentation and other failures to meet Medicare payment requirements among the causes.

To prevent inappropriate payments from compromising the Medicare trust funds, CMS works with Part A and Part B Medicare Administrative Contractors (MACs) and Durable Medical Equipment MACs (DME MACs). In fact, CMS works with a constellation of contractors tasked with protecting taxpayers and future Medicare beneficiaries. These are some of the CMS contractors:

• Recovery Audit Contractors (RACs) review postpayment claims with the goal of recovering improper payments made to healthcare providers under fee-for-service (FFS) Medicare plans. RACs also detect errors to direct CMS actions (directly and through MACs) that will prevent future improper payments. Providers should note that CMS pays RACs a percentage of the amounts they recover, creating a financial incentive for RAC review activity. RACs generally may review claims going back up to three years from the claim’s paid date.

• Supplemental Medical Review Contractors (SMRCs) reduce improper payment rates through medical review of Medicaid, Medicare Part A/B, and DMEPOS claims. Noridian Healthcare Solutions serves as the nation’s SMRC and determines whether claims follow coverage, coding, payment, and billing requirements. When an SMRC review identifies an improper payment, a MAC may initiate a claim adjustment or overpayment recovery. Suspected fraud is referred through the appropriate program-integrity process.

• Unified Program Integrity Contractors (UPICs) conduct regional activities to detect and deter abuse, waste, and fraud for medical claims filed through Medicare Part A and Part B, Medicaid, and the Medicare-Medicaid data match program. UPICs also target DME and home health and hospice under Medicare. UPIC contracts operate in five U.S. regions and fulfill responsibilities previously met by the Zone Program Integrity Contractor (ZPIC), Program Safeguard Contractor (PSC), and Medicaid Integrity Contractor (MIC) contracts.

• Investigations Medicare Drug Integrity Contractor (I-MEDIC) is responsible for monitoring fraud, waste, and abuse initiatives in the Medicare Advantage (Part C) and prescription drug coverage (Part D) benefits. I-MEDIC activities focus on providers, prescribers, and pharmacies.

• Plan Program Integrity Medicare Drug Integrity Contractor (PPI MEDIC) is responsible for the Part C and Part D proactive data analysis, audits, risk assessment reports, and plan sponsor education and outreach.

These contractors perform various review and program-integrity functions to identify improper payments, questionable billing patterns, and claims that do not meet applicable coding, coverage, medical-necessity, or payment requirements.

CMS’ Review Contractor Directory notes that one or several of these contractors may request claims records from providers.

The listed contractors are federal contractors performing audit, medical review, or program-integrity functions. Their ongoing scrutiny reinforces the value of maintaining an effective internal auditing and compliance process. Routine internal audits, and external audits conducted by objective third-party auditing services, enable healthcare organizations to discover their compliance oversights. Implementing an auditing program is among the most effective ways to prepare for federal and payer audits.

CMS, in its efforts to protect Medicare’s Hospital Insurance Trust Fund and the Supplementary Medical Insurance Trust Fund, is well fortified. The U.S. Department of Health and Human Services (HHS) oversees CMS, and the HHS Office of Inspector General (OIG) provides independent oversight of HHS programs and operations, including substantial work to prevent and detect fraud, waste, and abuse in Medicare and Medicaid.

Bottom line: Noncompliance is expensive. It costs federal and commercial payers through inappropriate payments, as well as programs to investigate, prevent, and recoup those payments. This cost is passed down to provider organizations through paybacks and, when applicable, monetary penalties.

While the OIG works with MACs and other auditors to detect abusive billing patterns, it also works with the Department of Justice and states’ attorneys general to facilitate legal actions. Medical coding and billing that violate state or federal laws can cost physician offices and other healthcare organizations in terms of:

• Payback demands;

• Fulfillment of a corporate integrity agreement;

• Employment of an independent review organization;

• Prosecution under the False Claims Act (FCA) and other federal/state laws;

• Civil monetary penalties;

• Exclusion from Medicare and Medicaid programs; and

• Criminal penalties.

Importance of Medical Auditing

Medical auditing performed by the provider organization, or through a third party on its behalf, can help keep coding and billing errors in check. Audits not only identify incorrect coding but also help prevent the same errors from being repeated. Habitual claims errors impose a cumulative effect on an organization and, worse, invite federal reproach.

A recurring pattern of overcoding or overbilling can create significant compliance risk, particularly if an organization becomes aware of the problem and fails to investigate and correct it. Under the FCA, specific intent to defraud is not required. The FCA’s knowledge standard includes actual knowledge, deliberate ignorance, and reckless disregard of the truth or falsity of information. By uncovering areas of noncompliance, medical auditing resolves ignorance, and ignorance is a liability.

The act of submitting a claim to Medicare or Medicaid is synonymous with certifying that the provider earned the payment requested, as coded on the claim. The OIG underscores the mandate of the FCA, explaining, “If you knew or should have known that the submitted claim was false, then the attempt to collect unearned money constitutes a violation.”

The key phrase to note is “should have known.” The OIG also states, “It is illegal to submit claims for payment to Medicare or Medicaid that you know or should know are false or fraudulent.” Healthcare organizations may face FCA liability when they knowingly submit false claims, including claims involving upcoding, double-billing, unbundling, or unsupported medical necessity.

Why is medical auditing of critical importance? FCA liability can include three times the government’s damages, plus an inflation-adjusted civil penalty.

What Does a Healthcare Auditor Do?

A professional medical auditor reviews coding accuracy, policies, and procedures to evaluate whether the organization is operating efficiently and complying with applicable coding, documentation, billing, and regulatory requirements. The auditor must possess knowledge of medical coding, medical terminology, clinical documentation, compliance, and regulatory guidelines. The auditor also must be able to determine the scope of an audit, use approved tools to perform it, compile data, report findings, and provide corrective recommendations and staff training.

Most medical auditors are experienced medical coders with advanced training. Auditors may work on behalf of an insurer, government agency, government contractor, or healthcare provider. In the latter workplace, auditors play a key role in the organization’s financial compliance by:

• Reducing claims denials caused by inappropriate coding or insufficient documentation;

• Determining outliers before payers ask the practice to conduct an internal audit;

• Revealing variation from national averages due to inappropriate coding;

• Ensuring proper documentation that supports reported services and procedures;

• Discovering overpayments and protecting against false claims liability;

• Preparing the organization to respond to payer and federal contractor reviews; and

• Identifying reimbursement deficiencies.

Auditors who conduct successful medical coding audits impart knowledge to resolve noncompliant billing activity. This enables providers and staff to protect patients, support appropriate reimbursement, and reduce the risk of punitive actions.

Federal Audit Targets

Being aware of federal audit targets and claim-error trends can help an organization identify and address areas that may attract MAC or RAC scrutiny. Several publications detail current targets and problem areas, directing medical coders toward vigilance and auditors toward proactivity. Two essential resources are the OIG Work Plan and the Comprehensive Error Rate Testing (CERT) report.

OIG Work Plan

Through ongoing risk assessments, OIG identifies areas of HHS programs and operations that may warrant attention because of concerns related to efficiency, effectiveness, program integrity, or the quality and safety of services. Approved audit and evaluation projects are added to the Work Plan, which is updated regularly to address emerging issues. 

A certified medical auditor should know what’s listed on the Work Plan. This knowledge allows the auditor to inform staff about areas receiving OIG attention and identify issues that may warrant additional internal review.

In addition to publishing its Work Plan, the OIG creates consumer fraud alerts, advisory opinions, and audit reports that provide additional insight into OIG compliance concerns and areas of federal scrutiny.

CERT Report

CERT is a CMS initiative. Testing is conducted annually with the goal of measuring and reducing improper payments in the Medicare FFS program.

Each year, CERT reviews a statistically valid stratified random sample of FFS claims submitted to A/B MACs and DME MACs. CERT requests supporting documentation for the sampled claims, which a medical review professional evaluates against Medicare coverage, coding, and payment requirements.

If the medical review professional discovers that coding, billing, and/or Medicare coverage criteria were not met, the claim is identified as a total or partial improper payment.

Through this annual review, CMS calculates the overall Medicare FFS improper payment rate. All data is then itemized in the annual CERT report. Note that CERT improper-payment rates are not fraud rates.

Provider organizations and auditors can review the annual CERT data to identify Medicare FFS error trends and areas that may warrant attention. In the same manner, auditors gain insight by using third-party payer-provider bulletins, RAC-identified vulnerabilities (listed on their websites), and the OIG Work Plan.

Knowledge is power. If it’s on payers’ radars, it should be on the auditor’s radar. Auditing for pervasive claim problems will ensure an organization doesn’t overlook them.

Medical Chart Audit Process

To verify whether reported coding is supported, the auditor compares the coding with the medical record documentation. The medical chart review, a frequently performed healthcare audit, evaluates documentation and claims information to determine whether claims have been coded appropriately.

Chart auditing has become an important part of healthcare compliance as federal and commercial payers use claims analysis, medical record review, and increasingly automated technologies to identify potential coding, billing, coverage, and medical-necessity issues. Payer reviews may involve requests for medical records, prepayment or postpayment review, or other audits of provider claims and documentation.

When a provider organization performs an internal audit — or hires an independent auditor to perform an external audit — the organization can assess whether its claims and supporting documentation are likely to withstand payer or government scrutiny. The audit also provides an opportunity to self-report and correct issues that pose a threat to the organization’s financial viability.

All medical coders should learn how to conduct an audit in view of its potential value to their employer (and their coding careers). Fortunately, the audit process is easy to understand when broken down to its component parts.

Step 1: Plan the Medical Record Audit

Perhaps a medical record audit is necessary to establish a baseline of coding accuracy for the organization or to assess the effectiveness of previous staff training related to areas targeted by audits. Auditing objectives range from investigating areas of insufficient documentation to identifying improper coding, billing activity, and postpayment risks. In any case, conducting an audit to produce usable data requires planning. Questions to consider include:

• Does benchmark data from previous audits exist?

• Do benchmarks suggest the focus of the audit (e.g., new patient visits, consultations, office visits, hospital visits, etc.)?

• Do other events suggest the focus of the audit (e.g., claims denials, federal audit targets or error reports, a new regulation or guideline, a new internal policy or software platform, a new medical coder or provider)?

• Will the audit evaluate revenue and compliance?

• Is the audit prospective (before filing the claims) or retrospective (after filing the claims)?

• How many charts will be reviewed?

• Is there a measure for the focus (e.g., utilization patterns)?

• Which audit tools will be used (e.g., code sets and guidelines, payer guidelines, fee schedules, and specialized software)?

Chart auditing is an iterative process, meaning the process is repeated, and what’s learned from one audit affects the starting point for the next, including the frequency of audits. As charts are audited, the answers to these questions will likely change.

Step 2: Choose Between 2 Basic Auditing Methods

A prospective audit helps identify and correct problems before sending claims to the payer. A prospective audit reviews the documentation and the codes assigned. This identifies inconsistencies or errors, although it may delay the billing process.

A retrospective audit is a postpayment audit to evaluate whether services that were previously reported to a payer were appropriate and consistent with the payer’s binding rules. The auditor reviews the documentation, claim forms, and sometimes the explanation of benefits (EOBs) to ensure proper medical billing.

Each medical practice must determine which type of audit method will work for its environment. Errors identified during a retrospective audit should be corrected as required, which may involve corrected claims, repayment of overpayments, or other corrective action.

Step 3: Decide the Audit Approach

Choosing between a focused audit and a random audit will depend on which approach serves the audit’s objectives.

• Focused audits center around a particular service item, provider, diagnosis, etc. For instance, a single provider who is trending in above-average reimbursement may need to be audited. Or maybe the organization is struggling with modifier errors.

• Random audits refer to comprehensive reviews involving a sample of charts arbitrarily selected to indicate compliance problems reflected in all charts. The sample may be drawn from a defined recent period appropriate to the audit objective, such as within the last three months. This type of audit identifies areas that may benefit from improvement efforts and additional training. Baseline audits — designed to inform the medical practice about how it fares in relation to correct coding and billing — may use random sampling across relevant coding practices, services, and practitioners to provide a broad view of compliance.

Step 4: Determine Audit Scope

Determining the scope of the audit involves honing or defining factors that influenced the decision to perform a focused or random audit.

A random sampling may be chosen if this is the practice’s first audit. If the organization has conducted previous audits, then past audit reports should suggest a focus area such as initial office visits, consultations, inpatient visits, or certain diagnosis codes. Reasons might necessitate a payer-focused audit and require a review of charts billed exclusively to Medicare, Medicaid, or another payer. Similarly, a provider-focused audit or a coder-focused audit may be performed. Maybe review is necessary for high-volume services or those with high denial rates.

Priority should define the audit scope. The focus of the audit should be on coding and billing complexities with a heightened potential to affect reimbursement or liability. Less urgent target areas should be scheduled with a recurring yearly audit work plan.

In defining the audit scope, the auditor should include the sample date range.

Step 5: Determine Sample Size

The audit sample should adequately represent the encounters or issues being evaluated. Auditing too few records may distort results, while auditing too many becomes impractical in terms of time and labor.

There is no single standard sample size for all coding audits. Sample size should reflect the audit objective, claim volume, risk level, and whether statistically valid conclusions are needed. OIG’s longstanding physician-practice compliance guidance offered five or more records per federal payer or five to 10 records per physician as a basic guide, while noting that there is no set formula. In practice, some auditors use samples of 10 to 15 charts for routine internal reviews.

The OIG also provides RAT-STATS to help with statistical sampling. This tool is provided for free through the OIG. RAT-STATS can assist with statistical sample design, random sample selection, and estimation of improper payments.

Tools such as RAT-STATS allow the practice to understand the sampling methodologies used by payers. This allows the practice to remain proactive in compliance efforts by mining information that reflects high-risk areas. Identifying these areas, auditing the documentation and coding, and educating staff based on identified variances can help the practice correct compliance risks before they are identified by a payer, reducing the risk of denials, overpayment recoupment, and other adverse findings.

Step 6: Select Audit Tools

Prioritizing efficiency when selecting an audit tool is important when auditing the medical record. If the auditor is conducting a review of surgical notes, for example, a surgical audit tool should be used. If the auditor is conducting an evaluation and management (E/M) audit, the tool needs to reflect the applicable E/M coding and payer guidelines.

Some auditors choose audit software to audit records, print an audit report, and help analyze the data. Audit software can assist with medical-necessity review, but it cannot replace the auditor’s judgment in evaluating the documentation against applicable coverage and payment requirements. This is a “thinking” process that requires the auditor to possess a strong background in medical coding.

When selecting an audit tool, remember that tools vary among payers. MAC tools may vary, as well. The auditor should choose according to the audit scope, using a payer- or MAC-specific tool when applicable.

It’s also imperative to have references on hand. For accuracy and to support audit findings with verifiable guidelines, the auditor should refer to:

• ICD-10-CM, CPT^®, and HCPCS Level II code sets and guidelines when auditing outpatient organizations

• CPT^® Assistant references and AHA Coding Clinic^® references

• Frequency reports by physician (utilization of levels of service obtained by the medical billing software) and utilization based on specialty (can be obtained by insurance carrier)

• Physician fee schedule by insurance carrier

• Payer guidelines and payment policies

• Medical terminology reference, such as a medical dictionary

• The OIG Work Plan

Step 7: Locate Documentation

Once the sample size and charts have been identified, documentation pertaining to the date of service (DOS) for charts under review will need to be collected. In addition to a note, the medical record for the patient encounter might include labs, forms, images, and other miscellaneous items. The auditor should obtain all documentation relevant to the service and the issues being reviewed.

In a retrospective audit, the superbill/charge ticket, patient chart, claim form or billing record (to validate what was submitted), and the explanation of benefits (EOB) or remittance advice for each patient encounter may be needed, depending on the audit scope.

The auditor should become familiar with the chart organization, special forms including the history form, problem list, and medication sheet.

Step 8: Conduct the Audit

Use tools and resources to perform the audit. Be sure to review both coding and documentation. Pay attention to the guidelines in the CPT^®, ICD-10-CM, and HCPCS Level II coding books, in addition to ensuring proper documentation. Double-check coding criteria for services, such as:

• New versus established patient

• Consultation requirements, when the payer recognizes consultation codes

• Time-based code requirements

• Critical care services

• Hospital services

• Nonphysician practitioner services

Step 9: Analyze Audit Findings

Once the audit is complete, the findings must be analyzed and problem areas identified, such as:

• Improper assignment of CPT^® or HCPCS Level II codes for procedures or services

• E/M levels not supported by documentation

• Incorrect diagnosis codes, including ICD-10-CM codes that do not reflect the highest level of specificity supported by the documentation and coding guidelines

• Missing modifiers and/or incorrect modifier usage

• Incorrect diagnosis linkage to the services reported

• Services performed but not billed

Step 10: Create the Audit Analysis and Summary Report

The audit findings need to be compiled in a concise report. The writing style should be detailed, persuasive, and clear regarding what was audited and how the audit was performed.

Identify the number of encounters documented correctly and incorrectly. Note trends and errors in coding. Each error or risk area should be outlined categorically and labeled to define the category (for example, particular CPT® code, payer, provider, or specialty). All errors should be explained and include a citation to the appropriate standard.

Finally, suggest remedial actions. Recommendations might include additional training or modification of documentation systems. Include recommendations for follow-up analysis to evaluate the effectiveness of the corrective action.

The auditor’s approach to communicating the audit results is as important as the audit approach. Choose a constructive tone to avoid defensive reactions that could sabotage improvement efforts. Also give the staff time to review the results and prepare questions before meeting. The audit report should be the first postaudit communication. Know the audience and personalize findings for the medical coder, the physician, and the nonphysician practitioner.

Step 11: Meet With Coders, Practitioners, and Ancillary Staff

Discussing audit findings allows the auditor to address risks and the corrective actions to mitigate them. Allow enough time to talk about each case, offer suggestions, and answer questions.

When conferencing with the provider, the auditor may get pushback. Providers concerned with patient care may not prioritize learning the details of coding and compliance. Auditors can help providers understand the importance of these areas by speaking to the providers' concerns. For instance, if the provider is concerned about unwanted attention from CMS, the auditor can outline the potential risk of an audit. Some auditors also show providers examples of how inaccurate coding can lead to revenue loss.

Let staff members know what they did well and how they can improve. If a physician isn’t documenting a thorough assessment and plan, for example, explain why capturing these elements is important for the patient and the practice. If audit findings are under dispute, substantiate them with hard copies of payer and coding guidelines.

Remember, the tone of communication is crucial. The goal is to establish open dialogue.

Step 12: Make Recommendations for Improvement

The audit won’t benefit the organization if efforts aren’t made to address utilization pattern abnormalities, coding errors, and documentation deficiencies.

Use audit findings to educate providers on how to improve clinical documentation. Recommendations might include shadowing sessions or creating “cheat sheets” to help practitioners capture the full clinical story and all services provided during the patient encounter.

Audits can also direct ancillary staff training. Tailor education to correct detected problems. Educate medical coders and billers on the proper coding and billing of CPT^® codes, ICD-10-CM codes, HCPCS Level II codes, and modifiers.

If internal policy causes error, revise the policy. Commit to following through on all recommendations, particularly audit-tailored training, monitoring, and suggested target areas of future audits.

Step 13: Provide Ongoing Monitoring and Assessment

Consult with providers and the compliance officer or practice manager to establish (or modify) an audit work plan. Create a timeline based on the audit results. A general rule to determine how often to conduct a chart review is “more errors, more audits.” But audit frequency also should be risk based. In addition to increasing the frequency or scope of review when audits identify significant or recurring errors, changing the audit plan also may be appropriate when new coding or payment requirements take effect, after corrective education, or when payer data or denials reveal emerging concerns. Follow-up auditing should determine whether corrective actions have been effective.

As an example of an internal audit policy, an organization may decide that 90 percent accuracy warrants annual follow-up auditing. If accuracy drops between 75 and 90 percent, internal policy may call for quarterly auditing. For accuracy below 75 percent, the organization may determine monthly audits are needed. Finally, with accuracy below 60 percent, a prospective audit may be implemented.

Step 14: Execute Audit Follow-Up

If an audit identifies a payer overpayment, the organization should determine and follow the payer’s requirements for reporting and returning the overpayment. Medicare Parts A and B providers and suppliers are subject to federal overpayment requirements, including deadlines for reporting and returning identified overpayments.

If an identified Medicare overpayment may be related to other overpayments arising from the same or a similar cause, the organization should conduct a timely, good-faith investigation to determine whether related overpayments exist. If findings confirm significant overpayments or potential self-disclosure issues, the organization should refer the matter to its compliance and legal teams and involve legal counsel when there is substantial legal or repayment risk.

Hire an External Auditor

AAPC has an audit services division, AAPC Client Services. It provides full-service healthcare compliance and corporate integrity audits for outpatient practices, health plans, healthcare attorneys, and government regulators to ensure supported medical necessity, correct coding, and compliance with regulatory issues. Get more information on how AAPC Client Services can fulfill auditing needs.

Schedule a medical chart review.

Medical Audit Checklist

• Is the patient eligible for the DOS on the claim?

• Do the claim demographics and data specifically match the medical records? For example, check for the same name, birth date, DOS, place of service (POS), etc.

• Are the billing and rendering providers reported correctly for the service, and does the documentation support the provider who performed or supervised the service?

• Is the provider appropriately qualified and authorized to perform and bill for the service?

• Was the required documentation submitted?

• Has the provider submitted any other claims for the same patient and date of service? Review the patient’s claims history for a previously denied or paid claim from this same provider for the same DOS, codes, and charges.

  • If there is a previously paid claim, what codes (claim lines) were paid and what were denied?

  • If there are claim lines denied, what was the reason?

  • What records were submitted with the previous claim? Are they the same or were additional records sent?

  • Is this a duplicate claim submitted by the provider?

  • Is the provider split-billing services performed on one DOS onto more than one claim?

• Does the medical record align with the CPT^® and HCPCS Level II codes on the claim? Look for upcoding, miscoding, unlisted codes, and unbundling of services.

• Are modifiers clearly supported and used appropriately in the medical records? For example, is there enough notation to support modifier 25 Significant, separately identifiable evaluation and management service by the same physician or other qualified health care professional on the same day of the procedure or other service? Are modifiers 26 Professional component and TC Technical component supported by the billing provider and the POS?

• Are the number of units billed correctly? Does the claim report 1 unit or multiple units for the code, as appropriate?

• Are the diagnoses coded to the highest level of specificity supported by the documentation and applicable coding guidelines?

• If the claim includes a diagnostic radiology service, is the required interpretation and report documented when the provider bills the professional component or global service?

• If the claim contains billing for DME, does the medical record include any required order, prescription, medical-necessity documentation, or other supporting documentation?

• Is the medical record properly authenticated by the appropriate practitioner? Are applicable signature requirements met? What type of signature is documented?

Last reviewed on Sept. 4, 2026, by the AAPC Thought Leadership Team