The Medical Billing Audit Checklist: 47 Items

Item 1: Is real-time eligibility verification (270/271) run at scheduling for every patient? Item 2: Is eligibility re-verified at check-in to catch coverage changes since scheduling? Item 3: Are insurance card images captured and OCR-validated against the eligibility response? Item 4: Are demographics validated against payer records (subscriber name, DOB, ID format)? Item 5: Is the secondary payer identified at registration and the COB order confirmed? Item 6: For Medicare patients, is the MSP questionnaire completed (working spouse, workers' comp, no-fault, ESRD)? Item 7: Are time-of-service collections happening for known copays and outstanding balances? Item 8: Are referral requirements identified for HMO patients before service? Item 9: Are no-show and cancellation policies operationalized to capture documented patient acknowledgment? Front-end gaps are the single largest controllable source of CARC 27, 31, and 22 denials.

Item 10: Is there a documented list of which CPT codes require PA by payer, kept current? Item 11: For PA-required services, is the request submitted within 24 hours of scheduling? Item 12: Is the approved PA number captured into the practice management system attached to the encounter, and is there a scrubber edit that blocks PA-required CPTs from claim submission without an authorization number? Item 13: Are pending PAs tracked in a dashboard with daily follow-up until cleared? CARC 197 denials are almost entirely preventable with discipline at items 10-12; the most common failure is item 12 (PA was approved, but the number didn't get captured to the claim).

Item 14: Is there a defined coder review cycle for every claim above a specified complexity threshold (typically all surgical, all level-4/5 E/M, all infusion)? Item 15: Are coders certified (CPC, CCS, CCS-P) and is annual continuing education tracked? Item 16: Is documentation reviewed against the current CPT E/M guidelines — the 2021 revision that dropped history and exam as elements of code selection for office visits in favour of medical decision making or total time, extended to the remaining E/M categories in the 2023 code set? Item 17: Are modifier 25, 59, 76, 77, and 91 applied consistently against NCCI edits? Item 18: For surgical claims, are global period rules (0, 10, 90 day) correctly applied? Item 19: Are diagnosis codes coded to highest specificity supported by documentation (no unspecified codes when specificity exists)? Item 20: Is there a query process when documentation is unclear, and is query response timeliness tracked? Item 21: Is the coder error rate by type tracked monthly? Item 22: Are coder audits performed quarterly with a minimum 25-chart sample? Coding gaps are the second largest revenue leak category and the largest compliance exposure.

Item 23: What is the documented clean claim rate, and under which definition? HFMA's MAP Keys define Clean Claim Rate (CL-1) as claims passing edits with no manual intervention over claims accepted into the claims processing tool for billing — which is not the same event as clearinghouse acceptance. MAP Keys publish the equation and the inclusions only; they publish no target value, and no free primary source publishes a clean-claim-rate target, so the number to beat is your own trailing baseline. Item 24: Are scrubber edits maintained against payer-specific rules and updated when payer policies change? Item 25: Is charge lag measured and bounded by a written internal SLA? MAP Keys defines Total Charge Lag Days (PB-4) as the days between date of service and the revenue-recognition posting date, averaged across charge codes billed — a definition, with no target attached, so the threshold has to be yours and it has to be written down. Item 26: Are NPI, taxonomy, and tax ID validated on every claim against NPPES and against the payer enrollment file? Item 27: Is place-of-service consistent with the rendering location (POS 11 office, POS 22 hospital outpatient, POS 02 telehealth)? Item 28: Are duplicate claim submissions prevented by the system, and are CARC 18 (duplicate) denials trended? Submission failures are the most measurable category — every gap shows in the CCR number.

Item 29: Is the denial rate trended monthly by CARC code, with the top 5 codes broken out separately? Item 30: Is the median time from denial receipt to first appeal action under 14 days? Item 31: Is appeal recovery rate tracked by denial type and by payer? Item 32: Is there a documented escalation path for denials that fail first-level appeal (peer-to-peer, second-level appeal, external review)? Item 33: Are denial root causes traced back to the front-end or coding stage that produced them, with feedback loops to prevent recurrence? Item 34: Are write-off thresholds enforced — no claim written off without documented appeal exhaustion or supervisor approval? Denial management is where most aged A/R sits; an unworked denial queue is the single biggest source of NCR drag.

Item 35: Is days in A/R computed under a stated formula, and the same one every month? MAP Keys' Net Days in A/R (FM-1) divides net A/R by average daily net patient service revenue; AAFP's method divides total receivables by average daily charges over a chosen period, net of credits. The two are not interchangeable, and switching between them mid-year manufactures a trend that is not there. Item 36: Is the aging bucket distribution (0-30, 31-60, 61-90, 91-120, 121+) reviewed monthly? Item 37: Is A/R over 90 days tracked as a percentage of total A/R against a threshold the practice has set and written down? No free primary source publishes a target for it. AAFP points specifically at the greater-than-120-day bucket, because good overall days in A/R can mask elevated older receivables. Item 38: Is there a defined work queue for each aging bucket, with daily worklist assignment? Item 39: Are bad debt write-offs reviewed and approved at the appropriate authority level, with documented criteria? A/R management is the recovery layer — gaps here turn front-end and coding mistakes into permanent revenue loss rather than recoverable rework.

Item 40: Are payer contract allowed amounts loaded into the practice management system, current to the most recent contract amendment? Item 41: Is each payment posted compared to the loaded allowed amount, with underpayments flagged automatically? Item 42: Are fee schedule rates set as a stated multiple of the current Medicare Physician Fee Schedule, with the multiple and its rationale documented? We publish no recommended multiple — the figures in circulation are trade-press convention rather than a sourced benchmark, and the defensible one depends on your payer mix and contracted rates. Item 43: Are renegotiation cycles documented, with major payer contracts reviewed at least every 24 months? Contract loading is one of the largest hidden revenue leak categories — payer underpayments that go undetected because the loaded rate doesn't match the contract rate represent immediate recoverable dollars.

Item 44: Is the HIPAA risk assessment current (within 12 months) and documented with mitigations for identified risks? Item 45: Are workforce members with PHI access trained annually, with documentation? Item 46: Is the OIG work plan reviewed annually and findings mapped against the practice's billing patterns (e.g., E/M upcoding scrutiny, modifier 25 utilization, telehealth POS)? Item 47: Are billing-side fraud red flags monitored — duplicate submissions, unusual coding patterns, after-hours billing activity, single-coder claim approval bypasses? Compliance audit findings rarely produce immediate revenue impact but represent the largest tail risk — a False Claims Act exposure can cost more than the entire billing operation in a year.

A thorough billing audit covers five areas: coding accuracy across all providers and service lines, denial root causes broken down by payer and reason code, A/R aging distribution with follow-up activity tracking, payer contract compliance including fee schedule validation against actual reimbursements, and front-end processes like eligibility verification, authorization workflows, and charge capture. Each area should produce specific findings with dollar amounts attached — not vague recommendations. You should know exactly how much revenue is at risk in each category.

Certain findings demand immediate attention: a single payer whose denial rate sits materially outside the rest of your book — AAFP's guidance puts the industry average at 5% to 10% with below 5% more desirable, so the signal is the outlier rather than any absolute threshold; A/R over 90 days materially above your own trailing baseline or concentrated in one payer; consistent underpayments against contracted rates; missing or lapsed provider credentials with active claims; recurring coding errors on the same CPT codes; and authorization denials that could have been prevented with better intake workflows. If your audit does not quantify these issues and rank them by financial impact, it is not actionable.

> This is an illustrative example demonstrating MedPrecision's reporting methodology. It is not presented as the result of an actual client engagement. Every practice-level figure below is synthetic. No patient, practice, or payer data appears anywhere on this page. Where a public benchmark comparator is shown, it is real and cited.

Example Practice A — the same illustrative practice used across all of our sample deliverables, so the artifacts can be read end to end: a four-physician, two-APP family medicine group in Ohio, roughly 2,050 encounters and $412,000 in gross charges per month. Reporting period: June 2026.

The 47-item checklist above is the instrument. This is what a completed findings report looks like when that instrument is run — the deliverable, not the method.

Scope and method

Findings, in both directions

An audit that reports only under-coding is a revenue-maximisation exercise. Reporting over-coding is what makes the rest of the numbers credible — and it is the finding that carries actual compliance risk.

Finding 2 is the one that matters most, and it reduces revenue. Six claims carried a modifier 25 that the documentation does not support. The correct response is a repayment review, not an appeal. An auditor who did not surface this would have produced a more flattering report and a larger liability.

Remediation

Why no headline dollar figure. A findings report of this kind can responsibly quantify denied dollars, because those are observed. It cannot responsibly quantify "recovered" dollars in advance, because recovery depends on payer response, appeal outcome and timely-filing runway. Any audit that opens with a single recovery number has estimated it. We would rather show the denied dollars, the error rate, and the direction of each error.