A paid claim can still contain a billing error. A denied claim can be correctly coded. The medical billing audit process examines the evidence behind both outcomes by connecting the clinical record, submitted claim, payer requirements, and payment transaction.
The financial exposure is measurable. The Centers for Medicare & Medicaid Services (CMS) reported in its Fiscal Year 2025 Improper Payments Fact Sheet that improper payments represented 6.50% of Medicare fee-for-service payments, amounting to an estimated $28.80 billion. CMS explicitly distinguishes improper payments from fraud: the category includes underpayments, overpayments, and payments whose accuracy cannot be established from available documentation.
For healthcare providers and billing students, a useful audit answers three questions: Was the claim supported? Was payment handled correctly? What must change to prevent the same problem?
What does a medical billing audit examine?
A medical billing audit compares documented services and billing transactions against applicable coding, coverage, and payment requirements.
Its scope should extend beyond code selection. A medical coding audit process evaluates diagnoses, procedures, modifiers, and units. A broader healthcare billing audit also examines eligibility, authorization, claim submission, payment posting, adjustments, and patient balances.
Updated on March 4, 2026, CMS’s Medical Review and Education guidance explains that medical review involves analyzing claims and examining medical records to detect errors, ensure accurate payments, and recover improper payments. Its coverage references include national coverage determinations, local coverage determinations, and CMS manuals.
Build the review around the payer and service date. Save the applicable policy version alongside the finding so another reviewer can reproduce the decision.
Understand the different audit types
Audit labels describe either timing or who performs the review. An internal billing audit, for example, can examine claims before submission or after payment.
Audit type | Timing or ownership | Main review purpose |
Pre-bill audit | Before claim submission | Identify documentation and billing problems before release |
Post-bill audit | After submission, potentially before payment | Examine submitted claims and identify necessary corrections |
Post-payment audit | After payment | Validate payment, coding support, adjustments, and potential refunds |
Internal billing audit | Conducted for the practice | Evaluate selected risks and operational controls |
Payer audit | Initiated by an insurer or its contractor | Assess claims against applicable payment requirements |
Define these terms in the audit plan. Without clear definitions, staff may interpret a “post-bill review” as including payment reconciliation, even before the claim has been adjudicated.
Step-by-step medical billing audit process
1. Define the question and scope
Start with a specific question: Are procedure modifiers supported? Are paid claims matching contracted allowances? Are authorization denials concentrated in one service?
Document the providers, locations, payers, service dates, claim statuses, and exclusions. Also identify whether the review unit is an encounter, claim, or claim line. That choice affects error-rate calculations.
Assign an audit owner and reviewers with relevant specialty knowledge. Where practical, have someone other than the original coder or biller evaluate the work.
HHS Office of Inspector General’s General Compliance Program Guidance, published in November 2023, includes auditing and monitoring among its seven compliance-program elements. The guidance is voluntary and nonbinding.
2. Select claims that answer the question
Use targeted selection to investigate a defined concern, such as repeated modifier use, duplicate payments, or a particular denial category. Use a broader selection method when evaluating routine performance across the practice.
Document how records were selected. A sample containing only denied claims cannot establish the error rate for all submitted claims.
For illustration, reviewing 30 claims from one provider may reveal a recurring workflow problem. That error rate should not be automatically applied to every provider or used to estimate an organization’s total repayment liability. Statistical extrapolation requires an appropriate methodology.
3. Assemble the evidence
For each selected encounter, gather the clinical note, relevant orders and reports, submitted claim, claim acknowledgments, remittance advice, and account ledger. Include eligibility and authorization records when relevant.
Preserve the claim version actually transmitted. Comparing the chart only with a subsequently corrected billing screen can hide the original error.
Create a finding log that records the evidence reviewed, missing information, applicable rule, reviewer conclusion, and follow-up owner. Keep unresolved questions separate from confirmed errors.
4. Review coding and documentation together
The coding and documentation audit process should connect each billed service to supporting clinical evidence.
Check whether the record supports the diagnosis, procedure, service level, units, modifiers, and rendering provider. Evaluate medical necessity against the applicable coverage requirements.
For modifier reviews, passing a software edit is insufficient evidence. CMS’s 2026 National Correct Coding Initiative Policy Manual, Chapter 1, states that clinical circumstances must justify modifier use; a modifier cannot be added solely to bypass an edit. An edit with modifier indicator “1” permits an exception only under appropriate circumstances.
A practical finding should explain what is missing. “Modifier unsupported because the record does not establish a distinct service” gives the team something specific to investigate.
5. Trace submission through claim adjudication
Compare the reviewed claim with what reached the payer. Check identifiers, service dates, place of service, diagnosis links, authorization details, and submission history.
Separate transmission problems from payer decisions. Record whether the claim was rejected before adjudication, denied after processing, paid, or left pending.
This distinction guides corrective action. Repeatedly resubmitting a claim without identifying its processing stage can obscure the problem and complicate the account history.
6. Reconcile payments and patient balances
A medical billing and collections audit should compare expected reimbursement with the remittance and ledger.
Review the contracted allowance, payer payment, patient responsibility, contractual adjustments, reversals, and refunds. Reconcile posted receipts to the associated deposit.
Consider a hypothetical claim with an expected allowed amount of $120. An $80 insurance payment does not establish a $40 underpayment if the remaining $40 was correctly assigned to the deductible. Conversely, a zero balance does not establish correct payment if staff wrote off an unexplained shortfall.
Calculate potential revenue leakage from supported payment expectations, rather than billed charges alone.
7. Validate and classify findings
Before issuing the report, let the responsible team provide missing evidence or explain disputed transactions. Retain the original finding and document the resolution.
Classify confirmed issues by cause: documentation, coding, authorization, submission, payer adjudication, or payment posting. Distinguish overpayments, underpayments, and errors without an immediate financial effect.
Report both frequency and dollars. Ten minor posting errors and one high-value unsupported service require different responses, even if both appear in the same audit.
8. Correct the cause and recheck performance
Give every corrective action an owner, deadline, and verification method. Actions might include revising a claim edit, correcting a fee schedule, updating documentation prompts, or providing focused education.
Then review a fresh sample of the affected work. Rechecking only the corrected claims proves that those accounts changed; it does not demonstrate that new claims are accurate.
A practical medical billing audit checklist
Use this checklist as a starting point, then add specialty and payer requirements:
- Patient and coverage: Do identity, insurance, and coverage dates match the encounter?
- Provider: Are rendering and billing details consistent with applicable enrollment requirements?
- Documentation: Does the record support the service, date, authentication, and relevant clinical findings?
- Coding: Are diagnoses, procedures, units, and modifiers supported?
- Coverage: Are applicable medical-necessity, referral, and authorization requirements addressed?
- Submission: Is there evidence of the transmitted claim and its processing status?
- Payment: Do allowances, receipts, adjustments, and patient balances reconcile?
- Resolution: Does each finding have supporting evidence, an assigned action, and a follow-up date?
A chart audit checklist covers only part of this work. Pair it with claim and payment records to evaluate the entire transaction.
How to prepare for a Medicare or Medicaid audit
For an external request, identify the requesting organization, claims involved, submission instructions, and response deadline immediately. Assign one person to coordinate the response and retain proof of delivery.
CMS’s Additional Documentation Request guidance, updated March 4, 2026, specifies 45 calendar days for the listed Medicare Administrative Contractor reviews and post-payment reviews by Supplemental Medical Review Contractors and Recovery Audit Contractors. Listed Unified Program Integrity Contractor reviews allow 30 calendar days. Confirm the review type before calculating the deadline.
Prepare an indexed packet that addresses each requested item. Preserve original records and their amendment history.
For the Medicaid audit process, identify the state program, contractor, or managed care organization involved. CMS’s Medicaid program-integrity resources describe multiple oversight arrangements. Check the applicable state and plan instructions instead of importing Medicare response rules.
What happens when an audit identifies an overpayment?
Escalate confirmed overpayments promptly and investigate whether the same cause affected other claims.
Under 42 CFR § 401.305, Medicare Parts A and B overpayments generally must be reported and returned by the later of 60 days after identification or the corresponding cost-report due date, if applicable. The regulation includes a six-year lookback.
A timely, good-faith investigation into related overpayments can suspend the reporting-and-return deadline under specified conditions. That suspension ends when the investigation concludes and the aggregate amount is calculated, or 180 days after initial identification, whichever occurs first. It is not an automatic extension for every audit.
Document the discovery date, investigation steps, affected claims, calculations, and reporting method. Obtain compliance or legal guidance where the obligation or deadline is uncertain.
Measure whether the corrections worked
Track claim-level errors, unsupported coding, payment variances, and repeat findings separately. Define every denominator: claims with errors divided by claims reviewed measures something different from incorrect lines divided by lines reviewed.
Compare equivalent samples over time and record actual recoveries separately from estimated opportunities.
The medical billing audit process is complete only after findings receive documented resolution and follow-up review. A useful audit leaves the practice with traceable decisions, corrected transactions, and evidence that the underlying billing problem has been addressed.