Claims for January 2026 visits reach Medicare’s one-year filing limit in January 2027. Any payer that audits you next spring will read notes your providers signed months ago. A problem you catch in December costs a corrected claim or a refund. Found by a payer, it can cost a records request and a recoupment.
You’ll find the year-end medical billing audit checklist split by payer: Medicare fee-for-service, Medicare Advantage, Medicaid, and commercial plans. It also covers the CPT, edit, and telehealth changes that start on January 1, 2027. A yearly medical billing audit doesn’t need to take a month if you scope it well.
You’ll get sample sizes based on HHS Office of Inspector General guidance, the red flags each payer looks for, the 2027 updates to load before January, and a free PDF your team can print and work from.
Year-End 2026 Audit Facts at a Glance
These are the rules and numbers behind this year’s medical billing audit checklist, each checked against its primary federal or AMA source as of October 28, 2026.
- Audit frequency: The HHS Office of Inspector General (OIG) recommends periodic audits at least once each year after a baseline audit (OIG Compliance Program Guidance for Individual and Small Group Physician Practices).
- Medicare error rate: The Centers for Medicare & Medicaid Services (CMS) reported a 6.55% Medicare fee-for-service improper payment rate for fiscal year 2025, or $28.83 billion (CMS Comprehensive Error Rate Testing program).
- Medicare filing limit: Providers must file Medicare claims within 1 calendar year after the date of service (42 CFR 424.44).
- Overpayments: Providers must report and return an identified Medicare overpayment within 60 days, with up to a 180-day pause for a good-faith investigation of related overpayments (42 CFR 401.305).
- NCCI edits: National Correct Coding Initiative (NCCI) procedure-to-procedure edits version 33.0 take effect January 1, 2027 (CMS Transmittal 13946).
- Telehealth: Medicare telehealth flexibilities run through December 31, 2027, and modifiers BB and BC become required on applicable telehealth claims starting January 1, 2027 (CMS Telehealth FAQ, updated October 8, 2026).
- Codes and rates: CPT 2027 adds 299 codes, revises 74, and deletes 80. CMS proposed 2027 conversion factors of $33.17 for qualifying APM participants and $32.84 for all other clinicians (AMA; CMS CY2027 Physician Fee Schedule proposed rule).
Your team can print the full checklist, split by payer and paired with the November to December audit calendar, from the free 2026 PDF.
Why a Yearly Medical Billing Audit Matters Before December 31
A year-end billing audit catches documentation, coding, and filing problems while you can still correct them. OIG guidance for physician practices recommends audits at least once each year, and year-end is when Medicare’s filing window starts closing on claims from early 2026.
The OIG wrote its OIG physician practice guidance in 2000 for individual and small group practices. It calls for a baseline audit first, then periodic audits at least once a year. Your accountant treats the year-end close the same way: you reconcile the books before anyone else looks at them.
Most federal findings come down to paperwork. CMS reported a 6.55% Medicare fee-for-service improper payment rate for fiscal year 2025, or $28.83 billion, in its CMS FY2025 improper payments fact sheet. In most of those cases, reviewers couldn’t confirm the payment from the documentation. Your team can catch a missing signature or an unfiled order in December.
Medicare’s one-year filing rule adds pressure. A claim for a January 5, 2026 visit has to reach Medicare by January 5, 2027. Anything still sitting in a hold queue from early 2026, waiting on a signature or an edit fix, moves to the top of your list this week.
Refunds run on their own deadline. If the audit finds money you weren’t owed, Medicare’s 60-day overpayment clock starts, so leave room in the schedule. The Department of Justice reported False Claims Act settlements and judgments above $6.8 billion in fiscal year 2025, with more than $5.7 billion from healthcare.
Regulatory compliance in healthcare reaches well past the coding desk. A medical billing compliance audit has to follow each claim from scheduling to payment posting, which is the same ground that full revenue cycle management services cover day to day.
Auditing in healthcare works best with a reviewer who didn’t build the claims. Some practices run the yearly pass in-house, and others bring in medical billing audit services to score the sample. Either way, a medical billing audit checklist keeps medical billing compliance work tied to specific claims and dates.
How to Scope the Audit: Sample Size, Date Range, and Payer Mix
Make three decisions before anyone pulls a chart: how many claims to review, which dates of service to sample, and which payers to include. The OIG gives you a starting sample size. Splitting that sample by payer is what lets the rest of this medical billing audit checklist work.
How Many Claims to Pull
The OIG says there’s no set formula for audit sample size. Its starting guide for physician practices is 5 or more medical records per federal payer, or 5 to 10 records per physician. From there, add records from your busiest private plans and expand wherever errors cluster.
| Situation | Starting sample | Where it comes from |
|---|---|---|
| Federal payers (Medicare, Medicaid) | 5 or more records per payer | OIG guidance |
| Practices with more than one physician | 5 to 10 records per physician | OIG guidance |
| Medicare Advantage and top commercial plans | Add records from the plans you bill most | One O Seven RCM practice recommendation |
| Any area where errors turn up | Expand the sample in that area before drawing conclusions | One O Seven RCM practice recommendation |
Treat a small sample as a warning light. If three of five Medicare charts miss the same modifier, pull more claims for that provider and code before you call it a pattern. A billing compliance audit that stops at the first sample can miss the size of a problem or overstate it.
Which Dates of Service to Sample
Sample dates of service from the last 12 months. Under 42 CFR 405.980, Medicare contractors can reopen a claim determination for any reason within 1 year and for good cause within 4 years, so errors you find inside that first year are the easiest to correct.
Pull a mix of paid, denied, and zero-paid claims. A medical claim audit built from denials alone shows you what payers rejected. It hides undercoding and overpayments, and those two findings decide whether you’re leaving money behind or holding money you’ll owe back.
Who Should Score the Sample
A Certified Professional Coder (CPC) or Certified Professional Medical Auditor (CPMA) should score the sample, and that person shouldn’t have coded the claims under review. Reviewers who check their own work tend to repeat the same reading of a note that produced the error in the first place.
Write the scoring rules down before the review starts: what counts as an error, how you’ll grade E/M levels, and where you’ll log each finding. A written medical claims audit process makes next year’s results comparable to this year’s, which is how you’ll tell whether provider education worked.
Smaller groups don’t often have a spare coder for this. If that’s your situation, One O Seven RCM can score the sample for you, and our team handles ongoing billing for small practices at a flat 2.99% of collections.
The Medical Billing Audit Checklist: Five Areas to Review Every Year
To run a yearly medical billing audit, review five areas in the order a claim moves: front-end access, documentation and coding, claims submission, payment and A/R, and compliance. Each area of this medical billing audit checklist lists what to check and the rule behind it.
Covering all five areas turns a coding spot check into a full billing audit and compliance review. You’re testing revenue cycle compliance from the first phone call to the final payment posting, and the payer add-ons for Medicare, Medicare Advantage, Medicaid, and commercial plans layer on top.
[VISUAL: Five-step claim path graphic. Alt text: “Five areas of a yearly medical billing audit: front-end access, documentation and coding, claims, payment and A/R, and compliance.”]
Front-End and Patient Access
Front-end access covers the patient, coverage, and authorization data your staff collect before the visit. The audit checks whether that data on each sampled claim matched the payer’s records on the date of service. A perfect code can’t rescue a claim billed to the wrong plan.
- Demographics match: Compare the patient name, date of birth, member ID, and group number on each claim with the insurance card and the payer’s file.
- Eligibility on the date of service: Confirm staff verified coverage for each sampled visit, not only at the first visit, and flag any plan that changed on January 1.
- Coordination of benefits: Check that the primary and secondary payer order is on file and that staff screened Medicare patients with other coverage for Medicare Secondary Payer status.
- Prior authorization: Match each authorization number to the CPT code, dates, and rendering provider on the claim, and confirm the payer issued it before the date of service.
- Advance Beneficiary Notice of Noncoverage (ABN): Confirm the patient signed the current ABN, form CMS-R-131, before any service Medicare may deny as not reasonable and necessary. Our breakdown of PR-96 and ABN rules covers what happens on the remittance when that notice is missing.
- Financial and consent forms: Check that signed and dated financial responsibility and consent forms sit in the chart.
The front-end failure that shows up most in year-end samples is eligibility checked once at intake and not again. A patient changes plans in March, the front desk keeps billing the old payer, and your team works denials for months. Real-time eligibility verification services before each visit close that gap.
Documentation and Coding Accuracy
Documentation and coding accuracy is where most federal improper payment findings start, because CMS reviewers judge each claim by the note behind it. Each billed code needs a signed note that supports it, and each provider’s levels and modifiers should hold up when you compare them with peers.
- Note supports every line: Trace each CPT and HCPCS Level II line to a signed, dated note for that date of service.
- E/M level by MDM or time: Check that office E/M levels match medical decision making or total time under the AMA E/M guidelines, using our 99215 time and MDM guide as a reference point, and compare each provider’s level mix with peers in the same specialty.
- Modifier 25: Confirm the note documents a significant, separately identifiable E/M service on the same day as the procedure, as our guide to modifier 25 documentation explains.
- Modifier 59 and X modifiers: Confirm the note documents a distinct service, and use the more specific XE, XS, XP, and XU modifiers that Medicare accepts in place of 59 where they fit.
- Diagnosis specificity: Code each diagnosis to the most specific ICD-10-CM code the note supports, using the FY2027 code set for dates of service on or after October 1, 2026.
- Time-based codes: Check that documented time supports each time-based code billed.
- Cloned notes: Flag copy-forward text that doesn’t fit the visit and route it to provider education.
Coders work from the note. If a provider’s documentation is thin, the billed level fails review even when the care was excellent. That’s why coding compliance starts with provider documentation habits, and retraining coders comes second.
Coding compliance software can flag NCCI pairs and deleted codes, but it can’t judge whether a note supports a level 5 visit. The coding regulations behind those edits change each January and October, so solid coding and compliance work pairs the software with a certified reviewer.
Claims Management and Submission
Claims management and submission checks whether clean claims reached each payer on time and passed current edits. The audit also confirms your team kept clearinghouse rejections in their own queue, apart from payer denials, and worked both. A rejected claim didn’t reach the payer at all.
- Rejections vs. denials: Keep clearinghouse rejections and payer denials in separate work queues, and confirm none sit unworked in either one.
- NCCI and MUE edits: Check code pairs and units against the current quarterly NCCI procedure-to-procedure and Medically Unlikely Edit (MUE) tables, and use our guide to NCCI edit denials for the fixes.
- Timely filing sweep: Check each unbilled or held claim against its limit: 1 calendar year from the date of service for Medicare under 42 CFR 424.44, the state manual for Medicaid, and the contract for commercial plans. Claims that miss it come back as CO-29 timely filing denials.
- Duplicates: Review claims with the same patient, date of service, and code for duplicate billing.
- Place of service and telehealth: Confirm POS 02 or POS 10 and modifier 95 match how each telehealth visit took place.
- Open claims: Confirm no claim has gone 30 days without a status check or follow-up note, a One O Seven RCM practice standard.
Hold queues are the usual reason a good claim misses its filing limit. A claim waits on a provider signature or an edit fix, the queue has no owner, and the claim ages past its deadline. Auditing medical claims in hold status each month, against payer billing guidelines, keeps claims compliance from slipping into write-offs.
If the same denial reasons keep showing up in your sample, you’re looking at a process problem. Our denial management services start from those patterns and fix the workflow step that keeps producing them.
Payment Integrity and A/R Recovery
Payment integrity and A/R recovery compares what each payer paid with what the contract says it should pay. The audit also checks that your team handled write-offs, refunds, and aged balances on purpose, with a reason and an approval, instead of letting them drift.
- Allowed vs. contracted rate: Compare paid amounts on 835 electronic remittances with the fee schedule loaded for that payer.
- Credit balances: Give each credit balance a documented reason, and send true overpayments to the refund steps in the overpayment section.
- Adjustments vs. write-offs: Check that contractual adjustments carry the right claim adjustment reason codes (CARCs) and that each write-off has an approval and a documented reason.
- Recoupments and offsets: Trace each payer takeback on a remittance to its original claim, and appeal the ones that don’t hold up.
- Secondary billing: Confirm your team sent secondary and tertiary claims after the primary paid, with the primary remittance attached.
- A/R aging: Review balances in 0 to 30, 31 to 60, 61 to 90, 91 to 120, and over 120 day buckets, and work older claims with high balances first. Our explainer on AR aging in medical billing shows how to read each bucket.
Underpayments post as paid and look fine on a standard aging report. Billing practices that skip contract checks can let a payer underpay the same code for a year before anyone notices. Healthcare payment compliance covers money you’re owed as well as money you owe, and consistent AR follow-up services catch both.
Compliance, Credentialing, and Security
The compliance, credentialing, and security area confirms three things. No one on staff appears on a federal exclusion list, and each provider holds active enrollment with each payer billed. Your HIPAA safeguards and compliance program records are also current. A gap in any of them can sink an otherwise clean claim.
- Exclusion screening: Check staff and contractors against the OIG’s List of Excluded Individuals/Entities (LEIE) in the OIG exclusions database and against SAM.gov, since hiring an excluded person can bring civil monetary penalties. Monthly screening matches the cadence states use for Medicaid providers.
- Medicare revalidation: Confirm each provider revalidated Medicare enrollment within its 5-year cycle under 42 CFR 424.515.
- Payer enrollment: Confirm each rendering provider and location is active with each payer you bill and that CAQH profiles are current.
- HIPAA risk analysis: Keep a current Security Rule risk analysis on file. HHS proposed Security Rule changes on December 27, 2024, and the current rule stays in effect until HHS issues a final rule.
- Business associate agreements: Confirm signed business associate agreements (BAAs) cover the clearinghouse, billing vendors, and any software that holds protected health information.
- Compliance program: Keep written policies, a named compliance contact, and audit records in line with the seven elements in the OIG’s General Compliance Program Guidance, which is voluntary.
- Training records: Document billing and coding staff training for the year.
Credentialing lapses don’t look like compliance problems at first. They show up as denials months later, after a revalidation date slips or a CAQH attestation goes stale. That’s why enrollment status belongs in this part of the medical billing audit checklist, and it’s the part an outside reviewer asks to see first.
OIG compliance program guidelines list auditing and monitoring among the seven elements of a healthcare compliance program. File your billing compliance findings, coding compliance program policy, and education notes together, and you’ll have a ready answer to medical billing compliance questions from any payer.
If the audit turns up enrollment gaps, One O Seven RCM’s provider credentialing services handle payer enrollment and CAQH upkeep at $107 per insurance, so each provider stays billable with each plan you accept.
Payer-by-Payer Review: What Each Payer Audits and How to Prepare
Medicare, Medicare Advantage, Medicaid, and commercial plans each run their own audits. Federal and state programs behind Medicare and Medicaid set fixed record deadlines. Audits of Medicare Advantage claims center on diagnosis support for risk adjustment, and commercial audits follow each plan’s contract and provider manual.
The five areas above cover each claim, whoever pays it. Healthcare billing compliance also depends on insurance compliance regulations that differ by payer. That’s why you split the sample by payer during scoping. This layer of the medical billing audit checklist tests medical billing compliance against each payer’s own audit programs.
| Payer | Who audits | Key deadline or number | What they focus on |
|---|---|---|---|
| Medicare fee-for-service | CERT, Medicare Administrative Contractors (MACs, including Targeted Probe and Educate), Recovery Audit Contractors (RACs), Unified Program Integrity Contractors (UPICs), and WISeR in six states | CERT records due within 45 calendar days; claims filed within 1 calendar year of service | Documentation that supports medical necessity and the codes billed |
| Medicare Advantage | CMS RADV audits of plans, then plan chart reviews of providers | CMS audits all eligible MA contracts each payment year, 35 to 200 records per plan | Whether medical records support the diagnoses submitted for risk adjustment |
| Medicaid | PERM, state Medicaid RACs, state program integrity units, and Medicaid Fraud Control Units | PERM initial record requests: 75 calendar days; Medicaid RAC lookback: 3 years unless the state approves longer | Documentation; insufficient documentation drove 77.17% of FY2025 Medicaid improper payments |
| Commercial payers | The plan’s payment integrity team and Special Investigations Unit | Set by your contract and the plan’s provider manual | Contract terms, reimbursement policies, and coding patterns |
Medicare Fee-for-Service
Medicare fee-for-service reviewers look for documentation that supports medical necessity and the codes billed. CMS error rate testing, Medicare Administrative Contractor reviews, and recovery audits all start from the medical record, so the Medicare part of your medical billing audit checklist should start there too.
The CMS CERT program reported a 6.55% improper payment rate for fiscal year 2025, or $28.83 billion, with Part B services at 8.44%, or $9.62 billion. That report covers claims from July 1, 2023 to June 30, 2024. CERT allows 45 calendar days per documentation request, so treat each one as a medical claims audit with a hard stop.
Medicare Administrative Contractors (MACs) process claims and run targeted reviews, including Targeted Probe and Educate (TPE). Recovery Audit Contractors (RACs) review paid claims for improper payments. Unified Program Integrity Contractors (UPICs) investigate potential fraud. A complex review by any of the three starts with a records request, which is where your audit work pays off.
CMS’s Wasteful and Inappropriate Service Reduction (WISeR) Model runs from January 1, 2026 to December 31, 2031. According to the CMS WISeR Model page, it covers Original Medicare in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington. Providers there either request prior authorization for selected services or go through pre-payment review.
One O Seven RCM works out of Fulshear, Texas, one of the six WISeR states. Practices that already track CO-197 prior auth denials can log each WISeR decision the same way, next to the claim it covers, so the audit trail stays in one place.
- Medical necessity: Confirm each sampled service meets the applicable Local Coverage Determination (LCD) or National Coverage Determination (NCD) and that the claim diagnosis supports it. Our guide to local coverage determinations shows where to find the policy for your MAC.
- ABN follow-through: Confirm each service billed under an ABN has the signed notice in the chart.
- WISeR services: In the six model states, confirm each selected service had a prior authorization decision or a pre-payment review flag, and route new requests through dedicated prior authorization support.
- CERT readiness: Assign one person to log each CERT request on arrival and answer it within 45 calendar days.
- Signatures: Confirm each note and order in the sample carries a valid signature, since unsigned records can’t support a claim.
- PECOS match: Confirm each provider’s Provider Enrollment, Chain, and Ownership System (PECOS) record matches the billing NPI and practice location.
A CERT or MAC records request with a hard deadline is a bad time to find unsigned notes. Our RAC and TPE audit defense team works from this same checklist and takes the record prep off your staff.
Medicare Advantage
CMS audits Medicare Advantage plans, and the plans pass that pressure down to providers through chart requests. Each plan wants proof that the diagnoses it submitted for risk adjustment appear in the medical record, so the Medicare Advantage part of your medical billing audit checklist should test diagnosis support claim by claim.
CMS reported a 6.09% improper payment rate for Medicare Part C in fiscal year 2025, or $23.67 billion, in the same FY2025 fact sheet. On May 21, 2025, CMS said in its CMS RADV expansion announcement that it would audit all eligible Medicare Advantage contracts for each payment year through Risk Adjustment Data Validation (RADV).
CMS also said it would finish payment years 2018 to 2024 by early 2026, grow its medical coder team from 40 to about 2,000, and review 35 to 200 records per plan, depending on plan size. More plan audits mean more chart requests reaching your front desk.
Each plan request comes down to one test: the note has to show the provider evaluated or managed the condition at that visit. Many coders check for it with MEAT, short for Monitor, Evaluate, Assess, Treat. MEAT is a common industry review approach, and CMS doesn’t publish it as a rule.
- Diagnosis support: Confirm each chronic condition coded on a sampled Medicare Advantage claim shows as addressed at that visit, beyond a line in the problem list, since that’s the core of HCC coding compliance.
- Resolved conditions: Code resolved conditions as history, and take them off the active diagnosis list.
- Specificity: Code each diagnosis to the highest specificity the note supports.
- Chart request log: Log each plan record request with its due date and proof of what you sent.
- Plan contract terms: Read each Medicare Advantage contract for its audit and recoupment clauses before the next request arrives.
Medicaid
Medicaid audits come from federal and state programs at once. The federal Payment Error Rate Measurement (PERM) program measures each state on a rotating schedule, and each state runs its own recovery audit and program integrity reviews. Filing limits and record rules come from your state Medicaid manual.
CMS reported a 6.12% Medicaid improper payment rate for fiscal year 2025, or $37.39 billion, and said insufficient documentation drove 77.17% of those improper payments. Under PERM, CMS measures each state once every three years on a 17 or 18 state rotation, and the CMS PERM provider overview lists Texas in Cycle 3.
Providers in a PERM sample get 75 calendar days to answer an initial record request and 14 days to answer an additional documentation request. Those windows sound generous until a request sits unopened in a shared inbox for three weeks.
Under 42 CFR Part 455 Subpart F, the Medicaid RAC regulations, states contract with Medicaid Recovery Audit Contractors. A Medicaid RAC can’t review claims older than 3 years from the claim date without state approval, and it has 60 calendar days to notify you of overpayment findings. States refer suspected fraud to their Medicaid Fraud Control Unit (MFCU).
- State filing limit: Check each held Medicaid claim against your state Medicaid manual’s filing limit, since healthcare regulatory compliance for Medicaid varies from state to state.
- Managed care plans: Check Medicaid managed care claims against each plan’s manual as well as the state rules.
- State exclusion list: Screen staff against your state’s Medicaid exclusion list as well as the federal LEIE.
- Record request owner: Assign one person to own PERM and RAC requests and track the 75-day and 14-day windows.
- Documentation: Hold sampled Medicaid notes to the same support standard this medical billing audit checklist uses for Medicare, since insufficient documentation drove 77.17% of FY2025 Medicaid improper payments.
Commercial Payers
Commercial payer audits follow your contract and the plan’s provider manual, with no federal program behind them. A plan’s payment integrity team can review claims before or after payment, request records, and recoup money it decides it overpaid, so your contract sets the rules.
Pre-payment review holds a claim until the plan receives records, which slows cash on that code. A post-payment healthcare claims audit can end in a recoupment or an offset against future payments, often months after the visit. Either kind can come from the plan’s Special Investigations Unit (SIU) if the plan suspects a pattern.
Some states limit how far back a commercial plan can recoup payments. Check your state’s insurance code and your contract for the limit that applies to you. Billing compliance with commercial plans depends on knowing those terms before a recoupment letter shows up in the mail.
- Audit clause: Read each contract’s audit and record-access terms, including how much notice the plan must give.
- Record deadline: Log the provider manual’s deadline for answering a record request for each top plan.
- Reimbursement policy changes: Review each top plan’s 2027 policy bulletins for modifier, E/M, and site-of-service changes.
- Recoupment notices: Match each recoupment or offset letter to its claim, and check it against the manual’s appeal deadline.
- Credentialing by plan: Confirm each provider holds active credentialing with each commercial plan and product you bill.
- Appeal levels: Write down each top plan’s appeal steps and deadlines where the billing team can find them, and send disputed takebacks through a commercial payer appeals process.
Commercial contracts often go years without a review, so the audit terms a plan applies today may not match what the practice remembers signing. Add each top contract to your medical billing audit checklist and read it next to the plan’s current manual. That side-by-side read keeps claims compliance tied to the terms the plan uses.
What Changes on January 1, 2027
Several billing changes land on January 1, 2027: the CPT 2027 code set, NCCI version 33.0 edits, required Medicare telehealth modifiers BB and BC, and new Physician Fee Schedule rates, which CMS has only proposed so far. Load each one before December 31 so your January claims go out clean.
The audit looks back at 2026, and these updates look forward. Each fix costs less in December than on a stack of denied January claims, so add the rows below as the last page of your medical billing audit checklist and assign each one an owner.
| Change | Effective date | What to check or update | Source |
|---|---|---|---|
| CPT 2027: 299 new codes, 74 revised, 80 deleted (453 editorial changes) | January 1, 2027 | Update the charge master, EHR templates, and fee schedule for each code your practice bills | AMA |
| Maternity care restructure: global codes replaced by phase-specific reporting (17 deleted, 12 new, 6 revised) | January 1, 2027 | OB/GYN practices: retrain coders and change how staff capture visits | AMA |
| NCCI procedure-to-procedure edits version 33.0 (Transmittal 13946, CR 14611, issued September 17, 2026) | January 1, 2027 (implementation January 4, 2027) | Load the new edits into the claim scrubber | CMS |
| Telehealth modifiers BB and BC required | January 1, 2027 | Add BB and BC rules to claim workflows where they apply | CMS Telehealth FAQ (updated October 8, 2026) |
| Medicare telehealth flexibilities continue | Through December 31, 2027 | Plan for the end-of-2027 cutoff | Consolidated Appropriations Act, 2026 (Public Law 119-75, signed February 3, 2026) |
| CY2027 Physician Fee Schedule conversion factor (proposed) | January 1, 2027, if finalized | Update 2027 revenue projections and payer contracts priced as a percentage of Medicare | CMS |
| ICD-10-CM FY2027 code set (already in effect) | October 1, 2026 to September 30, 2027 | Confirm the encoder uses FY2027 codes for dates of service on or after October 1, 2026 | CMS |
The AMA CPT 2027 release lists 299 new codes, 74 revised codes, 80 deletions, and 453 editorial changes. In the CMS NCCI transmittal, Transmittal 13946 issued September 17, 2026, CMS sets version 33.0 of the procedure-to-procedure edits for January 1, 2027, with implementation on January 4.
According to the CMS telehealth FAQ, updated October 8, 2026, modifier BB applies to telehealth furnished through a virtual platform owned by an entity the practitioner contracts with or has a payment arrangement with.
Modifier BC covers telehealth furnished incident to a physician’s or practitioner’s service. If your team needs a refresher on the older telehealth rules, our guide to telehealth modifier rules covers modifier 95 and its POS 02 and POS 10 pairing.
CMS proposed 2027 conversion factors of $33.17 for qualifying APM participants and $32.84 for all other clinicians in its CMS CY2027 PFS proposal. Those figures are $0.40 (1.19%) and $0.56 (1.68%) lower than the 2026 factors of $33.57 and $33.40. CMS attributes most of the drop to the end of a one-year 2.5% increase under Public Law 119-21.
CMS also proposed turning G2211 into a modifier that adds 16% to the E/M payment, or 32% for ACO participants. Until CMS publishes the final rule, treat both changes as proposed, and use our G2211 billing guide for the rules that apply to 2026 claims.
January denials often trace back to a charge master that still carries 2026 codes. Put these updates on the audit’s to-do list so coding compliance holds from the first visit of 2027, and check the CMS HCPCS quarterly update page for the January 2027 file before you load anything.
What to Do When the Audit Finds an Overpayment
Under 42 CFR 401.305, you have 60 days from identification to report and return a Medicare Part A or Part B overpayment. A timely, good-faith investigation of related overpayments can pause that deadline for up to 180 days, so build room for it into your audit schedule.
Some findings will be money you owe back. Under 42 CFR 401.305, you’ve identified an overpayment once you knowingly receive or retain it, with “knowingly” carrying its False Claims Act meaning at 31 U.S.C. 3729(b)(1)(A). Your deadline is the later of 60 days after identification or the date any related cost report is due.
If a timely, good-faith investigation into related overpayments is underway, the clock pauses until that investigation ends or 180 days pass, whichever comes first. The rule reaches overpayments identified within 6 years of receipt and covers Medicare Parts A and B. For Medicaid, check your state’s rules; for commercial plans, check the contract.
A billing compliance audit that finds an overpayment needs a paper trail as much as a refund. Work each finding from the medical billing audit checklist through these steps:
- Write down the date. Record the date your team identified the overpayment and who identified it.
- Decide whether to investigate. Choose right away whether related claims need review, so the 180-day pause can apply.
- Calculate the total. Add up the initial overpayment and any related overpayments the investigation finds.
- Report and return it. Use the payer’s refund process, and keep proof of what you sent and when.
- Fix and recheck. Correct the root cause, then audit that area again in the next cycle.
Ordinary billing errors go back through the payer’s refund process in most cases. The OIG’s Health Care Fraud Self-Disclosure Protocol, created in 1998, serves a different purpose: it’s for disclosing potential fraud that could bring civil monetary penalties.
Repeated errors call for more care under healthcare compliance regulations. If the audit points to a repeated error or anything that could be fraud, talk to a healthcare attorney before refunding or changing past claims. One O Seven RCM is a billing company, not a law firm, and we’ll tell you when you need one.
Adjusting the Audit for Your Specialty or an Upcoming Payer Review
The checklist works for any practice, but your sample should lean toward your specialty’s highest-risk codes. If a payer or CMS contractor has already sent a records request, run those exact records through the medical billing audit checklist before anything else on the calendar.
High-Risk Audit Areas by Specialty
Each specialty carries its own audit risk, so add that specialty’s highest-risk services to the sample. Medical coding compliance problems tend to cluster around the codes a specialty bills most, the modifiers it relies on, and any code set change that hits it in 2027.
| Specialty | Add these to the sample |
|---|---|
| Primary care and internal medicine | E/M level distribution, modifier 25 with procedures, and G2211 use |
| Behavioral health | Time-based psychotherapy codes, telehealth POS, and telehealth modifiers |
| OB/GYN | Readiness for the 2027 maternity code restructure |
| Podiatry | Routine foot care coverage, class findings modifiers Q7, Q8, and Q9, and nail debridement counts |
| Surgery and orthopedics | Global period billing, modifier 59, and X modifiers |
| Home health | Face-to-face encounter and certification documentation, the usual focus of home health billing audits |
| Hospital-based professionals | Split or shared visits, plus a profee compliance audit of professional fee coding |
One O Seven RCM’s specialty billing teams cover more than 75 specialties, from primary care to podiatry. If your specialty isn’t in the table, start with the three codes your practice bills most and the modifier you append most often.
If a Payer or CMS Contractor Review Is Coming
A records request from a payer or CMS contractor changes the order of work. Log the deadline the day the request arrives, check the requested records against the checklist before you send them, and name one person to handle each message with the reviewer.
- Log the deadline: Record the request date and response deadline the same day, using the CERT and PERM windows from the payer section as a guide.
- Pre-check the records: Run the exact requested records through this medical billing audit checklist before you send them.
- Signatures and attestations: Confirm the provider signed each note, and add late entries as dated addenda without editing the original note.
- Proof of submission: Keep tracking numbers or portal confirmations for everything you send.
- One owner: Assign one person to talk with the reviewer, or hand the record prep to payer audit response support if the deadline is close.
Podiatry Billing and Credentialing: What to Audit in 2026
Podiatry audits center on routine foot care. The CMS Medicare Benefit Policy Manual, Chapter 15, Section 290, separates covered foot care from excluded routine care, and Medicare contractors use class findings modifiers Q7, Q8, and Q9 to apply a presumption of coverage when the patient’s findings support it.
The Noridian routine foot care article, A57954, revised effective November 6, 2025, defines Q7 as one Class A finding, Q8 as two Class B findings, and Q9 as one Class B and two Class C findings. For some systemic conditions, the record also needs the name of the treating MD or DO and the approximate date of the last visit.
In Jurisdiction E, Noridian’s Part B team is running a Targeted Probe and Educate review of CPT 11056, paring of two to four corns or calluses. Its Noridian CPT 11056 review results for October 1 to December 31, 2025 list three top denial reasons: records not returned, documentation that didn’t support medical necessity, and missing valid signatures.
- Class findings: Confirm each routine foot care claim carries the Q7, Q8, or Q9 modifier that the documented findings support.
- Treating physician details: For conditions that require it, confirm the note names the MD or DO managing the systemic condition and the approximate date of the last visit.
- Nail debridement counts: Match the number of nails documented to the code billed, 11720 for one to five nails and 11721 for six or more.
- E/M with debridement: Bill an E/M with modifier 25 alongside debridement only when the note shows a separate, significant problem.
- Records and signatures: Confirm the provider signed each note and one person owns record requests, since those caused two of the top three denial reasons in Noridian’s review.
- DPM credentialing: Confirm each podiatrist (DPM) has current PECOS enrollment, an up-to-date CAQH profile, and active credentialing with each Medicare Advantage and commercial plan billed.
For podiatry practices that want this handled year-round, One O Seven RCM provides podiatry billing at 2.99% of collections and podiatry credentialing at $107 per insurance. Our coders work routine foot care rules, Q modifiers, and per-nail debridement coding, and we support practices in all 50 states.
Year-End Audit Calendar: November Through December 31
A year-end audit fits into about eight weeks if it starts in early November. Pull and screen the sample first, score it next, and sweep filing deadlines after that. The last two weeks go to fixing findings and loading the 2027 changes before December 31.
| Dates (2026) | Focus | Key items |
|---|---|---|
| November 2 to November 13 | Set up | Pull the payer-split sample, run exclusion screening, check enrollment, and watch for the CY2027 PFS final rule |
| November 16 to November 27 | Score | Documentation, coding, and modifiers first, then front-end and claims checks |
| November 30 to December 11 | Deadlines | Timely filing sweep for early 2026 claims, credit balances, and A/R over 90 days |
| December 14 to December 23 | Fix | Overpayment decisions, provider education, and loading CPT 2027, BB and BC rules, and NCCI version 33.0 |
| December 28 to December 31 | Document | File the audit results, findings, and corrective actions in the compliance record |
Starting after November 2 is fine if you shrink each phase instead of skipping one. Medical billing best practices put the claims with the hardest deadlines first, and Medicare claims from early 2026 have the hardest deadline of all, so run the filing sweep in your first week.
The same calendar appears in the PDF version of the medical billing audit checklist, so your team can print it, assign names to each phase, and check off each week as it closes.
Frequently Asked Questions
Does the OIG require a yearly billing audit?
The HHS Office of Inspector General (OIG) recommends a yearly audit but doesn’t require one by regulation. Its guidance for individual and small group physician practices calls for a baseline audit and then periodic audits at least once each year. That guidance is voluntary.
The OIG still treats regular auditing as a core part of an effective compliance program, so a yearly medical billing audit is the practical standard. It also gives you dated proof that your compliance program does what its written policies say.
How many charts should a year-end audit include?
The HHS Office of Inspector General (OIG) says there’s no set formula, and its starting guide is 5 or more medical records per federal payer, or 5 to 10 records per physician.
From there, add records from your largest Medicare Advantage and commercial plans. Expand the sample wherever errors show up before you draw conclusions, since a small sample can hide the size of a problem. The sample table in the scoping section of this medical billing audit checklist shows how to split it by payer.
How is a Medicare Advantage audit different from a Medicare audit?
Medicare fee-for-service reviewers check whether documentation supports medical necessity and the codes billed. Audits of Medicare Advantage claims ask a different question: do the records support the diagnoses plans submit for risk adjustment? That difference changes which charts you pull.
The Centers for Medicare & Medicaid Services (CMS) announced on May 21, 2025 that it would audit all eligible Medicare Advantage contracts each payment year. It runs those audits through Risk Adjustment Data Validation (RADV). Plans pass the work down to providers as chart requests, so your notes need to show the provider addressed each chronic condition at the visit.
What happens if our audit finds an overpayment?
Under 42 CFR 401.305, you have 60 days from identification to report and return a Medicare Part A or Part B overpayment. A timely, good-faith investigation of related overpayments can pause that deadline for up to 180 days.
The rule covers overpayments identified within 6 years of receipt. For Medicaid, check your state’s rules, and for commercial plans, check the contract. If the audit shows a pattern or anything that could be fraud, talk to a healthcare attorney before refunding or changing past claims.
What billing changes take effect January 1, 2027?
CPT 2027, National Correct Coding Initiative (NCCI) edits version 33.0, and required Medicare telehealth modifiers BB and BC all take effect January 1, 2027. The CPT update adds 299 codes, revises 74, and deletes 80.
The Centers for Medicare & Medicaid Services (CMS) has also proposed 2027 conversion factors of $33.17 for qualifying APM participants and $32.84 for all other clinicians, pending the final rule. Load the code and edit updates before December 31 so coding compliance holds on your first 2027 claims.
What is the OIG’s role in medical billing?
The HHS Office of Inspector General (OIG) oversees fraud, waste, and abuse in federal health programs like Medicare and Medicaid. For billing teams, the OIG matters in three practical ways, and each one touches the work a yearly audit covers.
The OIG publishes voluntary compliance guidance. It keeps the List of Excluded Individuals/Entities (LEIE) and runs the Health Care Fraud Self-Disclosure Protocol. Most medical billing compliance programs follow its framework, and its once-a-year audit advice is the basis for this medical billing audit checklist.
Download the Free Checklist and Next Steps
The free PDF version of this medical billing audit checklist puts the five audit areas, the payer add-ons, and the November to December calendar on printable pages. Hand each payer section to the person who owns that payer’s claims, and keep the completed copy in your compliance file.
A shared spreadsheet works for most small practices. Larger groups often use dedicated medical billing compliance audit tools to track findings across providers and locations, and either setup can produce a clean medical billing compliance audit report for the compliance file.
If your team can’t fit this in before December 31, One O Seven RCM can run the independent year-end audit and hand you findings by payer. Deeper problems call for a longer fix: our full-service medical billing runs at 2.99% of collections, and credentialing costs $107 per insurance.
One O Seven RCM is a Texas-based medical billing and credentialing company with AAPC-certified coders. We support practices in all 50 states across more than 75 specialties, including primary care, behavioral health, OB/GYN, and podiatry.
Sources
Centers for Medicare & Medicaid Services (CMS)
- CMS Comprehensive Error Rate Testing (CERT)
- CMS Fiscal Year 2025 Improper Payments Fact Sheet
- CMS WISeR Model
- CMS RADV expansion announcement (May 21, 2025)
- CMS Medicare Advantage RADV Program
- CMS PERM Provider Overview
- CMS CY2027 Physician Fee Schedule Proposed Rule Fact Sheet
CMS (continued) and Medicare contractors
- CMS NCCI Transmittal 13946
- CMS Telehealth FAQ (updated October 8, 2026)
- CMS ICD-10 Codes
- Billing and Coding: Routine Foot Care (A57954)
- Noridian JE Part B, CPT 11056 TPE Review Results
HHS Office of Inspector General (OIG)
- OIG Compliance Program Guidance for Individual and Small Group Physician Practices
- OIG General Compliance Program Guidance
- OIG Exclusions Program (LEIE)
- OIG Health Care Fraud Self-Disclosure Protocol
Code of Federal Regulations (eCFR)
- 42 CFR 424.44, Time limits for filing claims
- 42 CFR 401.305, Reporting and returning overpayments
- 42 CFR 424.515, Medicare enrollment revalidation
- 42 CFR 405.980, Reopening of initial determinations
- 42 CFR Part 455 Subpart F, Medicaid Recovery Audit Contractors Program
Other federal and association sources
