Visit Website →
← Back to blog

5 EHR Artifacts That Defend US Practices in Incident to Billing Audit

September 20, 2026
5 EHR Artifacts That Defend US Practices in Incident to Billing Audit

Incident-to claims are a live federal audit target in 2026, not a theoretical risk. The OIG added a national review of Part B incident-to payments to its Work Plan because these claims report the physician as the rendering provider even when a nonphysician practitioner did the work. Auditors test three things: the physician's initial visit and plan of care, direct supervision, and contemporaneous documentation. Your immediate move: run a small internal incident-to billing audit this week and pull five specific artifacts per sampled claim before a payer asks for them.

TL;DR:

  • A regular internal audit of 20 to 40 claims quarterly can identify systemic incident-to billing issues before auditors extrapolate errors to large claim volumes.
  • Proper documentation must link the physician’s initial visit, ongoing plan of care, supervision evidence, and the APP's notes to defend incident-to claims.
  • Starting in 2026, real-time audio and video supervision satisfy CMS requirements in many office settings, but audio-only supervision remains invalid.
  • A missing sentence linking the APP’s work to the physician’s established plan is the most common cause of audit failure, easily fixed with structured documentation prompts.
  • Prompt, organized responses to an audit request and retention of key artifacts increase the chance of successfully defending billed claims against recoupment efforts.
Himshield
Strengthen Your Billing Compliance Defense
HIMShield identifies coding, documentation, and charge capture risks before they become denials or audits for independent physician practices.
Explore HIMShield

Table of Contents

What Auditors Look For in an Incident-to Billing Audit

Every incident-to billing audit traces back to one regulation: 42 CFR 410.26 and the corresponding Medicare Benefit Policy Manual chapter. To bill incident-to, the service must sit inside an established plan of care the physician created, the physician must have performed the initial visit for that specific problem, and the physician must maintain active, ongoing involvement in the patient's care.

Direct supervision is where most practices get tripped up. Historically, that meant the physician had to be physically present in the office suite while the advanced practice provider (APP) delivered care. Starting January 1, 2026, CMS allows real-time audio and video to satisfy direct supervision in many office settings. Audio-only calls still disqualify the claim, and services carrying a global surgery indicator generally still require in-person presence.

Setting matters too. Incident-to billing generally applies in the office; hospital and skilled nursing facility settings have their own bundling rules that can exclude incident-to entirely. Get the eligibility test wrong and the reimbursement swings hard: services billed correctly under the physician's NPI pay at 100% of the Medicare Physician Fee Schedule, while the same service billed under the APP's own NPI pays at 85%.

Several contractor types run these reviews:

  • MACs (Medicare Administrative Contractors) conduct routine prepayment and postpayment reviews.
  • RACs (Recovery Audit Contractors) hunt for improper payments and get paid a percentage of what they recover.
  • SMRC (Supplemental Medical Review Contractor) runs CMS-directed national studies.
  • OIG conducts broader program integrity reviews, including the current incident-to project.

When any of them find a documentation gap in a sample, they can extrapolate that error rate across every similar claim you've filed, turning a handful of bad charts into a six or seven-figure recoupment demand.

Step-by-Step Internal Audit Checklist for This Quarter

You don't need a massive compliance department to catch incident-to exposure before Medicare does. A quarterly sample of 20 to 40 charts, drawn specifically from claims billed under physician NPIs where an APP likely rendered the service, is enough to surface systemic issues before a contractor extrapolates them.

  1. Identify the target claims. Pull claims billed under physician NPIs for visit types your APPs commonly handle, then cross-reference APP schedules against those dates.
  2. Gather the five core artifacts for each sampled claim: the physician's initiating note addressing the specific problem billed, the APP's note referencing that existing plan of care, explicit plan-of-care documentation, proof of supervision, and a schedule or presence log showing the physician was available.
  3. Validate the substance, not just the paperwork. Confirm medical necessity, check that the diagnosis matches the billed service, and verify the supervision modality is documented in the note itself if it was virtual.
  4. Classify each error you find and assign a fix: chart amendment for missing plan-of-care language, coder correction for NPI mismatches, or a scheduler rule change if presence logs are inconsistent.

Pro Tip: Keep each audit cycle to two weeks and a fixed sample size. A quarterly rhythm you actually finish beats an annual "deep dive" that stalls in month three and never gets remediated.

What Documentation Should You Have Ready for an ADR?

When a Medicare contractor sends an Additional Documentation Request, you're on the clock, and the practices that respond fastest are the ones who already have these artifacts organized by patient and date of service.

  • Initiating physician note: must show an assessment and plan specific to the billed problem, not a generic annual visit note.
  • APP progress note: should explicitly reference the physician's existing plan rather than introducing a new problem or treatment path.
  • Supervision documentation: states whether supervision was in-person or real-time audio/video, names who was supervising, and timestamps the encounter.
  • Presence or schedule logs: office sign-in records, EHR login timestamps, or scheduling system exports that corroborate the physician was on-site or connected during the visit.

Five artifacts, consistently converged on by CMS guidance and industry audit reviews, account for the majority of what separates a defensible claim from a recoupment target. Retain these records well beyond the standard filing window. Extrapolation projects can reach back across multiple years of claims, so a thin retention policy leaves you unable to defend older dates of service that get swept into the same sample.

Common Errors That Trigger Incident-to Billing Audits

A handful of recurring mistakes account for most incident-to recoupments, and none of them require a rules change to fix.

  • Missing initiating documentation. The physician's note doesn't address the specific problem later billed incident-to, so there's no established plan of care to point to.
  • Absent supervision evidence. The chart shows an APP visit but nothing indicating who supervised it or how.
  • NPI mismatch on ineligible services. A claim goes out under the physician's NPI when the underlying visit doesn't actually meet incident-to criteria, often a new problem the APP addressed independently.
  • Credentialing or enrollment lapses. The supervising physician wasn't properly enrolled or credentialed for the billing entity on the date of service.

A single missed supervision note in a sample of 30 charts can extrapolate into recoupment across thousands of similar claims once a contractor applies that error rate to your full claim universe. That's why small, frequent internal reviews matter more than one annual audit.

Pro Tip: Build a plan-of-care linkage prompt directly into your EHR templates for APP visits. A forced field that asks "which physician-established plan does this visit continue?" catches the gap before the claim ever goes out. Pair that with a periodic credentialing audit so enrollment lapses don't quietly accumulate between reviews.

EHR plan-of-care linkage and credentialing audit

How Should You Respond to an Audit Notice or ADR?

The way you respond in the first two weeks after an ADR lands often determines whether the contractor treats your practice as organized or careless, and that impression shapes how aggressively they extrapolate.

  1. Preserve records immediately. Freeze routine chart edits on the notes in question and designate one records custodian to control what goes out, so nothing looks altered after the fact.
  2. Run your internal checklist against the exact sampled claims. Pull the same five artifacts you'd gather in a routine quarterly audit, but this time for the specific dates of service under review.
  3. Assemble a clean, annotated submission package. Organize documents by claim, label which artifact answers which requirement, and keep a written chain of custody for every record you send.
  4. Loop in legal counsel when the request signals potential fraud allegations or a large extrapolated exposure. For straightforward documentation gaps, a clinical and coding response is usually sufficient.

Appeal deadlines are typically short, often 30 to 60 days depending on the contractor and level of appeal, so don't wait for the full package before starting your first-level response. Practices that remediate promptly and document the fix tend to see less aggressive follow-up on subsequent reviews.

Practitioner Perspective: What Audits Actually Reveal

The surprise isn't that incident-to claims fail audits. It's how often the failure traces to one missing sentence: a plan-of-care note that never named the problem the APP later billed for. Automated documentation scoring catches that gap before submission, not after a contractor flags it. That single fix, more than any policy change, is what reliably lowers false-positive audit triggers for the practices HIMShield works with.

— Elena

Get a Free Revenue Leakage Audit Before Medicare Runs Its Own

Running the checklist above manually every quarter takes real staff time you may not have. A Free 30-day Revenue Leakage Audit is available specifically for independent physician practices seeking to identify revenue risks without exhausting biller resources for weeks.

Himshield

The audit scans your EHR data for coding, documentation, and charge-capture gaps, including the exact incident-to risk points auditors check: missing plan-of-care linkage, thin supervision evidence, and NPI mismatches. You get a quantified leakage report, prioritized fixes ranked by dollar impact, and audit-ready evidence packages assembled for the claims most likely to draw scrutiny. It's built for billing managers and practice administrators who need proof before they commit budget, not another software rollout to manage.

Claim your Free 30-day Revenue Leakage Audit or explore the full HIM compliance engagement to see how the platform fits into your existing workflow.

Sources

FAQ

What Are the CMS Incident-to Billing Rules for 2026?

The core rules haven't changed: an established plan of care, a physician's initial visit for the problem billed, and direct supervision. What's new in 2026 is that real-time audio and video can satisfy direct supervision in many office settings, though audio-only calls still disqualify the claim.

What Are the Basic Rules for Incident-to Billing?

The service must be part of a treatment plan the physician already established, the physician must have personally handled the initial visit for that condition, and a physician must directly supervise the encounter under the CMS guidance in MLN SE0441. Miss any one element and the claim should go out under the rendering provider's own NPI instead.

Can You Give an Example of Incident-to Billing?

A physician diagnoses a patient with hypertension and sets a treatment plan. At the next visit, an APP in the same office checks blood pressure and adjusts medication dosage within that existing plan, and the physician is available for real-time supervision. Billed correctly, that visit goes out under the physician's NPI at 100% of the fee schedule instead of 85%.

Does UnitedHealthcare Allow Incident-to Billing?

Commercial payers, including UnitedHealthcare, set their own incident-to policies that don't always mirror Medicare's rules exactly. Always check the specific payer's provider manual or policy bulletin before applying Medicare's incident-to framework to a commercial claim.

How Often Should a Practice Run an Internal Incident-to Audit?

A quarterly sample of 20 to 40 charts is enough for most independent practices to catch systemic documentation gaps before a contractor extrapolates them across a larger claim set. Practices with higher APP-to-physician ratios or prior audit findings should sample more frequently.