Billing Audit Checklist Template

A billing audit is the fastest way to identify where your practice is losing money — whether through coding errors, documentation gaps, payer underpayments, or claim process failures. This checklist is built on OIG Work Plan priorities, HFMA MAP key performance indicators, MGMA benchmarks, and CMS documentation requirements. Use it quarterly at minimum; monthly if you've had a recent denial spike or are preparing for an external audit.

• E/M Level Distribution — Pull 3 months of codes. Verify your Level 4 (99214) and Level 5 (99215) mix vs. specialty benchmarks.HIGH
  OIG Benchmark: Primary care avg ~38% Level 4; specialist avg ~47% Level 4. More than 60% Level 4+5 in any specialty triggers RAC probe audit risk.
• Medical Decision-Making (MDM) documentation — Confirm charts support the complexity level billed (straightforward, low, moderate, high).HIGH
  For 99214: must document "moderate complexity MDM" — at least 2 of 3 MDM elements met (problems, data reviewed, risk).
• Time-based billing documentation — If using time to support E/M level, verify total time (or physician time) is documented explicitly in the note with the date.HIGH
  2024 rules: office visit time includes all physician time on date of service (pre/during/post-encounter). Document as total minutes.
• Diagnosis coding specificity — Verify ICD-10 codes are at the highest specificity available. Unspecified codes (e.g., M54.5 low back pain vs. M54.50 specified) are OIG audit triggers and reduce payment in some payer contracts.MED
• Undercoding review — Randomly audit 20 charts across all providers. If charts support a higher level than billed, calculate the revenue impact. MGMA 2026: undercoding is named as a top revenue leak in medical practices.HIGH
  Real-world consultant data (DoctorsManagement 2026): ~$100,000 per FTE provider per year in unrealized revenue from undercoding.
• New Patient vs. Established Patient codes — Verify 99201–99205 (new) vs. 99211–99215 (established) assignments are correct. New patient = not seen by any provider in the practice within 3 years.MED
• Incident-to billing requirements — If billing physician services under the supervising physician NPI, confirm: service is continuation of prior physician plan; supervising physician is present in office suite; NPP has assigned credentialing. OIG Work Plan 2026: incident-to remains under active scrutiny.HIGH
• Telehealth E/M codes — Confirm place of service 02 (telehealth, non-originating) or 10 (patient home) is used correctly. Audio-only services bill under G2252 (established) or G2251 (new) — not standard E/M codes — until CMS extends audio-only flexibilities.HIGH
• Preventive vs. Problem-Focused visit on same date — If billing both a preventive (99381–99397) and problem-focused (99201–99215) on the same date, modifier 25 must be appended to the E/M and the problem addressed must be separately documented beyond the preventive. One of the highest-denial patterns in 2025.HIGH
• Split/shared visit billing — For shared E/M between physician and NPP: the billing provider must perform the "substantive portion" (more than half the total time, or the history, exam, or MDM). Document which provider did what and when.MED

• Modifier 25 (significant, separately identifiable E/M) — Pull all claims with modifier 25 for a 90-day period. Confirm documentation supports that the E/M was separate from the procedure and required additional work beyond the typical pre/post-procedure care.HIGH
  OIG finding: modifier 25 is one of the most frequently misused modifiers. Denial rate for improperly applied modifier 25 claims exceeds 30% at major payers.
• Modifier 59 (distinct procedural service) — Verify modifier 59 is only used when NCCI edit pairs are actually distinct (different session, different site, different incision, or different injury). CMS prefers more specific modifiers: XE, XS, XP, XU.HIGH
• Modifier 51 (multiple procedures) — Confirm primary procedure (highest RVU) is billed without modifier 51; secondary procedures use modifier 51. Check payer-specific rules — some payers price automatically without modifier 51.MED
• Modifier 26/TC (professional/technical component) — If billing split-component services, verify the physician bills modifier 26 (professional) and the facility bills modifier TC. Double-billing the global service when only a component was provided is a RAC priority.HIGH
• NCCI Procedure-to-Procedure (PTP) Edits — Run claims through current NCCI edit tables. CMS updates NCCI edits quarterly. Verify no column 1/column 2 pairs are being billed together without an appropriate modifier.MED
  Free NCCI edit tables available at cms.gov/Medicare/Coding/NationalCorrectCodInitEd
• NCCI Medically Unlikely Edits (MUEs) — Verify units billed for each HCPCS/CPT code do not exceed CMS MUE limits. MUE violations are auto-denied and create immediate overpayment liability.MED
• Modifier 57 (decision for surgery) — When E/M precedes a major procedure on the same day or day before, modifier 57 is required on the E/M to prevent bundling. Confirm use aligns with the global surgery period (90-day major, 10-day minor).MED
• Global surgery period tracking — Confirm no E/M services are billed during the global period without modifier 24 (unrelated E/M) or modifier 79 (unrelated procedure). Practices frequently miss global period violations for subsequent visits.MED

• Real-time eligibility verification — Confirm eligibility is checked within 24–48 hours of appointment (not just at scheduling). Insurance changes without notice are common — 27% of all denials trace to eligibility errors (MGMA).HIGH
• Benefits verification for specific services — Beyond active coverage, verify: deductible amount and amount met, copay/coinsurance, out-of-pocket maximum, in-network status, authorization requirements for planned services.HIGH
• Coordination of Benefits (COB) — Identify all patients with dual coverage. Verify primary payer and bill in correct sequence. Payer COB disputes are a growing denial category in 2025–2026.MED
• Prior authorization completeness — Confirm PA has been obtained for every service on the PA-required list for each payer. Payers expanded PA requirements significantly in 2024–2025; verify your internal list is current with each payer's 2026 PA requirements.HIGH
  AMA 2025 survey: physicians average 40 PA requests/week. 32% say PA requests are often or always denied. Update your PA required service list quarterly.
• Authorization for the rendered service — Confirm authorization obtained is for the specific procedure actually performed (CPT code match), the specific provider who performed it, the specific date of service, and the correct number of units.HIGH
• Referral requirements — Confirm referral is in place for HMO and POS patients. Referral must match the specialist seen and the dates of service. Expired or wrong-specialist referrals are a denial trigger.MED
• Place of Service accuracy — Verify POS codes match where care was delivered. POS 11 (office) vs. POS 22 (outpatient hospital) vs. POS 02 (telehealth) affect reimbursement rates by 20–50% for the same CPT code. POS errors are among the most financially impactful coding mistakes.HIGH

• Provider enrollment status — Confirm every provider has active enrollment with every payer in the practice's contract portfolio. Billing under an unenrolled provider generates immediate denial with no appeal right in most cases.HIGH
• Medicare revalidation status — Check CMS PECOS for revalidation due dates. CMS deactivates Medicare billing privileges (PTAN) if a provider fails to revalidate enrollment every 5 years OR fails to submit any claims for 4 consecutive quarters.HIGH
  Note: NPIs do not expire. It is the Medicare billing privilege (PTAN) that is deactivated. Check PECOS, not NPPES, for revalidation status.
• CAQH ProView attestation — Verify all providers have completed re-attestation within 120 days (90 days recommended; 180 days for Illinois). Expired CAQH status blocks credentialing queries from commercial payers and triggers credential lapses.HIGH
• Taxonomy code accuracy — Confirm the billing taxonomy code matches the provider's specialty and is enrolled with each payer. Taxonomy mismatches generate invisible denials that appear as out-of-network or medical necessity rejections. UHC NC Medicaid mandated billing taxonomy on every claim as of January 2025.MED
• NPI Type 1 vs. Type 2 — Confirm billing NPI matches the entity type: individual provider = Type 1 NPI; group/organization = Type 2 NPI. Payer enrollment must include both where required (e.g., billing under group but rendering under individual).MED
• Credentialing continuity for new hires — Confirm new providers have obtained provisional billing privileges before seeing patients. Retroactive credentialing is not permitted at most payers — claims for services rendered before effective enrollment date cannot be paid.HIGH
• Group vs. individual contract assignment — Verify that individual provider contracts are correctly assigned under the group TIN, or that the provider is individually enrolled where group enrollment does not include them. Rendering provider NPI and billing TIN must match payer records.MED

• Denial rate by payer — If any single payer accounts for >15% of your denials, that payer needs a dedicated audit. Request a peer-to-peer review with their medical director for recurring medical necessity denials.HIGH
• Denial rate by provider — If any individual provider generates >2x the practice average denial rate, conduct a focused audit of their coding, documentation, and prior authorization compliance.HIGH
• Denial rework rate — What percentage of denied claims are reworked and resubmitted? Industry benchmark: 60–65% of denied claims are never reworked (MGMA). Track your rate and target >90% rework on recoverable denials.HIGH
• Timely filing violations — Pull CO-29 denials. If you have any, identify the point in the workflow where claims are getting delayed. Timely filing denials are permanent — no appeal rights, no exceptions.HIGH
• AI-driven denial identification — Growing in 2025–2026: algorithmic denials from payers (UHC nH Predict, Cigna PxDx) have documented 80–90% overturn rates on appeal but fewer than 0.2% of denials are appealed. Identify AI-generated denials by their fast turnaround (hours vs. days) and request peer-to-peer with a clinical reviewer.MED

• Underpayment identification — Compare allowed amounts on EOBs/ERAs against contracted rates for your top 50 billed codes at each major payer. Industry benchmark: 1–3% of net patient revenue is lost to underpayments (HFMA/MD Clarity); practices with less contract monitoring lose up to 11%.HIGH
• Fee schedule effective dates — Confirm you have the current fee schedule on file for each contracted payer and that your billing system is using it. Payers update fee schedules annually (often January 1 and July 1) without notification.HIGH
• Medicare Physician Fee Schedule — Verify your charge master reflects the current year's Medicare conversion factor. For 2026, CMS reduced the Medicare CF from 2025 levels. Confirm 2026 RVU values are loaded in your billing system. Most significant cuts: primary care codes, telehealth add-ons.MED
• Carve-out codes — Review your payer contracts for any codes or services that are "carved out" from your fee schedule and paid at a different rate (often Medicare-based percentages). Carve-outs are frequently missed in underpayment analyses.MED
• Global contract rate review — If any payer contract has not been renegotiated in 3+ years, calculate inflation-adjusted losses. Medical inflation has averaged 4–7% annually since 2022. A contract flat-lined for 3 years represents an 8–20% effective rate reduction.MED
• RAC / MAC payment history — Review any Targeted Probe and Educate (TPE) or RAC correspondence from the past 24 months. Identify any payment requests, document the education completed, and confirm your processes have been updated to prevent recurrence.HIGH
• Medicare Advantage audit comparison — Pull MA payer denial rates separately from commercial and Medicare FFS. MA initial denial rates averaged 10.1% vs. FFS 4.2% in 2025 (Kodiak). Elevated MA denials warrant dedicated PA compliance and appeals protocol.MED
• RPM/telehealth billing compliance — If your practice bills Remote Patient Monitoring (CPT 99453, 99454, 99457, 99458) or RTM codes (98975–98980), audit against the OIG's August 2025 report which identified widespread billing errors in RPM. Common errors: billing 99454 without meeting 16-day device data threshold, billing 99457 without 20+ minutes of interactive communication.HIGH