Coding compliance isn't a one-time project, it's an ongoing process that has to keep pace with annual regulatory updates, payer policy changes, and evolving documentation standards. With CMS guidelines for 2026 introducing refinements to Evaluation and Management (E/M) documentation expectations, updated ICD-10-CM code sets, and continued scrutiny on telehealth billing, practices that haven't reviewed their internal audit process recently are likely due for one.
A structured coding audit checklist gives practices a repeatable way to catch problems before they become compliance risks or revenue losses. Below is a practical framework for running an internal medical coding audit aligned with 2026 CMS expectations.
Why Regular Coding Audits Matter
Coding audits serve two purposes at once. First, they catch errors that lead to claim denials or underpayments, protecting revenue. Second, they identify patterns that could expose a practice to compliance risk, such as consistent upcoding, insufficient documentation, or billing for services that don't meet medical necessity criteria. CMS and other payers conduct their own audits, and practices that haven't self-audited are more likely to be caught off guard when an external review happens.
Running audits internally on a regular schedule, rather than only in response to a payer inquiry, puts practices in a proactive rather than reactive position.
Step 1: Define the Scope of the Audit
Before pulling charts, decide what the audit will cover. A focused audit is more useful than a vague, sweeping one. Common scope options include:
- Provider-specific audits: Reviewing a sample of claims from a single provider, useful when a provider is new, has had past documentation issues, or bills at unusually high levels for a given code.
- Code-specific audits: Focusing on high-risk or frequently billed codes, such as E/M levels 4 and 5, or codes with known payer scrutiny.
- Payer-specific audits: Reviewing claims submitted to a particular payer, especially useful if that payer has recently updated its local coverage determinations.
- Random sample audits: Pulling a randomized set of claims across providers and codes to get a general compliance snapshot.
Most practices benefit from rotating through these approaches throughout the year rather than relying on just one method.
Step 2: Verify Documentation Supports the Codes Billed
This is the core of any coding audit. For each claim reviewed, the documentation should be checked against the codes submitted, not the other way around. Key questions to ask:
- Does the clinical note support the E/M level billed, based on the current CMS documentation guidelines (medical decision making or time-based criteria)?
- Is the diagnosis code specific enough to reflect the condition documented, including laterality, severity, and episode of care where applicable?
- Are all procedure codes clearly supported by a documented service, with no assumptions filled in by the coder?
- Is there a signed and dated note for every billed encounter?
For 2026, CMS continues to emphasize medical decision making as a primary basis for E/M leveling, so audits should specifically confirm that MDM documentation, such as the number and complexity of problems addressed, data reviewed, and risk of complications, is clearly captured rather than implied.
Step 3: Check Modifier Usage
Modifiers are a frequent source of both denials and compliance risk when misused. An audit checklist should specifically review:
- Whether modifier 25 is used only when a significant, separately identifiable E/M service was performed alongside a procedure on the same day.
- Whether modifier 59 (or its more specific X-modifiers) is applied correctly to indicate distinct procedural services, rather than as a workaround to bypass bundling edits.
- Whether laterality modifiers (LT, RT) and other anatomical modifiers match what's documented in the note.
Step 4: Review Coding for Telehealth and Remote Services
Telehealth billing rules have continued to evolve since the pandemic-era flexibilities, and CMS updates its telehealth coverage list annually. A 2026-aligned audit should confirm:
- That place-of-service codes and modifiers (such as modifier 95 or POS 02/10) correctly reflect where the patient and provider were located during the encounter.
- That services billed as telehealth are actually on CMS's current approved telehealth services list for that year.
- That documentation reflects real-time, interactive communication where required, rather than asynchronous contact billed as a live visit.
Step 5: Cross-Check Against NCCI Edits and LCDs
The National Correct Coding Initiative (NCCI) publishes quarterly updates to its procedure-to-procedure and medically unlikely edits. An audit should sample claims against the current NCCI edit tables to catch any unbundling issues. Similarly, for Medicare claims, checking against the relevant Local Coverage Determination (LCD) for the region ensures that diagnosis codes billed actually meet the payer's coverage criteria for that service.
Step 6: Assess Coder Training and Update History
Part of a compliance audit isn't just reviewing claims, it's reviewing the people and processes behind them. This includes:
- Confirming coders have completed training on the current year's ICD-10-CM, CPT, and HCPCS updates.
- Checking that internal coding guidelines or cheat sheets used by staff have been updated to reflect 2026 changes, rather than left over from prior years.
- Reviewing whether coders have access to and regularly consult official CMS transmittals and payer bulletins, rather than relying solely on secondhand summaries.
Step 7: Document Findings and Create a Corrective Action Plan
An audit that doesn't result in documented findings and follow-up actions isn't complete. For each issue identified, the practice should record:
- The specific error pattern found (for example, consistent modifier 25 misuse by a particular provider).
- The scope of the issue (isolated incident vs. recurring pattern).
- A corrective action, such as targeted provider education, a documentation template update, or a coder retraining session.
- A follow-up timeline to confirm the corrective action resolved the issue in a subsequent audit cycle.
This step is also important from a compliance standpoint. If CMS or another payer does conduct an external audit, having a documented history of self-audits and corrective actions demonstrates a good-faith compliance effort, which can matter in how findings are treated.
How Many Charts Should You Review?
A common question when starting an internal audit is how large the sample needs to be to actually mean something. There's no single universal number, but a few general practices are widely used. Many compliance programs sample five to ten charts per provider per quarter as a baseline, increasing that number if issues are found or if a provider bills unusually high volumes of complex codes. For a targeted, code-specific audit, pulling twenty to thirty claims tied to that specific code across a recent time period tends to give enough data to spot a genuine pattern versus a one-off mistake.
The goal isn't statistical perfection, it's catching patterns early enough to correct them before they show up across hundreds of claims. A small, consistent sampling routine run every quarter will generally catch more real issues than a single large audit conducted once a year, simply because it creates more opportunities to notice a drift in coding habits before it becomes entrenched.
Tools That Support the Audit Process
While a coding audit can be done manually with chart reviews and spreadsheets, most practices benefit from a few supporting tools:
- Claim scrubbing software: Flags obvious mismatches, missing modifiers, or NCCI conflicts before a claim is even submitted, reducing the number of issues an audit later has to catch after the fact.
- Denial tracking reports: Sorting denials by CARC (Claim Adjustment Reason Code) and RARC (Remittance Advice Remark Code) helps identify which categories of errors are recurring, which can directly inform where the next audit should focus.
- CMS transmittals and MLN Matters articles: These official CMS publications are the most reliable source for confirming current-year guideline changes, rather than relying on secondhand summaries that may lag behind the actual policy update.
- Payer-specific LCD/NCD lookup tools: Since coverage criteria differ by payer and region, having quick access to the correct LCD for a Medicare Administrative Contractor's jurisdiction avoids applying the wrong region's rules during an audit.
None of these tools replace human review, but they reduce the volume of obvious errors an auditor has to manually catch, freeing up time to focus on the more nuanced documentation and medical necessity questions that actually require clinical judgment.
Building This Into an Ongoing Cycle
A single audit is a snapshot, not a compliance program. Practices that stay ahead of CMS updates typically build audits into a recurring cycle, quarterly for high-risk areas like E/M leveling and telehealth, annually for a full-scope review, and immediately following any major CMS guideline update. Treating the audit checklist as a living document that gets revised each year, rather than a static form, is what keeps the process actually useful as coding rules continue to shift.
Staying compliant with CMS 2026 guidelines isn't about memorizing every rule change the moment it's published. It's about having a consistent, structured process in place that catches gaps between documentation and coding before they turn into denials, overpayments, or compliance findings.
