Medical billing audit checklist: what to review and what to look for

A medical billing audit reviews a sample of claims from the visit through final payment to find where revenue is lost and where compliance risk exists. A useful checklist covers eight areas: front desk and eligibility data, documentation and coding, charge capture, claim submission and rejections, payment posting and underpayments, denials and appeals, A/R aging, and provider enrollment. For each area, compare what happened on real claims against what should have happened, and trace each problem back to the step that caused it.

The checklist below is built for a practice running its own internal review, or preparing for an outside audit. Most practices find it works best to review a sample of 20 to 50 encounters per provider, chosen from different payers and visit types, plus the reports for the same period.

Before you start

• Pick a period. A recent three month window gives enough volume and lets most claims finish processing.
• Pull the reports. A/R aging by payer, denials by reason code, charges and payments by provider, E/M level distribution, and a list of write-offs and adjustments.
• Choose the sample. Include high-volume codes, high-dollar services, frequently denied codes and any code a payer has flagged.
• Decide who reviews. Coding should be reviewed by someone other than the person who coded the claims.
• Use the minimum necessary. Reviewers should see only the records they need, inside the practice's own systems.

The checklist at a glance

1. Front desk and eligibility

• Patient name, date of birth and member ID on the claim match the insurance card
• The correct payer and plan were billed, including Medicare Advantage instead of Original Medicare where applicable
• Eligibility was checked before the visit and the result is recorded
• Prior authorization was obtained for services that needed it, and the authorization number is on the claim where required
• Copays and known balances were collected at check-in

If many problems in the audit start here, our eligibility verification and prior authorization page explains how that step can be moved ahead of the visit.

2. Documentation and coding

• The note is signed and dated by the rendering provider before the claim was sent
• The E/M level is supported by medical decision making or total time, as documented
• ICD-10 codes are as specific as the note supports and meet the payer's coverage policy
• Modifiers (25, 59, XE, XS, XP, XU, RT, LT, 50) are supported by the documentation
• Drug and supply units match the dose given and the HCPCS descriptor
• Services billed under another provider, such as incident-to, meet the payer's rules

Compare each provider's E/M level distribution with peers in the same specialty. A provider who bills almost everything at one level is either undercoding or overcoding, and both are worth reviewing. Our medical coding page covers how coding reviews are done.

3. Charge capture

• Every completed appointment on the schedule has a charge or a documented reason for none
• In-office procedures, injections, drugs, tests and supplies were billed along with the visit
• Hospital, nursing facility and after-hours services were entered
• Charges were entered within a set number of days of the visit

4. Claim submission and rejections

• Average days from visit to claim submission
• The share of claims accepted by the clearinghouse and payer on the first submission
• Rejections are corrected within a few working days
• No claims are sitting on hold without an owner and a reason
• Provider NPI, taxonomy, tax ID and service address match each payer's enrollment record

5. Payment posting and underpayments

• Allowed amounts match the contracted fee schedule for your most common codes
• Contractual adjustments are calculated correctly, and denials were not posted as adjustments
• Partial payments on multi-line claims were reviewed line by line
• Patient responsibility was moved to the patient or the secondary payer promptly
• Credit balances are reviewed and refunded on a regular schedule

Credit balances matter for compliance as well as accounting. Medicare and Medicaid overpayments must be reported and returned within 60 days of being identified, and since 2025 CMS allows that clock to be suspended for up to 180 days while the practice conducts a timely, good-faith investigation. Commercial contracts and state laws have their own refund rules.

6. Denials and appeals

• Every denial in the sample has a documented action and date
• Appeals were filed within the payer's deadline
• Denials are tracked by reason code, payer and provider each month
• The top denial reasons have a named owner and a prevention step

See our guide to common claim denial reasons for what the most frequent codes mean.

7. A/R aging and write-offs

• Days in A/R and the share of A/R over 90 days, compared with prior months
• Claims over 60 days have follow-up notes within the last few weeks
• No claims are close to a filing limit without action
• Write-offs have a reason code, and small balance and timely filing write-offs are reviewed for patterns

8. Credentialing and enrollment

• Each provider is enrolled and effective with each payer they bill, at each location
• CAQH profiles are attested on time
• Medicare revalidation dates are tracked
• ERA and EFT enrollment is active for each major payer

How to score what you find

A simple scoring method keeps the results comparable from one audit to the next. For each encounter in the sample, record whether it passed or failed in each area, and for coding, whether the error would have raised or lowered payment. Then calculate:

• Coding accuracy rate by provider: encounters coded correctly divided by encounters reviewed
• Charge capture rate: services documented and billed divided by services documented
• Error direction: how many errors were overcoding versus undercoding
• Dollar effect: the difference between what was billed and what the documentation supported, for the sample

Keep the spreadsheet and the sample list. The next audit should use the same method so you can see whether each area improved.

Compliance items to include

• A written compliance program, using the HHS Office of Inspector General's General Compliance Program Guidance as a reference
• Staff and providers checked against the OIG exclusion list on a regular schedule
• A signed business associate agreement with each vendor that handles patient information
• Documented coding and billing policies, and a record of training

Our billing compliance service covers these items in more depth.

After the audit

Share the results with providers and staff in plain terms, one area at a time, with specific examples from their own claims. An audit only helps if it leads to changes. Group the findings by root cause, estimate which ones affect the most claims or dollars, and assign each one an owner and a date. Repeat a smaller review in three to six months to confirm the fix worked. If the audit finds claims that were overpaid, work with your compliance lead on the refund process.

How SFA can help

If you want an outside view, our full RCM audit service reviews these areas in depth. To start smaller, a free practice audit involves no commitment: we review your billing and walk you through where revenue may be slipping.

Frequently asked questions

How often should a medical practice audit its billing?

Many practices run a focused internal review every quarter and a broader audit once a year. Audit more often when you add providers, change systems, see denials rise or receive a payer records request.

How many claims should a billing audit review?

A common approach is 20 to 50 encounters per provider, chosen across payers, visit types and high-risk codes. Larger samples make sense when the first review finds a pattern.

What is the difference between a coding audit and a billing audit?

A coding audit checks whether codes, modifiers and units match the documentation. A billing audit is broader and also covers eligibility, charge capture, claim submission, payment posting, denials, A/R and enrollment.