The Complete Guide to Medical Billing Audits

Most practices don’t think about medical billing audits until a records request from Medicare shows up with a 45-day deadline. By then, the errors under review are months old. The revenue they cost you may already be gone, and repayment demands could be on the way.

The problem is widespread. When the HHS Office of Inspector General reviewed outpatient physical therapy claims, it found that 61% did not comply with Medicare’s medical necessity, coding or documentation requirements. Denials keep climbing too: 41% of providers now report denial rates of 10% or higher, up from 38% in 2024.

What is a medical billing audit? A medical billing audit is a structured review of a practice’s claims and supporting documentation. It confirms that every service was documented, coded and billed correctly. Audits can be run internally, by an outside billing firm, or by payers such as Medicare. They catch errors that cause denials, lost revenue and overpayment demands.

At Perform Practice Solutions, we manage billing for more than 30 therapy clinics. This guide covers what we’ve learned about running audits and preparing for payer reviews. You’ll learn:

• The types of medical billing audits and who performs them
• The red flags auditors look for in therapy claims
• How to run an internal audit in seven steps, with a checklist
• How to prepare for a Medicare or commercial payer audit

---

What Is a Medical Billing Audit?

A medical billing audit compares four things for a sample of claims: what was documented, what was coded, what was billed and what was paid. Wherever those four don’t match, money is either lost or at risk of being taken back. The goal is to find those gaps before a payer does.

Billing Audits vs. Coding Audits

People often use the two terms interchangeably, but they answer different questions.

	Coding audit	Billing audit
Main question	Do the CPT codes, ICD-10 codes and modifiers match the documentation?	Was the claim submitted, paid and followed up correctly?
What’s reviewed	Evaluations, daily notes, plans of care, codes, units, modifiers	Claims, ERAs, denials, A/R aging, payer contracts, patient statements
Typical findings	Upcoding, undercoding, unsupported timed units, wrong modifiers	Eligibility errors, missed authorizations, underpayments, unworked denials, duplicate claims
Usually done by	Certified coder or compliance auditor	Billing manager or outsourced billing company

A full medical billing audit covers both. Coding errors create compliance risk, and billing errors leak revenue. Most practices have some of each.

---

Why Medical Billing Audits Matter for Your Practice

Regular medical billing audits protect revenue you’ve already earned and lower your compliance risk. An internal audit takes a few days of work. A failed payer audit can mean recoupments, extrapolated repayments and months of prepayment review.

• Recover lost revenue. Audits surface underpayments, unbilled timed units and denials no one followed up on. That money is already owed to you.
• Fix the root cause of denials. In Experian Health’s 2025 survey, 54% of providers said claim errors are increasing. An audit shows which errors repeat, so you can fix the process instead of reworking the same denial every week.
• Stay compliant with Medicare. Medicare’s error-testing program put the 2025 fee-for-service improper payment rate at 6.55%, down from 7.66% the year before. Missing PT/OT/SLP certifications remain a top Part B finding.
• Meet the 60-day overpayment rule. Once you identify a Medicare overpayment, you must report and return it within 60 days. Since January 1, 2025, that deadline can be paused for up to 180 days while you run a timely, good-faith investigation. A standing audit process makes that investigation possible.
• Lower your odds of being selected. Payers flag providers whose billing patterns look like outliers. Clean, consistent billing makes your practice less likely to be targeted.

---

Types of Medical Billing Audits

Medical billing audits differ by who runs them and when they happen. You choose internal audits, but payer audits choose you.

Internal, External, Prospective and Retrospective Audits

Audit type	When or by whom	Best for	Trade-off
Internal	Your own billing or compliance staff	Routine monthly or quarterly checks	Staff may miss their own habits
External	An independent auditor or billing firm	An objective baseline, or confirming a known problem is fixed	Costs more, needs data access
Prospective (pre-bill)	Before claims are submitted	New providers, new codes, practices under payer review	Briefly delays submission
Retrospective (post-pay)	After claims are paid	Spotting denial trends, underpayments and overpayments	Errors found may need refunds

Most practices do best with a mix: retrospective audits on a schedule, plus prospective review for new clinicians or any area a payer has flagged.

Payer and Government Audits

These are the audits that arrive by letter. Knowing who sent it tells you what’s at stake.

Auditor	What it does	What to expect
MAC: Targeted Probe and Educate (TPE)	Your Medicare Administrative Contractor reviews providers with high error rates or unusual billing	20–40 claims per round, up to three rounds, one-on-one education after each, and at least 45 days to correct. Failing all three can lead to 100% prepayment review, extrapolation or a RAC referral.
RAC (Recovery Audit Contractor)	Post-payment review of Medicare claims to find overpayments and underpayments	Additional documentation requests (ADRs), then demand letters for any overpayment found
UPIC (Unified Program Integrity Contractor)	Investigates suspected fraud, waste and abuse	Records requests, interviews, possible payment suspension or referral to law enforcement
CERT (Comprehensive Error Rate Testing)	Reviews a stratified random sample of claims to measure Medicare’s improper payment rate	A records request. If you don’t respond, the claim is counted as an error and denied.
Commercial and Medicare Advantage payers	Run their own audit programs, often through third-party vendors	Rules, look-back periods and appeal rights are set by your payer contract

---

What Do Auditors Look For? Common Red Flags in Therapy Claims

In therapy billing, most audit failures come from the paperwork, not from the code choice. The care was given, but the chart doesn’t prove it. CMS’s outpatient rehabilitation therapy documentation booklet lists the errors reviewers find most often. These are the ones we see most in PT, OT and SLP practices.

Red flag	Why it gets flagged	How to prevent it
Missing or late plan of care certification	Medicare requires a physician or NPP to sign and date the POC, and to recertify it when needed	Track certification status for every Medicare patient, and hold claims until the signed POC is on file
Incomplete plan of care	The POC must list diagnoses, long-term goals, therapy type, amount, frequency and duration	Use a POC template with required fields locked
Timed units that don’t match minutes	Units billed must be supported by documented minutes under the 8-minute rule	Record total timed minutes and total treatment time on every visit note
Missing progress reports	Medicare requires a progress report at least once every 10 treatment days	Set an EMR alert at visit 8 or 9
Weak medical necessity	Notes must show skilled care and functional progress, not only repeated exercises	Tie each visit to measurable goals and explain why a therapist’s skill was needed
Modifier errors (GP/GO/GN, KX, 59/X, CQ/CO)	Missing therapy modifiers, KX without supporting documentation, or 59 used to get around NCCI edits	Audit modifier use by provider each quarter
Unsigned or undated notes	An unsigned note doesn’t count as documentation	Run a weekly report of unsigned notes before billing
Eligibility and authorization gaps	Visits beyond authorized limits, or billed to an inactive plan, are denied	Verify benefits at intake and track visits used against authorizations

---

How to Conduct an Internal Medical Billing Audit (Step-by-Step)

An internal medical billing audit takes seven steps: set the scope, pull a sample, gather records, compare documentation to claims, review payments, measure the impact, then fix and re-check. A small practice can finish one in a few days.

Step 1: Define Your Scope and Goals

Decide what you’re testing before you pull a single claim. A focused audit looks at one payer, one provider or one code family, such as timed codes under Medicare. A broad baseline audit looks across all of them. Write the goal down, for example “confirm timed units match documented minutes for all Medicare patients in Q3.”

Step 2: Select Your Claim Sample

Use a random sample for a baseline and a targeted sample when you suspect a problem. Many practices start with 10 random claims per provider per quarter. Pull more where you see risk, such as new clinicians, high-volume codes or payers with rising denials.

Step 3: Gather the Documentation

For each claim, pull the initial evaluation, the plan of care and its certification, the visit note, any progress reports, authorizations, the claim as submitted, and the ERA or EOB.

Step 4: Compare Documentation to the Claim

Check each line: Does the note support the CPT code? Do the minutes support the units? Are the required modifiers present and justified? Is the note signed and dated? Was the POC certified for that date of service? Log every mismatch, even small ones.

Step 5: Review Payments, Denials and A/R

Compare what you were paid to your contracted rates. Look for underpayments, denials that were never appealed, and claims aging past 90 days. This is where most recoverable revenue hides.

Step 6: Calculate Your Error Rate and Financial Impact

Divide the claims with errors by the claims reviewed. Then total the dollars: revenue you missed (underbilling, unworked denials) and payments you may owe back (overbilling). Many practices aim for a coding accuracy rate of 95% or higher.

Step 7: Correct, Train and Re-Audit

Fix the claims you can, and refund any overpayments within the 60-day window. Then fix the cause: update templates, retrain the provider and add an EMR alert. Re-audit the same area in 60 to 90 days to confirm the fix worked.

---

Medical Billing Audit Checklist

Run this medical billing audit checklist against each claim in your sample. (Publishing note: also offer it as a gated PDF download to capture leads.)

Documentation

• Initial evaluation is signed, dated and includes credentials
• Plan of care lists diagnoses, goals, type, amount, frequency and duration
• POC is certified by a physician or NPP and recertified on time
• Progress report is completed at least every 10 treatment days (Medicare)
• Visit note records total timed minutes and total treatment time
• Note shows skilled care and progress toward functional goals

Coding

• CPT codes match the services documented
• Timed units follow the 8-minute rule
• Therapy modifiers (GP, GO, GN) are present
• KX, 59/X and CQ/CO modifiers are used only when supported
• ICD-10 codes support medical necessity and are coded to the highest specificity

Billing and Payment

• Eligibility was verified before the first visit
• Authorization covers the visits and dates billed
• Claim was submitted within the payer’s timely filing limit
• Payment matches the contracted rate
• Denials were worked or appealed within deadlines
• No duplicate claims or unapplied credit balances

---

How Often Should You Run Medical Billing Audits?

Most therapy practices should run an internal medical billing audit every quarter and an external audit once a year. Audit more often when risk goes up.

Situation	Recommended frequency
Routine, stable practice	Quarterly internal audit, plus an annual external audit
New clinician or new location	Monthly prospective review for the first 90 days
New EMR, new payer contract or major code change	A focused audit within 30–60 days of the change
Denial rate rising or a payer letter received	Immediately, focused on the flagged area
After corrective action	Re-audit the same area in 60–90 days

---

How to Prepare for a Payer or Medicare Audit

A payer audit is won or lost on how fast and how completely you respond. Missing a deadline usually means an automatic denial, however good your care was.

1. Log the deadline on day one. Medicare additional documentation requests usually allow 45 days to respond. Commercial deadlines vary by contract. Put the date on a shared calendar and assign one owner.
2. Identify the auditor. A TPE letter, a RAC request and a UPIC request carry very different stakes (see the table above). If it’s a UPIC, or the letter mentions fraud, call a healthcare attorney before you respond.
3. Pull complete records for every claim. Include the evaluation, POC and certification, every visit note for the dates in question, progress reports and signature attestations. Reviewers judge only what you send.
4. Audit the sample yourself first. Run each requested claim through the checklist above so you know your weak spots before the payer finds them.
5. Send an organized package. Add a cover letter, label each claim, and keep proof of submission.
6. Use the education session. In TPE, the one-on-one session tells you exactly what the reviewer wants. Take notes and update your process within the 45-day window.
7. Appeal what you disagree with. For Medicare, a redetermination can be filed within 120 days. Filing within 30 days of a demand letter can stop recoupment while the appeal is pending.

---

Common Medical Billing Audit Mistakes to Avoid

The most common audit mistake is finding errors and then not changing anything. These mistakes come up most often:

• Auditing only denied claims. Paid claims can still be wrong, and those are the ones payers recoup.
• Letting the person who billed the claim audit it. Have someone else review the work, or bring in an outside auditor once a year.
• Skipping the financial impact. “12 errors” won’t get attention. “$8,400 in missed timed units this quarter” will.
• Sitting on overpayments. Once an overpayment is identified, the 60-day clock is running.
• Not re-auditing. Without a follow-up review, you don’t know whether the fix worked.
• Treating the audit as a one-time project. Audits work best as a routine on the calendar, not as a reaction to a payer letter.

---

In-House vs. Outsourced Medical Billing Audits

In-house audits work for routine monthly checks. Outsourced audits add objectivity and deeper payer knowledge, which matters most when the stakes are high.

Factor	In-house audit	Outsourced audit
Cost	Staff time only	Project or monthly fee
Objectivity	Lower, since staff review their own process	Higher, with an independent reviewer
Therapy and payer expertise	Depends on your team	Specialists who see many practices’ claims
Speed	Competes with daily billing work	Dedicated time and a set deadline
Best for	Routine quarterly checks	Annual baseline, payer audit prep, denial sp

---

Conclusion: Make Medical Billing Audits a Habit

Medical billing audits are the cheapest insurance a practice can buy. A quarterly internal audit catches documentation gaps, unbilled units and unworked denials while they’re still easy to fix. An annual outside review shows you what your team is too close to see.

Start small: pick one payer, pull 10 claims per provider, and run them through the checklist above. The errors you find will tell you where to look next.

If you’d rather have experts handle it, or a payer letter has already arrived, Perform Practice Solutions can help. We’ll review your claims, quantify what’s being lost and show you how to fix it.

Schedule your medical billing audit with Perform Practice Solutions now!

---

FREQUENTLY ASKED QUESTIONS