Most practices that run an internal coding audit can show you the spreadsheet. Few can show you what changed because of it. The sample gets drawn, the charts get scored, the findings get emailed around, and the same errors turn up in the next quarter’s sample. What separates an audit that lowers denials from one that produces a number is scope, a fixed scoring taxonomy, and a follow-up step with an owner and a date.
What this covers
- Sample by provider and by code family. A practice-wide average hides the clinician whose 99214 pattern differs from everyone else’s.
- Score against a fixed taxonomy, the same five categories Medicare uses for improper payments, so two auditors reach the same number on one chart.
- Report an error rate and a payment error rate, and set the pass threshold before the sample is drawn.
- Incorrect coding drives 49.1 percent of E/M improper payments, which makes E/M level selection the audit that pays first.
- Every finding needs an owner, a due date and a re-audit date. A finding with none of the three is a note in a file.
A score with no owner and no due date is a number in a file. The audit is the part that changes the next claim.why the follow-up step carries the value
An internal coding audit is a sample of your own claims, scored against your own rules, run before a payer runs the same test with money attached. The payers already run it: Medicare reviews a stratified random sample of about 37,500 fee-for-service claims each reporting period and projects the findings to the whole program. A practice audit uses a smaller sample and a shorter timeline, and it can act on what it finds.
Sampling by provider and code family
Sample size is the first decision, and the published guidance is narrower than most practices assume. AAPC states that the Office of Inspector General and CMS both recommend reviewing coding for every physician and nonphysician provider annually, and sets the floor at 10 charts per provider each year. Run the audit less often than quarterly and the minimum rises to 20 charts.
AHIMA’s rule of thumb for physician office records is different: 50 randomly chosen records is an adequate sample, and any low-volume or high-risk area should be audited at 100 percent. The two numbers answer different questions. Ten charts per provider tells you whether one clinician needs education. Fifty tells you whether the practice has a systemic problem.
Random means reproducible
A random sample gives every record an equal chance of selection. Picking the short charts, or one physician’s charts, flatters the practice and proves nothing. AHIMA describes a workable method: select dates of service, then take every fifth patient in the appointment system.
Stratify by code family
One chart per office visit code cannot show a pattern. If the only 99214 you read is wrong, you cannot tell a slip from a habit. Draw the sample in two layers: every provider gets a random draw, and the three to five code families carrying the practice’s revenue get their own.
| Risk tier | What goes in it | Sample |
|---|---|---|
| Routine | Every provider, at least once a year | 10 charts per provider, or 20 when the audit runs less than quarterly |
| New or changed | Providers new to the practice or new to a code family | 20 charts, or a baseline draw of 20 dates of service |
| High risk | Codes on the OIG Work Plan, codes a payer has denied, new procedures | 100 percent when volume allows |
Change the sample and you change the result. Keep the method fixed between rounds, or a different set of charts will look like improvement.
Where a self-audit cannot reach, comprehensive chart auditing runs the same test on a larger draw, with the sampling method documented in the file.
The error taxonomy to score against
A score is useful only if two people reading the same chart reach the same number, so the categories get defined before the first chart is read. Medicare already publishes a set. CMS sorts every improper payment into one of five major error categories: no documentation, insufficient documentation, medical necessity, incorrect coding, and other.
| Category | The question it answers | Where the fix belongs |
|---|---|---|
| No documentation | Did anything reach the reviewer? | Records release and tracking |
| Insufficient documentation | Does the note support the service billed? | Templates, queries and clinician education |
| Medical necessity | Was the service necessary for this patient? | Documentation improvement and plan of care |
| Incorrect coding | Does the code match the documented service? | Coder education and a level check |
| Other | Duplicate payment, non-covered service, eligibility | Front-end edits and eligibility checks |
CMS places a claim in the insufficient documentation category when the record is inadequate to support payment, including a missing signature on an order. Incorrect coding covers a different code than the one billed, a service performed by someone other than the billing provider, or an unbundled service.
Two additions make the taxonomy work at practice level. Split errors into over-coding and under-coding, which have different causes. And give modifier and place of service errors their own buckets, since a payer can flag both without reading a note.
A chart can be coded perfectly and still be wrong. If the documentation does not establish that the service was reasonable and necessary, the category is medical necessity, and the work belongs with the clinician. Scoring it as a coding error sends the feedback to the wrong desk.
Scoring: error rate, accuracy rate and the pass line
Medicare Administrative Contractors calculate two numbers at the end of a review round: a provider claim error rate and a payment error rate. A practice can copy the habit. Chart error rate answers how often the work is wrong; payment error rate answers how much money the errors represent.
Report accuracy alongside error rate, and set the threshold before the sample is drawn. A practice that declares 80 percent accuracy acceptable after seeing the results has not set a threshold, it has described the results. AAPC notes that at an 80 percent threshold, one wrong chart in a ten-chart sample fails the provider.
Under-coding belongs in the score. An AAPC Services case study found 19 percent of charges undercoded in office visit coding after the 2021 E/M changes, so an audit that scores only over-coding reports half the problem.
- Chart identifier, date of service, provider and payer.
- Codes billed, and the codes the documentation supports.
- Error category from the fixed taxonomy, plus an over-coding or under-coding flag.
- The dollar difference between billed and supported.
- The person the finding is assigned to, and the re-audit date.
The last field turns a worksheet into a control. The audit is finished when the finding has been closed and the same code family has been re-audited.
E/M level selection is the audit that pays first
Start with evaluation and management. CMS reports an improper payment rate of 10.3 percent for all E/M codes, a projected $3.9 billion, with incorrect coding behind 49.1 percent of those payments, ahead of insufficient documentation at 34.1 percent and no documentation at 13.1 percent.
The rule the level is scored against changed, and the change is what audits still miss. For most E/M visit families the level comes from the level of medical decision making or from total time on the date of the encounter. History and examination no longer affect visit level selection.
That leaves two failure modes. A note documenting a moderate-complexity visit billed at a high level is an over-coding finding, and it is the pattern E/M review turns up most often. A note supporting a higher level than the one billed is a revenue leak. Reading the note against the medical decision making table finds both.
E/M review also catches errors that never reach the level decision. The OIG has announced a work plan review of E/M services performed the same day as a minor surgical procedure that Medicare paid without modifier 25 attached, covering calendar years 2023 through 2025. In one completed dermatology audit of that pattern, 90 of 100 sampled services met requirements and the OIG projected $62.9 million in overpayments.
The reference underneath all of this is the current CPT guidelines for the visit family you bill most, checked against medical coding updates each January.
The education loop that moves denial rates
A finding becomes an improvement in three steps: someone learns it, something changes in the workflow, and the change gets tested. AHIMA’s internal audit guidance puts education immediately after the initial results, followed by monthly staff meetings on payer updates and an annual review of coding changes. Education built from the practice’s own charts lands better than a memo.
The provider sees the note, sees what the code required, and hears the reason. A finding a clinician cannot reproduce gets argued with instead of fixed.
If a template prompts for the wrong elements, the template changes. Education aimed at the person repeats.
Ninety days is workable. Medicare allows at least 45 days between probe rounds before it looks again.
The payer’s denial reasons map onto the audit taxonomy. If incorrect coding falls while medical necessity denials rise, the education is aimed at the wrong thing.
A Targeted Probe and Educate review hands the provider a results letter naming each error, at least 45 days to change, and a release from review for a year if the error rate is acceptable. Running a practice audit on that rhythm rehearses the process the MAC will run, at a point where the fix is cheap.
Keeping the audit file defensible
Two things need paper. The first is the sampling method. The Program Integrity Manual requires contractors using statistical sampling for overpayment estimation to define the universe and the sampling frame, document the methodology and the sample size, and document the point estimate. A payer that extrapolates an error rate will build exactly that file.
The second is the shelf life of a finding. Claims can be reopened: within 12 months of the initial determination no good cause is needed, while after 12 months and within four years good cause must be established.
The OIG places this work inside a structure a practice can name. Its 2023 General Compliance Program Guidance lists element 6 as risk assessment, auditing, and monitoring, and element 7 as responding to detected offenses and developing corrective action.
Put an owner and a date on every finding, keep the sample list and the workpapers together, and close the loop with a re-audit. A practice that wants the sample, the scoring and the re-audit on a fixed calendar can schedule an appointment with a team that runs the process every quarter.
Internal coding audit questions
AAPC recommends at least 10 charts per provider each year, and 20 when the audit runs less often than quarterly. AHIMA’s rule of thumb for physician office records is 50 randomly chosen records. Use the per-provider floor to judge one clinician and the larger sample to judge the practice. Audit high-risk areas at 100 percent.
Set it before the sample is drawn. Medicare Administrative Contractors publish a goal error rate for each review topic and measure a claim error rate and a payment error rate at the end of every round. A practice can pick a threshold, apply it to both numbers, and read the trend across quarters rather than treating one round as a verdict.
Yes. Under-coding is a compliance risk and a revenue leak at once. AAPC Services found 19 percent of charges undercoded in office visit coding after the 2021 E/M changes, and a later study of hospital E/M coding found 6 percent overcoded and 8 percent undercoded. An audit that scores only over-coding reports half the problem.
Documentation that supports the level billed through medical decision making or total time. History and examination no longer select the level, though the descriptors still call for a medically appropriate history and exam when performed. When time is the basis, the full time must be completed rather than the midpoint.
Within about 90 days, on the same code family that produced the finding. Medicare allows at least 45 days between Targeted Probe and Educate rounds so the provider has time to change, and a re-audit run sooner than that tests the conversation rather than the workflow.
For your own audit it is what makes one quarter comparable to the next. For a payer review it can matter more. The Program Integrity Manual requires contractors that use statistical sampling for overpayment estimation to document the universe, the sampling frame, the methodology and the point estimate.
The bottom line
An internal coding audit is a control, not a report. The sample has to be drawn the same way twice, the errors have to land in a fixed taxonomy, and every finding needs an owner, a date and a re-audit. Run it on that pattern and the next payer review becomes a confirmation of work already done.
When did your practice last read its own charts?
Send us one quarter of charges by provider and by code family. We will score the sample against the same taxonomy Medicare uses, show you where the coding and the documentation disagree, and hand back the worksheet, the error rate and a re-audit date.
Request a free chart audit reviewThis article describes general coding and auditing practice rather than legal advice. Sampling standards, error-rate thresholds and payer review rules vary by payer and contract, so confirm them against the current Medicare manuals, the payer’s policy and your participation agreement.
