Self-Audits: Your Best Defense Against Government Scrutiny

Self-Audits: Your Best Defense Against Government Scrutiny

The Worst Time to Find a Billing Problem Is When Someone Else Finds It First

No medical practice wants to receive a letter requesting records.

No one wants to see the words:

Audit.

Overpayment.

Recoupment.

Medical record request.

Investigation.

But healthcare is one of the most heavily regulated industries in the country, and practices submit thousands of claims based on complicated coding, documentation, coverage, and billing rules.

Mistakes are going to happen.

The question isn't whether your practice will ever make a billing error.

The better question is:

Will you find it before a payer or government auditor does?

That's exactly why self-audits matter.

A strong internal auditing program isn't about finding ways to punish physicians or coders.

It's about finding vulnerabilities while you still have the opportunity to investigate them, correct them, educate your team, and prevent them from becoming bigger problems.

An Audit Isn't an Admission That You're Doing Something Wrong

Some practices avoid internal audits because they're afraid of what they'll find.

That's backwards.

Finding an error internally doesn't automatically mean your practice has a compliance crisis.

It means your compliance program is doing its job.

The HHS Office of Inspector General (OIG) has long emphasized the importance of healthcare compliance programs, including auditing and monitoring.

A practice that actively reviews its own billing can identify problems before those problems become patterns.

And patterns are where risk can become much more serious.

The Government Has Data. Lots of It.

Healthcare claims generate an enormous amount of information.

Every time you submit a claim, you're creating data.

That data can reveal:

• E/M distributions
• Modifier utilization
• Procedure volume
• Diagnosis patterns
• Provider utilization
• Billing frequency
• Place-of-service patterns
• Units billed
• Patient utilization
• Geographic differences

That means unusual billing patterns can potentially be identified without anyone initially reading a single medical record.

Your practice may think:

“We've never been audited, so we're probably fine.”

That's not a compliance strategy.

Outliers Don't Automatically Mean You're Wrong

This distinction is extremely important.

Suppose most physicians in your specialty report a certain percentage of high-level E/M services.

Your practice reports significantly more.

Does that automatically mean you're upcoding?

No.

Your patient population may legitimately be more complex.

You may operate a tertiary referral center.

Your providers may manage higher-risk patients.

Your specialty mix may be different.

But being an outlier creates a question:

Can your documentation explain why?

That's where self-auditing becomes valuable.

You don't want the first person asking that question to be an outside auditor.

What Should You Be Self-Auditing?

You don't need to audit every claim your practice submits.

You need a thoughtful, risk-based approach.

Here are some areas worth reviewing.

1. E/M Coding Patterns

Look at your providers' E/M distributions.

Are there unusual patterns?

Does one provider bill significantly differently from everyone else?

Are almost all visits being reported at one level?

Again, an outlier isn't automatically wrong.

It tells you:

Look here.

Then audit the documentation.

2. Modifier 25

Modifier 25 deserves attention because it can significantly affect reimbursement when an E/M service and procedure occur on the same date.

The question isn't:

“Did the patient have an office visit?”

The question is whether the documentation supports a significant, separately identifiable E/M service beyond the work associated with the procedure.

If your practice automatically appends Modifier 25 whenever an E/M and procedure appear together, that's worth auditing.

3. Modifier 59 and the X Modifiers

Another area deserving scrutiny is the use of Modifier 59 and, when applicable, the X{EPSU} modifiers.

These modifiers shouldn't simply be used to make an edit disappear.

If your billing workflow is:

Claim denies → Add Modifier 59 → Resubmit

you have a compliance problem waiting to happen.

Your audit should determine whether the circumstances actually support separate reporting.

4. High-Level E/M Services

If your practice frequently reports high-level services, review them.

Not because high-level codes are inherently suspicious.

They're not.

But higher-complexity services should have documentation that supports the reported level under the applicable E/M rules.

Don't audit with the assumption that:

Higher level = wrong.

Audit with the question:

Does the documentation support what we billed?

5. Critical Care

Critical care deserves special attention because it is time-based and subject to specific requirements.

Your audit should evaluate whether the documentation supports:

• The patient's critical condition
• The risk of deterioration
• The physician/QHP's active management
• Qualifying critical-care time
• Appropriate exclusion of separately reportable procedure time when required
• Applicable rules when multiple practitioners provide care

Simply documenting:

“Critical care time: 35 minutes”

doesn't necessarily tell the complete story.

6. Global Surgical Periods

Surgical practices should audit services reported during global periods.

Review the use of modifiers such as:

24 — Unrelated E/M during the postoperative period

57 — Decision for surgery

58 — Staged or related procedure/service during the postoperative period

78 — Unplanned return to the operating/procedure room for a related procedure

79 — Unrelated procedure during the postoperative period

These modifiers communicate very different circumstances.

They shouldn't be selected simply because the claim won't pay without one.

7. Units

Unit errors can create significant overpayments.

This is especially important for practices billing:

• Drugs
• Infusions
• Injections
• Therapy
• Time-based services
• Certain supplies

Compare:

What was administered or performed

to:

What was documented

to:

What was billed.

One decimal point, unit conversion, or quantity error repeated across hundreds of claims can become a major problem.

8. Medical Necessity

A technically correct CPT code can still create a problem if the service doesn't meet applicable coverage or medical-necessity requirements.

Your audit should evaluate more than:

“Did we choose the right code?”

It should also consider:

“Does the record support why the service was performed?”

Coding accuracy and medical necessity are related—but they're not the same thing.

9. Incident-To and Shared/Split Billing

If your practice uses billing arrangements involving physicians and nonphysician practitioners, audit them.

These rules can be nuanced and have changed over time.

Don't rely on:

“We've always billed it this way.”

Make sure your current workflow aligns with the current rules applicable to the payer and setting.

10. Services Your Billing Company Changes

This one often gets overlooked.

Your billing company receives a claim.

An edit fires.

Someone changes a modifier.

Or changes a code.

Or changes units.

Then the claim goes out.

Does your practice know that's happening?

Your self-audit shouldn't stop at the medical record.

Compare:

Medical Record → Coding → Claim → Payment

That's how you determine what was actually submitted under your provider's name.

Don't Just Audit Your Doctors

Revenue-cycle compliance isn't only about physician documentation.

Your audit should also look at operational processes.

For example:

Credentialing

Was the provider appropriately enrolled for the claims being submitted?

Prior authorization

Was authorization obtained when required?

Eligibility

Was coverage verified appropriately?

Place of service

Was the correct location reported?

Billing provider

Was the correct entity reported?

Rendering provider

Was the correct clinician identified?

Claims edits

Were changes made appropriately before submission?

A perfectly documented medical record can still result in an incorrect claim.

How Often Should You Audit?

There isn't one universal audit schedule appropriate for every practice.

Your frequency should reflect the size, specialty, services, prior findings, payer mix, and risk profile of your organization.

But auditing shouldn't be something you do once every five years.

A practical program might include:

Routine baseline audits

plus:

Focused audits when data identifies a potential problem.

For example:

Your analytics show an unusual spike in Modifier 25 utilization.

Don't wait until next year's audit.

Look at it now.

Audit New Providers Early

This is one of the best opportunities for prevention.

Don't wait until a physician has submitted thousands of claims before reviewing their documentation and coding.

Audit early.

Maybe after the first several weeks or months, depending on volume.

Identify:

• Documentation habits
• E/M selection
• Modifier usage
• Procedure documentation
• Diagnosis selection
• Time documentation

Then provide education.

Correcting a habit after 50 claims is much easier than correcting it after 5,000.

Self-Audits Shouldn't Be “Gotcha” Exercises

If physicians think auditing exists solely to catch them doing something wrong, they'll resist it.

Instead, position auditing correctly.

The goal is:

Accuracy.

Sometimes an audit identifies overcoding.

Sometimes it identifies undercoding.

Sometimes it finds missing documentation.

Sometimes it identifies a billing-system configuration problem.

Sometimes it discovers a payer issue.

And sometimes it confirms that your providers are doing everything correctly.

That's valuable too.

What Happens When You Find a Problem?

This is where a compliance program proves whether it's real.

Don't put the audit report in a folder and forget about it.

If an issue is identified:

Determine the scope.

How widespread is it?

Identify the root cause.

Provider? Coder? Billing company? EHR? Workflow?

Stop the error.

Fix the process causing it.

Determine whether affected claims require correction.

Evaluate potential overpayments and applicable repayment obligations.

Educate the people involved.

Re-audit.

Did the correction actually work?

Significant findings may warrant consultation with qualified healthcare compliance professionals or legal counsel to determine the appropriate response.

Documentation of Your Compliance Efforts Matters Too

If your practice performs audits, document them.

Keep records of:

• What was reviewed
• Why it was selected
• Sample methodology
• Findings
• Education provided
• Corrective action
• Claim corrections when applicable
• Follow-up audits
• Resolution

A compliance program shouldn't exist only in someone's head.

You should be able to demonstrate that the practice actively monitors its billing and responds when concerns are identified.

Your Billing Company Shouldn't Be Your Only Auditor

Your billing company absolutely should have quality-control processes.

But practice ownership also needs independent visibility.

Remember:

The claims are being submitted under your providers and your organization.

You should know:

What is being billed.

How it's being coded.

What modifiers are being used.

What is being changed.

What patterns exist.

What your documentation supports.

Outsourcing billing doesn't mean outsourcing responsibility.

Don't Audit Only After You Receive a Letter

This is the biggest point.

Some practices don't review compliance until something happens.

A payer requests 50 records.

Medicare sends correspondence.

A recoupment arrives.

An employee raises a concern.

Suddenly everyone starts auditing.

That's reactive compliance.

Self-auditing gives you the opportunity to be proactive.

Find the problem before someone else finds it for you.

The Bottom Line

Self-audits aren't about assuming your physicians are doing something wrong.

They're about recognizing something every healthcare organization should already understand:

Complex systems produce mistakes.

Your best defense is a compliance program capable of finding those mistakes, investigating them, correcting them, and preventing them from becoming patterns.

Don't wait for the government.

Don't wait for the payer.

Don't wait for the recoupment letter.

Audit your documentation.

Audit your coding.

Audit your claims.

Audit your billing company.

Audit your processes.

Because the most valuable audit your practice may ever receive is the one you perform on yourself—before someone else decides to perform it for you.