CPMA Medical Auditor common mistakes
CPMA Medical Auditor · Understand the traps and how to avoid them.
Treats the Anti-Kickback Statute and the physician self-referral (Stark) Law as interchangeable - e.g., clearing an arrangement because it fits a Stark exception and assuming it is therefore AKS-compliant, or calling an arrangement a Stark violation because it 'looks like it was meant to induce referrals.'
Both statutes are taught together in the compliance chapter and share the same fact patterns (physician compensation, referrals, leases), so candidates memorize the penalty table but never separate the elements: Stark is a strict-liability civil statute limited to designated health services paid by federal programs and analyzed through exceptions; the AKS is an intent-based criminal statute covering any item or service paid by a federal program and analyzed through safe harbors. Compliance with one does not establish compliance with the other.
What to do instead
Build a two-column comparison and run every scenario through it in order: (1) Is a federal health care program payer and a designated health service involved? If yes, analyze Stark exceptions. (2) Is there remuneration arranged to induce or reward referrals, with intent? If yes, analyze AKS safe harbors. Conclude on each statute separately, and state explicitly when one is satisfied and the other is not addressed.
Recites the seven elements of an effective compliance program from memory, but when given a narrative describing a compliance breakdown (for example, anonymous hotline calls never logged or investigated, or no baseline auditing after a coding change), cannot identify which element is absent and selects a plausible-sounding but wrong element.
The elements are memorized as a list of labels rather than as observable artifacts, and scenario questions describe symptoms rather than naming the element. Candidates match keywords instead of asking what evidence would prove the element exists.
What to do instead
For each element, write the concrete artifacts that evidence it (for auditing and monitoring: a written audit work plan, documented baseline and follow-up audits, sample methodology, and tracked corrective actions; for reporting: intake log, investigation file, non-retaliation policy). Practice converting scenario facts into 'evidence present / evidence absent' statements before choosing an element.
Extrapolates a projected overpayment from a small convenience or judgmental sample, or states the sample error rate as if it were the known population error rate with no qualifier.
Sample results look authoritative on a worksheet, and candidates are unfamiliar with the distinction between statistical and non-statistical sampling, so they accept any projection as valid. Exam items deliberately ask which conclusions the sample actually supports.
What to do instead
Before concluding, ask whether the sample was probability-based, randomly drawn, and sized for the desired confidence level. If not, report the results as descriptive of the items reviewed only. Reserve projections, confidence intervals, and extrapolated dollar amounts for statistically valid samples, and note that a payer or government contractor may extrapolate while a provider's internal judgmental sample may not be projected.
Computes the error rate by counting every incorrect code line rather than the defined unit of analysis, or switches between a claim-count error rate and a paid-dollar error rate within the same finding without labeling which is which.
Audit worksheets are organized by code lines, so the eye counts lines; and the exam prompt often says only 'error rate' without restating the denominator. Multiple errors inside one encounter then get counted as multiple erroneous encounters, inflating the figure.
What to do instead
Fix and write down the unit of analysis before any audit begins (encounter, claim, or line item). State the numerator and denominator explicitly in every calculation, and report the encounter error rate and the dollar-weighted error rate as two separate, clearly labeled measures that are never substituted for one another in a conclusion.
Applies the wrong E/M documentation guideline set to a date of service - for example, applying 1995/1997 documentation guidelines to a current office/outpatient visit, or mixing sets inside one encounter by pairing current medical decision-making rules with 1997 history and exam bullets.
Candidates tend to over-study the guideline set they learned first, and multiple sets remain legitimately in force across different settings and dates of service. Because all sets use the same vocabulary (history, exam, MDM), the mismatch is invisible unless the candidate consciously anchors to the date and place of service.
What to do instead
Make the first step of every E/M item explicit: identify the date of service and the place/type of service, then select the single governing guideline set. Audit only with that set's worksheet, and if a level cannot be supported under the correct set, record it as an error rather than defaulting to the set that produces a higher level.
Scores the level of service as supported because the required documentation elements are present, without asking whether the service was reasonable and necessary for the presenting problem - and conversely, downgrades a service solely because a non-essential element is missing.
Coding habits train a 'find the element, count the element' approach, while medical necessity is the overarching criterion and is patient- and payer-specific. It is easier to count bullets than to judge clinical appropriateness, so the necessity judgment is skipped.
What to do instead
Perform two distinct passes and report them as separate findings: pass one tests documentation sufficiency against the applicable guideline; pass two tests medical necessity by reading the history of present illness, assessment, and plan and asking whether the service, setting, and frequency match the documented clinical picture. Never let one pass override the other silently.
Treats every National Correct Coding Initiative column-one/column-two pair as permanently bundled, ignores the procedure-to-procedure modifier indicator, or uses modifier 59 where a more specific X{EPSU} modifier applies - and uses modifier 25 to bypass a procedure bundle rather than to identify a genuinely separate E/M service.
NCCI is actually two separate edit families (procedure-to-procedure edits with modifier indicators, and medically unlikely edits that cap units) plus a modifier-selection decision. Candidates collapse these into one idea of 'bundling' and reach for the modifier they have seen most often.
What to do instead
Always read the PTP modifier indicator: 0 means no modifier can override the edit; 1 means an appropriate modifier may. Choose the most specific modifier supported by the documentation, preferring XE/XS/XP/XU over 59. Use modifier 25 only when a distinct, medically necessary E/M was performed above and beyond the procedure's own pre-, intra-, and post-service work and is separately documented - never as a general unbundling tool, and never to override an indicator-0 edit.
Identifies an overpayment during an audit but recommends only prospective correction and provider education, omitting the obligation to quantify the identified overpayment and return it within the required timeframe - or, in the other direction, assumes an extrapolated projection must be refunded when only the identified amounts have been quantified.
Audit-reporting material emphasizes corrective action plans, and repayment duties sit in a separate legal/compliance chapter, so the repayment clock is never started in the answer. Candidates also blur the line between what an internal audit actually identified and what a payer contractor may project.
What to do instead
In every overpayment scenario, add the required remediation steps to the recommendation: suspend or reverse the affected billing, quantify the identified overpayment, and report and return it within 60 days of identification, with the applicable cost-report timing noted when relevant. State separately that extrapolation is a methodology used by payers and government contractors and that a provider's projected figure is not the same as a quantified identified overpayment.
Writes each finding as a bare conclusion ('the provider overbilled') without citing the standard that was breached, the evidence reviewed with counts, and a measurable recommendation that names an owner and a due date - and blends the finding, the recommendation, and management's response into one undifferentiated paragraph.
Narrative writing habits carry over from clinical or coding work, and report-writing is under-practiced relative to coding mechanics. A conclusion feels complete to the writer because the auditor already knows the reasoning, so the reasoning never gets written down.
What to do instead
Structure every finding as criteria (the policy, regulation, or code requirement), condition/evidence (what was reviewed, how many, and what was found, with numerator over denominator and dollar impact), effect, recommendation (specific, assigned, testable), and management response with target date. Draft the follow-up audit step at the same time, and keep each element in its own labeled section.
Distributes audit reports and supporting work papers that contain patient identifiers and unnecessary clinical detail to recipients beyond those with a need to know, and circulates draft findings as though they were final conclusions.
Auditors work directly in the medical record, so copying source excerpts feels like thoroughness, and emailing the working file to a broad distribution list feels like transparency. The confidentiality and version-control requirements are rarely the focus of coding practice.
What to do instead
Default to the minimum necessary: use encounter or claim identifiers in place of patient identifiers unless identity is essential, and mark reports confidential with a defined distribution list tied to job role. Label drafts as drafts, retain a final signed version, and treat the work papers and the report as protected compliance documents with controlled access.