Medical Billing and Coding Audit Services

Standard Operating Procedure: Medical Billing and Coding Audit Services

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Purpose

This Standard Operating Procedure (SOP) defines the operational, regulatory, and methodological framework for executing medical billing and coding audits across enterprise healthcare networks. The primary objective is to ensure systemic compliance with federal, state, and third-party payer guidelines, mitigate financial clawbacks, minimize legal exposure under the False Claims Act (FCA), and optimize revenue cycle integrity through systematic retrospective and prospective chart reviews.

2.2 Operational Boundaries & Regulatory Standards

The scope of this SOP encompasses all outpatient, inpatient, emergency, and ancillary service encounters audited by internal or external compliance teams. Operations must strictly adhere to:

• Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification Rules (45 CFR Parts 160 and 164).
• Centers for Medicare & Medicaid Services (CMS) guidelines, including the National Correct Coding Initiative (NCCI), Local Coverage Determinations (LCDs), and National Coverage Determinations (NCDs).
• International Classification of Diseases, Tenth Revision, Clinical Modification/Procedure Coding System (ICD-10-CM/PCS).
• Current Procedural Terminology (CPT) and Healthcare Common Procedure Coding System (HCPCS Level II) standards.
• Office of Inspector General (OIG) Compliance Program Guidance for Third-Party Medical Billing Companies and individual provider practices.

---

3. Prerequisites & Tool Requirements

Execution of this SOP requires the fulfillment of strict technical, infrastructural, and credentialing prerequisites:

• Certifications & Credentials: Auditors must hold active, unencumbered credentials from the American Academy of Professional Coders (AAPC)—such as Certified Professional Medical Auditor (CPMA), Certified Coding Specialist (CCS), or Certified Professional Coder (CPC)—or equivalent certifications from AHIMA. Clinicial auditors (RN, MD, DO) must possess current, unrevoked state licensure.
• Hardware: Enterprise-grade workstation with dual high-resolution displays, encrypted internal storage (AES-256), and biometric or multi-factor authentication (MFA) access controls.
• Software Access:
  • Enterprise Electronic Health Record (EHR) and Practice Management (PM) systems (read-only auditing profile).
  • Computer-Assisted Coding (CAC) and natural language processing (NLP) analytical suites.
  • Specialized medical coding encoder software (e.g., 3M 360 Encompass, Optum CAC).
  • Secure enterprise data analytics and reporting dashboards (Tableau/PowerBI connected to secure SQL data warehouses).
• Physical/Environmental Security: Private, HIPAA-compliant audit workspace (clean-desk policy enforced, zero unauthorized viewing angles, locked document disposal bins).

---

4. Roles & Responsibilities (RACI Matrix Table)

• Responsible (R): The role that performs the activity.
• Accountable (A): The role with final approval and fiduciary ownership.
• Consulted (C): The role providing advisory, clinical, or legal input.
• Informed (I): The role kept updated on audit milestones and outcomes.

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Planning & Sample Selection

• 1.1 Define the audit scope, objective (e.g., focused review vs. random sampling), and specialty service lines to be evaluated.
• 1.2 Determine sample size utilizing statistical valid random sampling (SVRS) methodologies (e.g., attribute sampling per OIG guidelines) based on total claim volume over the target timeframe.
• 1.3 Extract encounter datasets, including claims data, remittance advice (ERAs/EOBs), and corresponding medical records, ensuring strict encryption in transit and at rest.
• 1.4 Validate EHR audit trails to confirm record integrity and ensure no post-encounter modifications occurred without proper amendment logging.

Phase 2: Documentation Review & Code Validation

• 2.1 Perform an independent chart abstraction, reviewing documentation against the actual submitted codes for ICD-10-CM diagnosis accuracy, CPT/HCPCS procedure validity, and modifier application.
• 2.2 Evaluate Evaluation and Management (E/M) service levels strictly against current CMS/AMA documentation guidelines (utilizing either Total Time or Medical Decision Making [MDM] criteria).
• 2.3 Cross-reference services against NCCI edits, looking for unbundled procedures, mutually exclusive code pairs, and excessive unit counts.
• 2.4 Verify medical necessity by confirming that documented patient signs, symptoms, and diagnoses justify the diagnostic or therapeutic interventions rendered per LCD/NCD rules.

Phase 3: Discrepancy Analysis & Financial Impact Modeling

• 3.1 Document all coding and billing variances within the secure Audit Working Paper (AWP). Classify errors into mutually exclusive categories: Under-coding, Over-coding, Unbundling, Missing Documentation, or Billing Without Documentation.
• 3.2 Calculate the net financial impact by tabulating variances between billed charges, allowable amounts, and verified accurate payment thresholds.
• 3.3 Compute the aggregate error rate using the formula: $\text{Error Rate} = \left(\frac{\text{Total Erroneous Dollars}}{\text{Total Sample Dollars Reviewed}}\right) \times 100$.

Phase 4: Reporting, Remediation & Executive Briefing

• 4.1 Draft the Comprehensive Audit Findings Report detailing systemic trends, error distribution by provider, and financial exposure limits.
• 4.2 Convene a remediation conference with the Revenue Cycle Manager and Billing Operations to halt systemic billing errors immediately.
• 4.3 Schedule provider feedback sessions to present chart-specific findings and deliver targeted documentation education.
• 4.4 If systemic overpayments are identified, initiate the institutional overpayment refund protocol in compliance with the 60-day rule (42 CFR § 438.608).

---

6. Quality Assurance & Verification Criteria

To maintain institutional validity, every audit output undergoes rigorous Quality Assurance (QA) peer review before executive release.

• Acceptable Error Tolerance Thresholds:
  • Coding Accuracy Rate: $\ge 95%$ benchmark.
  • Financial Accuracy Rate: $\ge 98%$ benchmark.
  • Documentation Support Rate: $100%$ for high-risk modalities (e.g., surgical encounters, prolonged services).
• QA Review Checklist:
  • Dual-auditor validation performed on a randomly selected $10%$ secondary sample.
  • Inter-Rater Reliability (IRR) score calculated; must exceed $92%$ agreement.
  • All regulatory citations verified against current fiscal year CMS manuals.
  • Complete redaction of protected health information (PHI) verified for any external reporting copies.

---

7. Practical Troubleshooting Scenarios

Scenario A: Missing or Incomplete Medical Record Documentation in the EHR

• Symptom: During Phase 2 review, an operative report or physician progress note referenced in the billing claim is entirely absent from the EHR export or lacks an authenticated signature.
• Immediate Corrective Action Protocol:
  1. Flag the encounter immediately as Unsubstantiated Documentation (Category E).
  2. Issue an urgent query via the secure practice management portal to the HIM Director and attending provider, establishing a strict 48-hour response window.
  3. If the record cannot be produced or authenticated within the window, classify the claim as a complete overpayment, recommend immediate zero-pay/refund adjustment, and document the deficiency in the provider's compliance file.

Scenario B: Systematic NCCI Edit Bypass (Unbundling)

• Symptom: Analysis reveals a recurring pattern where a specific surgical team systematically bypasses NCCI column 1/column 2 edit pairs using inappropriate modifiers (e.g., overuse of Modifier 59 without distinct procedural documentation).
• Immediate Corrective Action Protocol:
  1. Suspend automated claims generation for the specific provider-service code combination pending review.
  2. Pull a retrospective expanded sample of 50 consecutive charts containing the modified codes.
  3. Issue a mandatory stop-work and corrective coding education directive to the billing department; adjust the scrub engine rules in the Practice Management billing module to block modifier application without explicit secondary operative note validation.