Medical billing audit services: coding, claims and charge capture

What is a medical billing and coding audit?

A medical billing and coding audit compares what was billed with what the record supports. For each sampled claim, the reviewer reads the chart, checks the codes, modifiers, units and charges on the claim, and records every difference. The result is an error rate and a list of causes, not just a list of mistakes.

The record behind a claim matters as much as the code. CMS's E/M guide says the documentation must support the level of service reported to a payer, and that the volume of documentation should not decide the level. So the reviewer starts from the note, not from the code.

What does a billing and coding audit check?

An audit scores each sampled claim on separate areas, so you can see where errors cluster. The table lists them.

The next sections take the main areas one at a time.

How big a chart sample is enough for a coding audit?

No federal rule sets one sample size. The OIG guidance for small physician practices says, "there is no set formula to how many medical records should be reviewed," and gives a basic guide of five or more medical records per federal payor, or five to ten medical records per physician. That guide is a floor for a small practice, not a standard for a hospital.

We choose the sample from the structure of your billing, not from a fixed number. The sample is random within strata so that high-volume and high-dollar claims cannot hide errors. Strata usually follow payer, claim type, provider and the codes that carry the most revenue or the most risk.

The same OIG text says a larger sample gives more comfort and encourages review of claims from every federal payor. If an early pass finds problems, widen the sample for that area.

How do you audit E/M and facility level accuracy?

For office and outpatient visits, CMS lets the practitioner choose the E/M level by medical decision making (MDM) or by total time on the date of the encounter. The reviewer checks that the level billed is supported by whichever method the note actually uses. CMS's MLN E/M booklet (MLN006764, May 2026) describes that choice and the date-of-encounter rule.

For time, the reviewer checks that the note states total time on the date of the encounter. For MDM, the reviewer checks that the problems, data and risk in the note support the level.

Facility level for ED and clinic visits

For emergency and clinic visits billed on the UB-04, the reviewer checks the facility level against the facility's written leveling criteria. The questions are whether the criteria exist, whether the nursing and resource documentation matches the level, and whether the same criteria were used all year. The detail is in ED facility level coding.

Both directions count. An audit finds visits billed too high, which create repayment exposure, and visits billed too low, which are lost revenue. CMS's own PEPPER tool tells hospitals to use it to pinpoint areas needing auditing and monitoring, including DRGs at risk of under-coding or over-coding.

How do modifiers and NCCI edits get audited?

NCCI is the CMS program that promotes correct coding of Medicare Part B claims, and it publishes procedure-to-procedure (PTP) edits and medically unlikely edits (MUEs) that CMS updates quarterly. The audit tests each sampled claim against the edit files in force on the date of service. See NCCI edits.

Each PTP edit carries a correct coding modifier indicator. An indicator of 0 means no modifier can bypass the edit, 1 means a PTP-associated modifier can bypass it under appropriate circumstances, and 9 means use of such modifiers is not specified. The 2026 NCCI Policy Manual says a modifier must not be added solely to bypass an edit when the clinical circumstances do not justify it.

That sentence is the core of a modifier audit. The reviewer opens the note and asks whether the clinical story supports the modifier: a separate encounter, a separate site or a separate specimen for the distinct-service modifiers, and a significant, separately identifiable E/M for modifier 25.

See also modifier 25 and modifier 59. Modifier 22 is different: it does not bypass an NCCI edit, so the reviewer checks it against the record separately.

Where a commercial plan paid the claim, the reviewer also checks that payer's own edit policy.

Do audits cover facility claims as well as professional claims?

Yes. We audit professional claims on the CMS-1500 and facility claims on the UB-04, and the checks differ because the claims are built differently. On a UB-04 the reviewer works field by field, using the CMS Claims Processing Manual, Chapter 25, for the form locators.

Inpatient claims add a MS-DRG check: whether the diagnoses and procedures in the record support the DRG that was grouped. See MS-DRGs.

Where the hospital also bills professional fees, the reviewer checks the matching CMS-1500 claim too.

Can an audit find missed charges and underpayments?

Yes. A charge capture review looks for services that appear in the record but never reached a claim, and a payment review looks for claims paid below the contracted or required amount. Both are lost revenue, and neither shows up as a denial.

The reviewer starts at the chart, not the claim. Procedure notes, supply logs, implant records and add-on services are compared with the charges that posted. Anything documented and not charged goes on a missed-charge list with a dollar estimate.

For payment accuracy, the reviewer compares each paid claim with the remittance advice and the contract or fee schedule. Short payments and unexplained adjustments are listed by payer so they can be appealed or raised with the payer. Denial management and A/R recovery take those items forward.

How do you audit NSA out-of-network payments against the QPA?

For out-of-network emergency and other covered services, the audit compares what the plan paid with the plan's qualifying payment amount (QPA). Under 45 CFR 149.140(b), the median contracted rate that the QPA is built on is found by ordering the plan's contracted rates for the same or similar item or service, in the same region, from least to greatest and taking the middle one.

The review lists each paid claim next to its QPA and billed amount and flags payments low enough to dispute. Flagged claims go to open negotiation and, if needed, federal IDR. The full method is on qualifying payment amount, and dispute work is on out-of-network billing and IDR.

What is a pre-bill versus a post-bill audit?

A pre-bill audit reviews claims before they are sent, so errors are fixed before a payer sees them. A post-bill audit reviews claims already submitted or paid, which finds patterns and any overpayment that needs to be returned.

The OIG physician practice guidance says each practice has to decide whether to review claims retrospectively or concurrently, so both approaches are accepted. Most groups use a pre-bill review for the highest-risk codes and a post-bill review for the full picture.

What do I get at the end of an audit?

You get a written report, the corrected-claims list and an education plan. The report scores each category separately, so you can see whether the problem is E/M levels, modifiers, charge capture or facility fields.

Audit findings are handled under the Business Associate Agreement we sign with every client, and our staff are covered by HIPAA training and NDAs.

How do audits fit a compliance program and protect us in a payer or RAC audit?

Regular billing and coding audits are part of a compliance program, not a substitute for one. The HHS-OIG General Compliance Program Guidance, published in 2023, places risk assessment, auditing and monitoring in Element 6 and says audits may be run by internal or external auditors with expertise in federal and state health care requirements.

The same guidance says small entities should conduct at least an annual audit, and lists remediation such as repaying overpayments, changing processes and educating personnel. It is voluntary and not binding.

In a payer or RAC review, an audit gives you a dated record of how you sampled and what you fixed, and you found your own errors first. CMS describes Recovery Audit Contractors as reviewing claims after payment to detect and correct past improper payments.

An audit can also create an obligation. Under 42 CFR 401.305, a person who has received a Medicare overpayment must report and return it by the later of 60 days after it was identified or the date any corresponding cost report is due. Have counsel review audit results that point to a possible overpayment.

How we handle billing and coding audits

We scope the audit with you, draw the sample, review each claim against the record and the payer rules, and report by category. The team includes AAPC and AHIMA certified coders. Our UB-04 checks cover bill type, revenue codes, patient status, condition and occurrence codes, authorization requirements and payer-specific rules.

Findings feed medical coding, denial management and revenue cycle management, so a fix found in an audit reaches future claims.

In our own billing, claims go out within 24 hours of charge entry and denials are worked within 48 hours. To discuss a scope, book a call.