Medical Coding Audit 2026: How to Run an Internal Audit and What to Look For

Most practices find out their coding is wrong when a RAC contractor sends a demand letter. That's the worst possible time to discover you've been consistently upcoding E/M visits or missing modifier requirements. An internal coding audit, done right, finds the same problems first — and gives you time to fix them, refund voluntarily if needed, and document the correction. That documentation is your best defense in any subsequent external audit.

Why Internal Coding Audits Matter

The OIG's compliance program guidance for physician practices recommends internal audits at least annually, and more frequently if your practice has a history of denials, prior external audits, or has recently added new providers or service lines. A well-run internal audit does four things: identifies overcoding (reducing recoupment risk), identifies undercoding (recovering revenue you're legitimately leaving behind), documents your good-faith compliance efforts, and creates a baseline for tracking improvement.

Practices that self-identify billing errors and voluntarily refund overpayments face significantly lower penalties than those caught in external audits. The OIG's Self-Disclosure Protocol allows practices to resolve potential False Claims Act violations at a minimum multiplier — typically 1.5x the overpayment — versus the statutory maximum of 3x plus civil monetary penalties.

How to Structure a Medical Coding Audit

Step 1: Select Your Sample

A statistically valid sample for a baseline audit is 25–30 records per provider per service type. For E/M codes, pull 30 claims across all five levels (99202–99215 or 99211–99215 depending on whether you bill new or established). If you see a pattern in the first 10, you don't need to continue — but a full 30-record sample gives you defensible data.

Step 2: Review Documentation Against the Code

For each sampled claim, pull the documentation and verify the code billed matches what the documentation supports. For E/M visits, score the MDM (or timed total time if time-based billing was used) and confirm the billed level is appropriate. For procedures, verify the documentation includes the required elements for that specific code.

Step 3: Calculate Error Rates

Track overcoding (billed higher than documentation supports), undercoding (billed lower than documentation supports), and other errors (wrong modifier, missing required diagnosis, etc.) separately. Industry benchmark for acceptable error rate: below 5% for overcoding. An overcoding rate above 10% is a red flag that requires corrective action before external auditors find it.

Step 4: Identify Root Causes

Coding errors cluster around specific causes: provider documentation habits, coder training gaps, system configuration issues, or specific code families. A pattern of 99215 overcoding across all providers in a practice usually points to a template problem — the EHR's default MDM scoring is set too high. A pattern limited to one provider suggests individual training is needed.

Step 5: Implement and Verify Corrective Action

Document everything. Your corrective action plan should include what the error was, the root cause, the training or system change implemented, who was responsible, and the timeline. Re-audit the same code categories 90 days after corrective action to verify the error rate has dropped.

High-Risk Codes to Audit in 2026

Based on OIG Work Plan priorities and MAC audit activity, these code categories warrant focused attention:

• E/M codes 99214 and 99215 — persistently over-utilized relative to Medicare benchmarks
• Telehealth E/M codes — documentation of audio-visual capability and patient location still frequently missing
• Care management codes (99490, 99491, 99495, 99496) — consent and time documentation gaps
• Modifier -25 use — E/M with same-day procedure; documentation must support separate and significant E/M service
• Global surgery period codes — separately billing services included in the surgical global period

Using Audit Findings to Negotiate Payer Contracts

A clean internal audit — showing low error rates, documented corrective action history, and coding that tracks with clinical outcomes — is a credentialing asset. Some payer quality programs (HEDIS, Star ratings) use claims data to assess practice quality. Practices with coding that accurately reflects their clinical work score better on these metrics, which affects both pay-for-performance bonuses and future contract negotiations.