Behavioral health and TMS practices face even sharper scrutiny. Complex CPT coding (90867-90869), prior authorization rules, and medical necessity documentation create more opportunities for auditors to find gaps.
This guide breaks down audit types, procedures, tools, and how to prepare your practice with confidence.
Key Takeaways
- Know the two audit paths: internal (self-conducted) and external (payer or CMS-driven)
- Prepare for compliance, coding, quality assurance, and privacy/security audits
- Treat documentation quality and coding accuracy as your primary defenses
- Partner with certified billers to cut audit risk and lift clean claim rates
What Is a Healthcare Audit and Why Does It Matter?
A healthcare audit is a systematic review of medical records, billing claims, and operational processes. Its purpose: verify compliance, confirm accuracy, and catch problems before they become penalties.
Audits serve four main goals:
- Catch documentation errors before they trigger denials or recoupments
- Prevent fraud and abuse through consistent monitoring
- Protect reimbursement by confirming claims match documented care
- Improve care quality by tightening clinical record-keeping
CMS estimates the Medicare fee-for-service improper payment rate at 6.55%, totaling $28.83 billion, for fiscal year 2025, per CMS's Fiscal Year 2025 Improper Payments Fact Sheet. Medicaid's improper payment rate sits at 6.12%, or $37.39 billion.
Practices without dedicated compliance staff are the most exposed. Small and solo practices often lack the bandwidth to run internal reviews, which means the first audit they encounter is often an external one, with real money on the line.
What Are the Different Types of Medical Audits in Healthcare?
Medical audits fall into two broad groups: who runs them (internal vs. external) and what they examine (compliance, coding, quality, or privacy). Knowing the differences helps you prepare before a request hits your desk.
Internal Audits
Internal audits are self-conducted reviews focused on catching problems before payers do. They should happen at least annually, though many compliance experts recommend more frequent checks. The goal is proactive risk identification before small issues become costly findings.
External Audits
External audits come from payers, Medicare/Medicaid (through CMS), or Recovery Audit Contractors (RACs). CMS's RAC program specifically targets improper payments, both overpayments and underpayments, through post-payment review of Part A and Part B claims.
These reviews can include an Additional Documentation Request (ADR), sent directly to your practice, requesting records that support coding, billing, and medical necessity. External audits carry higher stakes than internal ones. There's no do-over once findings are issued.
Compliance, Coding, and Specialty-Focused Audits
Beyond internal versus external, audits break down by focus area:
- Compliance audits — verify HIPAA adherence and OIG standard alignment
- Coding/documentation audits — confirm CPT/ICD-10 accuracy and note-to-code matching
- Quality assurance audits — assess clinical outcomes and care consistency
- Privacy/security audits — check data handling and access controls
Behavioral health and TMS billing carry specialty-specific risk. CMS's coverage article for TMS (CPT 90867-90869) requires specific ICD-10 diagnoses (F32.2, F33.2), a documented face-to-face assessment, and clinical judgment on contraindications.
Frequency limits matter too: 90867 shouldn't repeat within six weeks, and 90869 shouldn't overlap with 90867 or 90868. Miss those rules, and you've created an audit flag.
What Are Common Audit Procedures Used in Medical Audits?
Most audits, internal or external, follow a similar five-step arc:
- Planning: Define scope and objectives. Choose a focused audit (one provider, one code, or one service) or a random sample across the practice.
- Data collection: Pull medical records, coding documentation, billing history, and payer correspondence.
- Analysis and benchmarking: Compare billing patterns against national coding averages and payer-specific guidelines.
- Reporting findings: Document discrepancies, denial patterns, and compliance gaps in a formal report with clear recommendations.
- Corrective action and follow-up: Train staff, update policies, and monitor results to confirm the fix held.
A code billed at twice the national utilization rate is a common trigger for deeper review during analysis. Skipping step five is where most practices fail—a one-time correction without ongoing monitoring only delays the next finding.
What Are Common Audit Tools Used in Medical Audits?
Practical audits rely on a handful of tools working together:
- EHR systems for pulling documentation completeness and treatment history
- Audit tracking and compliance software for flagging billing irregularities automatically
- Coding checklists and payer-guideline references (CPT, ICD-10, and NCCI edit tables) for chart reviews
- Real-time dashboards that show claim status continuously, rather than waiting for a quarterly report
CMS maintains National Correct Coding Initiative (NCCI) edits specifically to prevent improper payment from mismatched code combinations or incorrect units of service. These edit tables get updated annually, so a static checklist from two years ago won't catch this year's flags.
Continuous visibility closes that gap. Persistex clients get real-time dashboards showing claim status as it happens, so auditing stays an ongoing habit instead of a reactive scramble after denials land.
What Are the 5 C's of Auditing?
When an audit surfaces a problem, auditors typically structure the finding around five elements:
| Element | What It Means |
|---|---|
| Criteria | The standard the claim should have met |
| Condition | What actually happened |
| Cause | Why the gap occurred |
| Consequence | The financial or compliance impact |
| Corrective Action | The fix and prevention plan |
Example: A behavioral health claim gets flagged for missing medical necessity documentation.
- Criteria: CMS requires a documented assessment supporting the billed diagnosis (such as F32.2 or F33.2)
- Condition: The chart lacks a documented assessment note
- Cause: The provider's documentation template doesn't prompt for this field
- Consequence: Claim denial and potential repayment demand
- Corrective Action: Update the documentation template and retrain staff on required fields
This framework works because it forces you past "we made a mistake" and into "here's exactly why, and here's how we stop it."
How to Prepare Your Practice for a Healthcare Audit
Preparation beats reaction every time. A few practical habits make the biggest difference:
- Keep documentation timely and organized — every billed service needs a paper trail for medical necessity, not a note added weeks later
- Run regular self-audits, or partner with a billing service that catches coding issues before payers do
- Train staff continuously; payer policies and HIPAA rules shift often enough that one-time training goes stale within a year
Practices working with certified billing partners tend to enter audits in a stronger position. Persistex's team holds CPC, CPB, RHIT, and CCS certifications, and its pre-submission audit process validates diagnosis-to-procedure linkage before claims go out.
That process has reduced coding-related denials by an average of 35% for clients — so audit requests start from organized records, not a scramble to reconstruct them.
Frequently Asked Questions
What is a medical audit?
A medical audit is a systematic review of billing, coding, and clinical documentation to verify compliance and accuracy. Your team can run one internally, or an outside payer can initiate it.
What are medical audits used for in healthcare?
Audits verify regulatory compliance, prevent fraud, protect reimbursement accuracy, and improve care quality. They also help practices catch billing errors before those errors turn into larger financial losses.
What are the different types of medical audits in healthcare?
The main categories are internal (self-conducted) and external (payer or CMS-driven). Specialty audits also cover compliance, coding, quality assurance, and privacy/security.
What are common audit procedures used in medical audits?
Standard procedures include planning the scope, collecting data, benchmarking findings against national averages, reporting discrepancies, and implementing corrective action.
What are common audit tools used in medical audits?
Common tools include EHR systems, audit tracking software, coding checklists referencing CPT/ICD-10/NCCI edits, and real-time claim status dashboards.
What are the 5 C's of auditing?
The 5 C's are Criteria, Condition, Cause, Consequence, and Corrective Action, a framework for structuring audit findings and their fixes.
