Medical Coding Audit Buyer's Guide: What to Know Before You Hire

A medical coding audit takes a sample of your billed claims and asks one question of each chart: does the documentation support the codes that were submitted? An auditor — ideally an AAPC- or AHIMA-credentialed coder who is independent of the person who originally coded the chart — pulls the encounter note, operative report, or other source documentation and re-codes it blind, then compares their result to what was billed.

The review covers four code families on every chart:

1. Diagnosis codes (ICD-10-CM). Is each diagnosis documented, coded to the correct specificity, and sequenced correctly? Unspecified codes where a specific one was documented are a common finding.
2. Procedure / service codes (CPT and HCPCS). Does the documentation support the level of service billed? For E/M codes, do the time or medical-decision-making elements meet the 2021+ E/M guidelines for the level submitted?
3. Modifiers. Were modifiers like 25, 59, 24, and the X-modifiers (XE, XS, XP, XU) used correctly and supported by documentation? CMS's own rule is that a modifier must not be appended to a code solely to bypass an edit where the clinical circumstances do not justify it, and the documentation must support the modifier — which is exactly what this part of the review tests.
4. Medical necessity and linkage. Is each procedure linked to a diagnosis that establishes medical necessity, consistent with applicable LCD/NCD policy? The OIG's General Compliance Program Guidance says this part of a claims review should be performed by an appropriately credentialed clinician — so confirm who, on any audit you buy, is doing it.

The deliverable is not just 'you made mistakes.' A real audit produces a scored error rate, a categorized list of findings (by type, by provider, by code), the financial exposure (over- and under-billed dollars), and a corrective-action plan. If a vendor hands you a pass/fail with no error rate and no findings detail, you bought a spot-check, not an audit. For the document-by-document version of this process, see our medical billing audit checklist.

The single most important decision in scoping a coding audit is timing — whether you review claims before they are submitted (prospective) or after they have been paid (retrospective). Most mature compliance programs run both.

Prospective audits are the safest place to catch a problem because nothing has been billed yet — you fix the code, not a paid claim. They are the right choice for onboarding a new provider, rolling out a new service line, or watching a code that has burned you before. The trade-off is that holding claims for review slows cash on the sampled charts.

Retrospective audits are how you measure where you actually stand and how you satisfy the OIG's expectation of periodic monitoring. The catch every buyer must understand, and the detail most summaries get wrong by generalising it: the 60-day overpayment rule is a federal health care program rule, not a rule about payers at large. 42 CFR 401.305 defines an overpayment as funds received or retained under title XVIII of the Social Security Act — Medicare — to which the person is not entitled, and requires that a person who has received one report and return it by the later of 60 days after the date it was identified or the date any corresponding cost report is due; the regulation also states that a person has identified an overpayment when the person knowingly receives or retains it. A parallel obligation applies to Medicaid. Commercial overpayments are governed by your payer contract and by state law instead, on entirely different clocks. So a retrospective audit can create an affirmative federal obligation to refund money — that is the feature, not a bug, that makes a voluntary audit a False Claims Act defence rather than a liability — but scope it knowing which of your payers that obligation actually attaches to. Run it under your compliance officer and, for high-risk findings, attorney-client privilege.

The second scoping decision is how charts are selected. A random audit measures overall coding health; a focused audit investigates a specific suspected problem. The OIG's compliance guidance contemplates both, and a strong program alternates between them.

Random/baseline audits are your annual physical. They tell you the practice-wide accuracy rate. Because the sample is random, the result is generalizable to your whole population — that is what makes it a defensible compliance artifact, and it is also why the threshold you measure against has to be one you set and document yourself (see the sample-size section below; no federal agency publishes an accuracy target).

Focused audits are diagnostic. You run one when something is already pointing at a risk: a provider whose E/M distribution skews far higher than peers, a CPT code with an abnormal denial rate, a modifier 25 pattern, or a code that appears on the current OIG Work Plan or a CERT/RAC target list. Because every chart in a focused audit shares the risk factor, the error rate will (correctly) look higher than a random sample — you chose the charts most likely to be wrong. A focused error rate is therefore not comparable to a random-sample rate at all, and trending the two together is the most common way an audit programme misreads its own data.

In our coding audits we start a new client with a small random probe across providers to find where the risk concentrates, then convert to focused reviews on the one or two providers or codes that drive most of the exposure. The reason is structural rather than a performance claim we can put a number on: a random probe is the only sample that tells you where the risk is, and a focused review is the only sample that tells you how big it is, so running them in that order answers both questions with fewer charts than auditing everyone equally.

Coding errors are not all the same kind of problem. A good audit report sorts findings into categories, because each category has a different financial and compliance meaning.

Upcoding — billing a higher-paying code than the documentation supports (for example, a level-5 E/M, 99215, when the note only supports a level 3, 99213). Upcoding is the highest-compliance-risk finding because it represents money the practice was overpaid; sustained upcoding is the classic False Claims Act exposure and the reason E/M distribution is on nearly every OIG Work Plan.

Undercoding — billing a lower code than the documentation supports. Buyers often ignore this, but it is lost revenue you earned and did not collect, and a pattern of undercoding can paradoxically still draw scrutiny. A real audit reports undercoding dollars right alongside overcoding so you see net exposure in both directions.

Modifier misuse — appending (or omitting) a modifier the documentation does not support. The usual suspects are modifier 25 (significant, separately identifiable E/M on a procedure day) used as a reflex, and modifier 59 / the X-modifiers used to unbundle without distinct-service documentation. CMS states the test plainly for the second group: medical documentation must support the use of the modifier, and a modifier must not be appended to a code solely to bypass an edit.

Unbundling — billing component codes separately when an NCCI Procedure-to-Procedure edit requires them to be billed as one, or splitting a single comprehensive service into parts. Unbundling typically surfaces in production as a CARC 97 or CARC 236 denial; an audit finds the pattern before the payer does.

The categories matter for what you do next: overcoding and unbundling create refund obligations and need corrective billing; modifier and documentation findings need provider education; undercoding needs a revenue-recovery (and re-bill where timely) workflow.

A coding audit is not just an operational exercise — it is a documented element of a compliance program, and the OIG has been explicit for decades about what it expects. It has been much less explicit about numbers than the industry suggests, and the difference matters when you are evaluating a vendor's claims.

The OIG compliance-program baseline. The HHS Office of Inspector General's General Compliance Program Guidance makes risk assessment, auditing and monitoring Element 6 of the seven elements of an effective compliance program. It expects the compliance work plan to carry a schedule of audits driven by an annual risk assessment, and it says those audits may be run by internal or external auditors with expertise in Federal and State health care requirements. It also sets a scope requirement most coding-audit statements of work quietly omit: because Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary, entities should ensure claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician — OIG's stated concern being that audits without that clinical review fail to identify medical-necessity compliance problems at all. When you scope an audit, decide explicitly whether medical-necessity review is in it, and who performs that part.

The accuracy benchmark that does not exist. A 95% coding accuracy target is quoted across this industry, usually attributed to the OIG. It is not an OIG figure. The OIG's compliance guidance for physician practices (65 Fed. Reg. 59434, 5 October 2000) sets no accuracy target and no error-rate threshold, and neither does the current General Compliance Program Guidance. We checked both, in full, on 17 September 2026. That leaves the threshold where it actually belongs: a number your practice sets, writes down, and applies consistently — so that 'below threshold' triggers a defined response (corrective action, education, re-audit) rather than a debate. A documented internal standard you actually enforce is a stronger compliance artifact than a borrowed number with no publisher behind it.

The CMS audit context you are insulating against. Independent coding audits exist partly to keep you off the wrong end of CMS's own programs: the Comprehensive Error Rate Testing (CERT) program that measures the Medicare fee-for-service improper-payment rate, the Recovery Audit Contractor (RAC) program that recovers overpayments, and Targeted Probe and Educate (TPE), under which a MAC reviews 20 to 40 of a provider's claims and supporting medical records per round, offers one-on-one education after each round, allows at least 45 days to make changes, and can repeat the cycle up to two more times before referring a provider who has not improved to CMS. MACs select for TPE on the basis of high denial rates or billing that varies from peers. A voluntary internal audit finds and fixes the same errors on your terms and timeline.

Independence and credentials. For an audit to be defensible, the auditor should be independent of the original coder and hold a recognized coding credential (for example AAPC's CPC or CPMA, or AHIMA's CCS or RHIT). An auditor grading their own work is not an audit. When evaluating coding audit vendors, ask who codes, what credential they hold, whether the reviewer is separate from your day-to-day coding team, and — per the OIG guidance above — who performs the medical-necessity portion of the review.

The 60-day rule, again. Because retrospective findings on Medicare and Medicaid claims can create a reporting-and-return obligation within 60 days of identification, many practices run higher-risk audits under their compliance officer and, where warranted, attorney-client privilege. That does not let you ignore findings — it structures how identification and the resulting obligation are handled.

Two numbers define an audit's rigor: how many charts are reviewed and what error rate triggers escalation. Buyers should ask about both before signing — and should know which of the numbers a vendor quotes have a publisher behind them.

Sample size. There is no legally mandated number. There are two published reference points, and they are smaller than the figures usually attributed to them:

• The OIG's guide for physician practices — five or more records per Federal payor, or five to ten records per physician. The OIG's compliance program guidance for individual and small group physician practices (65 Fed. Reg. 59434, 5 October 2000) states that although there is no set formula for how many medical records should be reviewed, a basic guide is five or more medical records per Federal payor (Medicare, Medicaid), or five to ten medical records per physician — adding that the larger the sample, the greater the confidence in the result. The widely repeated '20 to 40 charts per provider, per the OIG' is not in that document; we read it in full on 17 September 2026.
• CMS's Targeted Probe and Educate — 20 to 40 claims per round. CMS states that a MAC reviews 20 to 40 of a provider's claims and supporting medical records per round, for up to three rounds. This is the source of the 20-40 figure, and it describes a regulatory review of one targeted topic, not an OIG recommendation for a voluntary baseline audit. Useful as a mental model for what a focused regulatory look feels like; not a sampling standard for your own programme.
• Statistically valid random samples for extrapolation. When findings will be projected across a whole population, the sample must be designed for statistical validity — a sampling statistician's question, not a rule of thumb. If a vendor intends to extrapolate overpayments, the sample design has to support it and the methodology has to be in the report.

In practice a routine compliance audit sits somewhere between the OIG's five-to-ten per physician and the larger samples a practice chooses for confidence; larger costs more and tells you more, and that trade-off is yours to set explicitly rather than inherit from a vendor's default.

Error-rate thresholds. Score the audit two ways and report both:

1. Coding accuracy rate = charts coded fully correctly / charts reviewed.
2. Financial error rate = net dollars miscoded / dollars reviewed. This is what a payer extrapolates from, and it can differ sharply from the accuracy rate if a few high-dollar charts drive the error.

No federal agency publishes an acceptable value for either, which means the escalation trigger is a policy decision your practice makes and documents in advance. Set it, write it into the compliance plan, and apply it without negotiation: a finding of sustained upcoding, an accuracy rate below your documented threshold on a random sample, or any single error pattern that repeats across providers should trigger a corrective-action plan, provider education, and a follow-up audit to confirm the fix held.

Pricing for medical coding audit services is one of the least transparent line items in revenue cycle, and the ranges quoted across vendor content are the reason. There is no free, primary survey of coding-audit pricing — no federal agency, professional body or public dataset publishes one — so any range you read, including ranges we previously published on this page, is somebody's impression presented as a market figure. We removed ours rather than restate it. What we can give you is the structure, which is what you actually need to compare two quotes.

The four pricing structures, and what each one is suited to:

What moves the price within any of them: surgical and interventional specialties (operative-note review is slower than office E/M), prospective timing (charts are reviewed individually before billing), whether medical-necessity review by an appropriately credentialed clinician is in scope, extrapolation-grade statistical design, included provider-education sessions, and turnaround time.

What to make sure is in scope before you sign: a written error rate (accuracy and financial), categorized findings by type and provider, the over- and under-billed dollar figures, a corrective-action plan, a debrief, and a named methodology including how the sample was drawn. The cheapest per-chart quote that returns a spreadsheet with no scored error rate and no corrective plan is not a compliance-grade audit — it is data entry. Ask every vendor to quote the same scope in writing; a quote that will not state its sample design is not comparable to one that will.

Our own coding audit is quoted against your scope — chart volume, specialty mix, timing, and whether medical-necessity review is included — not from a published rate card, and the quote states the sample design and the deliverable before any charts are pulled. Pair the audit with ongoing medical coding services and the corrective-action loop closes instead of recurring next quarter.

A coding audit pays for itself not only through recovered and protected dollars but by killing the recurring denials that the same coding errors generate week after week. These are the named denial codes a coding audit most often traces back to a fixable coding pattern.

The pattern is consistent: a coding audit converts a stream of recurring denials into a handful of root-cause fixes. Where an audit finds that a share of one provider's level-5 E/M visits is not supported by the note, fixing that documentation pattern removes the downstream denials and the audit exposure in one move — which is why findings are reported by provider and by code rather than as a single practice-wide score. For the denial-side workflow that complements the audit, see our denial management guide and the full CARC denial codes list. When the audit's corrective-action plan needs an owner, outsourced medical billing audit services can run the audit, the fix, and the re-audit end to end.