Medical Billing Audit: How to Run One, How Many Claims to Check, and What to Do With What You Find
Most practices only look hard at their billing when something goes wrong. Cash drops. A payer asks for records. The biller who knew everything gives notice. By then the errors are months old, and some claims are already past the filing deadline.
A medical billing audit finds the same problems earlier, while the money can still be recovered. This guide covers how many claims to pull, the seven steps of an audit, a checklist of red flags to look for, and what the law expects if you find that a payer overpaid you.
What a medical billing audit actually checks
A billing audit follows a claim from the front desk to the bank. For each claim in your sample, you ask four questions:
1. Was the insurance right? Correct patient, correct payer, coverage active on the date of service.
2. Does the chart support the codes? Every CPT or HCPCS code, unit, diagnosis and modifier.
3. Was everything billed? Services in the note that never made it onto the claim.
4. Was the claim paid correctly? Allowed amount matches your contract, and any denial was worked.
An audit doesn’t judge clinical care. An auditor can say a note doesn’t support a level 4 visit. An auditor can’t say the patient should have been treated differently. Keep those two questions apart, or the audit turns into an argument with your providers.
Types of medical billing audits
Audit” covers a few different jobs. Pick the one that matches your problem.
Type When claims are checked Best for Main drawback
Prospective Before the claim goes out New providers, new services, a practice that just failed a payer review Slows billing while claims wait
Retrospective After payment Finding patterns, overpayments and missed revenue Some errors are already past deadlines
Focused After payment, one code or one denial type A sudden jump in one denia, or a payer letter about one code Misses problems outside the focus
Audits can also be interna (your own staff) or external (an outside coder or billing company). Internal audits are cheaper and can run more often. External audits remove the problem of people checking their own work. Many practices do a yearly external audit and smaller internal ones in between.
Why billing audits matter: what the numbers say
The federal government audits a sample of Medicare claims every year through its Comprehensive Error Rate Testing (CERT) program. For fiscal year 2025, CMS reported a Medicare fee-for-service improper payment rate of 6.55%, or $28.83 billion, down from 7.66% ($31.70 billion) in FY 2024.
The detail that matters for you: CMS says most improper payments happened because a reviewer couldn’t confirm the payment was proper from the documentation. In most cases the service was probably done. The paperwork just didn’t prove it. That’s exactly what an audit checks.
Commercial payers show a similar pattern. KFF’s March 2026 analysis of CMS Transparency in Coverage data for 2024 HealthCare.gov plans found insurers denied 19% of in-network claims. Of those, 25% were listed as administrative and only 5% as medical necessity. And fewer than 1% of denied claims were ever appealed.
Every denial also costs money to work. MGMA puts the average cost to rework a denied claim at $25.20.
A note on numbers you’ll see elsewhere: many billing sites say 80% of medical bills contain errors. We couldn’t trace that to a study with a stated sample, so we don’t use it.
How many claims should you audit?
There’s no single legal number. The best-known guide comes from the HHS Office of Inspector General’s Compliance Program Guidance for Individual and Small Group Physician Practices (October 2000). It says:
Although there is no set formula to how many medical records should be reviewed, a basic guide is five or more medical records per Federal payor (i.e., Medicare, Medicaid), or five to ten medical records per physician.
The same guidance recommends periodic audits at least once each year after a first baseline audit . The baseline looks at your whole claim process, from patient intake through submission and payment, and becomes the benchmark you measure later audits against.
Practice size Starting sample How often
Solo provider 10 claims, spread across your main payers At least yearly. Quarterly for new services
2 to 5 providers 5 to 10 claims per provider At least yearly
Any size, after a problem 20 or more claims of the code or payer in question Again after the fix is in place
The OIG numbers are a floor, not a ceiling. If your first sample shows a lot of errors in one area, pull more claims from that area before you draw conclusions.
How to do a medical billing audit in 7 steps
Step 1: Set one goal and a time window
Write down one sentence: what you’re checking and why. “Check E/M levels for Dr. A, April to June” is a goal. “Check our billing” isn’t. Use recent dates of service, usually the last 90 days, so anything you find can still be corrected inside filing limits.
Step 2: Pull a fair sample
Pick claims at random within the window. Don’t pick the ones someone remembers as odd. Include paid, denied and zero-paid claims. If you only audit denials, you’ll never find overpayments or undercoding, because those claims got paid.
Step 3: Check the front end
Compare the patient’s name, date of birth, member ID and payer order on the claim against the insurance card and the eligibility check for that date. Errors here cause CO-16, CO-22, PR-27 and CO-109 denials. Our guide to insurance eligibility verification insurance-eligibility-verification-how-it-actually-works shows what the front desk should confirm, and the policy number on an insurance card policy-number-on-insurance-card-explained explains the fields people mix up.
Step 4: Compare the chart to the codes
Read the note first, then the claim. Does the documentation support each code, the units, the diagnosis order and every modifier? This is where most “insufficient documentation” findings come from. For office visits, check the E/M level against the medical decision making or total time rules. Look for services billed separately that the payer will treat as bundled, which shows up as CO-97 co-97-denial-code-what-it-means-and-how-to-fix-it.
Step 5: Look for missed charges
Audits aren’t only about over-billing. Check for services in the note that never reached the claim: injections, supplies, add-on codes, a separate procedure done the same day. Undercoding is a quiet loss. No payer will ever write to tell you about it.
Step 6: Check the payment against your contract
Open the EOB or 835 remittance eob-in-medical-billing-how-to-read-one-and-catch-errors for each claim. Did the payer allow what your contract says? Was each denial worked, appealed or written off, and was the write-off right? A CO-45co-45-denial-code-why-it-usually-is-not-a-denial-at-all adjustment is normal. A CO-16 that got written off instead of corrected is money you gave away.
Step 7: Score it, report it, fix one thing
Mark each claim as correct, overcoded, undercoded, missed charge or front-end error. Turn the counts into a one-page report: error rate, dollars involved, top cause. Then change one process and re-audit that area in 60 to 90 days.
An audit that ends with a report and no change is just a record of the problem
Medical billing audit checklist
Area What to check Red flag
Registration Name, DOB, member ID, payer order Repeated CO-16, CO-22 or CO-109 denials
Eligibility Coverage active on the date of service PR-27 blog-pr-27-denial-code denials, patient balances written off
Authorization Auth number on file before the visit CO-197 blog-co-197-denial-code denials E/M levels Level supported by MDM or time One provider billing nearly every visit at the same level
Modifiers 25, 59 and X{EPSU} backed by the note Modifier 25 on almost every visit with a procedure
Diagnosis coding Most specific ICD-10 code, right order | Unspecified codes when the note has detail. CO-50 or CO-11 denials |
Charge capture Every documented service billed Injections or supplies in notes but not on claims
Timely filing Claims sent within each payer’s limit Any CO-29 co-29-denial-code denia
Records requests Requests answered before the deadline CO-252 blog-co-252-denial-code denials left open
Payment posting Allowed amount matches contract Underpayments posted without review
Denial follow-up Every denial worked before its deadline Denials written off with no reason noted
If one row keeps lighting up, that’s your next focused audit. For a plain-English meaning of every code above, see our list of common denial codes in medical billing common-denial-codes-in-medical-billing.
What to do if the audit finds an overpayment
This is the part most practices aren’t ready for, and the part no checklist post talks about.
Under the Medicare and Medicaid overpayment rule, 42 CFR Â 401.305, a provider must report and return an overpayment within 60 days of identifying it. A change in the CY 2025 Physician Fee Schedule final rule, effective January 1, 2025, changed two things:
- The clock starts sooner. You’ve “identified” an overpayment when you know about it, or act in reckless disregard or deliberate ignorance of it. You no longer get extra time to work out the exact amount before the 60 days start.
- You can pause it to investigate. The 60-day deadline can be suspended for up to 180 days while you do a timely, good-faith investigation into related overpayments from the same cause.
Keeping a known overpayment past the deadline can create liability under the False Claims Act.
We’re a billing company, not a law firm. If an audit turns up a pattern of overpayments, talk to a healthcare attorney before you refund anything or change past claims
What an audit can't tell you
A 30-claim audit tells you a lot about those 30 claims and only a little about the other 3,000. Treat a small sample as a warning light, not a final verdict.
An audit also can’t fix a process. If the problem is a front-desk habit, the fix is training and a check-in step, not a better biller. A billing team can show you the pattern and the dollars. It can’t stand at the front desk.
And a clean audit isn’t a guarantee. A payer’s reviewer may read the same note differently. The point is to make your reasoning visible before someone else asks for it.
Get a free denial audit
Not sure where your billing is leaking? We’ll review a sample of your recent remittances, group your denials by code and cause, and show you which three changes would recover the most money. You get the report whether or not you work with us.
Request your free denial audit
If you’d rather hand the whole thing off, our physician billing services include regular claim reviews, and our medical coding team checks code and modifier choices before claims go out. Running billing in-house? Our guide on denial management for small practicesshows how to set up a simple denial log between audits.
What is a medical billing audit
A medical billing audit is a review of a sample of a practice's claims. Each claim is compared with the patient's chart, coding rules and what the payer paid, to find coding errors, missed charges, unworked denials and overpayments.
How often should a practice do a billing audit?
The HHS Office of Inspector General's 2000 compliance guidance for physician practices recommends periodic audits at least once a year, after a first baseline audit. Many practices also run a focused audit whenever one denial type suddenly rises.
How many claims should be reviewed in a billing audit?
There's no fixed legal number. OIG guidance gives a basic guide of five or more medical records per federal payer, or five to ten per physician. If the first review finds errors in one area, pull more claims from that area.
