A medical billing and coding audit is a structured review of a sample of claims against the medical record and payer rules, to check that every code, modifier, unit and charge is supported, billed correctly and paid correctly. It finds undercoding that loses revenue, overcoding that creates compliance risk, and process errors that cause denials, so they can be fixed before a payer finds them.
Most practices only learn their coding is off when denials rise or a payer sends a records request. A regular audit turns that around. This guide explains what a medical billing and coding audit checks, the main types of audit, when to run one, and a step-by-step process and checklist you can use, whether you audit internally or bring in an outside team.
Key Takeaways
- A billing and coding audit compares claims with the documentation behind them and with payer rules, then measures how accurate they are.
- Audits protect revenue as well as compliance. They often find undercoded services and missed charges, not only overcoding.
- Run a baseline audit for each provider, then audit routinely (many practices do it quarterly or yearly) and whenever warning signs appear.
- Score results, fix root causes, retrain, and re-audit to confirm the fixes worked.
- If an audit finds Medicare or Medicaid overpayments, they must be reported and returned within 60 days of being identified, although for Medicare Parts A and B the deadline can be suspended for up to 180 days during a good-faith investigation.
What Does a Medical Billing and Coding Audit Check?
A medical coding audit focuses on whether the codes match the documentation. A billing audit looks wider, at whether the claim was built, submitted and paid correctly. Most practices combine the two. A full review checks:
- Documentation: the record supports the service, is signed and dated, and meets payer requirements for that service.
- E/M levels: the level billed matches medical decision making or total time, as documented (emergency department visits use MDM only).
- Procedure and diagnosis codes: CPT, HCPCS and ICD-10-CM codes are valid, specific and correctly linked to each service.
- Modifiers: modifiers such as 25, 59 and the X modifiers are used only when the documentation supports them.
- Bundling and NCCI edits: services aren’t unbundled or billed together when they shouldn’t be.
- Medical necessity: diagnoses and documentation meet payer coverage policies, including Medicare NCDs and LCDs.
- Units, dates and place of service: time-based and drug units, dates of service and POS codes are correct.
- Charges and payments: every billable service was charged, and payments match the contracted rate.
Our guides to upcoding and downcoding and bundling and unbundling explain two of the most common problems audits uncover.
Types of Medical Billing Audits
| Audit type | What it means | Best used for |
|---|---|---|
| Internal | Run by your own certified coder or compliance staff | Routine monitoring and quick feedback |
| External | Run by an independent coding audit firm | Objective review, high-risk areas, or when internal staff coded the claims |
| Prospective (pre-bill) | Claims are reviewed before submission | New providers, new services and known problem areas |
| Retrospective (post-payment) | Paid claims are reviewed after the fact | Measuring accuracy and finding overpayments or underpayments |
| Random sample | A random set of claims per provider | Baseline accuracy and routine audits |
| Focused (targeted) | Claims for one code, modifier, service or payer | Following up on denials, data outliers or payer letters |
When Should You Audit?
Set a routine and also audit when the data tells you to. Common triggers include:
- A new provider joins, or a provider starts offering a new service.
- Denials rise for coding, modifier or medical necessity reasons.
- E/M level distribution looks very different from peers in the same specialty.
- Annual code set changes take effect (CPT each January 1; HCPCS Level II quarterly, with the major update each January; ICD-10-CM each October 1, with possible April updates).
- A payer sends a records request, a prepayment review notice or an audit letter.
- You change billing staff, software or billing company.
OIG’s General Compliance Program Guidance lists risk assessment, auditing and monitoring as one of the seven elements of an effective compliance program, so routine audits are part of good practice for any provider that bills federal programs.
How to Run a Medical Billing Audit: 8 Steps
- Set the scope and goal. Decide whether this is a baseline, routine or focused audit, and which providers, payers, codes and dates of service it covers.
- Choose the sample. Many practices start with a small random sample per provider (often around 10 encounters) and expand it when the error rate is high. A focused audit pulls every claim for the code or issue in question.
- Gather the records. Collect the claim, the full documentation for the date of service, the remittance, and any authorization or order.
- Review each claim. Code each encounter independently from the documentation, then compare your codes, modifiers and units with what was billed. Note the payer policy behind each finding.
- Score the results. Calculate the accuracy rate and the dollar impact, separating overcoding (overpayment risk) from undercoding (lost revenue).
- Find the root causes. Decide whether each error came from documentation, code selection, a template, charge entry, or a system setting.
- Correct and repay. Submit corrected claims where the payer allows it, refund confirmed overpayments, and document everything.
- Educate and re-audit. Share findings with each provider and coder, update templates and edits, and re-audit the same area in a few months to confirm the fix.
What Audits Usually Find
| Finding | Typical cause | Fix |
|---|---|---|
| E/M levels too high or too low | Levels chosen by habit, not MDM or time | E/M training and documentation templates built around MDM |
| Modifier 25 or 59 overuse | Added to get past edits without support | Modifier rules in the scrubber and coder review |
| Unspecified diagnosis codes | Missing laterality, type or episode detail | Specificity prompts in the EHR and coder queries |
| Missed charges | Services documented but never charged | Daily charge reconciliation against the schedule |
| Unsupported services | Missing signature, order or time statement | Documentation checklists by service |
| Medical necessity failures | Diagnosis doesn’t meet the coverage policy | Pre-bill policy checks for high-risk services |
| Underpayments | Payments not compared with contracted rates | Contract variance checks at payment posting |
How to Measure Audit Results
Track two numbers for each provider and for the practice as a whole:
Coding accuracy rate. Correctly coded claims ÷ claims reviewed. Many practices use 95% as a target, though that is a common industry benchmark rather than an official standard.
Dollar error rate. The net dollar value of errors ÷ total dollars reviewed, split into overpayments and underpayments. This shows the financial effect, which an accuracy rate alone can hide.
For example, if an audit of 40 claims finds 36 correct, accuracy is 36 ÷ 40 = 90%. If the four errors were all undercoded E/M visits, the practice is leaving money on the table rather than facing a refund, and the fix is provider education rather than repayment.
Medical Billing Audit Checklist
- Scope, sample size and date range written down before the review starts
- Complete records, claims and remittances for every sampled encounter
- Current CPT, HCPCS and ICD-10-CM code sets and payer policies on hand
- Each encounter coded independently, then compared with what was billed
- Findings recorded by type: E/M level, modifier, diagnosis, units, charge, documentation
- Accuracy rate and dollar impact calculated per provider
- Root cause recorded for every error
- Corrected claims and refunds handled and documented
- Education delivered and a re-audit date set
Internal Audit or Outside Medical Billing Audit Services?
Both work, and many practices use both. An internal audit is cheaper and faster, and it keeps feedback close to the providers. Its weakness is independence: if the same team that coded the claims also audits them, the same blind spots tend to repeat. Outside medical billing audit services bring certified auditors who review many specialties and payers, an objective view, and a report that carries more weight with leadership or a payer.
A practical approach is to run routine internal checks every month or quarter, and bring in an independent auditor once a year, for high-risk services, or whenever auditing medical claims turns up a pattern you can’t explain. Whoever does the work, the auditor should hold a recognized credential (for example CPC, CCS-P or CPMA), use current code sets and payer policies, and document every finding so it can be defended later.
Audits, Overpayments and Compliance
An audit can reveal that a payer was overpaid. For Medicare and Medicaid, providers must report and return an identified overpayment within 60 days. For Medicare Parts A and B, under the rule in effect since January 1, 2025 (42 CFR 401.305), that deadline can be suspended for up to 180 days while the provider completes a timely, good-faith investigation into related overpayments. Work with health care counsel on any significant findings, and keep the audit file. Exclusion screening is a related control; see our Medicare compliance screening checklist.
Specialty practices face their own audit risks. See our physical therapy billing audit checklist and our behavioral health insurance audit guide. For an independent review by certified coders, see our medical coding audit services.
Not sure how accurate your coding and billing really are? Steady Medical Billing will audit a sample of your claims and show you the accuracy rate, the dollar impact and the fixes, at no cost. Request your free RCM audit.
Frequently Asked Questions
What is a medical billing audit?
A medical billing audit is a review of a sample of claims against the medical record and payer rules to check that codes, modifiers, units and charges are supported, billed correctly and paid correctly. It finds lost revenue, compliance risks and process errors.
What is the difference between a coding audit and a billing audit?
A coding audit checks whether the CPT, HCPCS and ICD-10-CM codes and modifiers match the documentation. A billing audit looks wider, at whether claims were built, submitted and paid correctly, including charges, payments and payer rules. Most practices combine the two.
How often should a medical practice audit its coding?
Many practices run a baseline audit for each provider, then audit quarterly or yearly, plus focused audits when denials rise, a new provider or service starts, code sets change or a payer sends a records request.
How many claims should be in a coding audit sample?
There is no single required number. Many practices start with a small random sample per provider, often around 10 encounters, and expand the sample when the error rate is high. Focused audits review every claim for the issue in question.
What is a good coding accuracy rate?
Many practices aim for 95% or higher. That is a common industry benchmark rather than an official standard, so also track the dollar impact of errors, split into overpayments and underpayments.
What happens if an audit finds an overpayment?
For Medicare and Medicaid, an identified overpayment must be reported and returned within 60 days. Since January 1, 2025, for Medicare Parts A and B, that deadline can be suspended for up to 180 days while a timely, good-faith investigation of related overpayments is completed. Involve health care counsel for significant findings.
