Billing and Reimbursement Auditing
Audit design and coding rules
A billing audit tests whether a submitted claim is supported by documentation, coding rules, and medical necessity. Design matters: define the population, choose random versus targeted sampling, document the sampling methodology, and apply consistent review criteria. If a payer extrapolates, the sample must be statistically valid; extrapolating from a judgmental sample is a defensible finding against the audit itself.
Concepts a candidate must recognize: medical necessity as the overriding coverage test; evaluation and management level selection under the 2021 guidelines using medical decision making or total time; modifiers such as 25 (significant, separately identifiable service), 59 and the X-modifiers (distinct service), 26 and TC (professional and technical components), and 76 or 77 (repeat procedures); National Correct Coding Initiative edits and bundling; DRG validation with principal diagnosis selection and CC/MCC capture; the two-midnight rule for inpatient admission; observation versus inpatient status; incident-to billing; split or shared visits; and teaching physician documentation requirements.
Traps: flagging a high-level E/M visit as upcoded without checking the documented medical decision making; applying modifier 25 where the record shows no separately identifiable service; accepting cloned or copy-pasted documentation as support; and extracting a single error into a population-wide dollar figure without a valid statistical basis.
Worked example: 200 claims are sampled from a population of 5,000. Forty claims are overpaid by 150 dollars each, an error rate of 20 percent. The projected overpayment is 20 percent of total allowed dollars for the population, not 40 times 150, and the projection is only usable if the sample was random and adequately sized.
Clinical Operations
Processes that keep care moving
Clinical operations auditing examines whether people, processes, and capacity are deployed safely and efficiently. The scope spans credentialing, privileging, and payer enrollment; staffing and scheduling; surgical and procedural throughput; case management and utilization review; discharge planning; supply and implant management; and contract labor.
Separate three easily confused terms. Credentialing verifies education, licensure, training, and work history. Privileging is the governing body's authorization for a practitioner to perform specific procedures at a specific facility. Payer enrollment is contracting and registration with an insurer so claims pay. A provider can be fully credentialed and privileged and still be unenrolled with a major payer.
Operational metrics candidates should compute: operating room block utilization, which is used minutes divided by available block minutes; first-case on-time starts; turnover time; case cancellation rate; agency and overtime as a percentage of total labor cost; length of stay against geometric mean; and readmission rates. Utilization review tests admission status and continued-stay criteria; case management tests whether transition planning started early enough to prevent avoidable days.
Traps: computing OR utilization with scheduled rather than available minutes; treating high occupancy as proof of efficiency; and attributing length-of-stay variance to physicians when discharge delays come from post-acute placement.
Worked example: an OR suite has 4,000 available block minutes weekly and 2,600 used minutes, so utilization is 65 percent. Under a common 75 percent threshold, leadership should audit block release policy and late-start causes before adding capacity. Rule of thumb: measure utilization at the constraint, and only after confirming the data excludes blocked-but-unused time inconsistently.
Quality and Patient Safety Auditing
Standards, measures, and learning systems
Quality auditing tests whether care meets external requirements and internal expectations, and whether the organization learns from harm. Know the CMS Conditions of Participation as the baseline for Medicare participation, accreditation standards from The Joint Commission or DNV as a deemed status pathway, and national quality programs such as HEDIS, eCQMs, and star ratings.
Safety terminology is heavily tested. An adverse event is unintended harm from care, not the underlying disease. A sentinel event is an unexpected occurrence involving death or serious harm and requires immediate investigation. A never event is a clearly identifiable, preventable serious incident. Root cause analysis is retrospective, performed after an event, and asks why it happened. Failure mode and effects analysis is prospective, performed before a process launches, and asks what could go wrong. Incident reporting systems, just culture, and disclosure obligations support the learning loop.
Clinical audit areas include infection prevention (central line-associated bloodstream infections, catheter-associated urinary tract infections, surgical site infections, hand hygiene compliance), medication reconciliation and high-alert medications, restraint use, patient rights, and environment-of-care rounding. Data validation matters: confirm the measure denominator, the specification version, and the abstraction accuracy before reporting a rate.
Traps: confusing root cause analysis with FMEA; calling every adverse event a sentinel event; and reporting a rate improvement that actually reflects a changed denominator.
Worked example: a hospital reports a fall rate drop after changing its denominator from patient days to discharges. Before celebrating, re-run the prior period under the new specification. Rule of thumb: when a quality metric moves suddenly, validate the measure before crediting the intervention.
Healthcare Information Technology, Privacy and Data Analytics
Systems, safeguards, and evidence
Health IT auditing covers the electronic health record, computerized provider order entry, clinical decision support, interoperability and health information exchange, and the controls that protect the data. Privacy and security rest on the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, reinforced by HITECH. Know permitted uses for treatment, payment, and operations; the minimum necessary standard and its treatment exception; authorization requirements; the accounting of disclosures; and business associate agreements, which are required before a vendor touches protected health information on the entity's behalf.
Breach notification timing is a reliable test item: individuals must be notified without unreasonable delay and no later than 60 days after discovery, with HHS notification and media notice when a breach affects more than 500 residents of a state or jurisdiction. Discovery is when the incident is known or should have been known through reasonable diligence. Security safeguards include access controls, audit logging, integrity controls, transmission encryption, and periodic user access reviews; encryption can support a safe harbor.
De-identification follows either the Safe Harbor method, removing 18 specified identifiers with no actual knowledge of re-identification risk, or the expert determination method.
Analytics concepts: computer-assisted audit techniques, attribute versus variable sampling, statistical versus judgmental sampling, outlier and peer-group analysis, and dashboards tracking key risk indicators. Traps: starting the 60-day breach clock at the end of the investigation rather than at discovery; assuming minimum necessary applies to treatment; and treating de-identified data as still requiring a business associate agreement.
Worked example: a laptop with unencrypted PHI for 800 patients is stolen. The clock starts at discovery, notification is due within 60 days, and HHS plus media notice apply because more than 500 individuals in a state are affected.