Under-coding won't protect you.
Plenty of practices bill a level below what they did, on purpose, hoping conservative codes keep auditors away. The opposite happens. Auditors and payers both read patterns, and a steady habit of billing below the documentation reads as a coding problem from the outside. Medical Economics put it in a headline: under-coding won't save you; it could trigger a payer audit.
A coding audit is how you see your own patterns before a payer does it for you.
A medical coding audit is an independent review of how a practice assigns medical codes, comparing the codes on submitted claims against the clinical documentation behind them. The auditor samples patient charts, checks the CPT, ICD-10, and HCPCS codes against what the provider actually documented, and reports where the two don't match. The deliverable is a findings report plus an education plan, not a bill.
What a coding audit is, and what it is not
The coding audit checks one translation: the clinical note into codes. It does not check whether the claim went out on time, whether the payer paid it right, or whether the denial got worked. That is the billing audit's job, the wider review covering the whole revenue cycle from verification to payment posting. The two overlap at exactly one layer: the codes. For the full stack, read medical billing audits: what they cover.
Put simply, the coding audit checks whether the codes matched the visit, and the billing audit checks whether the money moved right. A practice that has never been checked may need both. Start with the coding audit when the question on your desk is about accuracy and compliance rather than cash flow.
The kinds of coding audits
Not every coding audit is the same job. Four types, and the one you need depends on what prompted it.
| Pre-bill (prospective) | Post-payment (retrospective) | Baseline | Focused | |
|---|---|---|---|---|
| When | Before claims go out | After claims are paid | The first audit a practice runs | A specific problem is already suspected |
| What it checks | A sample of claims before submission | Paid claims, checked against the notes | A broad sample across providers and services | One code, payer, provider, or procedure |
| Good for | New providers, new services, recent guideline changes | Finding patterns and measuring accuracy | Establishing "normal" so later audits are comparable | Denial spikes, a payer records request, a new high-dollar procedure |
| Weakness | Slows the claim flow | The money already moved | Takes the longest to set up | Answers one question, not the whole picture |
Medical Economics notes a rule of thumb some practices follow: audits for new providers run prospectively, audits for established providers run retrospectively. Either way, the baseline audit deserves attention. The HHS Office of Inspector General's compliance guidance for physician practices describes it as the audit that examines the claim development process from intake through payment, identifies what may contribute to non-compliance, and establishes the record-selection methodology every future audit follows. Without a baseline, each audit is a one-off. With one, you get a trend line.
What auditors sample
An audit that reads every chart would take forever and tell you nothing extra. The sample is the audit, in a sense: get it wrong and the findings don't generalize.
The common working range, per one firm ranking for this keyword: 10 to 15 cases per physician, with a mix of evaluation-and-management service types (new patient, established patient, consultation) and a similar count for each provider. Larger samples detect trends and outliers more accurately. Up to 10 percent of case volume is treated as a statistically valid sample, and a practice seeing heavy denials or rejections may push the sample higher.
Sampling also gets stratified. Random sampling gives every claim an equal chance; stratified sampling deliberately oversamples the claims where errors cost the most: high-dollar procedures, your most-billed codes, new providers, and payers with the worst denial mix. Both methods are legitimate. Ask the auditor which one is being used and why, and get the methodology in writing. A sample the auditor can't explain is a sample you can't trust.
One more rule, and it's yours to enforce: don't cherry-pick. Handing the auditor your cleanest charts turns the engagement into theater. The point is to see your real coding habits, under-coding and all.
What the auditor checks, line by line
At the chart level, the review is methodical. An auditor reference published by Optum describes the minimum coding audit as validating CPT code use (including the E/M level assigned), catching undocumented or underdocumented services, checking modifier use, and verifying diagnosis-code accuracy against medical necessity. Place of service and category of service get checked too.
In plain English, the auditor is answering these questions for each chart:
- Do the CPT and HCPCS codes match the procedures and supplies documented?
- Do the ICD-10 codes explain why the services were medically necessary?
- Is the E/M level supported by what is actually in the note?
- Are modifiers present, correct, and used only when appropriate?
- Was the right place of service billed?
- Are any services bundled that should not be, or unbundled that should not be?
- Is anything in the note missing, unsigned, or copied from another encounter?
Common findings, and what each one means
Findings cluster into a small set of categories.
| Finding | What the auditor sees | What usually fixes it |
|---|---|---|
| Upcoding | The code pays more than the documentation supports | Documentation that matches the level billed; E/M refresher training |
| Under-coding | The note supports a higher level than what was billed | Billing to the documentation instead of billing defensively |
| Modifier errors | Modifier -25 or -59 missing, wrong, or overused | A written modifier policy and a pre-bill check |
| Bundling problems | Separate codes billed for services that pay as one bundle, or one code where two were earned | Correct Coding Initiative (CCI) edit checks in the claim scrubber |
| Medical necessity gaps | The diagnosis code does not justify the service billed | Stating the "why" in the note, not just the "what" |
| Unsupported E/M level | History, exam, or decision-making thinner than the level billed | Documenting to the level you bill, every visit |
| Place of service errors | Office billed when the service happened at a facility, or the reverse | A place-of-service check at charge entry |
| Cloned documentation | Notes copied across encounters with only the date changed | EHR template discipline and spot checks |
Two of these surprise practice owners. The first is under-coding: leaving money on the table reads as a coding failure in an audit, and as noted up top, payers can read the pattern too. The second is cloned notes. Copy-paste is fast, and auditors know it. When five encounters read word for word, the documentation stops supporting any of them.
How the audit runs
Six steps, in order:
- Scope. You and the auditor agree on what is being checked: which providers, which date range, which payers, which audit type. Everything downstream follows this agreement, so read it like a contract.
- Data pull. The auditor needs the sampled claims and the clinical notes behind them. Nothing moves without a signed Business Associate Agreement. HIPAA treats the auditor as a business associate.
- Sampling. The auditor pulls the sample using the agreed methodology: random, stratified, or both. You should be able to explain the method back to someone afterward.
- Line-by-line review. A certified coder checks each chart code by code against the note. This is the slow part, and it is the part that matters.
- Validation. A serious auditor walks the preliminary findings past your team before finalizing. Some flagged "errors" are your workflow doing something unusual on purpose. The validation pass separates real findings from misunderstandings, and it is the one step that takes your staff's time.
- Report, plan, follow-up. The deliverable, covered next, then a corrective action plan with owners and dates, then a follow-up audit to confirm the fixes stuck. An audit with no follow-up is a diagnosis with no treatment.
What the report should contain
A usable coding audit report has five parts:
- An accuracy rate per provider. One firm ranking for this keyword cites HHS OIG guidance recommending accuracy rates of 95 percent or higher for physicians. However your auditor scores it, the number should be per provider, not blended across the practice, because coaching happens per provider.
- Claim-level findings, each tied to a specific claim, code, and note. Vague findings ("documentation needs improvement") are not findings.
- A trend view: which error categories repeat, which providers repeat them, which codes attract them. This is where the sample pays for itself.
- Education recommendations. The audit exists to change habits, so the report should say who needs training on what, not just what was wrong.
- A corrective action plan with owners and dates, plus a scheduled follow-up audit. Ask for the follow-up date before the engagement ends.
How to prepare your practice
Preparation is mostly about not getting in the way.
Don't pre-clean the sample. Pulling your best charts defeats the purpose. The auditor needs your real claims, including the ones your newest provider coded at midnight.
Have the basics ready. The provider roster, the date range of claims in scope, EHR access or chart exports, and whatever coding policies exist. If there are no written coding policies, say so. The auditor will find out anyway.
Fix documentation habits, not charts. Complete notes, signed and dated, with medical necessity stated rather than implied. Template the parts of the note that are always true, and free-text the parts that differ per patient. Auditors flag cloned notes fast, so templates need a human pass every time.
Stand up the compliance basics. The OIG's compliance guidance for physician practices names seven components of an effective program: written policies and standards, a designated compliance officer, training and education, open lines of communication, enforced disciplinary standards, internal monitoring and auditing, and prompt corrective action. You do not need all seven to run one audit. But a practice with none of them is exactly the practice that needs the audit most.
Self-audit or hire an auditor?
A practice can audit its own coding, with one condition: the reviewer can't be the coder. A certified coder reviewing someone else's work inside the practice is a credible internal audit. A coder reviewing their own charts is hygiene, not assurance.
The workable pattern: small self-audits quarterly, an external audit annually or after a trigger (a denial spike, a new provider, a new high-dollar service, a payer records request). External auditors bring pattern memory from across the practices they serve, which is how they know what a healthy error mix looks like. If the audit surfaces problems your in-house team can't fix, that's a staffing question, and the outsourcing framework covers it.
For the denial side of the same patterns, the denial causes catalog maps the rejection codes these findings tend to produce.
Five questions to ask before you hire
Borrow this list for the first call:
- Who does the review, and what are their credentials? Look for AAPC's CPMA, the auditing-specific certification.
- How do you build the sample, and will the methodology be in writing?
- Does the report include claim-level findings and per-provider accuracy rates, or just a summary?
- Do you validate preliminary findings with our team before finalizing?
- Does the engagement include the education plan and a follow-up audit, or does it end at the findings?
Our medical coding audit service page lists firms that offer this work, matched from the services they publish on their own sites. Our methodology explains how those listings are built, so you know what the match is based on before you start calling.