This guide organizes CPMA subject matter into ten sequenced sections, moving from the auditor's role and federal regulations through HIPAA, documentation, coding, and the full audit cycle. Each concept pairs a rule with a worked example and a common pitfall, so you practice decisions rather than memorize definitions. Use it alongside the official study materials: read a section, work the examples, and note where your reasoning diverges. Concepts cite the references they rest on, letting you verify every rule before relying on it in an audit or on exam day.
The Auditor's Role and the Business of Medicine
1. Why Practices Perform Medical Audits
Medical audits serve four core functions: reviewing quality of care, educating providers on documentation guidelines, confirming that services are supported and appropriate revenue is captured, and defending the practice against external audits, litigation, and payer denials. An auditor frames findings within these purposes.
Example: A clinic schedules quarterly self-audits after repeated payer denials; the auditor positions the review as both education and denial defense, not punishment.
Mistake to avoid: Treating audit results purely as a billing scorecard and ignoring quality-of-care and education objectives.
Reference: AAPC CPMA study guide sample
2. Supporting Findings With Verifiable Guidelines
Audit findings and recommendations must be supported by applicable, verifiable guidelines that are clearly enumerated and explained to the provider. Because healthcare regulations are not always definitive, the auditor distinguishes the precise requirements that apply in a particular circumstance before declaring any result.
Example: An auditor cites the specific payer policy section behind each E/M downgrade in the report so the provider can verify every conclusion.
Mistake to avoid: Issuing findings based on personal coding preference without citing an identifiable, verifiable rule.
Reference: AAPC CPMA study guide sample
3. Rules Vary by Payer, Geography, and Setting
Healthcare regulations vary by payer, geographic area, and care setting. The same service may be billed under different rules in a hospital outpatient department versus a physician office. Auditors confirm which setting and payer rules govern each claim before applying a standard.
Example: An office visit audited under facility assumptions is rechecked against physician-office rules once the auditor confirms the place of service.
Mistake to avoid: Applying one payer's policy or one setting's rules to every claim in a multi-payer, multi-site sample.
Reference: AAPC CPMA study guide sample
4. Distinguishing HMO and PPO Plan Structures
HMOs, authorized under the 1973 HMO Act, typically operate as prepaid plans with gatekeeping features, while PPOs negotiate predetermined fees within a network and give members more options: no primary care physician requirement and no referrals needed. Auditors recognize plan type when reviewing referral and authorization documentation.
Example: A claim denied for lacking a referral is reviewed for PPO membership; as a PPO patient, no referral was required, so the denial is challenged.
Mistake to avoid: Assuming every managed care plan requires a primary care physician gatekeeper or referral before specialty visits.
Reference: AAPC CPMA study guide sample
5. Medicare Part A Versus Part B Coverage
Medicare, enacted in 1965 under title XVIII of the Social Security Act, splits coverage into Part A for hospital stays and Part B for physician services. Citizens were automatically enrolled in Part A at 65 with optional Part B. Auditors match the billed service to the correct part.
Example: A surgeon's professional fee billed for an inpatient stay is confirmed as Part B physician services, distinct from the Part A hospital claim.
Mistake to avoid: Auditing physician professional charges as though they fall under Part A hospital coverage.
Reference: AAPC CPMA study guide sample
6. External Audit Pressure and the Self-Audit Rationale
Government enforcement of healthcare fraud is financially significant, and practices face recovery audit contractor reviews, private payer denials, and litigation risk. Because noncompliance risks are high, more physicians perform or plan regular self-audits to identify and correct problems before external entities find them.
Example: After a payer requests records for ten claims, a practice launches a proactive self-audit of the same service category to fix issues first.
Mistake to avoid: Waiting for a RAC or payer audit notice before examining documentation and billing patterns.
Reference: AAPC CPMA study guide sample
Federal Regulations: OIG, CMS, Fraud, and Abuse
7. Fraud Versus Abuse in Federal Programs
CMS defines abuse as actions creating unnecessary costs to federal healthcare programs, such as misusing codes on a claim, charging excessively, or billing for medically unnecessary services. Fraud involves intentional misrepresentation, like falsifying chart notations, upcoding, unbundling, or altering claims for higher payment.
Example: A coder repeatedly upcodes visits to raise payment; the auditor classifies this as suspected fraud, not mere abuse, and escalates it.
Mistake to avoid: Labeling deliberate upcoding or claim alteration as simple abuse and handling it only with education.
Reference: AAPC CPMA study guide sample
8. False Claims Act Exposure in Healthcare
Relative to healthcare, False Claims Act violations include falsifying medical chart notations, submitting claims for services not performed, not requested, or unnecessary, billing for expired drugs, upcoding, unbundling, and billing physician services performed by non-physician providers without regard to incident-to guidelines.
Example: A practice bills a physician code for services a non-physician provider rendered without meeting incident-to rules; the auditor flags False Claims Act exposure.
Mistake to avoid: Treating NPP-billed physician services as a minor coding slip rather than potential False Claims Act exposure.
Reference: AAPC CPMA study guide sample
9. Civil Monetary Penalties and Proper Claims Filing
The Civil Monetary Penalty Law and the False Claims Act both relate to proper claims filing. Mere mistakes that can be remedied by returning overpayments generally do not violate these laws, distinguishing innocent error from knowing misconduct when an auditor characterizes findings.
Example: An isolated clerical overpayment is identified as a remediable mistake; the auditor recommends returning the funds rather than declaring a violation.
Mistake to avoid: Declaring a law violation for an honest, promptly corrected billing mistake without evidence of knowing misconduct.
Reference: AAPC CPMA study guide sample
10. Reasonable and Necessary Standard for Medicare Payment
Physicians may order any tests they believe appropriate, including screening tests, but Medicare pays only for services meeting its definition of reasonable and necessary to diagnose or treat a patient's medical condition. Auditors check that documentation supports this standard for each billed service.
Example: A screening panel is ordered without any documented indication; the auditor flags it because Medicare payment requires the reasonable and necessary standard.
Mistake to avoid: Assuming that any test a physician orders automatically qualifies for Medicare payment regardless of documented necessity.
Reference: AAPC CPMA study guide sample
11. OIG Oversight and the Teaching-Hospital Context
The Office of Inspector General oversees fraud and abuse in federal healthcare programs, while Physicians at Teaching Hospitals (PATH) guidelines, written and enforced by CMS, govern teaching settings. An audit of a teaching-hospital provider may be scoped to government payers specifically because of PATH rules.
Example: A new teaching-hospital attending's audit is limited to Medicare and Medicaid claims because the PATH guidelines drive the stated review objective and scope.
Mistake to avoid: Auditing teaching-physician claims under generic private-payer assumptions instead of the CMS-enforced PATH rules.
Reference: AAPC CPMA study guide sample
12. Using CERT Data to Focus Audits
The CERT program identifies errors causing improper payments in the Medicare program. Auditors use published CERT findings to spot error-prone service areas and target provider education and documentation improvement, making it a practical source for choosing audit focus.
Example: CERT data show high improper-payment rates for a service type; the auditor builds a focused review and education plan around that category.
Mistake to avoid: Ignoring publicly available improper-payment error data when deciding which services to audit.
Reference: AAPC CPMA study guide sample
HIPAA Privacy Rule Foundations
13. Who Is a Covered Entity Under HIPAA
The Privacy Rule applies to three covered entity types: health plans, health care clearinghouses, and any health care provider that transmits health information electronically in connection with standard HIPAA transactions, such as claims, eligibility inquiries, or referral authorization requests.
Example: Even a small solo physician office that submits electronic standard claims qualifies as a fully covered entity under the Privacy Rule.
Mistake to avoid: Assuming small practices or solo physicians escape Privacy Rule coverage because of their size.
Reference: HHS Summary of the HIPAA Privacy Rule
14. The Electronic Transaction Trigger for Provider Coverage
Using electronic technology like email alone does not make a provider a covered entity; the transmission must connect to a standard transaction, whether sent directly or through a billing service acting on the provider's behalf. Auditors confirm this trigger when assessing privacy obligations.
Example: A paper-based practice uses email only for scheduling and files no electronic claims; it falls outside the standard-transaction coverage trigger.
Mistake to avoid: Treating any email use as proof a provider is a HIPAA covered entity.
Reference: HHS Summary of the HIPAA Privacy Rule
15. Business Associates and Required Contracts
A business associate is a non-workforce person or organization performing functions for a covered entity involving protected health information, such as claims processing, billing, utilization review, or data analysis. A written agreement must impose safeguards, and a covered entity cannot authorize any use the Rule forbids.
Example: A billing company that handles the practice's electronic claims must sign a business associate agreement before receiving any identifiable patient records.
Mistake to avoid: Allowing a contractor access to identifiable records without a signed business associate agreement in place.
Reference: HHS Summary of the HIPAA Privacy Rule
16. Protected Health Information in Any Medium
Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate in any form: electronic, paper, or oral. It includes demographic data relating to health, care provision, or payment that identifies the individual or reasonably could.
Example: A receptionist discussing a patient's diagnosis aloud at the front desk involves oral PHI and the same privacy protections as records.
Mistake to avoid: Limiting privacy protections to electronic records and overlooking oral and paper PHI disclosures.
Reference: HHS Summary of the HIPAA Privacy Rule
17. De-Identifying Health Information
De-identified information faces no use or disclosure restrictions. De-identification occurs either through a formal determination by a qualified statistician or by removing specified identifiers of the individual and relatives, household members, and employers, which works only if the entity has no actual knowledge the remainder could identify someone.
Example: A practice strips names, dates, and geographic detail from a dataset for a quality study; with no re-identification knowledge, the data is unrestricted.
Mistake to avoid: Deleting only the patient name and assuming the record is de-identified under the safe harbor.
Reference: HHS Summary of the HIPAA Privacy Rule
18. Limited Data Sets Versus De-Identification
A limited data set is protected health information with specified direct identifiers removed, and it may be used only for research, health care operations, or public health, under a data use agreement promising safeguards. Unlike de-identified data, it remains PHI and is not unrestricted.
Example: A researcher receives visit dates under a signed data use agreement; because it remains a limited data set, privacy safeguards still apply.
Mistake to avoid: Treating a limited data set as fully de-identified and sharing it without a data use agreement.
Reference: HHS Summary of the HIPAA Privacy Rule
HIPAA Uses, Disclosures, and Individual Rights
19. Treatment, Payment, and Operations Uses
A covered entity may use and disclose PHI without authorization for its own treatment, payment, and health care operations, and may disclose for another provider's treatment, another entity's payment, and certain operations like quality assurance and fraud detection, when both entities have a relationship with the individual.
Example: A practice sends records to a consultant conducting a coding audit; this is a permitted health care operations use without patient authorization.
Mistake to avoid: Demanding patient authorization for routine internal audit activity that qualifies as health care operations.
Reference: HHS Summary of the HIPAA Privacy Rule
20. The Minimum Necessary Standard and Its Exceptions
Covered entities must make reasonable efforts to use, disclose, and request only the minimum PHI needed for the purpose, and may not send an entire medical record unless specifically justified. The standard does not apply to treatment disclosures, disclosures to the individual, authorized uses, or HHS enforcement.
Example: A payer requests one visit note to adjudicate a claim; sending the whole chart violates minimum necessary unless the full record is justified.
Mistake to avoid: Releasing the entire record routinely when only a specific encounter supports the request's purpose.
Reference: HHS Summary of the HIPAA Privacy Rule
21. When Written Authorization Is Required
Written authorization is required for uses and disclosures outside treatment, payment, operations, and other permitted categories, such as disclosures to life insurers, employers for pre-employment physicals, or pharmaceutical firms for marketing. Authorizations must be plain language, specify information and recipients, include expiration, and state revocation rights.
Example: A practice releases physical exam results to a life insurer only after the patient signs a written authorization meeting content requirements.
Mistake to avoid: Sending records to an employer or insurer for non-covered purposes without a valid written authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
22. Special Handling of Psychotherapy Notes
Psychotherapy notes, separated from the rest of the record and excluding medication monitoring, session times, and clinical summaries, require authorization for most uses, including treatment, payment, and operations. Narrow exceptions include the originator's own treatment use, training, legal defense, and HHS compliance investigations.
Example: A payer requests psychotherapy notes for payment review; the practice refuses absent authorization because payment review is not an allowed exception.
Mistake to avoid: Releasing psychotherapy notes for routine payment purposes without the individual's signed authorization.
Reference: HHS Summary of the HIPAA Privacy Rule
23. Individual Rights of Access, Amendment, and Accounting
Individuals may review and obtain copies of PHI in the designated record set, request amendment of inaccurate information, and receive an accounting of disclosures covering up to the prior six years. Accounting excludes treatment, payment, operations, and authorized disclosures, among other exceptions.
Example: A patient requests an accounting of disclosures; the practice lists only those outside treatment, payment, and operations for the covered period.
Mistake to avoid: Including routine treatment and payment disclosures in the accounting of disclosures given to a patient.
Reference: HHS Summary of the HIPAA Privacy Rule
24. Notice of Privacy Practices Distribution
Direct treatment providers must deliver the notice at first service encounter, post it prominently at each site, and make good faith efforts to obtain written acknowledgement, documenting any failure. Health plans must distribute to enrollees and remind them at least every three years of availability.
Example: At a new patient's first visit the practice delivers the notice and obtains a signed acknowledgement, documenting the reason when the signature is missed.
Mistake to avoid: Skipping documentation of the reason when a patient does not sign the acknowledgement.
Reference: HHS Summary of the HIPAA Privacy Rule
Medical Record Standards and Documentation
25. SOAP Format and the Assessment Element
SOAP is a common medical record documentation format in which the A represents Assessment, the provider's synthesis of the patient's condition, distinct from the Objective findings and the Plan. Auditors use the assessment to verify that billed diagnoses are actually documented.
Example: A note lists symptoms under Objective but never states an assessment; the auditor finds the billed diagnosis undocumented and flags the claim.
Mistake to avoid: Accepting a billed diagnosis when the note documents findings but never states an assessment.
Reference: AAPC CPMA study guide sample
26. Informed Consent Versus Other Patient Forms
Informed consent is the form signed by the patient verifying understanding of procedures, outcomes, and options of treatment. It differs from assignment of benefits, release of information, and confirmation of receipt of the privacy notice, each of which serves a separate administrative purpose.
Example: Before an elective procedure, the auditor checks for a valid signed informed consent rather than merely a release of information form.
Mistake to avoid: Treating a release of information or privacy acknowledgement as proof of informed consent for a procedure.
Reference: AAPC CPMA study guide sample
27. EHR Copying and Cloning Risk
When reviewing records printed from an electronic health record, the key EHR-specific risk is copying or cloning, where prior notes are duplicated forward. Auditors examine whether each entry reflects the current encounter rather than replicated text that may no longer be accurate.
Example: Identical examination paragraphs appear across six consecutive visits; the auditor flags cloned documentation and questions whether current findings were assessed.
Mistake to avoid: Accepting identical repeated note text as evidence the service was actually performed as documented.
Reference: AAPC CPMA study guide sample
28. Authentication Timing for Reports
Authentication of a report by a physician or other practitioner takes place after the document has been transcribed and reviewed, not at dictation or before transcription. Auditors verify signatures and credentials on every audited document as part of record completeness.
Example: An operative report is signed before transcription was even complete; the auditor notes that valid authentication follows transcription and the physician's review.
Mistake to avoid: Counting an unsigned or pre-transcription signature as valid authentication of a transcribed report.
Reference: AAPC CPMA study guide sample
29. Correcting and Explaining Delayed Entries
Records must show corrections properly made, and delayed entries require an explanation. Late documentation should identify when it was added and why, preserving the record's integrity so auditors can distinguish contemporaneous care documentation from after-the-fact additions.
Example: An addendum added a week after a visit includes the addition date and reason; without that explanation the auditor would flag the entry.
Mistake to avoid: Accepting undated and unexplained late additions to the chart as though they were contemporaneous documentation.
Reference: AAPC CPMA study guide sample
30. Accreditation and Survey Exemptions
Providers and suppliers approved by a national accreditation organization may be exempt from routine state survey agency surveys determining compliance with Medicare conditions. This exemption does not extend to OIG investigations or audits generally, so accredited status does not eliminate audit exposure.
Example: An accredited clinic skips routine state Medicare surveys but still participates in a payer audit; accreditation exempts only the survey requirement.
Mistake to avoid: Assuming national accreditation shields a provider from OIG investigations or routine claims audits.
Reference: AAPC CPMA study guide sample
CPT Coding Conventions for Auditors
31. Reading CPT Conventions and Symbols
The CPT code book contains instructions, coding guidelines, parenthetical notes, and symbols guiding proper coding. A bullet to the left of a code marks a new procedure or service. Auditors use these conventions to test whether reported codes follow the book's own rules.
Example: A claim uses a code ignoring a parenthetical note prohibiting combination with another billed code; the auditor cites the note in findings.
Mistake to avoid: Coding from code descriptors alone without checking notes and symbols on the surrounding pages.
Reference: AAPC CPMA study guide sample
32. Add-On Code Rules
Add-on codes, marked with a plus, describe procedures carried out in addition to a primary procedure, are never reported alone, and always accompany specific primary codes listed in a parenthetical note. When the list is too extensive, no parenthetical list appears.
Example: A bronchoscopy navigation add-on is billed together with its listed primary bronchoscopy code; reporting the add-on alone would be an error.
Mistake to avoid: Reporting an add-on code on a claim without any qualifying primary procedure code.
Reference: AAPC CPMA study guide sample
33. Multiple Procedure Reduction and the MPFS Indicator
Under the multiple procedure concept, the highest valued code pays 100 percent, the second highest 50 percent, and additional procedures 25 percent. The MPFS Relative Value File shows a 0 in the multiple procedure column when a code is exempt and a 2 when the reduction applies.
Example: An add-on code with a multiple procedure indicator of 0 is paid at full value alongside the primary code; a 50 percent reduction underpays.
Mistake to avoid: Reducing payment for a code whose multiple procedure indicator is 0, such as an exempt add-on.
Reference: AAPC CPMA study guide sample
34. Matching the Code Edition to the Date of Service
When auditing, use the codes valid on the date of service, not the audit date. An audit performed in one year for prior-year dates of service must apply the prior year's code set, including codes since revised or deleted.
Example: A March audit of prior-year October claims uses the prior-year edition; a code deleted since then was still valid at service time.
Mistake to avoid: Auditing historical claims with the current year's code book and flagging valid old codes as errors.
Reference: AAPC CPMA study guide sample
35. Payer Policy Versus CPT Guidelines
Not all payers follow CPT coding guidelines. An auditor must apply payer variations to CPT rules during an audit and communicate the differences in a way that makes sense to the provider, distinguishing the code book's rules from each payer's published policy.
Example: A payer bundles a service that CPT allows separately; the auditor reports this as a payer-policy variance rather than a CPT coding error.
Mistake to avoid: Declaring a CPT violation when the finding actually stems from a payer-specific policy variation.
Reference: AAPC CPMA study guide sample
36. Applying NCCI Edits in Audits
NCCI edits pair column 1 and column 2 codes; when both are billed, the column 2 code is typically not separately payable because it is inclusive. Modifier 59 may override an edit when documentation supports a distinct service, whereas modifier 51 addresses multiple procedures, not edit overrides.
Example: A biopsy billed with a repair hits an NCCI edit; the auditor checks whether documentation supports a distinct service before allowing modifier 59.
Mistake to avoid: Automatically appending modifier 59 to bypass an edit without documentation of a distinct procedural service.
Reference: AAPC CPMA study guide sample
Auditing Special Services: Anesthesia and Drug Administration
37. Anesthesia Coding Elements
Anesthesia coding combines a base code selected by the surgical procedure, units from start and stop times, a physical status modifier reflecting patient severity, and a qualifying modifier showing who performed the service. The procedure performed, not the surgeon's list alone, determines the anesthesia code.
Example: For a transurethral prostate resection under general anesthesia with ASA status 2, the auditor confirms the base code, P2 modifier, and time units.
Mistake to avoid: Selecting the anesthesia base code from the surgeon's postoperative diagnosis instead of the procedure performed.
Reference: AAPC CPMA study guide sample
38. Calculating Total Anesthesia Time
Total anesthesia time runs from when the anesthesia provider begins preparing the patient for anesthesia until care ends after the procedure, not merely the surgical start-to-stop interval. Auditors sum prep time through release to verify billed time units.
Example: The anesthesia provider prepares the patient at 12:18 and ends care at 13:31; total time is 73 minutes, not just the surgical interval.
Mistake to avoid: Counting only the intraoperative interval, omitting preparation and post-care minutes that count toward anesthesia time.
Reference: AAPC CPMA study guide sample
39. Personally Performed Versus Medically Directed Anesthesia
Anesthesia claims carry a modifier showing the provider's role: personally performed when the anesthesiologist alone delivers care, versus medical direction when the anesthesiologist supervises CRNAs in concurrent cases. The auditor matches documentation of who provided care to the modifier billed.
Example: An anesthesiologist medically directing three concurrent cases with CRNAs is audited for medical direction modifiers, not a personally performed modifier.
Mistake to avoid: Accepting a personally performed modifier when the record shows concurrent cases with CRNAs under medical direction.
Reference: AAPC CPMA study guide sample
40. Hierarchy of Infusion and Injection Coding
When multiple infusions, injections, or combinations are administered, only one initial service code is reported unless protocol requires two separate IV sites. The initial code chosen is the one that best describes the key or primary reason for the encounter, regardless of administration order.
Example: A chemotherapy encounter with several drugs reports one initial code matching the primary treatment reason, plus sequential and push codes as documented.
Mistake to avoid: Reporting multiple initial codes because several drugs were given through one IV site.
Reference: AAPC CPMA study guide sample
41. Defining an IV Push
An intravenous or intra-arterial push is an injection in which the administering healthcare professional is continuously present to administer the substance and observe the patient, or an infusion of fifteen minutes or less. This definition separates push codes from timed infusion codes.
Example: A drug infused over ten minutes with the nurse continuously present qualifies as a push, coded from the push definition rather than infusion time rules.
Mistake to avoid: Coding a brief fifteen-minute-or-less infusion as a timed infusion instead of a push.
Reference: AAPC CPMA study guide sample
42. Incidental Hydration and Wasted Drug Documentation
Fluid used to administer drugs is considered incidental hydration and is not separately reported. Chemotherapy documentation must show ordered versus administered amounts, and wasted drug amounts are noted in the record, supporting accurate administration coding and waste accountability.
Example: The saline running with chemotherapy is not billed separately; the auditor also verifies the waste notation for the partially discarded drug.
Mistake to avoid: Billing hydration separately when the fluid only served to deliver the drug, or ignoring documented waste.
Reference: AAPC CPMA study guide sample
E/M, Teaching Physicians, and Medical Necessity
43. Leveling Office and Other Outpatient E/M Services
Office and other outpatient E/M levels are determined under AMA CPT guidelines, based on documented elements appropriate to the encounter rather than habit. Auditors re-level each visit from the note itself and compare the result to the level billed.
Example: A follow-up fracture check with stable findings and straightforward decision making is re-leveled from documentation, and the billed level is adjusted to match.
Mistake to avoid: Confirming the billed E/M level without independently re-leveling the visit from its documented elements.
Reference: AAPC CPMA study guide sample
44. Time-Based E/M Selection
When time controls the E/M level, the auditor totals the qualifying time documented for the encounter on the date of service. The level corresponds to the documented total, and rounding up from undocumented or non-qualifying time inflates the claim.
Example: A visit documents 73 total qualifying minutes; the auditor selects the level whose time range includes 73 minutes, not the next higher bracket.
Mistake to avoid: Selecting a higher E/M level by estimating time never documented in the record.
Reference: AAPC CPMA study guide sample
45. Teaching Physician Documentation Requirements
Teaching physician and PATH guidelines determine when a supervising physician's own documentation supports billing physician services performed with resident involvement. The auditor verifies that the teaching physician's presence and participation are documented for the billed service rather than relying on the resident's note alone.
Example: A resident's note lacks any teaching physician attestation of presence or participation, so the auditor questions physician-level billing for that encounter.
Mistake to avoid: Allowing physician-level billing on resident documentation with no teaching physician participation statement.
Reference: AAPC CPMA study guide sample
46. Shared or Split Services
Shared or split services involve a physician and another qualified health professional jointly furnishing a service, with billing dependent on which practitioner performs the substantive portion and how the payer defines split policy. Auditors apply the specific payer's split rules to the documentation.
Example: A visit where a nurse practitioner and physician each document portions is audited under the payer's shared-visit rule to determine the correct billing provider.
Mistake to avoid: Billing shared visits without checking the payer's definition of the substantive portion requirement.
Reference: AAPC CPMA study guide sample
47. Medical Necessity Links Diagnosis to Service
Medical necessity requires the documented diagnosis or clinical indication to justify the service billed. Insurers pay only when documentation demonstrates the indication; a correctly coded service without a supporting documented diagnosis still fails necessity review and may be denied.
Example: A high-level visit is billed for a routine follow-up with no complicating documented indication; the auditor downgrades it on necessity grounds.
Mistake to avoid: Validating code selection while ignoring whether the documented diagnosis supports the service's necessity.
Reference: AAPC CPMA study guide sample
48. Global Surgical Indicators in the MPFS
The MPFS Relative Value File lists global days for each procedure, with XXX meaning the global surgical concept does not apply and ZZZ marking an add-on code tied to another procedure's global period. Auditors use these indicators to test global-period billing decisions.
Example: A code with XXX global days is confirmed as outside the global package, so a same-day E/M may be evaluated on its own merits.
Mistake to avoid: Assuming every surgical-looking code carries a global package without checking its global days indicator.
Reference: AAPC CPMA study guide sample
The Audit Process: Scope, Sampling, and Statistics
49. Defining Audit Objectives and Scope
Audit objectives are the high-level goals addressing controls and risks of the activity reviewed, while scope defines the parameters used to achieve them, including which activities and period of records are examined. Both must be stated clearly before selection begins.
Example: An audit's objective is verifying a new provider's billing accuracy; its scope lists that provider, the payers, dates, and code types included.
Mistake to avoid: Starting chart selection before writing a clear audit objective and a defined, documented scope.
Reference: AAPC CPMA study guide sample
50. Stating What the Audit Excludes
The scope also defines what will not be part of the audit, which prevents outcomes from reflecting misleading information. Explicit exclusions, such as omitting self-pay patients or surgical claims, keep findings interpretable, defensible, and correctly limited to the population actually reviewed.
Example: A scope excludes self-pay encounters; the auditor notes this exclusion in the report so results are not read as covering all patients.
Mistake to avoid: Leaving exclusions unstated, inviting readers to generalize findings beyond the population actually audited.
Reference: AAPC CPMA study guide sample
51. Prospective, Retrospective, and Focused Reviews
Prospective audits review claims being held pending findings, retrospective audits review billed claims from system reports, and focused reviews target a specific issue. Each type supports different selection criteria and timing, and the auditor matches the review type to the objective.
Example: Claims held before submission are audited prospectively, letting the practice correct errors before billing rather than refunding money after payment.
Mistake to avoid: Running a retrospective review when the goal was preventing problem claims from going out the door.
Reference: AAPC CPMA study guide sample
52. Selection Criteria for Audit Samples
Selection options include random selection of any service, controlled selection of a specific level or type of service, high-volume services, high-risk services, frequent denials, and past errors. The criterion chosen should connect directly to the audit objective and the risk being explored.
Example: A practice with repeated denials for one particular service uses the frequent-denials selection criterion to target that specific service category in the sample.
Mistake to avoid: Choosing charts by convenience rather than a criterion tied to the stated objective.
Reference: AAPC CPMA study guide sample
53. Determining How Many Records to Audit
A representative selection balances size against usefulness: too few records may distort results, while too many add little effectiveness. A commonly used guide is 10-15 charts per provider, and the OIG recommends five to ten random charts per physician for annual compliance audits.
Example: A selection of ten charts per provider, concentrated within one quarter, lets the auditor observe documentation trends without over-reviewing the practice.
Mistake to avoid: Auditing a handful of scattered charts and treating the results as a reliable practice-wide pattern.
Reference: AAPC CPMA study guide sample
54. Statistical Tools and Benchmark Graphs
RAT-STATS is the statistical tool used by the OIG's Office of Audit Services and available to providers for valid sampling. Bell-curve comparisons of a provider's E/M distribution against national percentages reveal which levels deviate and merit audit attention.
Example: A provider's curve spikes at one mid-level code far above the national percentage; the auditor prioritizes that level in the sample.
Mistake to avoid: Drawing conclusions from a sample selected without a valid statistical method or comparison benchmark.
Reference: AAPC CPMA study guide sample
Risk Analysis, Validation, and Corrective Action
55. Controlling Versus Persuasive Standards
To justify an allegation of error, auditors are limited to controlling standards. Where no controlling standard exists for the service evaluated, they must not declare error but instead use persuasive standards, with citations and qualifications, to identify potential post-payment risk.
Example: No binding rule addresses a reporting method, so the auditor reports potential post-payment risk with persuasive citations instead of declaring an error.
Mistake to avoid: Declaring an error based only on persuasive guidance in an area with no controlling standard.
Reference: AAPC CPMA study guide sample
56. Validating Rules Before Declaring Findings
Validation of the rules particular to the audited services and payer is the most important step in any compliance audit and should occur at the beginning. Each error or non-conformance must be identified with citations to the applicable policy provision or binding rule.
Example: Before finalizing a code downgrade, the auditor retrieves and cites the exact payer policy provision that supports the conclusion in writing.
Mistake to avoid: Finalizing audit results first and only afterward searching for rule citations that support conclusions already reached.
Reference: AAPC CPMA study guide sample
57. Contract-Based Commercial Plan Obligations
Most commercial plans are contract based: in-network providers agree to abide by payer policies through separate contracts. The auditor must review the contract to determine the binding rules, including whether non-conformance permits recoupment or only network termination, and whether corrective action is offered.
Example: A contract requires compliance with published clinical policies with notice of material changes; the auditor checks whether the provider accepted a change before declaring non-conformance.
Mistake to avoid: Auditing commercial claims without reading the provider-payer contract that defines which policies actually bind.
Reference: AAPC CPMA study guide sample
58. Communicating Findings and Risk
Discussing audit results with the provider lets the auditor provide a risk analysis, identify specific risks, and recommend corrective action with supporting documentation. Where policies are ambiguous, the auditor addresses the likelihood the payer will deem codes erroneous and recommends alternative reporting methods.
Example: For an ambiguous modifier issue, the auditor presents the payer's likely position, the supporting reasoning, and a clearly safer alternative reporting method.
Mistake to avoid: Delivering findings with no citations, no risk context, and no recommended corrective path for the provider.
Reference: AAPC CPMA study guide sample
59. Voluntary Repayment Versus Self-Disclosure
When an audit reveals overpayments, practices may use voluntary repayment to return funds identified through their own review, while self-disclosure processes address broader matters, including potential fraud exposure. The auditor's role is quantifying and documenting findings that support the appropriate path chosen.
Example: A routine self-audit uncovers systematic overpayment across a year of claims; leadership evaluates whether simple repayment suffices or formal self-disclosure is warranted.
Mistake to avoid: Treating every overpayment as routine repayment without evaluating whether disclosure obligations are triggered.
Reference: AAPC CPMA study guide sample
60. Corrective Action Plans After Audit Findings
A corrective action plan translates audit findings into concrete steps: provider education, documentation changes, billing corrections, and follow-up review to confirm improvement. The plan should reference the specific findings it addresses and assign responsibility, timelines, and measurable success criteria.
Example: After repeated cloning findings, the corrective plan mandates EHR template changes, targeted provider education, and a scheduled re-audit the following quarter.
Mistake to avoid: Closing an audit with findings only and no documented corrective plan or scheduled follow-up.
Reference: AAPC CPMA study guide sample
References and further reading
Source links checked on Oct 2, 2026.