You cannot guarantee that a payer will never audit your practice. You can make an audit far less likely to find anything, and far less likely to start. Payers select practices through data analysis of outlier billing, high error rates and denial patterns. Accurate documentation, clean coding, regular internal audits and a written compliance plan are what keep you off those lists. If an audit still arrives, the same habits keep it short.
This guide covers what draws payer attention, what a practical prevention routine looks like, how Medicare and commercial audits differ, and what to do in the first days of a request.
TL;DR
- Documentation is the first defense. Notes that are complete, legible, dated, signed and that support the billed level of service prevent most audit findings.
- Know your outlier status. Compare your E/M and modifier usage with specialty peers before a payer does it for you.
- Audit yourself on a schedule. The OIG recommends at least annual practice audits, and prospective review catches errors before a claim leaves.
- Treat every request as time-sensitive. Assign one point person, calendar the deadline and have a clinician review the records.
- Catch leakage before submission. Automated chart scans find coding, documentation and charge-capture gaps while they are still cheap to fix.
Table of Contents
- Why practices get audited in the first place
- What draws payer scrutiny
- A prevention routine that fits a small practice
- Medicare and commercial audits: what is different
- Our perspective
- If a payer audit request arrives anyway
- A 30-day starting plan
- See your exposure before a payer does
- FAQ
- Sources
Why practices get audited in the first place
Audits are rarely random. Medicare's own program description says its contractors use data analysis to find providers with high claim error rates or unusual billing practices, and items and services with high national error rates. The same page says providers whose claims comply with Medicare policy won't be chosen for targeted review. That is the whole strategy in one idea: stop looking like an outlier, and stop having errors to find.
Commercial payers work differently. According to the AMA, commercial audit practices are less consistent and defined individually in each contract, and commercial payors are increasingly using artificial intelligence tools to spot outlier billing patterns. For a small practice, that means a pattern you never noticed can become visible to a payer's software long before it becomes visible to you.
The AMA also tells physicians who run their own practices to assume they will be audited at some point and to train billing staff in proper coding and billing. So the realistic goal is twofold: reduce what triggers an audit, and make sure that an audit finds a clean record.
What draws payer scrutiny
The same handful of problems shows up again and again. AAPC lists ten common billing errors found during audits:
- Duplicate claim submission
- Undocumented services
- Noncovered services
- Medical necessity not established
- Inappropriate unbundling of services
- Beneficiary eligibility problems
- Incorrect carrier
- Medicare as secondary payer errors
- Incorrect diagnosis
- Modifier errors
A few deserve a closer look.
Documentation that does not support the claim
Banner Health's provider audit page names the most common errors it sees: progress notes not signed appropriately, services billed under the NPI of a provider who did not render them, and upcoded E/M services where the note does not support the level billed. None of these requires bad intent. A missed signature or a templated note is enough.
The ACEP Reimbursement Committee lists what commercial payers expect from a record: all entries legible, dated and signed by the performing provider, the E/M code supported in the clinical record, medical necessity clearly documented, and abnormal lab or x-ray results paired with a follow-up plan. ACEP calls thorough, accurate documentation for each patient the most important preventative measure.
For worked examples of what medical necessity looks like in a note, see our medical necessity documentation examples.
Modifiers and bundling
AAPC notes that misuse and abuse of modifiers is under OIG scrutiny and can result in penalties. The AMA points to a related mistake: failing to check NCCI edits when reporting multiple codes. The CMS developed NCCI to promote correct coding and prevent inappropriate Medicare Part B payments. A modifier appended to get a pair of codes paid, without documentation behind it, is exactly the pattern analytics look for.
E/M levels that drift from your peers
If your specialty bills mostly mid-level visits and your practice bills mostly high-level ones, a payer will notice. The Physicians Advocacy Institute advises practices to assess audit risk by comparing their use of procedure codes and modifiers with others in their specialty. It also suggests reading the CERT report's findings on improper Medicare payments to confirm you are not billing in a way already found to be improper.
Undercoding matters too. A practice that systematically bills below what its notes support leaves earned revenue unclaimed, and it distorts your benchmark in the other direction.
A prevention routine that fits a small practice
You do not need a compliance department. You need a short list of repeatable habits, owned by named people.
Step 1: Build a written compliance plan
The OIG's guidance for individual and small group practices describes seven components of a voluntary compliance program:
- Internal monitoring and auditing
- Written compliance and practice standards
- A designated compliance officer or contact
- Training and education
- Response to detected violations and corrective action
- Open lines of communication
- Disciplinary standards enforced through well-publicized guidelines
The ACEP committee adds that a compliance plan supporting quality documentation, coding and billing helps lead to successful future audit outcomes. For a three-physician practice, the "plan" can be a few pages, as long as it is written, current and used.
Step 2: Audit yourself on a schedule
The AMA-affiliated guidance from the American Academy of Neurology says the OIG recommends that practice audits be conducted at least annually and used to find risk areas in coding and billing, reasonable and necessary services, and documentation. For sample size, the CMS self-audit fact sheet reports that the OIG recommends reviewing five or more records per federal payer, or five to ten records per physician.
The OIG advises that the people doing the review include the person in charge of billing and a medically trained person, preferably a physician. The CMS fact sheet states that self-audits can help reduce improper payments and lower the chances of an external audit.
If you have never done one, start with our guide to what a medical record audit is.
Step 3: Review claims before they go out
A retrospective audit tells you what went wrong. A prospective audit prevents it. In a prospective billing audit, a designated staff member or internal compliance officer reviews claims before submission to confirm coding, documentation and adherence to the health plan's payment policies. This is the single most effective place to intervene, because correcting a note costs minutes and correcting a paid claim costs an overpayment process.
Step 4: Benchmark your E/M and modifier use
The AAN guidance advises getting current Medicare E/M frequency data for your state and specialty and comparing it with your own, to see whether you are overcoding or undercoding. Do the same for modifier 25, modifier 59 and any code your payer mix scrutinizes. Ask your billing team for a report by provider. Know your denial rate by payer and by reason, because denial trends often show a problem before an audit letter does.
Step 5: Train, then retrain
The AMA says billing staff must be trained in how to code and bill properly. Add the clinicians: the best coder cannot fix a note that does not say what happened. Short, specific sessions tied to your own findings work better than a generic annual slideshow.
Step 6: Fix and track what you find
When an internal audit finds an error, correct the record properly, document the corrective action and look for the root cause. If the error led to a payment you should not have received, the clock matters (see below).
Medicare and commercial audits: what is different
| Medicare and Medicaid | Commercial payers | |
|---|---|---|
| Who runs it | CMS and its contractors | Each insurer, under your contract |
| Approach | Targeted probe and educate, with one-on-one help to correct errors | Varies by contract; often starts with a time-sensitive records request |
| Record volume | Targeted at specific providers and services | Generally no limit on the number of records a payer may request, per ACEP |
| Lookback | Set by federal rules | May be limited by state law or your participation contract |
| Where to look | CMS contractor guidance | Your payer contract and provider manual |
The ACEP guidance confirms the commercial pattern: audits typically begin with a time-sensitive documentation request, there are generally no limits on how many records a private payer may request, and depending on state law or the contract there may be limits on the period audited. Read the audit and recoupment language in every payer contract you hold, and keep a one-page summary of each.
The 60-day overpayment rule
If your own review finds that you were overpaid by Medicare, the clock starts. The CMS final rule requires providers to report and return overpayments by the later of 60 days after the overpayment was identified or the date any corresponding cost report is due. An overpayment is identified when you have, or through reasonable diligence should have, determined that you received it and quantified the amount. The rule applies a six-year lookback, and an overpayment kept past the deadline becomes an obligation under the False Claims Act. This is a reason to audit and fix promptly rather than to avoid looking. If you find one, our guide on responding to an overpayment demand walks through the steps, and your healthcare attorney should confirm the specifics for your case.
Our perspective
Most practices we talk to are not careless. They are busy. Charge capture slips, a template carries a level of service the note does not earn, a signature is missed, and nobody sees it because nobody has time to read charts after clinic.
That is why we built HIMShield to look at the data before the claim leaves. It scans EHR data for coding, documentation and charge-capture gaps, quantifies them per provider and per payer, and drafts corrections for one-click physician e-signature. The point is to turn audit prevention from a yearly project into a routine that runs without adding staff or training.
Our view is that the best audit defense is a record that needs no defending. When a payer does ask, a practice that already knows its own numbers can respond with confidence and assemble a complete package quickly.
Elena
If a payer audit request arrives anyway
Prevention lowers the odds. It does not make them zero, so have the response ready.
- Read the request carefully and note the deadline. The AMA's payor audit checklist advises reviewing the request carefully and calendaring the response date. Dr. Blake, quoted by the AMA, says most requests carry a timestamp and practices should start responding immediately.
- Name one point person. Pick a senior staff member to coordinate everything.
- Check the contract. Find the audit and recoupment language in the payor contract and provider manual.
- Have a clinician review the records. Experts from Polsinelli told the AMA that the clinician involved in the case should review the records, with all requested imaging and lab tests included. They also said that if a record is incomplete, a note explaining it is acceptable, provided it is currently dated and does not pretend to be part of the original documents.
- Document how you send it. The Physicians Advocacy Institute advises date and page stamping and copying all correspondence, and sending by certified mail or another tracked method with receipt verification retained.
- Understand extrapolation. The AMA checklist explains that payors request chart data for a sample and extrapolate the results to your whole universe of patients for that payor, so even one adverse claim can significantly affect a recoupment demand. The PAI guidance says that if an audit seeks repayment, you should analyze how the amount was calculated and, if extrapolation was used, consider requesting a review of 100% of your records for the audit period.
- Involve an attorney when the notice alleges misconduct. ACEP advises that any commercial-plan notice alleging possible criminal misconduct should always be handled by an attorney.
Our postpayment audit response guide lays out the first ten days in more detail, and the six-step medical record request response covers the records side.
A 30-day starting plan
If you want a concrete order of work, this sequence fits a small practice:
- Week 1: Pull your denial report by payer and reason. Pull E/M distribution by provider. Identify the top three outliers.
- Week 2: Review five to ten charts per provider from the outlier areas. Check signatures, dates, medical necessity and modifier support.
- Week 3: Correct what can be corrected properly, record the corrective action and decide whether any overpayment needs to be returned.
- Week 4: Hold a short training session built on your own findings. Name your compliance contact, and put the next audit on the calendar.
Our article on preventing payer recoupment in 30 days expands this approach, and the practice audit survival checklist gives you a printable list.
See your exposure before a payer does
Manual audits sample a handful of charts. Our free 30-day Revenue Leakage Audit looks across your EHR data for coding, documentation and charge-capture gaps, and delivers a per-provider, per-payer report that quantifies what is at risk. It is built for independent practices and works without new staff or software training for your team.
Start with the free 30-day Revenue Leakage Audit, or learn more about our HIM compliance engagement.
FAQ
Can a practice guarantee it will never be audited?
No. The AMA advises physicians who run their own practices to assume they will be audited at some point. What you control is the outcome: accurate documentation, regular self-audits and a ready response plan make an audit shorter and far less costly, and clean claims keep you out of data-driven targeting.
How often should we run an internal audit?
The OIG recommends at least once a year, with five to ten records per physician or five or more per federal payer. Many practices add a lighter prospective review of claims before submission so errors are caught on a rolling basis.
What is the most common reason practices fail an audit?
Documentation that does not support the billed service. Unsigned notes, an E/M level the note does not justify and missing medical necessity appear in the lists published by AAPC and Banner Health. Those are fixable with a routine review.
How long do we have to respond to a commercial payer audit request?
It depends on the request and your contract. ACEP notes that commercial audits usually start with a time-sensitive request, so check the date on the letter and the audit language in your provider agreement the day it arrives.
Sources
- Targeted Probe and Educate, CMS
- Why physicians are key to successfully navigating payor audits, AMA
- Your practice checklist: Trends in payor audits and disputes, AMA
- Medical Auditing Frequently Asked Questions, AAPC
- Provider Audits and Trends, Banner Health
- Preparing for Payer Audits, ACEP Reimbursement Committee
- Medical coding examples that could cost you, AMA
- Medical Audits: What Physicians Need to Know, Physicians Advocacy Institute
- OIG Compliance Program for Individual and Small Group Physician Practices
- How to perform a physician practice internal billing audit, AAN
- CMS self-audit fact sheet
- Federal Register: Medicare overpayment final rule, February 12, 2016
- Payor Audit Checklist, AMA
- When payors audit your private practice, panic is no help, AMA