Medical Billing Audit Report

Standard Operating Procedure: Medical Billing Audit Report

1. Document Control & Revision History

---

2. Executive Summary & Scope

This Standard Operating Procedure (SOP) establishes the mandatory institutional framework for executing medical billing audits across all enterprise healthcare operational units. The primary objective is to systematically verify coding accuracy, validate claim integrity, identify revenue leakage, and ensure rigorous adherence to federal, state, and payer-specific regulatory mandates.

The operational boundaries of this SOP encompass pre-billing validation, post-payment adjudication reviews, retrospective sampling of high-volume and high-dollar accounts, and third-party payer audits. Compliance with this procedure is mandatory for all personnel involved in revenue cycle management, clinical documentation improvement (CDI), and financial compliance.

Regulatory standards enforced through this SOP include:

• Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules (45 CFR Parts 160 and 164).
• Centers for Medicare & Medicaid Services (CMS) National Correct Coding Initiative (NCCI) edits and Local/National Coverage Determinations (LCD/NCD).
• Office of Inspector General (OIG) Compliance Program Guidance for Third-Party Medical Billing Companies.
• International Classification of Diseases, 10th Revision, Clinical Modification and Procedure Coding System (ICD-10-CM/PCS).
• Current Procedural Terminology (CPT) and Healthcare Common Procedure Coding System (HCPCS Level II) guidelines.

---

3. Prerequisites & Tool Requirements

Execution of this SOP requires strict adherence to technical, environmental, and credentialing prerequisites. Auditors failing to meet these baseline requirements are prohibited from accessing operational datasets.

Hardware & Software Access

• Enterprise-grade, encrypted workstation meeting NIST SP 800-171 compliance standards.
• Secure Virtual Private Network (VPN) with multi-factor authentication (MFA) enabled.
• Role-based access control (RBAC) credentials for the Enterprise Electronic Health Record (EHR) system (e.g., Epic, Cerner).
• Active licenses for computer-assisted coding (CAC) and revenue cycle analytics software (e.g., 3M 360 Encompass, Episource).
• Secure access to the Payer Direct Portals (Availity, Palmetto GBA, NGSConnexion, etc.).

Certifications & Credentials

• Active, unencumbered professional certification from an accredited body:
  • Certified Professional Medical Auditor (CPMA) via AAPC, or
  • Certified Coding Specialist (CCS) / Certified Health Data Analyst (CHDA) via AHIMA.
• Annual completion of Enterprise HIPAA Security and Privacy Awareness training.
• Documented clearance via institutional background check and confidentiality/non-disclosure agreement execution.

Environmental & Safety Protocols

• Audits must be conducted within a private office or secure remote workspace compliant with HIPAA "Sight and Sound" regulations to prevent Protected Health Information (PHI) exposure.
• Automated screen-lock protocols set to engage after three minutes of inactivity.

---

4. Roles & Responsibilities (RACI Matrix Table)

• Responsible (R): The role that performs the activity and drafts the operational audit report.
• Accountable (A): The role with final approval authority and ultimate liability for audit findings.
• Consulted (C): The role providing subject matter expertise, clinical clarification, or policy input.
• Informed (I): The role kept updated on audit progress, macro-trends, and high-level outcomes.

---

5. Step-by-Step Operational Procedure

This procedure is executed in four sequential phases. Every checkbox must be validated and initialed in the master audit log.

Phase 1: Pre-Audit Sampling & Scope Definition

• 1.1 Establish the audit period (e.g., retrospective review of preceding calendar quarter) and define the clinical specialty departments under review.
• 1.2 Determine sample size utilizing standard statistical sampling methodologies (e.g., OIG RAT-STATS or attribute sampling targeting a 95% confidence level with a 5% precision rate).
• 1.3 Extract encounter datasets, including demographic files, charge master line items, clinical notes, provider NPIs, and remittance advice (835/837 files) from the EHR.
• 1.4 Encrypt extracted datasets and ingest them into the secure auditing software workspace in compliance with FIPS 140-2 standards.

Phase 2: Documentation & Coding Verification

• 2.1 Cross-reference every selected CPT/HCPCS code against the corresponding provider clinical documentation within the EHR to verify medical necessity.
• 2.2 Validate ICD-10-CM diagnosis code specificity, ensuring highest-degree-of-certainty coding is utilized and supported by clinical indicators in the progress notes.
• 2.3 Check modifiers (e.g., 25, 59, XE, XP, XS, XU) for correct deployment, ensuring proper unbundling justification or distinct procedural service validation.
• 2.4 Verify that provider signatures, credentials, and time-stamps comply with CMS and institutional authentication standards.
• 2.5 Run NCCI edit checks to identify any mutually exclusive code pairs or unbundling errors not captured by frontline scrubbers.

Phase 3: Financial & Adjudication Variance Analysis

• 3.1 Compare billed amounts against current contracted payer fee schedules and Medicare Physician Fee Schedule (MPFS) baselines.
• 3.2 Analyze explanation of benefits (EOB) and electronic remittance advice (ERA) files for systemic underpayments, contractual adjustments, and denial reason codes (e.g., CO-16, CO-50).
• 3.3 Calculate net financial variance per encounter, categorizing discrepancies into overpayments, underpayments, unbilled charges, and writing-off errors.
• 3.4 Identify root causes for any identified variances (e.g., front-end registration error, clinical documentation gap, systemic scrubbing failure).

Phase 4: Reporting & Corrective Action Plan (CAP) Initiation

• 4.1 Draft the formal Medical Billing Audit Report incorporating executive summaries, aggregate error rates, financial impact metrics, and qualitative findings.
• 4.2 Convene an exit conference with the Revenue Cycle Operations Manager and Coding Supervisors to review preliminary findings and dispute windows.
• 4.3 Finalize the audit report and upload it to the compliance management repository.
• 4.4 Issue Corrective Action Plans (CAPs) to respective department heads with assigned remediation milestones and mandatory re-audit dates.

---

6. Quality Assurance & Verification Criteria

To maintain institutional integrity, the audit process itself is governed by strict quality control benchmarks. Every executed audit must satisfy the following criteria before final sign-off.

Audit Tolerance Thresholds & Acceptance Benchmarks

• Coding Accuracy Rate: Must equal or exceed 95.0% overall. Any score below 90.0% triggers an immediate 100% retrospective audit of the provider's or coder's entire portfolio for the active quarter.
• Financial Net Variance Threshold: Cumulative variance across the sample size must not exceed ±1.5% of gross sampled billed charges.
• Documentation Conformance: 100% of sampled records must possess authenticated, time-stamped provider signatures and verified medical necessity justifications.
• Sample Integrity: Variance between pulled EHR data and source documents due to extraction errors must be 0.0%.

Quality Assurance Checklist

• Internal peer review completed: A secondary auditor independently reviews a random 10% sub-sample of the primary audit.
• Inter-rater reliability (IRR) score calculated: Must achieve an absolute agreement rate of $\ge 92%$ between primary and secondary auditors.
• All disputed findings documented with objective clinical or regulatory citations.

---

7. Practical Troubleshooting Scenarios

Scenario A: Systematic Unbundling Flags Driven by EHR Template Defaults

• Symptom: A high volume of claims within an outpatient surgical clinic are flagged during Phase 2 for improper modifier use and unbundling (e.g., simultaneous billing of component procedures that violate NCCI rules).
• Root Cause: An updated EHR clinical documentation template automatically populates macro-checked diagnostic codes and procedure prompts that conflict with NCCI pairing logic, overriding manual coder input.
• Immediate Corrective Action Protocol:
  1. Issue an immediate operational halt (freeze) on all outgoing claims utilizing the affected EHR template within 2 hours of discovery.
  2. Notify the Revenue Cycle Operations Manager and IT EHR Informatics Lead.
  3. Revoke template macro-population permissions for the specific clinical department until IT remediates the logic engine.
  4. Perform a retroactive scope sweep of all claims submitted using the flawed template over the preceding 14 days, calculating financial exposure and preparing corrected claims (Form 1500 adjustments / 837P replacements) for submission.

Scenario B: Provider Documentation Non-Authentication (Missing Signatures)

• Symptom: Phase 2 review reveals that 12% of high-dollar inpatient records lack legally compliant provider signatures and attestations past the CMS 30-day operational completion window.
• Root Cause: Attending physicians failing to complete electronic sign-offs prior to discharge disposition workflows, compounded by a lack of automated escalation alerts.
• Immediate Corrective Action Protocol:
  1. Quarantine all affected accounts in a dedicated "Pending Authentication" billing queue to prevent premature claims drop.
  2. Generate an automated, urgent priority task list directed to the non-compliant providers via the EHR secure messaging portal.
  3. Escalate recurring non-compliant provider names directly to the Chief Medical Officer (CMO) and department chair for administrative intervention.
  4. For any claims already adjudicated and paid where signatures are retroactively unobtainable, calculate the total overpayment liability and initiate voluntary refund protocols to the Medicare Administrative Contractor (MAC) or commercial payer within 60 days of identification, per federal self-disclosure mandates.