Medical Billing Audit

Standard Operating Procedure: Medical Billing Audit

1. Document Control & Revision History

---

2. Executive Summary & Scope

2.1 Clinical Statement of Operational Boundaries

This Standard Operating Procedure (SOP) governs the systematic, retrospective, and prospective auditing of medical billing, documentation integrity, and claims generation across all outpatient and inpatient service lines. The operational boundary encompasses the entire revenue cycle continuum—from patient registration and point-of-care clinical documentation to charge capture, claims adjudication, and post-payment reimbursement reconciliation.

2.2 Regulatory Standards & Compliance Framework

All audit activities executed under this SOP must maintain strict adherence to federal, state, and institutional statutes, including but not limited to:

• Health Insurance Portability and Accountability Act (HIPAA) (Pub. L. 104-191) regarding Protected Health Information (PHI) security and privacy.
• The False Claims Act (31 U.S.C. §§ 3729–3733) prohibiting the submission of false or fraudulent claims to federal healthcare programs.
• The Stark Law (42 U.S.C. § 1395nn) and Federal Anti-Kickback Statute (42 U.S.C. § 1320a-7b) governing physician self-referrals and remuneration.
• Centers for Medicare & Medicaid Services (CMS) guidelines, including National Correct Coding Initiative (NCCI) edits, Local Coverage Determinations (LCDs), and National Coverage Determinations (NCDs).
• Office of Inspector General (OIG) Compliance Program Guidance for Third-Party Medical Billing Companies and Hospitals.

---

3. Prerequisites & Tool Requirements

3.1 Software & System Access

• Enterprise Electronic Health Record (EHR) system with read-only administrative auditing permissions (e.g., Epic, Cerner).
• Medical billing and Practice Management (PM) software (e.g., Athenahealth, eClinicalWorks) with full claims history access.
• Computer-Assisted Coding (CAC) and auditing platforms (e.g., 3M Health Information Systems, Optum).
• Secure Electronic Data Interchange (EDI) clearinghouse reporting portals.
• Secure analytics and data visualization tools with data encryption at rest and in transit (AES-256).

3.2 Certifications & Qualifications

• Auditors must hold at least one active, industry-recognized credential:
  • Certified Professional Medical Auditor (CPMA) via AAPC.
  • Certified Coding Specialist (CCS) or Certified Coding Specialist-Physician-based (CCS-P) via AHIMA.
  • Certified Healthcare Auditor (CHA) or equivalent designation.
• Mandatory annual compliance training certification, including HIPAA Privacy and Security modules and Fraud, Waste, and Abuse (FWA) prevention.

3.3 Hardware & Security Equipment

• Enterprise-issued, hardware-encrypted workstation meeting FIPS 140-2 compliance standards.
• Multi-factor authentication (MFA) tokens for secure network access.
• Dedicated privacy filter for physical workspace compliance.

---

4. Roles & Responsibilities (RACI Matrix Table)

Definitions:

• Responsible (R): The role that performs the activity to achieve the deliverable.
• Accountable (A): The sole role with final approval and fiduciary/regulatory accountability.
• Consulted (C): Subject matter experts providing critical inputs and advisory support.
• Informed (I): Stakeholders kept updated on operational milestones and audit outcomes.

---

5. Step-by-Step Operational Procedure

Phase 1: Pre-Audit Planning and Sample Selection

• 1.1 Define the audit scope, specifying the clinical department, provider NPIs, and date of service (DOS) parameters for the evaluation period.
• 1.2 Establish the sample size using a statistically valid methodology (e.g., Attribute Sampling per OIG guidelines, targeting a minimum confidence level of 95% with a 5% precision rate).
• 1.3 Extract the billing data set from the PM software, cross-referencing claim submissions against EHR encounter logs to ensure completeness of the sampling frame.
• 1.4 Generate the randomized patient chart selection list and securely transmit identifiers to the HIM/Medical Records retrieval queue.

Phase 2: Documentation Retrieval and Cross-Validation

• 2.1 Pull complete clinical documentation for each selected encounter, including physician notes, nursing records, diagnostic imaging reports, pathology results, and operative reports.
• 2.2 Verify the presence of a valid, signed physician order or encounter justification supporting the medical necessity of every billed service.
• 2.3 Reconcile the rendered services documented in the clinical record against the line-item charges posted in the billing ledger.

Phase 3: Coding Accuracy and Regulatory Compliance Review

• 3.1 Audit International Classification of Diseases (ICD-10-CM/PCS) codes for highest specificity, sequence accuracy, and direct support from clinical diagnostic findings.
• 3.2 Evaluate Current Procedural Terminology (CPT) and Healthcare Common Procedure Coding System (HCPCS) codes for precise alignment with procedural documentation.
• 3.3 Check evaluation and management (E/M) code selection against current CMS documentation guidelines (Medical Decision Making [MDM] or Time-based tracking).
• 3.4 Cross-reference claim lines against active NCCI edits, checking for unbundling errors, mutually exclusive code pairs, and correct modifier usage (-25, -59, -XE, -XP, -XS, -XU).

Phase 4: Financial Variance and Adjudication Analysis

• 4.1 Compare allowable charges against contracted payer fee schedules and actual remitted payments found in Electronic Remittance Advices (ERAs).
• 4.2 Identify instances of undercoding (revenue leakage) and overcoding (compliance liability/exposure).
• 4.3 Review all claim denials, rejections, and zero-payment lines associated with the sample set to determine root-cause failure points.

Phase 5: Reporting, Feedback, and Remediation

• 5.1 Compile individual audit findings into the standardized Enterprise Billing Audit Report template.
• 5.2 Calculate the net financial error rate, overpayment variance, and coding accuracy percentage for the audited cohort.
• 5.3 Submit the preliminary audit report to the Revenue Cycle Manager and Billing Supervisor for a 10-business-day provider rebuttal and review window.
• 5.4 Finalize the audit report, log compliance infractions exceeding tolerance thresholds, and route the document to the Chief Compliance Officer and CFO.

---

6. Quality Assurance & Verification Criteria

6.1 Audit Checklist Verification Matrix

• Demographic Integrity: Patient name, MRN, DOB, and insurance ID match across EHR, PM, and clearinghouse systems.
• Signature Authentication: Every clinical entry possesses a valid electronic or physical signature with a timestamp prior to claim submission.
• Supervision Compliance: For services rendered by mid-level providers (NP/PA), verify that incident-to or direct supervision requirements were met and documented.

6.2 Tolerance Thresholds & Benchmarks

• Coding Accuracy Rate: Must meet or exceed 95% overall agreement between audited codes and clinical documentation.
• Financial Error Rate (Net Variance): Must not exceed ±2% of total billed charges within the audited sample.
• Documentation Deficiencies: Zero tolerance for systemic unauthenticated entries or missing medical necessity justifications for high-cost interventions.

---

7. Practical Troubleshooting Scenarios

Scenario A: Systematic Unbundling and NCCI Edit Violations

• Condition: The audit reveals a recurring pattern where a specific surgical department routinely bills component codes separately that are bundled under NCCI guidelines (e.g., billing separate vascular access codes during a primary surgical procedure without appropriate modifiers).
• Immediate Corrective Action Protocol:
  1. Halt all pending claims originating from the identified provider/department matching the specific NCCI violation profile.
  2. Issue an immediate operational advisory to the Billing and Coding Supervisor to implement a hard-stop soft edit in the billing clearinghouse rules engine.
  3. Conduct a targeted retrospective lookback across the preceding 90 days for the same provider group to calculate total financial exposure.
  4. Prepare corrected claims with appropriate modifiers or submit adjustment/refund claims to commercial payers and Medicare Administrative Contractors (MACs) within 60 days of identifying any confirmed overpayment, in accordance with the ACA 60-day rule.

Scenario B: Severe Documentation Deficiencies (Unauthenticated or Late-Entry Records)

• Condition: Multiple sampled charts contain critical clinical notes that were unauthenticated at the time of claim submission or were added well outside the institutional policy window without proper delayed-entry notation.
• Immediate Corrective Action Protocol:
  1. Flag the affected claims as "High Compliance Risk" in the audit database.
  2. Notify the Chief Compliance Officer and the Clinical Department Chair in writing within 24 hours of discovery.
  3. Retract or void the unauthenticated claims currently in-process before final adjudication if permitted by payer contracts.
  4. For already-paid claims, initiate voluntary refund procedures to the affected payer accompanied by an explanatory compliance memorandum.
  5. Mandate targeted documentation and EHR compliance retraining for the offending clinician(s), with follow-up re-auditing scheduled at 30 and 60 days post-remediation.