Finding the ideal partner for medical coding audit services usually means facing a binary choice: partners who bring measurable accuracy vs. vendors who simply provide temporary coding support. While this may sound like a highly subjective choice given that healthcare institutions come in various sizes, shapes, and specializations, there is a right answer. And coming to the right conclusion is critical for you from a compliance perspective and for your revenue integrity. A well-designed audit does more than simply highlighting errors, it acts as a powerful diagnostic tool for your entire health information management (HIM) operation.
Here is how to cut through the marketing noise and choose a coding audit partner who delivers actionable insights you can trust, backed by a solid strategy that actually improves your bottom line.
What Medical Coding Audit Services Include, and What They Do Not
An independent external coding audit provides an objective evaluation of your clinical documentation and coding accuracy. Fundamentally speaking, it is an inspection of the record-to-claim lifecycle.
Audit versus coding vendor
The basic difference is that an audit partner reviews coding that someone else assigned, and a coding vendor is the one who assigns it. These are entirely different purchases with different evidence requirements. When you are evaluating an auditor on coding-vendor criteria like sheer processing speed rather than analytical depth, you are most likely to end up with a findings deck that nobody acts on. In such cases, independence is the product.
The audit types
Serious audit engagements focus on a set of specific vulnerability points. The most common scopes include code-level accuracy, DRG validation for inpatient stays, professional fee evaluation and management (E/M) reviews, risk adjustment and hierarchical condition category (HCC) validation, as well as denial-driven prebill reviews.
What sits outside a coding audit — charge capture, payment posting and collections belong elsewhere
A pure coding compliance audit stops at the accuracy and medical necessity of the codes. While audit findings influence revenue integrity, the audit itself does not encompass charge capture reconciliation, payment posting, or direct collections. Evaluating those functions requires a different toolset.
Why the Audit You Commission Decides What You Learn
The way you structure your audit dictates the validity of your results. If you commission a flawed audit, you will receive flawed reassurances or unnecessary alarms. CMS recently reported that traditional Medicare made over $28.8 billion in improper payments during the 2025 reporting period, with insufficient documentation remaining a primary culprit.[1] In this high-stakes environment, poorly designed audits leave you exposed.
A sample too small to support a conclusion
Reviewing just five random charts per coder might surface a specific misunderstanding, but it lacks the statistical power to declare an overarching accuracy rate. A sample too small to conclude anything creates a false sense of security while leaving systemic coding compliance audit risks buried.
An accuracy number that measures the wrong thing
Vendors can artificially inflate accuracy rates by using denominators that flatter the result. If an audit measures only the percentage of individual codes correct (where most charts carry multiple uncontested routine codes), the success rate looks phenomenal, even if the primary diagnosis that drove the DRG was completely wrong.
Scope that avoids the risky chart types
Limiting the audit to historically clean chart types—like routine wellness visits—while ignoring complex surgical encounters or high-acuity inpatient stays, produces a skewed picture. The Office of Inspector General (OIG) Work Plan specifically targets high-risk areas like facility E/M coding and emergency department billing. Avoiding these in your audit defeats the purpose.
Findings with no owner, no deadline and no education attached
A sprawling spreadsheet of errors without an assigned owner or follow-up deadline is practically useless. Without targeted education and a measurable timeline for correction, an audit is just an expensive observation.
Retrospective, Concurrent and Prebill Coding Audits Compared
Timing is everything in audit design. Different methodologies serve distinct operational goals. Most hospitals and health systems require a mix of all three, and you should ask prospective partners to price them accordingly.
| Feature | Retrospective | Concurrent | Prebill |
|---|---|---|---|
| What it Catches | Post-bill coding errors, systemic trends, and compliance vulnerabilities. | Mid-stay documentation gaps and clinical validation issues. | Errors and unbundling issues right before the claim drops. |
| Feedback Latency | Weeks or months after the encounter. | Within 24–48 hours, while the chart is still active. | Immediate, prior to billing. |
| Impact on DNFB | None. | Minimal, but requires swift physician responses. | Temporarily increases DNFB as claims are held. |
| Rework Burden | High (requires amended claims and rebilling). | Low (issues fixed before final coding). | Medium (requires immediate coder correction). |
| Best Used For | Compliance baseline, statistically valid sampling, and extrapolation. | Complex inpatient stays needing CDI intervention. | High-dollar, high-denial-risk claims. |
Retrospective — the compliance baseline, and the only design that supports extrapolation
Because retrospective audits look at closed, fully billed records, they are the gold standard for compliance. They are the only design that supports the random sampling required to extrapolate findings across an entire population for overpayment calculations.
Concurrent — shortening the feedback loop while the chart is still open
Concurrent review happens while the patient is still receiving care. It drastically shortens the coder and provider feedback latency, allowing clinical documentation integrity specialists to issue queries before discharge.
Prebill — stopping the error before the claim, and the revenue-hold trade-off
A prebill hold catches the error before the claim leaves the building. It prevents the costly cycle of denials and appeals, but comes with a distinct trade-off: it holds up revenue and directly impacts your discharged-not-final-billed (DNFB) metrics.
How Many Charts Should a Medical Coding Audit Include?
The answer depends on what you are trying to prove. Most standard coder assessments rely on 30 charts, but a repayment investigation requires a vastly different approach.
The probe — does a problem exist
A probe audit typically reviews 30 charts per coder. This industry convention is designed simply to tell you if a problem exists. It identifies educational gaps and routine errors, but the sample is not robust enough to project financial impact across your entire claim volume.
The statistically valid sample — how large is the problem, and can it be extrapolated
If you need to know exactly how much financial risk exists, you need a statistically valid random sample. Sized for extrapolation—often using OIG’s RAT-STATS software to establish a confidence interval—this method can legally support an overpayment repayment calculation.
Stratification by chart type, service line, coder and payer
An organization-wide audit should be stratified to ensure proportional representation. Breaking the sample down by specific service lines, high-risk chart types, individual coders, and major payers prevents a high-performing department from masking the errors of a struggling one.
Random versus targeted selection, and why the distinction must appear in the report
A random sample measures broad, systemic accuracy. A targeted sample hunts for specific, known vulnerabilities (like a specific high-denial CPT code). Both are legitimate, but presenting a targeted sample’s elevated error rate as your overall organizational accuracy rate is fundamentally dishonest. Your report must distinctly separate the two.
How Is Coding Audit Accuracy Measured?
Accuracy as a stand-alone metric is very hard to define when it comes to audits. There is a lot of room for manipulation. Here’s how the true picture looks like.
| Metric | Calculation | What it Shows | Typical Range |
|---|---|---|---|
| Per-Code Accuracy | Total correct codes / Total codes audited | Evaluates coder’s technical precision across every line item. | High (92% – 98%) |
| Per-Chart Accuracy | Fully correct charts / Total charts audited | An unforgiving “all-or-nothing” pass/fail test per encounter. | Low to Medium (70% – 85%) |
| Financial Accuracy | Correctly reimbursed claims / Total claims | Highlights only the errors that actually moved money. | Medium to High (85% – 95%) |
Per-code, per-chart and per-claim: same audit, three different numbers
Imagine a chart with 10 codes. Nine are correct, but the primary diagnosis is wrong. Under per-code accuracy, the coder scores a 90%. Under per-chart accuracy, the chart fails entirely, scoring 0%. Per-claim accuracy looks at whether that single error changed the reimbursement. Always ask which denominator is being used.
Financial accuracy — which errors actually moved money
Financial accuracy ignores benign sequencing errors and focuses solely on impact. This is the metric the Chief Financial Officer cares about. It calculates the net financial discrepancy caused by undercoding or overcoding against the total expected reimbursement.
DRG-level accuracy and case mix index impact, separate from code-level accuracy
In case of inpatient work, it is possible for a chart to carry minor code errors without shifting the DRG. Contradictory to that, missing a single major complication can drastically alter the DRG and lower the case mix index, even if every other code is flawless. The key is to understand how clinical DRG auditing works to ensure your partner separates DRG-level performance from general code accuracy.
Inter-rater reliability between the partner’s own auditors, and who audits the auditor
If two of the vendor’s own auditors review the same chart and disagree on the outcome, the accuracy rate they report is just noise. Ask for their measured inter-rater reliability (IRR) and inquire about their second-level review process to ensure consistency.
Questionnaire Before You Decide
When you are interviewing potential vendors, do not hesitate to skip past generic sales pitches and ask uncomfortable operational questions.
1. Which credentials do your auditors hold, and who will audit our specific chart types?
Why it matters: Inpatient DRG auditing requires vastly different expertise than outpatient HCC coding.
Strong answer: The vendor names specific credentials (CCS, CDIP, CRC) aligned to your case mix and commits to matching auditor experience with your specific service lines.
Red flag: “Our auditors are fully certified,” without specifying which credentials or admitting they use generalists for complex surgical charts.
2. How will you size and select the sample, and can the result be extrapolated?
Why it matters: Sampling is what separates probe audits from statistically valid reviews.
Strong answer: A good service provider will explain the difference between a 30-chart probe and a RAT-STATS randomized sample. This confirms that they can support a statistically valid sample if compliance requires it.
Red flag: Promising to extrapolate findings from a small, hand-picked targeted sample.
3. Will this be retrospective, concurrent or prebill — and why that one for us?
Why it matters: Your current operational pain points should dictate the methodology.
Strong answer: They recommend a specific mix based on your DNFB limits and compliance goals, explaining the trade-offs of each.
Red flag: Pushing prebill audits exclusively just to demonstrate an immediate return on investment, ignoring the compliance risks of closed charts.
4. How do you define accuracy, and will you report per-code, per-chart and financial accuracy?
Why it matters: Vendors can hide poor coder performance behind a flattering denominator.
Strong answer: They commit to providing all three metrics simultaneously so you have a complete, transparent view of performance.
Red flag: Refusing to calculate per-chart accuracy because it “looks too low.”
5. Do you report DRG-level accuracy separately from code-level accuracy?
Why it matters: Inpatient revenue hinges entirely on the DRG, not the volume of secondary codes.
Strong answer: They provide a dedicated DRG validation report tracking shifts, case mix index impact, and specific MCC/CC capture rates.
Red flag: Lumping all inpatient coding errors into a single, diluted percentage.
6. What is the measured inter-rater reliability between your auditors, and how is it maintained?
Why it matters: Audit results become irrelevant and completely beat the purpose if they are highly subjective.
Strong answer: They cite a specific IRR threshold (e.g., 95%+) and explain their internal peer-review and tie-breaker processes.
Red flag: When they do not formally measure IRR internally.
7. What does the rebuttal process look like, and who adjudicates a disputed finding?
Why it matters: Your internal coders will disagree with some findings. A healthy audit embraces this.
Strong answer: A good vendor provides a defined rebuttal window, a disputed findings log, and relies on established coding clinics or payer’s policies to adjudicate disagreements.
Red flag: An auditor who refuses to be challenged or lacks a formal mechanism for review.
8. Do we get a report or an action plan, and is coder education included in the package or charged extra?
Why it matters: A report only tells you what went wrong but an action plan gives you the solution to fix all that went wrong.
Strong answer: The deliverable includes detailed root cause analysis and a structured corrective action plan. Education is explicitly priced in the statement of work.
Red flag: The engagement ends the moment the final spreadsheet is delivered.
9. What is inside and outside the scope, and how is a scope change priced and approved?
Why it matters: Audits can easily spiral into open-ended consulting engagements.
Strong answer: The contract strictly defines chart volumes, review types, and deliverables, with a clear change order process for any PHI data expansion or extra reviews.
Red flag: Vague language about “flexible review parameters” that usually leads to surprise billing.
What Happens After the Findings: Rebuttal, Action Plan and Education
A findings report on its own changes nothing. To achieve meaningful improvement, the audit must transition smoothly into remediation. The sequence of a successful engagement should route naturally into audit and education consulting engagements.
The rebuttal window and why an auditor who will not be challenged is a liability
An auditor who cannot defend their rationale against your senior coders undermines trust in the entire process. A defined rebuttal window allows your team to present clinical evidence or specific payer policies that the auditor may have lacked context for, ensuring the final report is impeccably accurate.
From findings to root cause — coder error, documentation gap, or edit and payer policy change
Errors stem from three primary sources: a coder applying a rule incorrectly, a physician leaving a clinical gap in the record, or a silent payer policy change triggering an edit. Acknowledging this distinction is crucial because physician gaps require clinical documentation integrity support, not coder remediation.
The corrective action plan: owners, dates and a measurable target
A corrective action plan assigns specific individuals to fix identified root causes by a specific date. It sets measurable targets—such as reducing unspecified diagnosis codes by 15% within the quarter—shifting the dynamic from observation to execution.
Education that is targeted at the errors found, not a generic annual refresher
Generic, off-the-shelf training wastes time. The audit should fuel targeted coder education programs built exclusively around the specific errors, service lines, and physicians flagged in the findings report.
The re-audit — proving movement on the same measure, with the same denominator
You only know if the education worked if you measure it again. A scheduled re-audit, using the exact same sample parameters and denominators, provides the definitive proof of movement and justifies the investment.
The Risks of an External Coding Audit, and How to Manage Them
External audits are inherently risky. Acknowledging and managing these risks upfront is the hallmark of a mature compliance program.
Scope creep from a fixed-fee audit into an open-ended consulting engagement
Without strict boundaries, a simple baseline audit can quickly expand into an expensive, sprawling initiative. Define exact chart limits and require formal change orders for any additional work.
Findings you are then obliged to act on — scope the first engagement with compliance counsel
Once an external auditor quantifies a systemic overpayment, you have a legal obligation to address it. Therefore, involve your internal compliance counsel before commissioning an extrapolated, statistically valid sample to ensure findings are managed appropriately.
Coder morale and the difference between an audit used for education and one used for blame
An audit weaponized against staff destroys morale and drives turnover. Position the audit as a diagnostic tool for process improvement and continuous learning, not as a punitive performance review.
Over-reliance on automated review without credentialed human validation
While automated audit tools excel at flagging pattern-based anomalies and NCCI edit issues, they struggle with clinical nuance and complex principal diagnosis sequencing. A reliable audit always keeps a credentialed, human-in-the-loop reviewer at the helm.
Lightning Strategy to Finalize Your Medical Coding Audit Partner in Just 30-Days
Selecting a vendor does not have to be a multi-quarter ordeal. A structured 30-day process ensures clarity and speed.
Week 1 — define the question and baseline your own numbers
Determine precisely what the audit needs to solve—are you fighting denials, or checking compliance? Pull your current internal accuracy and denial-by-coding rates to establish a clear baseline.
Week 2 — shortlist and issue the nine questions in writing
Select two or three highly qualified vendors. Instead of sitting through lengthy sales presentations, issue the nine questions outlined in this article in writing to force concrete, actionable responses.
Week 3 — the paid blind audit: same charts, two partners, compared findings
This is the ultimate test. Send the exact same batch of 30 complex charts to your shortlisted partners. Pay for the time, then compare their findings against each other and against your own senior coders’ assessments. This rapidly reveals true auditor quality.
Week 4 — score, contract the action plan and re-audit, set the cadence
Score the blind audit results, negotiate a statement of work that explicitly includes the corrective action plan and education, and establish the ongoing re-audit cadence.
Frequently Asked Questions
How much does a medical coding audit cost?
Costs vary based on chart volume, complexity, and methodology. A limited probe audit is significantly less expensive than a statistically valid random sample requiring complex clinical validation and extensive coder education deliverables.
How often should coding audits be performed?
The OIG recommends regular auditing as part of a robust compliance program. Organizations typically perform comprehensive external audits annually, supplemented by monthly or quarterly internal probe audits on high-risk service lines.
What is the difference between an internal and an external coding audit?
Internal audits are conducted by your own staff, offering rapid feedback for daily operations. External audits are performed by an independent third party, providing the objective, bias-free baseline required for strict compliance and board-level reporting.
Which credentials should a coding auditor hold?
Auditors should hold credentials matching the chart complexity. Look for AHIMA or AAPC certifications such as CCS (Certified Coding Specialist), CDIP (Clinical Documentation Improvement Practitioner), or CRC (Certified Risk Adjustment Coder) for specialized risk reviews.
Can an audit partner also correct and rebill the claims it finds?
A pure external audit partner identifies errors and provides an action plan, but generally does not alter your live claims, post payments, or manage collections in order to maintain complete independence from the revenue realization process.
Benchmarks For a Medical Coding Audit Company
Authority in the audit space is proven through volume, security, and credentialing. Do not settle for vague promises of quality alone.
The seven pieces of evidence to request in writing
Before signing, require the following:
- The standard accuracy denominator used in reporting.
- Monthly audit capacity.
- Turnaround time categorized by chart type.
- The exact mix of auditor credentials.
- Specialty and service line coverage capabilities.
- Security and privacy certifications.
- Named references from organizations with a comparable case mix.
How we answer them
At LexiCode, we audit 309K+ charts annually, by relying on our fleet of highly experienced, AHIMA-certified auditors. Maintaining strict data security through HITRUST CSF certification, our teams have supported over 204K+ providers. Review the full consulting and audit services data sheet for complete specifications.
Say Hi to Our Experts
The value of an audit is directly proportional to the meaningful change it brings within your HIM operations. When you know which questions to ask and how to test for auditor reliability, you protect your revenue and your compliance standing simultaneously. Take the next step in evaluating your operational accuracy by exploring a comprehensive approach with our team. Reach out to our experts for a quick assessment today.