Work through the ten groups in order, because later application assumes earlier foundations. Each concept pairs a rule with a resolved example and a mistake to avoid: read the explanation, predict the example's outcome, then check your reasoning against the decision given. Verify surprising rules in the references below. Treat this as exam-focused review support that complements, never replaces, official study materials for the credential you are pursuing.
Regulatory Foundations and the Auditor's Role
1. Fraud versus abuse in federal healthcare programs
CMS treats abuse as actions creating unnecessary program costs without proven intent, such as misusing codes on a claim or failing to keep adequate records. Fraud involves knowing misconduct, like misrepresenting a diagnosis to justify payment or billing a higher level than delivered. Intent separates the categories.
Example: A clinic bills a comprehensive visit when a limited exam occurred. With no evidence of intent, the auditor classifies it as abuse and recommends education plus repayment rather than a fraud referral.
Mistake to avoid: Labeling every coding error as fraud; intent, not the error itself, drives that classification.
Reference: AAPC CPMA study guide sample
2. False Claims Act exposure in auditing
The False Claims Act reaches falsified chart notations, claims for services not performed or not requested, expired drugs, upcoding, unbundling, and physician claims for non-physician provider work that ignores incident-to guidelines. Auditors flag these patterns because each claim can carry liability individually, not merely in aggregate.
Example: An audit finds physician claims for services rendered solely by an unsupervised aide. The auditor documents potential False Claims Act exposure and escalates it rather than treating it as routine education.
Mistake to avoid: Treating non-physician-provider billing that ignores incident-to rules as a simple documentation lapse.
Reference: AAPC CPMA study guide sample
3. Civil Monetary Penalty Law and proper claims filing
The Civil Monetary Penalty Law pairs with the False Claims Act around proper claims filing. Mere mistakes that the practice remedies by returning overpayments generally do not violate these laws, so auditors distinguish correctable error from knowing misconduct before recommending severity of response.
Example: A coder misreads a prior-year note and overbills one visit, and the practice refunds promptly. The auditor records an honest mistake with correction, not a penalty-law violation.
Mistake to avoid: Recommending penalty framing for good-faith errors already corrected through timely repayment.
Reference: AAPC CPMA study guide sample
4. Reasonable and necessary as the payment gate
Physicians may order any test they judge appropriate for patients, including screenings, but Medicare pays only for services meeting its definition of reasonable and necessary to diagnose or treat a condition. Auditors test documentation against that payment standard, not against clinical preference or the mere presence of an order.
Example: A screening panel is ordered at a routine visit with no supporting indication documented. The auditor flags payment risk because coverage necessity is absent, even though the order itself was permissible.
Mistake to avoid: Assuming a physician order alone establishes the medical necessity that coverage requires.
Reference: AAPC CPMA study guide sample
5. OIG guidance as the auditor's benchmark
The Office of Inspector General publishes compliance guidance and conducts fraud and abuse work that shapes audit priorities across the industry. Auditors use OIG positions, such as recommended random chart counts for annual compliance audits, as persuasive benchmarks when constructing internal review plans and later defending the method chosen.
Example: A practice plans its yearly internal review. The auditor proposes random chart pulls per physician consistent with OIG guidance and documents that basis within the audit plan.
Mistake to avoid: Citing internal habit instead of an identifiable OIG or payer standard when the method is challenged.
Reference: AAPC CPMA study guide sample
6. Why practices perform self-audits
Internal audits review quality of care provided to patients, educate providers on documentation guidelines, confirm that services are supported and appropriate revenue is captured, and build a defense record against external audits, malpractice litigation, and health plan requests or denials. The auditor frames findings around these purposes when reporting.
Example: Facing recovery-auditor attention, a group audits its highest-volume surgical codes first. The report emphasizes documentation support and education, creating evidence of proactive compliance.
Mistake to avoid: Limiting audit goals to revenue recovery and omitting quality, education, and defense objectives.
Reference: AAPC CPMA study guide sample
HIPAA Covered Entities and Protected Information
7. Who counts as a covered entity
The Privacy Rule covers health plans, health care clearinghouses, and any health care provider that transmits health information electronically in connection with standard transactions such as claims, eligibility inquiries, or referral authorization requests. Simply using email or computers does not create coverage; the transmission must connect to a standard transaction.
Example: A small counseling office mails paper claims only and emails appointment reminders. It is not covered, because neither electronic activity involves a standard HIPAA transaction.
Mistake to avoid: Assuming any provider using email or computers automatically falls under the Privacy Rule.
Reference: HHS Summary of the HIPAA Privacy Rule
8. Health plan and non-plan boundaries
Health plans include health, dental, vision, and drug insurers, HMOs, Medicare, Medicaid, and employer group plans, but workers compensation carriers, automobile insurers, and property-casualty insurers are not health plans. Programs whose principal activity is granting funds or directly delivering care, like community health centers, also fall outside the plan definition.
Example: An auditor checks whether a state auto-medical-pay carrier must honor privacy-rule requests. It does not, because automobile insurance is excluded from the health-plan definition.
Mistake to avoid: Treating every payer of medical bills as a HIPAA health plan subject to the Rule.
Reference: HHS Summary of the HIPAA Privacy Rule
9. Business associates and their contracts
A business associate is a person or organization outside the workforce that performs functions for a covered entity involving protected health information, such as claims processing, billing, utilization review, data analysis, or consulting. The covered entity must impose written safeguards through a business associate agreement and cannot authorize any use the Rule itself forbids.
Example: A practice hires an outside billing company that views patient records. The auditor verifies a signed agreement exists before concluding the arrangement is compliant.
Mistake to avoid: Letting a contractor access records for years without a current written business associate agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
10. Protected health information in every medium
Protected health information is individually identifiable health data held or transmitted by a covered entity or its business associate in electronic, paper, or oral form. It includes demographic identifiers tied to health status, care, or payment, such as name, address, birth date, and Social Security number, regardless of the medium carrying it.
Example: A nurse verbally discusses a named patient's results in a hallway. Because oral identifiable health information counts, the auditor treats it as a privacy-rule matter, not mere etiquette.
Mistake to avoid: Limiting privacy review to electronic and paper records while ignoring oral disclosures entirely.
Reference: HHS Summary of the HIPAA Privacy Rule
11. Two routes to de-identification
De-identified information escapes Privacy Rule restrictions either through a formal determination by a qualified statistician or by removing specified identifiers of the individual and of relatives, employers, and household members, with no actual knowledge that the remainder could identify someone. Dates beyond year and ages over eighty-nine require special handling.
Example: A registry strips names, full addresses, and exact dates, keeping only birth year. The auditor confirms no residual knowledge of identifiability before approving unrestricted use.
Mistake to avoid: Deleting names only and calling a dataset de-identified while exact dates and zip codes remain.
Reference: HHS Summary of the HIPAA Privacy Rule
12. Records outside protected health information
Employment records a covered entity maintains in its capacity as an employer, and education records governed by the Family Educational Rights and Privacy Act, are excluded from protected health information. Auditors check which role the entity held when creating the record before applying privacy-rule analysis to a disclosure.
Example: A hospital's human-resources file on a nurse who is also a patient stays outside PHI rules as an employment record, unlike her treatment chart.
Mistake to avoid: Applying privacy-rule access procedures to employment files the Rule expressly excludes.
Reference: HHS Summary of the HIPAA Privacy Rule
Permitted Uses and Disclosures
13. Treatment, payment, and operations without authorization
A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations without individual authorization. Operations include quality assessment and improvement, credentialing, competency assurance, medical reviews, audits, legal services, fraud and abuse detection, and compliance programs, which is the legal basis supporting internal medical auditing itself.
Example: An auditor reviews charts for a compliance program. The review proceeds without patient authorizations because it qualifies as health care operations.
Mistake to avoid: Delaying an internal compliance audit while collecting patient signatures the Rule does not require.
Reference: HHS Summary of the HIPAA Privacy Rule
14. The only two required disclosures
Covered entities must disclose protected health information in only two situations: to individuals or their personal representatives specifically when they request access or an accounting of disclosures, and to HHS when it undertakes a compliance investigation, review, or enforcement action. Every other disclosure category is permitted but never compelled.
Example: A patient demands a copy of his record for a lawsuit. The entity provides access because individual access is required, regardless of the litigation purpose.
Mistake to avoid: Treating a payer or attorney routine request as a mandatory disclosure the Rule itself compels.
Reference: HHS Summary of the HIPAA Privacy Rule
15. Opportunity to agree or object
Informal permission suffices for facility directories and for sharing information directly relevant to involvement in care or payment with family, relatives, friends, or persons the individual identifies. When the patient is incapacitated, in an emergency, or simply unavailable, covered entities may generally act under professional judgment in the patient's best interest.
Example: An unconscious patient's spouse asks about her condition. Staff disclose relevant information using professional judgment, since informal agreement is impossible during the emergency.
Mistake to avoid: Refusing all family communication during emergencies instead of applying best-interest professional judgment.
Reference: HHS Summary of the HIPAA Privacy Rule
16. Incidental disclosures with safeguards
Incidental uses or disclosures that flow from an otherwise permitted activity are allowed when the entity has adopted reasonable safeguards and has limited the information shared to the minimum necessary. The Rule does not demand elimination of every conceivable risk, such as faintly overheard fragments in shared waiting spaces.
Example: A waiting-room caller faintly hears a receptionist confirm another patient's name. Because safeguards and minimum-necessary limits were in place, this is permissible, not reportable.
Mistake to avoid: Declaring any overheard conversation a violation without checking safeguards and minimum-necessary compliance.
Reference: HHS Summary of the HIPAA Privacy Rule
17. Public interest disclosures and their conditions
Twelve national-priority purposes permit disclosure without authorization, including required by law, public health, health oversight, judicial and administrative proceedings, law enforcement, decedents, organ donation, research, serious threats, essential government functions, and workers compensation. Each purpose carries its own conditions, so the auditor verifies the specific limits before release.
Example: A payer's fraud unit requests records under health oversight authority. The auditor confirms the unit qualifies as a health oversight agency before releasing without authorization.
Mistake to avoid: Releasing under one public-interest label when the request actually fits a different purpose with different conditions.
Reference: HHS Summary of the HIPAA Privacy Rule
18. Limited data sets and data use agreements
A limited data set removes direct identifiers of the individual and of relatives, employers, and household members but may retain dates and partial geographic detail. It may be used and disclosed for research, public health, or health care operations only when the recipient enters a data use agreement promising specified safeguards for the information.
Example: A researcher receives visit dates and five-digit zip codes under a signed agreement. The auditor approves this as a limited data set, not de-identified data needing no agreement.
Mistake to avoid: Confusing limited data sets with de-identified data and skipping the required data use agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
Authorizations and Individual Rights
19. When written authorization is required
Any use or disclosure outside treatment, payment, health care operations, or the Rule's permitted categories requires written authorization in plain language, specifying the information involved, persons disclosing and receiving, expiration, and revocation rights. Disclosures to life insurers for coverage, employer physical results, and pharmaceutical marketing are examples requiring authorization.
Example: An employer requests a pre-employment lab result. The clinic releases only after the applicant signs a compliant authorization, because this fits no permitted category.
Mistake to avoid: Sending records to employers or insurers on a verbal request without a valid written authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
20. Psychotherapy notes as a special class
Psychotherapy notes, meaning a mental health professional's separated documentation analyzing private counseling session contents, require authorization for most uses, including treatment by others, payment, and operations. Narrow exceptions include the originator's own treatment, the entity's training, legal defense against the individual, HHS oversight, and averting serious imminent threats.
Example: A payer requests psychotherapy notes to process a claim. The auditor denies release because payment purposes fall outside the exceptions, unlike the rest of the record.
Mistake to avoid: Treating psychotherapy notes like ordinary progress notes for payment disclosure purposes.
Reference: HHS Summary of the HIPAA Privacy Rule
21. Marketing rules and their carve-outs
Marketing means communications encouraging purchase or use of a product or service, and arrangements where the entity discloses protected health information for remuneration so another entity can promote its products also count. Carve-outs include describing the entity's own services, network provider listings, treatment communications, and care coordination, which need no authorization.
Example: A clinic mails refill-reminder letters about its own pharmacy services. This is a treatment-related carve-out, so no marketing authorization is needed.
Mistake to avoid: Demanding authorizations for appointment reminders or the entity's own service descriptions that the Rule exempts.
Reference: HHS Summary of the HIPAA Privacy Rule
22. Minimum necessary and its exceptions
Entities must make reasonable efforts to use, disclose, and request only the minimum protected health information needed for the intended purpose, and cannot send entire records unless the whole record is specifically justified. The standard does not apply to treatment disclosures, disclosures to the individual, authorized uses, HHS enforcement, or legally required disclosures.
Example: A billing vendor receives only encounter and claim data, not full charts. Because the request serves payment, minimum-necessary limits apply and justify the narrower release.
Mistake to avoid: Sending complete charts to payers or vendors when the stated purpose could be met with narrower data.
Reference: HHS Summary of the HIPAA Privacy Rule
23. Access rights and the designated record set
Individuals may review and obtain copies of protected health information in the designated record set, meaning records used to make decisions about them, including medical and billing records. Psychotherapy notes, information compiled for legal proceedings, and laboratory results where CLIA prohibits access are excepted from the right of access.
Example: A patient requests her complete billing file. The auditor confirms billing records sit within the designated record set, so access is granted with reasonable cost-based copying fees.
Mistake to avoid: Denying access to billing records by treating only the clinical chart as accessible.
Reference: HHS Summary of the HIPAA Privacy Rule
24. Accounting of disclosures and its exclusions
Individuals may obtain an accounting of disclosures covering up to the six years preceding the request, but disclosures for treatment, payment, or operations, to the individual, under authorization, of limited data sets, and for national security or correctional purposes are excluded from what must be accounted for.
Example: A patient's accounting lists only oversight and judicial disclosures from the period. Treatment-related releases to consulting providers are properly omitted under the exclusions.
Mistake to avoid: Logging routine treatment and payment disclosures in an accounting the Rule expressly excludes.
Reference: HHS Summary of the HIPAA Privacy Rule
Medical Record Standards and Documentation
25. Cloned documentation as an audit red flag
When reviewing records printed from an electronic health record, auditors watch for copying or cloning, where prior notes are duplicated forward into new encounters. Cloning undermines the credibility of each entry's specificity and can inflate billed levels, so auditors compare serial notes for identical text before crediting the documentation.
Example: Three consecutive visits contain identical examination paragraphs word for word. The auditor flags cloning risk and verifies whether each encounter's findings were genuinely reassessed.
Mistake to avoid: Accepting identical repeated examinations as independent support for each separately billed visit.
Reference: AAPC CPMA study guide sample
26. SOAP structure and the assessment element
SOAP is a common documentation format in which S is subjective, O is objective, A is assessment, and P is plan. The assessment reflects the provider's reasoning about the patient's condition, and auditors look there for diagnoses and the medical necessity that links findings to the plan chosen.
Example: A note lists symptoms and findings, but the assessment merely says to follow up. The auditor finds insufficient diagnostic reasoning to support the billed complexity.
Mistake to avoid: Treating a restated chief complaint as an assessment when no diagnostic conclusion is documented.
Reference: AAPC CPMA study guide sample
27. Authentication timing for reports
A physician or other practitioner authenticates a report after the document has been transcribed and reviewed, not before transcription or while it is being dictated. Auditors check that signatures or electronic verification follow the completed document, since earlier authentication cannot attest to the final content.
Example: An operative report bears a signature dated before the transcription date. The auditor cites defective authentication because the attestation precedes the finished document.
Mistake to avoid: Counting a pre-transcription signature as valid authentication of the final report content.
Reference: AAPC CPMA study guide sample
28. Informed consent versus administrative forms
Informed consent, signed by the patient, verifies understanding of the procedures, outcomes, and options of treatment. It differs from a release of information authorizing disclosure, an assignment of benefits directing payment, and acknowledgment of the privacy notice, each serving a distinct legal function in the record.
Example: A chart contains a release form but no informed consent before a procedure. The auditor records a missing consent, not a privacy-notice deficiency, because the forms differ.
Mistake to avoid: Treating a signed release of information or privacy acknowledgment as proof of informed consent.
Reference: AAPC CPMA study guide sample
29. Correcting delayed entries properly
Late entries and corrections must be made properly, identifying the date and author of the addition and giving an explanation for the delayed entry. Auditors distinguish legitimate addenda, which preserve the original entry intact, from improper alterations that overwrite or obscure what was first documented.
Example: A provider adds an addendum a week later, dated and explained. The auditor accepts it, but would fault the same change had it erased the original text.
Mistake to avoid: Accepting backdated or unexplained corrections that obscure the original documentation timeline.
Reference: AAPC CPMA study guide sample
30. Using CERT findings to target education
The CERT program identifies errors causing improper payments in the Medicare program, and those findings reveal where provider documentation needs improvement. Auditors use published error areas to select focused reviews and target provider education, rather than treating CERT as a provider-requested error-rate reporting service.
Example: Published error findings show documentation weaknesses in a service category the practice bills heavily. The auditor builds a focused review around that category and cites the error source.
Mistake to avoid: Waiting for a provider to request CERT error rates, which the program does not supply that way.
Reference: AAPC CPMA study guide sample
CPT Conventions and Payment Rules for Auditors
31. Add-on codes follow their primaries
Add-on codes, marked with a plus symbol, are never reported alone and always accompany specific primary procedures identified in parenthetical notes. When the list of associated primaries is too extensive, no parenthetical list appears, so the auditor confirms the primary relationship from the code family context instead.
Example: A claim reports an add-on navigation code with no qualifying primary bronchoscopy. The auditor flags the add-on as unbillable because it cannot stand alone.
Mistake to avoid: Allowing an add-on code reported without its required primary procedure on the claim.
Reference: AAPC CPMA study guide sample
32. Add-on exemption from multiple procedure reduction
Add-on codes are exempt from the multiple procedure concept, and their fee schedule amounts already account for any reduction, so payment is made at one hundred percent. Auditors verify the multiple procedure indicator for each line before applying or withholding a reduction on a claim.
Example: A bronchoscopy claim pairs a primary code with an add-on navigation code. The auditor confirms the add-on pays in full, with reduction applied only where indicators require it.
Mistake to avoid: Cutting an add-on code payment to fifty percent as though it were a second full procedure.
Reference: AAPC CPMA study guide sample
33. Matching code versions to dates of service
A bullet symbol to the left of a code marks new procedures and services added to the CPT book. When auditing, apply the codes that were valid on the date of service, not the audit date, so a review of prior-year claims must use the prior-year book and its conventions throughout.
Example: An audit conducted this year covers last October's services. The auditor codes from the earlier year's book because those codes governed the encounters.
Mistake to avoid: Recoding old claims with current-year codes that did not exist or differed on the service date.
Reference: AAPC CPMA study guide sample
34. Payer variation from CPT guidelines
Not all payers follow CPT coding guidelines, so an auditor must apply payer variations during the audit and communicate the differences in a way providers understand. Findings should establish which rule set controls, CPT or the payer's own policy, before any deviation is declared an error.
Example: A commercial payer bundles a service that CPT lists separately. The auditor reports the difference as payer policy, not a CPT violation, and documents both rules.
Mistake to avoid: Declaring provider error using CPT rules alone when the payer's controlling policy differs.
Reference: AAPC CPMA study guide sample
35. Multiple procedure payment reduction mechanics
When multiple procedures are performed during the same operative session, the highest valued code pays at one hundred percent, the second highest at fifty percent, and each additional procedure at twenty-five percent. Claims exceeding five line items may be evaluated by payers for special pricing.
Example: Three surgical codes from one session appear on a claim. The auditor confirms the payer applied full, half, and quarter payment in descending value order.
Mistake to avoid: Expecting equal or full payment for every procedure line within a multi-procedure session.
Reference: AAPC CPMA study guide sample
36. Reading MPFS relative value file indicators
The Medicare Physician Fee Schedule Relative Value File shows global days, multiple procedure status, bilateral and assist-surgery flags, and related data auditors use. A zero in the multiple procedure column means no reduction applies, a two means reduction applies, and global indicators like XXX signal no global package. Each line must be read individually because global status and reduction status are separate columns.
Example: A claim pairs 11730 Removal of nail plate with a higher-valued excision from the same session. The file shows 000 global days but a multiple procedure indicator of 2 for 11730, so no global package applies, yet the nail-plate line is subject to the multiple procedure reduction; the add-on 11732 on the same claim shows an indicator of 0, confirming the add-on escapes the reduction.
Mistake to avoid: Reading 000 global days as proof that no multiple procedure reduction applies, or withholding the reduction on a line whose indicator reads 2.
Reference: AAPC CPMA study guide sample
E/M and Anesthesia Service Auditing
37. Selecting office visit E/M levels
Office and other outpatient E/M codes are selected following AMA CPT guidelines, which base the level on medical decision making or on total time on the date of the encounter. The auditor reads the assessment, data reviewed, risk addressed, and any documented time to test whether the billed level holds.
Example: An established patient returns for hypertension follow-up. The note documents one stable blood-pressure reading, a renewal of the current medication, and no data review, testing, or risk discussion, and no time is recorded. The auditor supports only a straightforward level and downcodes the billed higher level that lacks documented complexity.
Mistake to avoid: Grading visits by documentation volume rather than decision making or documented time.
Reference: AAPC CPMA study guide sample
38. Calculating total anesthesia time
Anesthesia time runs from when the provider begins preparing the patient for anesthesia to when the provider ends care, which extends past the surgical stop time. Auditors sum preparation through post-operative attendance rather than merely counting from surgical start to surgical end.
Example: Preparation begins at 08:36, the surgical procedure ends at 09:40, and the anesthesia provider ends care at 10:02. Total anesthesia time is measured 08:36 to 10:02, eighty-six minutes, exceeding the surgical window alone.
Mistake to avoid: Computing anesthesia time from incision to closure, omitting preparation and emergence periods.
Reference: AAPC CPMA study guide sample
39. Physical status modifiers
Anesthesia claims carry a P modifier reflecting the patient's ASA physical status, such as P2 for mild systemic disease. The modifier is assigned from the documented status rather than assumed, so the auditor verifies the recorded ASA classification against the modifier actually billed before accepting the claim.
Example: A record documents ASA physical status 2 for a patient with mild controlled hypertension, but the claim carries no physical status modifier at all. The auditor corrects the claim to append P2, matching the modifier to the documented classification.
Mistake to avoid: Billing a physical status modifier from habit or a default instead of the ASA classification documented in the anesthesia record.
Reference: AAPC CPMA study guide sample
40. Personally performed versus medical direction
An anesthesiologist personally performing a case bills with the AA modifier, while medical direction of concurrent cases staffed by CRNAs is a different arrangement with its own requirements. The auditor reads who actually provided care and how many concurrent cases were directed before accepting the modifier billed.
Example: An anesthesiologist directs three concurrent cases with CRNAs. The auditor rejects personally-performed billing and applies medical direction rules because concurrency is documented.
Mistake to avoid: Accepting personally-performed modifiers on cases the anesthesiologist only medically directed.
Reference: AAPC CPMA study guide sample
41. The procedure drives the anesthesia code choice
The anesthesia code is determined by the surgical procedure performed, not by the anesthesia technique chosen or the preoperative diagnosis alone. Auditors locate the procedure in the record and map it to the correct anesthesia code family before evaluating time, physical status, and modifiers.
Example: A patient undergoes inguinal hernia repair under general anesthesia, with a preoperative diagnosis of an incidental lipoma. The auditor selects the anesthesia code from the hernia repair, the defining procedure, not from the general anesthesia technique or the preoperative diagnosis.
Mistake to avoid: Choosing anesthesia codes from the anesthesia type or preoperative diagnosis instead of the procedure.
Reference: AAPC CPMA study guide sample
42. Auditing anesthesia documentation elements
An anesthesia record should show the anesthesiologist identity, preoperative and postoperative diagnoses, the procedure, anesthesia type, start and stop times, physical status, and any additional procedures the anesthesiologist personally performed, such as arterial line placement, which may be separately reportable.
Example: For a shoulder arthroscopy under monitored anesthesia care, the record documents the anesthesiologist's identity, preoperative and postoperative diagnoses, the procedure, anesthesia type, start and stop times, and physical status, plus an arterial line the anesthesiologist personally placed in the right radial artery before induction. The auditor allows the arterial line as an additional reportable service alongside the anesthesia code.
Mistake to avoid: Overlooking separately reportable lines or services the anesthesiologist personally performed.
Reference: AAPC CPMA study guide sample
Physician Services, Teaching Rules, and Drug Administration
43. Teaching physician rules in audits
Teaching physician guidelines, written and enforced through CMS and historically framed by Physicians at Teaching Hospitals initiatives, define when a supervising physician's presence and documentation support billing for resident work. Auditors of teaching settings test the note against these rules before crediting the physician's claim.
Example: A note shows only a resident's evaluation with no attending participation documented. The auditor denies physician billing because teaching requirements were unmet.
Mistake to avoid: Allowing physician billing on resident-only documentation lacking any record of teaching participation.
Reference: AAPC CPMA study guide sample
44. Shared or split services
Shared or split services involve a physician and another qualified healthcare professional each performing a documented portion of a service, with specific rules determining who may bill and how the service is reported. The auditor identifies each contributor's documented share before deciding the proper billing party.
Example: A physician and a nurse practitioner each document substantive portions of one visit. The auditor applies split-service rules to determine which party may bill.
Mistake to avoid: Billing the entire service under the physician without examining each contributor's documented share.
Reference: AAPC CPMA study guide sample
45. Incident-to risk in physician claims
Submitting claims for physician services performed by a non-physician provider without regard to incident-to guidelines is an identified False Claims Act example. Auditors verify that supervision and billing designation match the rendering professional's qualifications and the payer's coverage rules before allowing physician-level billing.
Example: Aides perform a service billed under the physician with no required supervision documented. The auditor flags potential false-claims exposure and recommends claim correction.
Mistake to avoid: Assuming services performed by any staff member may be billed under the physician automatically.
Reference: AAPC CPMA study guide sample
46. One initial infusion code per encounter
When multiple infusions, injections, or combinations are administered, only one initial service code is reported unless protocol requires two separate IV sites. The initial code that best describes the key or primary reason for the encounter is reported, irrespective of the order in which the infusions were administered.
Example: Chemotherapy with supportive drugs runs through one site. The auditor allows a single initial code chosen by the encounter's primary purpose, not by sequence.
Mistake to avoid: Reporting multiple initial codes because several drugs were administered through one site.
Reference: AAPC CPMA study guide sample
47. Defining an IV push
An intravenous or intra-arterial push is an injection in which the healthcare professional administering the substance is continuously present to administer it and observe the patient, or an infusion of fifteen minutes or less. Duration and continuous presence, not the drug's identity, distinguish push from infusion coding.
Example: A drug runs over twelve minutes with the nurse continuously present. The auditor codes a push, because the time stays within the fifteen-minute boundary.
Mistake to avoid: Coding short administrations as infusions based on the drug rather than the time test.
Reference: AAPC CPMA study guide sample
48. Incidental hydration is not separately billed
The fluid used to administer drugs is considered incidental hydration and is not separately reported. Auditors remove saline or carrier-fluid lines from drug administration claims unless the hydration stands apart as its own medically distinct service with independent documentation supporting it.
Example: A chemotherapy note lists saline running with the drugs in one bag. The auditor deletes the hydration line as incidental to the administration.
Mistake to avoid: Reporting carrier fluids used to deliver drugs as a separate hydration service line.
Reference: AAPC CPMA study guide sample
The Audit Process: Scope, Sampling, and Selection
49. Setting the audit objective first
The audit objective states the high-level goals and anticipated accomplishments of the review, addressing the controls and risks associated with the activity examined. A clear objective, such as verifying a new provider's documentation and billing accuracy, anchors every later decision about scope, sample selection, and reporting.
Example: Management wants to know whether a newly hired provider bills accurately. The auditor writes that question as the objective before selecting any records.
Mistake to avoid: Beginning chart selection before a written objective defines what the audit must answer.
Reference: AAPC CPMA study guide sample
50. Defining scope, including exclusions
Scope sets the parameters used toward achieving the objective: which providers, payers, code types, settings, and dates of service are examined. The scope also defines what will not be part of the audit, which prevents outcomes from reflecting misleading information about areas never reviewed.
Example: A review covers Medicare E/M only. The auditor's report expressly excludes commercial claims so readers cannot infer broader compliance.
Mistake to avoid: Presenting findings without stating the payer, provider, and service boundaries that were excluded.
Reference: AAPC CPMA study guide sample
51. Prospective versus retrospective samples
Retrospective audit samples are drawn from reports generated within the billing system for claims already submitted, while prospective samples consist of claims being held pending audit findings. The auditor's selection method and timing differ, and findings feed either repayment analysis or pre-billing correction.
Example: A practice holds this week's claims before release. The auditor reviews them prospectively, so corrections occur before submission rather than through refunds.
Mistake to avoid: Applying retrospective repayment logic to prospective reviews of claims never yet billed.
Reference: AAPC CPMA study guide sample
52. Selection criteria for focused reviews
Beyond random selection, auditors can target a controlled category, a specific level or type of service, high-volume services, high-risk services, frequent denials, or past errors. The criterion chosen should trace back to the objective, so a denial-driven objective justifies a denial-focused sample.
Example: Denials cluster on one injection family. The auditor selects that family under the frequent-denial criterion, matching the sample to the stated objective.
Mistake to avoid: Choosing high-volume codes for convenience when the stated objective concerns denials or risk.
Reference: AAPC CPMA study guide sample
53. Sizing the record sample
Auditing too few records may distort results, while auditing too many is normally no more effective. The materials suggest roughly ten to fifteen charts per provider as a good selection size, note the OIG recommendation of five to ten random charts per physician for annual compliance audits, and stress management input on final counts.
Example: A two-provider review draws ten charts each, split between visit and procedure codes, so both categories inform the trend analysis.
Mistake to avoid: Auditing a handful of charts and presenting the results as a provider-wide compliance conclusion.
Reference: AAPC CPMA study guide sample
54. Bell curve analysis for E/M targeting
Comparing a provider's E/M level distribution against national percentages on a bell curve reveals outliers, such as heavy concentration in the highest new-patient codes. Auditors use that comparison to choose which code levels deserve chart review, concentrating effort where the deviation from expected patterns appears.
Example: A provider's new-patient visits skew heavily toward the top two levels versus national patterns. The auditor prioritizes those levels for detailed review.
Mistake to avoid: Reviewing all levels equally when the distribution comparison pinpoints specific outlier codes.
Reference: AAPC CPMA study guide sample
Risk Analysis, Validation, and Communication
55. Controlling versus persuasive standards
To justify an allegation of error, auditors are limited to the application of controlling standards, such as binding regulations, law, or contract provisions. Where no controlling standard exists for the service evaluated, they declare potential post-payment risk using persuasive standards, with appropriate citations and qualifications.
Example: No binding rule addresses a reporting method, but payer bulletins discourage it. The auditor reports risk with citations rather than calling it an error.
Mistake to avoid: Declaring error from a persuasive guideline that no binding rule incorporates.
Reference: AAPC CPMA study guide sample
56. Contract rules governing in-network providers
Most commercial plans are contract based, and in-network providers agree to abide by payer policies. The auditor reads the contract to learn whether nonconformance entitles the payer to recoup money, only threatens network termination, or allows corrective action, because those answers significantly change the finding's severity.
Example: A contract relieves the payer of financial liability for policy violations. The auditor treats documented nonconformance as recoupment-level error, not merely termination risk.
Mistake to avoid: Grading findings without first reading the provider's contract for the applicable sanction.
Reference: AAPC CPMA study guide sample
57. Validating rules before judging claims
The most important step in any compliance audit is validation of the rules particular to the services being audited and the payer billed, and this risk analysis belongs at the beginning. When an error is found, the specific reason must be identified with citations to the applicable policy provision or binding rule.
Example: Before reviewing charts, the auditor gathers the payer's policies for each billed code family. Findings then cite exact provisions rather than general assertions.
Mistake to avoid: Finishing chart review first and hunting for supporting rules afterward to justify conclusions.
Reference: AAPC CPMA study guide sample
58. Communicating findings with citations
Audit findings and recommendations must be supported by applicable, verifiable guidelines, clearly enumerated and explained for the provider. The auditor identifies the resources and tools used to conduct the audit, and where only persuasive standards support a risk statement, those standards are named explicitly.
Example: A report flags modifier misuse and quotes the specific payer policy section. The provider can verify the rule, which strengthens acceptance of the correction.
Mistake to avoid: Delivering conclusions without verifiable citations that let providers check the rule themselves.
Reference: AAPC CPMA study guide sample
59. Corrective action plans after findings
A corrective action plan converts audit findings into concrete remediation, such as retraining, documentation changes, or claim corrections. Where a payer offers a corrective-action opportunity before termination, the auditor's plan documents a good-faith response and reduces the risk of escalation beyond the practice's control.
Example: Repeated cloning caused level inflation. The corrective plan mandates templates without copy-forward and a sixty-day re-audit to verify the change.
Mistake to avoid: Closing an audit with findings only and no documented corrective steps or follow-up review.
Reference: AAPC CPMA study guide sample
60. Voluntary repayment versus self-disclosure
Voluntary repayment audits return identified overpayments to payers, while self-disclosure processes report potential fraud or larger issues to authorities. The auditor distinguishes routine overpayment refunding from matters warranting formal disclosure, because the pathway, timing, and exposure differ significantly between them.
Example: An audit finds systematic upcoding across a year. Because the pattern suggests more than simple overpayment, the auditor recommends evaluating self-disclosure rather than silent refunding.
Mistake to avoid: Treating a significant fraud-pattern finding as routine repayment and refunding without disclosure consideration.
Reference: AAPC CPMA study guide sample
References and further reading
Source links checked on Oct 2, 2026.