Medical Coding Audit 2026

How to Run an Internal Audit and What to Look For

Most practices find out their coding is wrong when a RAC contractor sends a demand letter. That's the worst possible time to discover you've been consistently upcoding E/M visits or missing modifier requirements. An internal coding audit, done right, finds the same problems first, and gives you time to fix them, refund voluntarily if needed, and document the correction. That documentation is your best defense in any subsequent external audit. The financial stakes here are real: a recurring gap in this area adds up to lost or delayed revenue every month.

Why Internal Coding Audits Matter

The OIG's compliance program guidance for physician practices recommends internal audits at least annually, and more frequently if your practice has a history of denials, prior external audits, or has recently added new providers or service lines. A well-run internal audit does four things: identifies overcoding (reducing recoupment risk), identifies undercoding (recovering revenue you're legitimately leaving behind), documents your good-faith compliance efforts, and creates a baseline for tracking improvement. Contractors can look back three years, and on a practice with a recurring pattern here, that lookback can put a large recoupment at stake, before the cost of the appeal.

Practices that self-identify billing errors and voluntarily refund overpayments face significantly lower penalties than those caught in external audits. The OIG's Self-Disclosure Protocol allows practices to resolve potential False Claims Act violations at a minimum multiplier, typically 1.5x the overpayment, versus the statutory maximum of 3x plus civil monetary penalties.

How to Structure a Medical Coding Audit

Step 1: Select Your Sample

A statistically valid sample for a baseline audit is 25–30 records per provider per service type. For E/M codes, pull 30 claims across all five levels (99202–99215 or 99211–99215 depending on whether you bill new or established). If you see a pattern in the first 10, you don't need to continue, but a full 30-record sample gives you defensible data.

Step 2: Review Documentation Against the Code

For each sampled claim, pull the documentation and verify the code billed matches what the documentation supports. For E/M visits, score the MDM (or timed total time if time-based billing was used) and confirm the billed level is appropriate. For procedures, verify the documentation includes the required elements for that specific code.

Step 3: Calculate Error Rates

Track overcoding (billed higher than documentation supports), undercoding (billed lower than documentation supports), and other errors (wrong modifier, missing required diagnosis, etc.) separately. Industry benchmark for acceptable error rate: below 5% for overcoding. An overcoding rate above 10% is a red flag that requires corrective action before external auditors find it.

Step 4: Identify Root Causes

Coding errors cluster around specific causes: provider documentation habits, coder training gaps, system configuration issues, or specific code families. A pattern of 99215 overcoding across all providers in a practice usually points to a template problem, the EHR's default MDM scoring is set too high. A pattern limited to one provider suggests individual training is needed.

Step 5: Implement and Verify Corrective Action

Document everything. Your corrective action plan should include what the error was, the root cause, the training or system change implemented, who was responsible, and the timeline. Re-audit the same code categories 90 days after corrective action to verify the error rate has dropped.

High-Risk Codes to Audit in 2026

Based on OIG Work Plan priorities and MAC audit activity, these code categories warrant focused attention:

• E/M codes 99214 and 99215, persistently over-utilized relative to Medicare benchmarks
• Telehealth E/M codes: documentation of audio-visual capability and patient location still frequently missing
• Care management codes (99490, 99491, 99495, 99496), consent and time documentation gaps
• Modifier -25 use: E/M with same-day procedure; documentation must support separate and significant E/M service
• Global surgery period codes: separately billing services included in the surgical global period

Using Audit Findings to Negotiate Payer Contracts

A clean internal audit: showing low error rates, documented corrective action history, and coding that tracks with clinical outcomes, is a credentialing asset. Some payer quality programs (HEDIS, Star ratings) use claims data to assess practice quality. Practices with coding that accurately reflects their clinical work score better on these metrics, which affects both pay-for-performance bonuses and future contract negotiations.

Choosing the Sample So It Means Something

A good audit starts with a sample that reflects how you actually bill. Pull records across every provider, every major payer, and the service lines that make the most money, not just the easy ones. Include some high-level visits and some low-level ones, because errors appear in both directions.

If the first sample finds a lot of errors in one area, expand it there. If it finds few, don't assume everything's fine. Rotate the focus each quarter so that over a year every provider and every major code family has been reviewed at least once.

Scoring Findings and Deciding What Comes Next

Score each claim as correctly coded, under-coded, over-coded, or unsupported by documentation, and note the reason. Calculate an error rate for each provider and each service, and note whether the errors cluster around a code, a template, or a person. A cluster is a fixable cause. A scattering is a training issue.

Decide in advance what happens at each error level. A low rate might call for feedback only. A higher rate might trigger a larger follow-up sample, targeted training, and re-audit in 60 to 90 days. Agreeing on the rules before you see the results keeps the process consistent.

Handling Overpayments You Find

Sometimes an audit will show that claims were paid at a higher level than the record supports. Once you've identified an overpayment and quantified it, the clock is running on your obligation to report and return it. Don't sit on it. Involve your compliance lead or counsel, document the timeline, and follow the payer's refund process.

The article recommends documenting corrective action, and that's the part people skip. A short memo covering what you found, how you fixed it, and how you'll check that the fix worked is your strongest evidence of an effective compliance program.

Report the Results So People Act on Them

An audit that ends in a spreadsheet does nothing. Write a short report for each audit: what you reviewed, how many claims, the error rate by provider and code family, the three most common problems, and the actions you recommend. Keep it to two pages.

Share it with the providers and the coding staff. Meet with anyone whose error rate was high, look at real examples together, and agree on what changes. Set a date for re-audit and put it on the calendar.

Retain the reports, the samples, and the follow-up in one place. In an external audit, a documented history of reviewing and correcting your own work is worth more than any claim that you're careful.

Audit Follow-Up Checklist

Frequently Asked Questions About Medical Coding Audit 2026: How to Run an Internal Audit and What to Look For

How often should a medical practice run an internal coding audit?

The OIG compliance guidance recommends internal coding audits at least annually. High-risk practices: those with prior external audits, high denial rates, or recently added providers or service lines, should audit semi-annually or quarterly. After corrective action, a follow-up audit at 90 days verifies the fix worked.

What is an acceptable internal coding audit error rate?

An overcoding error rate below 5% is generally acceptable and requires only minor training. A rate of 5-10% is moderate risk and requires documented corrective action with re-audit in 90 days. Above 10% is significant risk, and above 20% may require voluntary refund and consultation with a healthcare attorney.

What is the OIG Self-Disclosure Protocol for billing errors?

The OIG Self-Disclosure Protocol allows practices that identify potential False Claims Act violations to proactively disclose and resolve them at a lower multiplier, typically 1.5x the overpayment, versus the statutory maximum of 3x plus civil monetary penalties. Self-disclosure requires calculation of the overpayment, repayment, and a corrective action plan.