How big a chart sample do you need for a coding audit?
It depends on what the audit is for, and no single number fits all three common purposes. For routine monitoring, the OIG's physician practice guidance gives a basic guide of five or more records per federal payor or five to ten per physician. To estimate an overpayment amount, the OIG's Self-Disclosure Protocol requires a statistically valid random sample of at least 100 items. For a Medicare contractor's extrapolation, CMS says it is neither possible nor desirable to set a minimum sample size for all situations.
Written by Salman Saeed, CEO and Co-Founder · Reviewed by a Certified Medical Coder · 
In short: pick the purpose first. A small random sample is enough to spot a pattern and educate coders, but a projection of dollars needs a defined population, random selection, a documented method and, under the OIG protocol, at least 100 items. Missing records count as errors, and a statistician should design anything you will rely on for a refund.
Which sample size applies to which audit purpose?
Match the sample to the decision you will make with the result. The table sets out what each official source says. None of them gives a single number for every audit, and none sets a pass mark for an error rate.
| Purpose | What the source says | Source |
|---|---|---|
| Routine monitoring and coder education | A basic guide is five or more medical records per federal payor, or five to ten per physician; there is no set formula, and a larger sample gives more comfort | OIG compliance guidance for individual and small group physician practices |
| Estimating an overpayment to disclose to OIG | A sample of at least 100 items, selected by random numbers, using the mean point estimate; smaller samples near 100 suffice for a homogeneous population and larger ones for a mixed one | OIG Health Care Fraud Self-Disclosure Protocol |
| A Medicare contractor projecting an overpayment | Neither possible nor desirable to specify a minimum sample size for all situations; the lower limit of a one-sided 90 percent confidence interval is normally used for the demand | CMS Program Integrity Manual, chapter 8 |
Read the first row as a floor for a routine check, the second as the floor for a number you might return to the government, and the third as a reminder that validity comes from the method, not from a magic count.
How do you draw a sample that will hold up?
Define the population first, then draw randomly from a list of every item in it. The Self-Disclosure Protocol asks for a statement of the review objective, a description of the population and how it was built, the sampling unit and the sampling frame. It also asks for the source of the random numbers, and it strongly recommends OIG's free RAT-STATS software.
- State the objective in one sentence, such as "estimate the rate of unsupported level 5 emergency visit codes in 2026."
- Define the population: which provider, payers, dates of service and code family.
- Build the sampling frame, a list of every claim that fits, and note any that fall outside it.
- Pick the design. The protocol says to use simple random sampling unless you can show a need for stratified or multistage sampling.
- Generate random numbers with software, and record the source and the settings, so someone else could repeat the draw.
- Pull the charts. A missing record counts as an error under the protocol, because rules require the retention of support for submitted claims.
- Have qualified reviewers score each claim against a written standard, and name them in your report.
CMS describes the same discipline for its own contractors: document the methodology so it can be replicated, and use a statistician. A sample you cannot reproduce is a convenience sample, and it will not support a refund calculation or a challenge to a payer.
How do you score the sample and read the error rate?
Count claims with at least one error, then separate the error types and the dollars. A single error rate hides whether the problem is upcoding, undercoding, a missing modifier or missing documentation, and each has a different fix.
A group has 4,000 claims in the frame. A random sample of 100 shows 9 with errors: 6 overcoded, 2 undercoded and 1 with no supporting note. Across the sample, overpayments total $1,260.00 and underpayments total $210.00. Under the protocol, the damages estimate does not net underpayments against overpayments. The average audited difference is $1,260.00 divided by 100 claims, or $12.60, and the difference estimator multiplies that by the 4,000 claims in the frame.
The Self-Disclosure Protocol names this method: variables sampling with the difference estimator, in which the total error is estimated by multiplying the average audited difference by the number of units in the population. The example shows only the arithmetic. Have a statistician confirm the design and the confidence interval before you rely on it.
Track underpayments too, even though they are not netted in an OIG estimate. They are money you did not bill, and they show whether coders are being too cautious.
When should you expand the sample?
Expand when a small sample shows a pattern you cannot ignore. Start with a probe sample, such as the five-to-ten record guide, and if it shows a repeated problem, draw a larger random sample from the whole population. The protocol allows probe-sample claims to be counted in the 100-item sample if that is statistically appropriate.
Expanding has consequences. Under 42 CFR 401.305(a)(2), a person has identified a Medicare overpayment when it knowingly receives or retains it, and under 401.305(b)(1) it must be reported and returned by the later of 60 days after identification or the date any corresponding cost report is due. The deadline is suspended while a timely, good-faith investigation into related overpayments is under way, until the investigation ends or 180 days after the initial identification, whichever is earlier. The lookback period is 6 years under 401.305(f). Talk to counsel before you expand a sample on a payer's money.
What can a small sample tell you, and what can it not?
A small sample can show that a problem exists and which coders or codes to look at. It cannot support a dollar projection. If 3 of 10 sampled emergency visit levels are unsupported, you have learned where to look and who to train. You have not learned the size of the exposure.
For work on level selection, the E/M level post and the ICD-10 mistakes post are good sources of audit standards, and the pre-bill versus post-bill post explains when in the claim's life to sample.
How Nucleus Align handles it
Our billing and coding audits are a paid service, and our coding team includes AAPC and AHIMA certified coders. We sign a Business Associate Agreement with every client. If you are planning a first audit for a group like emergency medicine, book a call and bring the population you want reviewed.
- Compliance Program Guidance for Individual and Small Group Physician Practices, 65 FR 59434 · Federal Register
- OIG Health Care Fraud Self-Disclosure Protocol (April 17, 2013, amended November 8, 2021) · HHS Office of Inspector General
- Medicare Program Integrity Manual, chapter 8, section 8.4 · CMS
- 42 CFR 401.305, Requirements for reporting and returning of overpayments · eCFR
We check every rule, code and deadline against the official source. See our editorial policy.
Common questions
Straight answers from the team that does the work.
Ask a billing lead directly. A 20-minute call, Monday to Friday, 9am to 5pm Eastern.
01How many charts should I review for a coding audit?
The OIG's physician practice guidance gives a basic guide of five or more records per federal payor or five to ten per physician for routine review, with no set formula. For a statistically valid overpayment estimate, the OIG Self-Disclosure Protocol requires at least 100 items.
02What sample size does the OIG require for an overpayment estimate?
The Self-Disclosure Protocol requires a sample of at least 100 items selected through random numbers, using the mean point estimate. It adds that sizes closer to 100 suffice for a homogeneous population and larger ones are needed for a mixed population, and it sets no minimum precision level.
03Does CMS set a minimum sample size for extrapolation?
No. Chapter 8 of the Program Integrity Manual says it is neither possible nor desirable to specify a minimum sample size that applies to all situations. It stresses a probability sample drawn correctly and a documented method, and normally uses the lower limit of a one-sided 90 percent confidence interval.
04What error rate is acceptable in a coding audit?
The sources reviewed for this post set no pass mark. Decide your own threshold in advance from your risk, track error types and dollars separately, and treat repeated errors in the same code or by the same provider as findings even when the overall rate looks low.
05Do missing charts count as errors in a sample?
In the OIG Self-Disclosure Protocol, yes. Missing sample items are treated as errors because federal program rules require retention of supporting information for submitted claims. Note every missing item in your report, and fix the retrieval problem at the source so the next sample is complete.
Talk to a billing lead.
A 20-minute call about your payers, volume and setup. Monday to Friday, 9am to 5pm Eastern.