Medical Billing Audit Checklist for Practice Owners

What does a billing audit check, and what is it worth to your practice?

A medical billing audit checks three things about your practice's claims: whether every visit became a claim, whether each claim was paid at the rate you agreed, and whether anything was paid that should not have been. The first two protect revenue; the third protects you from repayment demands. Most of the work runs on reports your practice-management system or billing company already produces, so an owner or practice manager can run it without a coder on staff.

The checklist on this page is a revenue audit: it follows the money, not the chart notes. A coding audit compares a sample of signed notes with the codes billed and needs a trained reviewer; a sampled coding and chart audit is the deeper version of that one check. HHS-OIG's guidance for physician practices says self-audits can show whether bills are accurately coded and whether documentation is being completed correctly (OIG Compliance Program Guidance for Individual and Small Group Physician Practices), which is why a small documentation sample sits in the list below.

Which checks on the medical billing audit checklist can you run on your own numbers?

Run these ten checks in order: the first five find money that is late or lost, the last five find causes and risks. The table after the list shows what good looks like and what should worry you.

Reports to ask for before you start

Ask your biller or billing company for seven reports: A/R aging by payer, the denial log for the last 90 days, adjustments by reason for the last 12 months, payments by code for your ten highest-volume codes, visits with no charge entered, open rejections, and credit balances. If a report cannot be produced, record that as your first finding.

1. Aged A/R by payer. Pull aging in the standard buckets: 0-30, 31-60, 61-90, 91-120 and over 120 days, aged from the date of service, as HFMA's MAP Keys define them. Within that aging report, isolate balances older than 90 days. Note their share of total A/R and which payers hold them.
2. Denials, and which ones nobody is working. HFMA's remittance denial rate is claims denied divided by claims remitted. For an owner, the sharper number is how many denials have no logged action, and how old the oldest one is.
3. Write-offs by reason. Total 12 months of adjustments for timely filing, denials written off and small balances. Each is money your practice gave up or lost.
4. Payments against your contracted rates. Compare the allowed amount on remittances for your top codes with each payer's fee schedule (the next section shows how).
5. Filing-deadline exposure. List unbilled and rejected claims by the days left before each payer's timely filing limit. Medicare claims must be filed no later than 12 months after the date of service (Medicare Claims Processing Manual, chapter 1, §70), and a Medicare late-filing denial cannot be appealed. Commercial limits can be far shorter: Cigna's commercial limit for participating providers is 90 days from the date of service, unless your agreement or state law allows longer. See which payers give your practice the least time.
6. Charge capture. Match one week of the appointment schedule against charges entered. Every completed visit should have a charge, or a written reason it does not.
7. Open rejections. A rejection fails front-end or clearinghouse edits and never enters adjudication, so the payer has not received a claim it can pay. Ask for the count and the age of the oldest.
8. Credit balances. Pull the accounts where your practice holds more than it is owed. HFMA reads credit balances as a sign of late or incorrect cash posting, or incorrect payment, and some of them are overpayments your practice must return.
9. A documentation sample. OIG's guidance suggests five or more medical records per federal payer, or five to ten per physician. Check that each signed note supports the claim billed for it.
10. Where the money lands, and who can see it. Confirm every deposit reaches your practice's own account and that your practice holds its own logins to the practice-management system and clearinghouse. Medicare pays a billing agent in your name only under conditions that include the agent's pay not being related to the dollar amount billed or collected (chapter 1, §30.2.4). Then check the monthly billing report against your bank deposits.

Are your payers paying your contracted rates?

An underpayment can post as paid and be missed by a denial-only review. Partial payments can also contain a denial, so compare paid claims with contracted rates as well as working the denial log. The check sets the allowed amount on each remittance beside the rate in that payer's fee schedule for the same code. Remittance adjustments carry a group code: CMS describes CO (contractual obligation) adjustments as generally a write-off for the provider that is not billed to the patient, and PR as an amount that may be billed to the patient, typically deductibles and copays (Medicare Claims Processing Manual, chapter 22). A CO adjustment larger than your contract allows is money your practice is absorbing.

Start with your ten highest-volume codes and your three largest payers. This check needs your signed fee schedules; if your practice cannot find them, that is the first thing to fix.

What to compare a Medicare payment against

For Medicare claims, the benchmark is the Physician Fee Schedule amount for your locality, not a contract. The table shows the 2026 national Medicare amount (unadjusted) for five common office codes, from the CMS CY 2026 PFS relative value file (RVU26D). Actual payment varies by locality, setting and payer. Compare the allowed amount on the remittance, not the payment, because the patient's share (group code PR) comes out of the payment.

A worked underpayment example

Example, with round numbers: your contract with a commercial payer sets $110.00 for 99214, and the remittances show an allowed amount of $104.50. The gap is $110.00 − $104.50 = $5.50 a visit. At 80 visits a month that is 80 × $5.50 = $440.00 a month, or $440.00 × 12 = $5,280.00 a year, on one code with one payer. Disputes have windows too: Cigna allows 180 calendar days from the initial payment or denial notice, and Aetna's reconsideration window is 180 calendar days from the initial claim decision unless a state exception applies. A check run once a year finds lines it is too late to dispute.

Read the workflow as text

1. Pull the reports — Aging by payer, denials, write-offs, rejections, credit balances, payments by code. Owner: Practice manager.
2. Compare to contracts — Set remittance allowed amounts beside each payer's fee schedule. Owner: Practice manager.
3. Sample signed notes — OIG's guide: five to ten records per physician, each checked against its claim. Owner: Trained reviewer.
4. Answer each finding — Claims affected, cause, fix and a date, in writing. Owner: Biller or billing company.
5. Return overpayments — Medicare overpayments: generally reported and returned within 60 days. Owner: Owner, with counsel.
6. Re-run next quarter — Same reports and sample size, so the trend means something. Owner: Practice manager.

What if the audit finds money your practice owes back?

Credit balances, duplicate payments and claims billed above what the note supports can mean a payer paid too much. For Medicare, under 42 CFR 401.305, an overpayment is identified when the practice knowingly receives or retains it, and it must generally be reported and returned within 60 days of being identified. The deadline can be suspended for up to 180 days while the practice runs a timely, good-faith investigation into related overpayments, and the rule covers an overpayment identified within 6 years of the date it was received.

The 60-day clock is the reason to review credit balances every month instead of leaving them for a year-end clean-up. For commercial payers, check the refund terms in each contract. If a finding looks larger than a single claim, bring in your healthcare attorney before anything is reported.

What do you do with what you find?

Each finding goes one of three ways: your staff fix it, your billing company fixes it, or you hand the work to someone new. The figure shows who does what in a self-audit, and the table compares the three routes. Whoever takes a finding should answer it in writing: the claims affected, the cause, the fix and a date.

A large 90+ balance has its own decision, covered in whether to work old A/R or hand it off. A denial pattern has an order of attack, set out in which denials to fix first. If the same findings return after you have raised them with your billing company, read what to secure before you switch billing companies before you give notice.

How often should you audit, and what does it cost?

We suggest running the money checks (aged A/R, denials, write-offs, rejections and credit balances) monthly, and the contract-rate and documentation checks at least quarterly. OIG's 2000 compliance guidance for physician practices sets the floor for the compliance side: after a baseline audit, it recommends periodic audits at least once each year. Run the checks again after any staff change, software change or switch of billing company, because those are the moments claims slip through.

Doing it yourself costs staff time. Skipping the checks can leave underpayments and unbilled visits outside the reports you review. A denial log alone does not check either charge completeness or every paid claim against its contracted rate. Outside help runs from free to priced work. The Free A/R Deadline Map is free and covers unpaid insurance claims over 90 days (Clock starts with your claim-level aging export and signed BAA; above 10 requests in a week, we confirm your date within 1 business day.). A coding and chart audit is priced in writing before any records are pulled. Ongoing billing rates are on our pricing page.

When should you hand the audit off?

Hand the audit off when the same findings come back after you have raised them, when nobody in your practice has time to run the checks, or when the reports you asked for never arrive; a report your billing team cannot produce is a finding in itself. Start with the part that has a clock on it, the claims over 90 days. The Free A/R Deadline Map takes the aging report you already pulled and turns it into this: A claim-by-claim list of every unpaid insurance claim over 90 days in the aging report you send: payer, amount, the deadline it faces, the denial reason and the next action, sorted by deadline. Turnaround is 5 business days. Clock starts with your claim-level aging export and signed BAA; above 10 requests in a week, we confirm your date within 1 business day. It answers check 1, and check 5 for claims already in your aging report. Contract rates, charge capture and the documentation sample (checks 4, 6 and 9) stay with your practice or a separate audit.

Common questions

How do I know if our billing company is doing a good job?

Ask for the reports in the checklist and watch three things: whether they arrive without chasing, whether they agree with your bank deposits, and whether every denial shows a logged action. Reports you cannot reconcile, denials you never see and payments routed away from your account are the signs to act on.

Can I audit our billing myself without a coder on staff?

Yes, for nine of the ten checks: they need only reports and your fee schedules. The documentation sample is the one check that needs a trained reviewer, because it compares signed notes with the codes billed.

Are insurers paying our contracted rates, and how would I know?

Only by comparing. Pull the allowed amounts on remittances for your top codes and set them beside each payer's fee schedule. Some underpaid lines post as paid without a denial; others carry a partial denial. A denial report alone does not verify the contracted rate. Start with three payers and ten codes, and dispute each underpaid line inside the payer's dispute window.

How often should a practice audit its billing?

Monthly for the money checks, quarterly for contract rates and documentation, and at least once a year for the compliance review that HHS-OIG recommends for physician practices. Re-run the checks after a biller leaves or your practice changes billing company.

What performance targets should our billing contract include?

Targets you can check against a report: how soon claims go out once charges are complete, how soon denials are worked, when the monthly report arrives and how it defines each number, and who pays when a claim misses a deadline on the company's watch. What the billing contract should say covers the rest. A target with no report behind it cannot be enforced.

What does a billing audit cost our practice?

Running the checks yourself costs staff time. Our coding and chart audit is quoted in writing once the sample is set, before any records are pulled. The Free A/R Deadline Map is free and covers unpaid insurance claims over 90 days. Clock starts with your claim-level aging export and signed BAA; above 10 requests in a week, we confirm your date within 1 business day.

What happens if the audit shows Medicare overpaid us?

Under 42 CFR 401.305, a Medicare overpayment must generally be reported and returned within 60 days of being identified, and the deadline can be suspended for up to 180 days while you investigate related claims in good faith. Work out the amount, stop the cause, and talk to your healthcare attorney before reporting anything larger than a single claim.