How a Medical Billing Audit Works — and When Your Practice Needs One

A medical billing audit is a structured review of a practice's claims, documentation, and revenue cycle processes to answer two questions: are we billing accurately and compliantly, and are we collecting everything we've earned? Done well, an audit produces something more useful than a grade — a ranked list of problems, each with a dollar value and a specific process fix.

Practices typically seek an audit when something feels wrong: collections are down, denials are up, a payer has asked questions, or a key biller has left. But the most valuable audits happen before any of those signals, while problems are still cheap to fix.

What an audit examines

• Documentation support: whether the codes billed are supported by the clinical notes, using a representative sample of encounters
• Coding accuracy: specificity, modifier use, bundling, and evaluation-and-management levels against current guidelines
• Claim integrity: demographics, eligibility handling, authorization documentation, and timely filing performance
• Payment accuracy: whether payments received match contracted fee schedules — the underpayment review most practices have never done
• Denial patterns: root causes grouped by process step, with recovery rates on appealed denials
• Credentialing hygiene: enrollment status, effective dates, and recredentialing deadlines for every provider and payer
• Compliance exposure: exclusion screening, documentation of medical necessity, and patterns that could draw payer scrutiny

Types of audits

Audits vary by timing and by who performs them. A prospective (pre-bill) audit reviews claims before submission and prevents errors from reaching the payer; a retrospective audit reviews claims after payment and finds both overpayments and revenue left on the table. An internal audit is performed by your own staff — cheap and continuous, but blind to its own blind spots. An external audit brings in reviewers who see many practices and know what 'normal' looks like; it's the better choice for a baseline.

Most mature practices combine them: continuous internal checks on a few high-risk items (eligibility, authorizations, timely filing), plus an external baseline audit annually or whenever the revenue cycle changes materially.

What audits typically find

Findings cluster into familiar categories: undercoding from conservative documentation habits, overcoding in a handful of providers whose habits drifted, missed contractual escalations on underpaid claims, denials abandoned inside the appeal window, and credentialing files held together by one person's memory. None of these imply dishonesty — they're the natural drift of any process nobody measures.

The audit's real product is proportion. Practices are routinely surprised that the problem they worried about (say, coding) is smaller than one they never considered (say, systematic underpayment on a specific payer's contract).

When to audit

• Annually, as a baseline, with a sampled chart review per provider
• When collections or denial rates shift without an obvious operational cause
• When a new provider joins, a new specialty line launches, or billing responsibility changes hands
• Before a payer contract renegotiation — know your true collection rate first
• After any payer inquiry, audit request, or overpayment notice, to size the exposure before responding
• When considering a new billing vendor or outsourced billing arrangement, to establish a before picture

What happens after the audit

An audit that ends in a report has failed. The deliverable that matters is a corrective action plan: each finding gets an owner, a fix, a deadline, and a measurement that will show whether the fix worked — a denial rate, a days-in-AR figure, a collection percentage by payer. Follow-up matters as much as the initial review; the standard pattern is a re-check of the same sample areas within a few months.

If you're deciding whether your practice needs an audit, a useful self-test: can you state, right now, your top three denial root causes by dollar value, your collection rate against contract by payer, and the recredentialing due date for every provider? Any blank is a good place to start.