Catch billing problems before auditors do
Proactive compliance auditing, HIPAA readiness reviews, RAC audit prep, and coding accuracy analysis, so your practice is always audit-ready, not audit-reactive.
OIG Work Plan Audits
We review your billing patterns against the current OIG Work Plan targets, the list of services the Office of Inspector General is actively auditing this year.
- Modifier 59 and X-modifier usage
- Same-day E&M + procedure patterns
- High-use CPT code outliers
- Place-of-service accuracy
RAC & MAC Audit Readiness
Recovery Audit Contractors (RACs) and Medicare Administrative Contractors (MACs) conduct post-payment reviews. We prepare your documentation to withstand scrutiny.
- Medical necessity documentation review
- LCD/NCD coverage criteria verification
- Signature and authentication compliance
- Overpayment risk identification
Coding Accuracy Reviews
We audit a statistically significant sample of claims each quarter to measure coding accuracy and identify systematic errors before they become a pattern payers flag.
- E&M level appropriateness
- Diagnosis code specificity
- Procedure code selection accuracy
- Modifier application correctness
HIPAA Compliance Review
Billing operations touch PHI at every step. We verify that your billing workflows, data transmission, and vendor relationships meet current HIPAA requirements.
- BAA coverage for all billing vendors
- PHI transmission security review
- Minimum necessary standard compliance
- Breach risk identification
Documentation Gap Analysis
We identify documentation patterns that create claim risk (unsigned notes, missing orders, inadequate medical necessity language) before those claims are submitted.
- Provider-specific documentation audits
- Template compliance review
- Order and referral verification
- Time-based service documentation
Credentialing Compliance
Billing a service under the wrong provider NPI, or while a provider is not yet credentialed, is both a denial trigger and a compliance violation.
- NPI and taxonomy code verification
- Credentialing status tracking per payer
- Incident-to billing rule compliance
- Locum tenens and covering provider rules
| Finding | Frequency | Risk Level | Typical Impact |
|---|---|---|---|
| E&M level unsupported by documentation | Commonly found | High | Overpayment demand, potential recoupment |
| Modifier 25 without distinct E&M documentation | Commonly found | High | RAC audit trigger, bundling recoupment |
| Missing or unsigned orders for diagnostic services | Commonly found | Medium | Denial on post-payment audit |
| ICD-10 codes lacking required specificity | Commonly found | Medium | Medical necessity denials |
| BAA not on file for a billing-related vendor | Commonly found | High | HIPAA violation exposure |
| Place-of-service code errors on telehealth claims | Commonly found | Medium | Claim denial, resubmission required |
| Incident-to billing without supervising provider present | 29% of multi-provider practices | High | False Claims Act exposure |
What auditors look at first, and why you should too
Audits rarely start with a surprise. They start with a pattern: a high rate of modifier 59, a provider whose E/M levels sit at the top of the curve, a service line the OIG has already named in its Work Plan. Your own data shows those patterns long before a payer letter does, if someone looks.
The lookback is long. Recovery audit contractors can review Medicare claims up to three years after payment, and if you find an overpayment yourself, federal rules generally require you to report and return it within 60 days. A problem found in month 35 is a bigger bill than one found in month 3, because the error repeated the whole time.
Proactive review is cheaper than reactive defense. A sample of 30 to 50 charts per provider each quarter is enough to see whether errors are random or systematic, and systematic errors are the ones that get a practice flagged.
How a compliance review runs
- Scope and sampleWe agree which risk areas to cover, then pull a statistically sound claim sample, typically 30 to 50 records per provider per quarter.
- Record reviewEach claim is checked against the medical record: coding, medical necessity, modifiers, signatures and orders.
- Risk scoringFindings are rated high, medium or low and tied to the CMS guideline or payer policy that applies.
- Written action planYou get specific corrections: provider education, workflow changes, or claim amendments and refunds where needed.
- Follow-up auditWe re-sample the same areas the next quarter to show whether the fixes held.
What compliance auditing costs
Compliance and coding audits are included in our Enterprise billing tier. For everyone else, they're a standalone service quoted after a short intake, based on provider count and audit scope.
Audit response support (if you've already received a records request) is scoped separately, because the work depends on the volume of records and the deadline. Call us; the first conversation is free.
Questions we hear most
How often should a practice audit itself?
Quarterly is a sound rhythm for most practices, with extra reviews after a new provider joins, a code set changes or a payer letter arrives.
What's the difference between a RAC and a MAC review?
Recovery audit contractors review paid Medicare claims to find improper payments, while Medicare administrative contractors process claims and run their own medical reviews. Both can ask for records, and both expect documentation that supports the service billed.
What happens if you find an overpayment?
We document it, quantify it and help you correct and return it inside the 60-day window. Returning it on time is far better than being found holding it.
Do you handle HIPAA reviews too?
Yes. We check business associate agreements, PHI transmission security, minimum necessary practices and breach risk as part of the billing-side review.
Related: Coding validation · RAC audits in 2026 · Billing compliance guide · HIPAA notice.
Find out what your practice's audit risk looks like
Our free revenue assessment includes a compliance risk snapshot, no charge, no commitment. Most practices have at least 2–3 high-risk findings in the first review.
Request Free Compliance Review →