Key Medical Coding Audit Topics Compliance Auditors Should Consider

Providers should ensure effective controls are in place to code and bill for diagnoses and procedures accurately and compliantly, resulting in claims which demonstrate the acuity of patients served as well as the level of care and medical necessity of services provided. The American Medical Association (AMA) has outlined the following as key coding and billing risk areas for consideration: unbundling of codes; evaluation and management (E/M) level upcoding; National Correct Coding Initiative (NCCI) edits when reporting multiple codes; appropriate utilization of modifiers; time-based coding; and appropriate utilization of injection codes.^[3] Additionally, enforcement agencies and their associated audit programs, such as the Office of Inspector General (OIG) and Centers for Medicare and Medicaid Services (CMS) Recovery Audit (RA) program, identify key audit or focus areas each year that typically align with the AMA’s key risk areas. The consequences for inappropriate unbundling or upcoding can include repayments, reputational damages, Corporate Integrity Agreements (CIAs), and significant legal costs.

As hospital and physician-practice compliance leaders consider which coding audits to perform in 2024, it is considered best practice to review the industry’s high priority topics for consideration. Listed below are high priority risks and issues that have been identified through review of AMA, OIG and RA program work plans, as well as considerations for how to leverage data to risk-rank and tackle these audits.

1. Medicare Part B Add-On payments for COVID-19 tests: The OIG will review providers’ supporting documentation for the COVID-19 clinical diagnostic laboratory test add-on payments to determine whether the documentation complied with Medicare Part B Add-On Payments requirements.^[4] Organizations should use 837 claims analytics to assess how frequently CPT/HCPCS codes for clinical diagnostic laboratory test add-ons were billed to governmental payors such as Medicare and Medicaid to determine their risk exposure, and then decide whether a probe sample review of medical records is warranted.
2. Medicare payments for trauma claims: The OIG has identified trauma centers that are improperly billing for medically unnecessary trauma team activation as well as providers who have received trauma team activation payments without the proper designation or verification. CMS does not currently track which providers are designated or verified as trauma centers. Therefore, the OIG is looking to determine the amount of Medicare overpayments for trauma claims, including identification of providers that are not trauma centers or that billed for medically unnecessary trauma team activations. Compliance leadership should use claims analytics and EMR reports to isolate claims that are missing the appropriate code or do not contain ICD-10-CM codes associated with traumatic events, or for patients who did not come to the emergency department (ED) via ambulance.
3. Evaluation and management services: E/M services are those provided by a physician or other healthcare professional in which the provider is evaluating or managing a patient’s health. The Current Procedural Terminology (CPT^®) code is typically selected based on the level of medical decision making by the provider or the amount of time the provider spends with the patient. Medicare has published research that identified office visits (established), hospital (initial), and hospital (subsequent) as the top three errors in E/M service categories. The frequent errors observed by CMS were insufficient documentation, lack of medical necessity and incorrect coding of E/M services.^[5] Some specific E/M services of concern identified by enforcement agencies include:
    
   • Dermatologist claims for evaluation and management services on the same day as minor surgical procedures: In 2019, about 56 percent of dermatologist claims with an E/M service also included minor surgical procedures (e.g., lesion removals, destructions and biopsies) on the same day. This may indicate abuse scenarios in which the provider used modifier 25 to bill Medicare for a significant and separately identifiable E/M service when only a minor surgical procedure and related preoperative and/or postoperative services are supported by the beneficiary's medical record. The OIG will determine whether dermatologists' claims for E/M services on the same day of service as a minor surgical procedure complied with Medicare requirements.^[6] Compliance leadership should identify claims associated with providers or facilities that have modifier 25 appended to CPT codes more frequently than their peers.
   • Audit of emergency department E/M services: The OIG will determine whether Medicare payments to providers for emergency department E/M services were appropriate and paid in accordance with Medicare requirements.^[7] Certain CPT codes should only be used when a beneficiary is seen in an emergency department. All E/M services reported to Medicare must be adequately documented so that medical necessity is clearly evident. This includes emergency department E/M CPTs for which documentation must support the medical decision making or time spent for professional fee billing (PB) E/M. Auditors can identify a probe sample of claims in which E/M 99285 was billed and validate that documentation supported this level. Auditors also could target claims in which the first-listed ICD-10 CM code may not be associated with more acute conditions (e.g., otitis media, localized rash, simple UTI).
4. Unbundling: Some CPT codes are used for several components of a service that are to be reimbursed through a single code. Unbundling occurs when multiple CPT codes are reported where a single code should have been used. Unbundling can result because of a misunderstanding of the single CPT code or to receive a higher payment than is permitted. Top risk areas identified for unbundling include:
    
   • Muscle flap with breast reconstruction or breast prosthesis insertion: IG will review documentation to determine if muscle flap creation warranted separate reimbursement, given that flap creation is considered inclusive to breast reconstruction or breast prosthesis services. To receive payment, documentation must indicate that the flap creation was performed during a different session; during a different procedure or surgery; during a different site or organ system; during a separate incision/excision; on a separate lesion; or on a separate injury not ordinarily encountered on the same day by the same individual.^[8] Auditors can isolate claims in which both the breast-reconstruction CPT and the muscle-flap CPT (with modifier 25 appended) are listed on the claim and validate that documentation supported the unbundling.
   • Medical supplies billed from consolidated billing list during a home health episode: The OIG will review documentation to confirm that any medical supplies billed from the consolidated billing list were billed in accordance with requirements. Medical supplies included in the consolidated billing list are not considered separately billable if used during a home health episode.^[9]
   • Unbundling of prolonged codes: RA programs have confirmed that prolonged CPT codes will be an area of focus in 2024. Prolonged service codes are add-on codes for services that take longer than usual or expected and are typically added in minute increments (e.g., 15 additional minutes of E/M time). The review will determine whether the services associated with these codes were appropriately reimbursed, as well as whether the services were rendered during the same calendar month that chronic care management codes were billed.^[10] Auditors can isolate claims in which prolonged service CPT codes are used – especially those for which a high number of prolonged service CPTs are appended (indicating an especially long service provided) – to validate that the time spent and documented in the medical record supports the use of the prolonged service CPT codes on the claim.
5. Audit of Medicaid applied behavior analysis (ABA) for children diagnosed with autism: The OIG will audit Medicaid claims for ABA services provided to children diagnosed with autism to determine whether a state Medicaid agency’s ABA payments comply with Federal and State requirements.^[11] Specifically, the OIG seeks to stop providing payments for unallowable services and to require paybacks for payments made for unallowable services. Each state’s Medicaid program maintains unique guidelines and/or requirements associated with the provision of ABA services; therefore, compliance professionals should review applicable Medicaid guidelines and ensure documentation and ABA services rendered meet applicable requirements. Compliance leadership should review the applicable state Medicaid guidelines and requirements and validate that adolescent ABA services align with those requirements, remembering to evaluate all states in which the provider organization receives patients for such treatment.
6. Vertebral augmentation procedures: Vertebral augmentation is an outpatient procedure used to strengthen damaged vertebrae by injecting orthopedic cement into vertebrae to increase their height and strength. CMS has indicated that it has concerns regarding these procedures, specifically: 
    
   • Missing signature and date on clinical documentation that supports the patient’s symptoms
   • No radiographs that support the medical necessity of the procedure
   • Insufficient medical record documentation of the provider’s attempt at conservative medical management and its failure or contraindication
   • No signed and dated attestation statement for the operative report, if a physician signature was missing or illegible (or a missing operative report, if the statement was electronically signed)^[12]
7. Orders for durable medical equipment (DME): DME includes medical equipment and supplies that are ordered by a physician for daily or extended use. CMS has reiterated that there are specific requirements that must be met to receive reimbursement for DME. Providers and their claims must meet the following requirements:^[13] 
    
   • Include a valid standard written order prior to claim submission
   • Include the practitioner’s name or NPI on the valid standard written order
   • The ordering physician and DME supplier must be actively enrolled in Medicare on the date of service
   • A physician, physician assistant, nurse practitioner or certified nurse specialist must document a face-to-face encounter exam with a patient in the six months before the written order for certain DME items

As provider organizations develop their compliance and/or coding audit work plans, they should follow best practices and review the industry’s high priority topics for consideration, including the OIG Work Plan and recent enforcement activities. Compliance and coding programs should consider including any of the relevant topics discussed above on their work plans to ensure proper controls are in place to mitigate billing-compliance risk and facilitate accurate documentation and claim creation.

Most organizations, however, have finite compliance auditing resources available to perform these types of audits. Thus, compliance leadership should employ data analytics to risk rank the highest-priority audit areas. This includes conducting a volume analysis, focused on governmental payors, of specific audit-prone CPTs, DRGs or services. Organizations also should cross-reference the volumes with the associated average payment of these services to determine dollar exposure to the organization if a pattern of noncompliant clinical documentation and coding is identified. Finally, compliance leadership can cross-reference those results with data from benchmarking reports like Comparative Billing Reports (CBRs) and the Program for Evaluating Payment Patterns Electronic Report (PEPPER) to identify any locations noted as outliers in audit areas also on the OIG or other enforcement agency workplans.

1. “Denial Rework Costs Providers Roughly $118 per Claim: 4 Takeaways,” by Kelly Gooch, Becker’s Hospital Review, June 26, 2017: https://www.beckershospitalreview.com/finance/denial-rework-costs-providers-roughly-118-per-claim-4-takeaways.html.

2. Practical Tips for Maintaining Control Over the Revenue Cycle,” by Eric Arnson, HFMA, February 28, 2019: https://www.hfma.org/technology/63414/.

3. “8 Medical Coding Mistakes That Could Cost You,” by Kevin B. O’Reilly, American Medical Association, September 18, 2023: https://www.ama-assn.org/practice-management/cpt/8-medical-coding-mistakes-could-cost-you.

4. “Medicare Part B Add-on Payments for COVID-19 Tests,” Oig.hhs.gov, November 15, 2021: https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000706.asp.

5. “Complying with Medial Record Documentation Requirements,” ICN909160, CMS, March 2024: https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/MLN-Publications-Items/ICN909160.

6. “Dermatologist Claims for Evaluation and Management Services on the Same Day as Minor Surgical Procedures,” OIG.HHS.gov, April 15, 2021: https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000577.asp.

7. “Audit of Medicare Emergency Department Evaluation and Management Services,” OIG.HHS.gov, August 16, 2021: https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000612.asp.

8. “0217-Muscle Flap with Breast Reconstruction or Breast Prosthesis Insertion: Unbundling,” CMW.gov, June 6, 2023: https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery/1555941763/1a298-muscle-flap-breast-reconstruction-or-breast-prosthesis-insertion-unbundling.

9. “0218-Medical Supplies Billed from Consolidated Billing List During a Home Health Episode: Unbundling,” CMW.gov, June 6, 2023: https://www.cms.gov/research-statistics-data-and-systems/monitoring-programs/medicare-ffs-compliance-programs/recovery/568075650/5a301-medical-supplies-billed-consolidated-billing-list-during-home-health-episode-unbundling.

10. “CMS Approved Audit Issues,” Performant Financial, n.d.: https://www.performantcorp.com/cms-rac/cms-rac-resources/cms-approved-audit-issues/default.aspx#Region-1.

11. “Audit of Medicaid Applied Behavior Analysis for Children Diagnosed with Autism,” OIG.HHS.gov, June 15, 2021: https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000601.asp.

12. “Complying with Medical Record Documentation Requirements,” The Medicare Learning Network, March 2024: https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/CERTMedRecDoc-FactSheet-ICN909160.pdf.

13. Ibid.