A medical billing audit is a systematic review of a practice’s clinical documentation, coding, and claim submissions to verify accuracy, compliance, and proper reimbursement. Think of it as a financial health checkup and a quality control filter for your revenue cycle. It finds the money you are losing, the errors that create denials, and the compliance risks that can turn into repayments or penalties.
Most practices do not need an audit because something went wrong in a dramatic way. They need one because billing is a chain of small steps, and a small error at any step repeats on every claim that follows it. A wrong modifier, a missed prior authorization, a fee schedule that was never updated, a denial that was never appealed. None of those looks like a crisis on its own. Together, they decide how much of your work you actually get paid for.
This guide explains what a medical billing audit is, the four types, which one your practice needs, what a good audit examines, what you should receive, what a free audit should not be, and how the Netix free audit works. It also tells you how to prepare, so you can judge any audit, from any company, on the same standard.
What Is a Medical Billing Audit?
A medical billing audit reviews a sample of your claims, coding, and revenue cycle data and checks them against three things: what the documentation supports, what the payer rules require, and what your contracts say you should be paid. It is not a full review of every claim you have ever sent. It is a structured sample, examined properly, with findings you can act on.
The audit checks clinical documentation first, because documentation is what supports everything else. Notes, lab reports, and other records must match the services billed. Then it checks the codes: ICD-10, CPT, HCPCS, and modifiers such as Modifier 25. Then it checks claim submission and Explanation of Benefits data, meaning what was charged against what was actually paid. Then it checks payer contracts, meaning whether you were paid at your negotiated fee schedule or underpaid. Then it checks regulatory compliance, including HIPAA, CMS, and payer guidelines, so upcoding and fraud penalties stay off your list of problems.
An audit is different from a coding audit. A coding audit looks mainly at whether the codes on a claim are correct. A billing audit is wider. It covers coding, but it also covers the front end, the claim, the denial, the payment, and the accounts receivable that follow. If a claim was denied because eligibility was never checked, a coding audit will not catch it. A billing audit should.
A billing audit is also different from a payer audit. A payer audit is done by an insurer or a government contractor, after the fact, and it usually ends with a demand for repayment. Your own audit is proactive. You run it before an outsider does, so you find the problems first and fix them on your terms.
The 4 Types of Billing Audits
Not every audit is the same job. The type decides who does it, when it happens, and what it can find.
| Type | Who does it | When it happens | What it is for |
|---|---|---|---|
| Internal | Your own staff or billing team | Ongoing, proactive | Catch mistakes early, fix denial patterns, check compliance before outsiders look |
| External | A third-party auditor, insurer, or government contractor | Retrospective, targeted | An unbiased review, often investigating high-risk billing or demanding repayments |
| Prospective | Internal staff or payer pre-payment reviewers | Before claims are sent or paid | Prevent errors and denials before money changes hands |
| Retrospective | Internal team, state or federal agency, or commercial plan | After claims are processed and paid | Review completed history, often resulting in refunds or clawbacks |
Most practices reading this guide are considering an external, retrospective audit of a recent period, done by a billing company as a free audit. That is the type this guide focuses on. The internal and prospective types still matter, because a good external audit should leave you with the internal checks to run yourself afterwards.
Which Audit Do You Need?
Start with the problem, not the product. The right scope follows the symptom.
If denials keep rising and you cannot say why, you need a denial-root-cause audit, focused on a recent period, with every denial categorized by cause. If revenue feels flat while visit volume is steady, you need a payment and underpayment audit, checking billed charges against contractual allowables. If a payer has flagged your coding, or you are worried about an external audit, you need a compliance-focused audit of coding and documentation, with a credentialed auditor. If you are choosing a billing company, a free audit is a reasonable first step, but only if it meets the credibility test later in this guide.
A random baseline audit samples claims across providers, service lines, and payers, and gives you an honest picture of the whole operation. A focused audit looks at one provider, one service line, or one high-risk code set, and answers one question well. Both are legitimate. What is not legitimate is a vendor who calls a small hand-picked list of problem claims an audit. Ask how the sample was chosen, how large it is, and what the denominator is. A finding without a denominator is an anecdote, not a result.
If you are comparing vendors, the audit is also a test of the vendor. A company that cannot explain its sampling method, its report format, and its data handling before you share anything has already told you how it works. That matters more than any sales claim, and it is why the section on choosing a billing company in this guide is worth reading before you book anything.
What an Audit Examines: The 5 Areas
A good audit examines five areas. Each one is confirmed for the Netix free audit from the live site. If any audit you are offered skips one of these areas without saying so, ask what was left out and why.
1. Clean Claim Rate
The clean claim rate is the share of claims that go out clean, with no errors, and get accepted on first submission. It is the single best early warning sign in billing, because a low rate means errors are being built into the process instead of caught by it.
The audit checks your clean claim rate against a stated benchmark, with the source and methodology named, not a vague appeal to industry standards. The HFMA high-performance target of 98 percent is a useful reference point, but it is a target, not a verdict. What matters is your rate, how it is measured, and what is dragging it down: front-end errors, coding errors, or missing information that should have been caught before the claim left the office.
For context on how the rate is measured and what moves it, see the clean claim rate benchmarks guide.
2. Denial Patterns and Root Causes
Denials are not one problem. They are a dozen problems wearing the same label. The audit categorizes every denial in the sample by root cause, using CARC and RARC codes, then drills to the process failure behind it: front-end, coding, documentation, administrative or timely filing, or a payer-side error worth appealing.
The proportion by root cause tells you where the problem lives. If most denials come from the front end, the fix is eligibility checks, prior authorization, and demographics. If most come from coding, the fix is coder training and documentation templates. If most come from timely filing, the fix is a submission calendar and a follow-up cadence. A list of denied claims without root causes is a complaint, not an audit finding.
Denial analysis also covers the appeals that never happened. An audit should check which denials were appealed, which were written off without a fight, and which are still recoverable. In-network claims are denied more often than most practices expect, and a meaningful share of appealed denials are overturned, so the write-off pile deserves a second look. The full picture, including the benchmark figures with sources, is in the denial management guide.
Front-end errors deserve their own attention inside this area. Eligibility that was never verified, a prior authorization that was never obtained, and demographics that were entered wrong are all preventable, and they are all cheaper to fix before the visit than after the denial. The prior authorization process guide covers the workflow that prevents the authorization denials, and the credentialing timelines guide covers the enrollment delays that become credentialing denials when a provider is not yet enrolled with a payer.
3. AR Aging and Collectability
Accounts receivable aging shows how long your money has been sitting unpaid, and by whom. The audit looks at AR aging by payer, especially the buckets over 90 days and over 120 days, and asks which of it is still collectible and which of it is dead.
Old AR is not one number. A claim that is 45 days old and awaiting a payer response is a different job from a claim that is 120 days old and was never followed up. The audit should separate the two, and it should show AR over 90 days as a share of total AR, so you can see whether the problem is growing or stable.
The audit also checks the follow-up cadence behind the numbers. Who works which bucket, how often, and what happens when a payer does not answer. An AR report without a worklist is a photograph. An audit should turn it into a plan: which claims to appeal, which to call on, which to write off, and which process change stops the next batch from aging the same way. The accounts receivable aging guide explains how to read the buckets and what each one demands.
4. Coding Distribution and Documentation
Coding distribution means how your codes spread across a service: which CPT, ICD-10, and HCPCS codes you use most, whether the levels match the documentation, and whether the pattern looks like your specialty and your patient mix, or like a habit.
The audit checks E/M levels against medical decision-making or time, diagnosis specificity and medical-necessity linkage, and modifier accuracy, especially modifier 25 and modifier 59 and its X modifiers. It checks both directions. Upcoding, billing a higher level than the documentation supports, creates compliance risk and repayment exposure. Downcoding, billing a lower level than the work justifies, quietly gives revenue away on every visit.
Documentation adequacy is part of this area too. Cloned or over-templated notes, missing signatures, services billed without support, and non-covered services billed without the appropriate modifiers all show up here. A good auditor names the specific documentation gap and the specific fix, such as a template change or a documentation standard, instead of writing a vague warning about compliance.
5. Collection Rate and Payer Payments
Collection rate is the share of what you were owed that you actually collected, after contractual adjustments. It is the number that decides whether your billing operation works, and it is the number most often quoted without a definition. The audit should state the definition it uses, the period it covers, and the contractual allowables it measured against.
The heart of this area is payment reconciliation: billed charges against payments against contractual allowables, claim by claim, payer by payer. That is how underpayments surface. A payer that pays below the contracted rate on a code you bill every week is a small leak with a large annual total, and it is invisible until someone reconciles it. The audit should also check fee-schedule alignment, meaning whether your fee schedule matches your current contracts, and whether underpayments were ever appealed.
This is also where your billing services earn their fee, if you outsource. A vendor that cannot show you reconciled payments and recovered underpayments is charging you for sending claims, not for collecting revenue. Ask for the reconciliation, not the promise.
What Does a Medical Billing Audit Cost?
The honest answer is that it depends on scope, and any company that quotes a price before asking about scope is selling, not auditing.
A free audit is a sample review, not a full review of your whole billing history. It is offered by billing companies to demonstrate value and win new clients, and there is nothing wrong with that, as long as you know what it is. What a free audit should include, and what it should not require, is covered in the credibility section below.
A paid audit is usually priced by scope: the number of claims sampled, the number of providers or service lines, the period covered, and whether it includes a written report and a walkthrough. A comprehensive audit of a multi-provider practice costs more than a focused audit of one service line, because it examines more and takes longer. A compliance audit by a credentialed auditor costs more than a revenue review, because the qualifications and the liability are different.
What should drive the price is the work, not the promise. Before you agree to a paid audit, ask for the scope in writing: the sample size and method, the areas examined, the report format, the timeline, and what happens afterwards. If the price is tied to a percentage of what the audit finds, ask how the finding is calculated, who verifies it, and what happens if the finding is wrong. A fee that grows with the problem found is a fee with an incentive to find problems.
For the wider question of what billing help costs, and how the pricing models work, see the guide to what outsourcing costs. It covers percentage of collections, per-claim, and flat pricing, with the honest trade-offs of each.
What You Receive: What a Good Audit Report Contains
An audit that ends with a phone call and a proposal is not an audit. It is a sales meeting. A real audit ends with a written document that you keep, that you can share with your compliance counsel or your board, and that you can act on without hiring the company that wrote it.
A good report contains the audit period, the sampling method and sample size, and the data sources used: claims, remittance advice, medical records, fee schedules, and AR reports. It states its limitations honestly: records that were unavailable, payer delays, and anything that could not be assessed. A report that claims to have audited everything from a small sample in a short timeline is telling you it did not audit everything.
The findings should be specific and evidence-based, ranked by financial impact and compliance risk. A finding should read like evidence, not like a slogan. For example, an illustrative finding, not Netix data, would read: payer X denied 14 percent of the sampled claims, and 62 percent of those denials came from missing prior authorization for one procedure, with the sampled claims referenced. You can check that. You can fix that. A finding that reads “your denials are too high” tells you nothing and fixes nothing.
Metrics in the report should show your actual performance against a stated benchmark, with the benchmark source named. Clean claim rate, initial denial rate, days in AR, AR over 90 days as a share of total AR, and net collection rate are the numbers that matter, and each one should come with its definition and its period.
Recommendations should be split in two. The first half is what your practice can do internally: front-end fixes, coder training, documentation templates, a follow-up cadence. The second half is vendor-accountability items: the appeals backlog, underpayment recovery, and fee-schedule renegotiation. A report that only recommends hiring the auditor has not finished the job.
Finally, any opportunity estimate in the report must show its math. Volume, denial rate, average claim value, and expected recovery rate, stated plainly, so you can check the arithmetic. A single large number with no assumptions behind it is a sales device, not a finding.
What a Free Audit Should NOT Be
A free audit is a sample review offered to demonstrate value. That is legitimate. What turns it into a trap is easy to spot once you know the signs.
A free audit should not start with system access before any agreement is signed. Your data should change hands only under a signed Business Associate Agreement, with the scope agreed in writing first. No BAA and no defined scope means your patient information is moving without protection, and that alone is a reason to walk away.
A free audit should not end with verbal-only findings. If the findings live only in a meeting, and the only next step is a contract, you were not audited. You were pitched. Ask in advance: will I receive a written report with the sampling methodology and the findings, and can I keep it if I do not engage you? An evasive answer is your answer.
A free audit should not present a deliberately alarming number with no methodology, sample, or supporting data behind it. “You are losing 400,000 dollars a year” means nothing without the sample, the denominator, and the math. Neither should it guarantee savings before the data has been reviewed. No one can guarantee what they have not yet examined.
A free audit should not pressure you to decide before you have reviewed the report. Pricing that expires on Friday, a discount that vanishes if you do not sign today, and a walkthrough that is really a closing call are all the same sign. A credible auditor is patient, because the report speaks for itself.
And a free audit should not hide who did the work. Ask for the auditor’s credentials: CPC, CCS, or equivalent, and familiarity with payer rules and E/M guidelines for your specialty. Ask for client references from practices of a similar size and specialty. A company that cannot name its auditor or its references is asking you to trust a brand instead of a person.
If you are comparing vendors, read the guide to choosing a billing company before you sign anything. It covers the diligence checklist, the red flags in the sales process, and the contract terms that protect you, and it applies to audit vendors exactly as it applies to billing vendors.
How the Netix Free Audit Works, Step by Step
Step 1: You request the audit. You fill in the form on the contact page with your name, practice name, email, phone, specialty, number of providers, current billing setup, and your biggest challenge. The form takes about 2 minutes. Please do not send patient health information through the form.
Step 2: You hear back within one business day.
Step 3: You share the practice-level information needed for the audit. Your audit starts from practice-level information only, never patient records.
Step 4: The audit is delivered within 48-72 hours.
Step 5: The optional walkthrough call. You can walk through the findings on a call, ask questions, and decide what to do next.
Step 6: You decide. There is no obligation.
Your audit starts from practice-level information only, never patient records. If we work together, patient information is shared only after a signed Business Associate Agreement, through a secure channel we set up for you. That wording is from the live contact page, and it stays exactly as the site states it.
What Happens After the Audit
An audit is only useful if something changes after it. There are four honest options, and a credible auditor should be comfortable with all four.
First, fix it yourself. Many findings are process fixes your own team can make: an eligibility check at scheduling, a prior authorization workflow, a documentation template, a follow-up cadence for old AR. The report should say which findings fall in this group, so you can start without spending anything.
Second, hire Netix to fix it. If the audit shows the problem is the billing operation itself, and you want a vendor to run it, that is the next conversation. The audit does not obligate you to it.
Third, hire someone else to fix it. A credible report is written so another vendor, or your own team, can act on it. If the report only makes sense when the auditor implements it, it was written to sell the implementation, not to inform you.
Fourth, do nothing, for now. Some findings are small, some fixes cost more than they save, and some practices have other priorities first. Doing nothing is a legitimate choice when it is an informed one. The audit gives you the information. The decision stays yours.
If the audit shows that your current biller is the problem, and not your process, then the question changes from what to fix to who should run your billing. The guide to switching billing companies covers how to change vendors without losing revenue, including the transition timeline and what to demand on exit. Read it before you give notice to anyone.
How to Prepare for a Billing Audit
Preparation is simple, and it is mostly about access and honesty. The auditor needs to see how billing actually works in your practice, not how it is supposed to work.
Gather the reports the auditor asks for: recent claims data, remittance advice, AR aging reports, denial reports, and fee schedules. Do not clean the data first. An audit of cleaned data tells the auditor about your cleaning, not about your billing.
Name one person on your team as the audit contact, someone who knows the billing workflow and can answer questions about exceptions. Auditors waste the most time chasing answers from five different people, and the answers they get are worse for it.
Tell the auditor what you already suspect. If you think denials are rising, or one payer is underpaying, or one provider’s coding looks odd, say so. A good auditor checks your suspicion against the sample instead of ignoring it, and a suspicion confirmed is a finding you can act on immediately.
Set aside time for the walkthrough. The report is the record, but the walkthrough is where you learn which findings matter most and which fixes come first. Come with questions, and leave with a ranked list, not a stack of paper.
Frequently Asked Questions
What is a medical billing audit?
A medical billing audit is a systematic review of a healthcare provider’s clinical documentation, coding, and claim submissions to verify accuracy, compliance, and proper reimbursement. It checks what the documentation supports, what the payer rules require, and what your contracts say you should be paid, usually on a sample of recent claims.
How much does a medical billing audit cost?
It depends on scope: the sample size, the number of providers or service lines, the period covered, and whether it includes a written report and a walkthrough. A free audit is a sample review offered by a billing company to demonstrate value. A paid audit is priced by the work involved, and the scope should be agreed in writing before you pay anything.
What is the difference between a medical billing audit and a coding audit?
A coding audit looks mainly at whether the codes on a claim are correct. A billing audit is wider. It covers coding, but it also covers the front end, the claim, the denial, the payment, and the accounts receivable that follow. A claim denied because eligibility was never checked will not be caught by a coding audit. A billing audit should catch it.
What does a medical billing audit check?
It checks clinical documentation against the services billed, coding accuracy including CPT, ICD-10, HCPCS, and modifiers, claim submission against Explanation of Benefits data, payer payments against contractual allowables, denial root causes, AR aging and collectability, and regulatory compliance. The five areas in this guide cover each of those in detail.
How often should a medical practice conduct a billing audit?
There is no single rule, and any company that gives you one without asking about your practice is guessing. A practice with stable billing and low denials can audit less often than a practice that is growing, changing systems, adding providers, or seeing denials rise. A reasonable rhythm for most practices is an annual review, with a focused audit whenever a trigger appears: a payer flag, a coding change, a new service line, or a denial spike.
What are common errors found in a medical billing audit?
The common errors are upcoding and downcoding, modifier mistakes, missing or weak documentation, services billed without support, eligibility and prior authorization failures, timely filing misses, underpayments that were never appealed, and denials that were written off instead of appealed. The pattern matters more than any single error. One upcoded claim is a mistake. The same upcoded claim on every visit is a process failure.
The Bottom Line
A medical billing audit answers three questions: are your claims right, are you being paid what your contracts promise, and what should change first. The answers should come in writing, with the method stated, the findings ranked, and the math shown. If an audit cannot give you those three things, it is not an audit. It is a sales call with a stethoscope on it.
If you want those three answers for your practice, the Netix free audit is the way to get them. Request it, read the report, and decide from the evidence. That is what the audit is for.
