Hospitals shopping for coding compliance audit services often ask for "a coding audit" as if it were one product. It is two. An inpatient audit and an outpatient audit test different code sets, different payment logic, and different failure modes, and a firm that is strong at one is not automatically competent at the other. Knowing the difference before you engage an outside firm is the difference between an audit that finds your actual risk and one that produces a tidy report about the wrong thing.

This page explains what each audit type examines, where the risk concentrates in each, and what to ask a provider of coding compliance audit services before signing.

Why coding compliance audit services split along the inpatient and outpatient line

The split follows the payment system. Inpatient hospital stays under Medicare are paid through the Inpatient Prospective Payment System, where the entire stay resolves to one MS-DRG and one payment. Outpatient services are paid under the Outpatient Prospective Payment System, where each service line on the claim carries its own CPT or HCPCS code and its own payment logic. Different payment logic means different ways to be wrong.

The stakes are not small on either side. The Centers for Medicare and Medicaid Services reported a Medicare fee-for-service improper payment rate of 7.38 percent for fiscal year 2023, and the Office of Inspector General has recommended regular coding audits in its hospital compliance program guidance since 1998. A hospital that audits only one side of its coding has audited only part of its exposure.

What inpatient coding compliance audit services examine

An inpatient coding audit validates the MS-DRG assignment for a sample of discharges against the physician documentation in the record.

Specifically, the auditor checks:

  • Principal diagnosis selection under ICD-10-CM and the Uniform Hospital Discharge Data Set definition, because the principal diagnosis drives the DRG family.
  • Secondary diagnoses, especially complications and comorbidities (CCs) and major complications and comorbidities (MCCs), which move a stay between DRG severity levels and change payment materially.
  • ICD-10-PCS procedure codes, which can shift a case from a medical to a surgical DRG.
  • Present-on-admission indicators, which affect hospital-acquired condition logic.
  • Discharge disposition, which affects transfer-payment adjustments.

Where inpatient risk concentrates: severity. The OIG reported in 2021 that the share of Medicare inpatient stays billed at the highest severity level grew nearly 20 percent between fiscal years 2014 and 2019, and in a 2020 review found hospitals had overbilled Medicare roughly $1 billion by assigning severe malnutrition codes the documentation did not support. Inpatient coding compliance audit services earn their fee by testing whether every CC and MCC is supported in the chart.

Inpatient audits also run the other direction. Missed secondary diagnoses and under-sequenced principal diagnoses cost hospitals revenue they earned, and a credible audit reports under-coding alongside over-coding.

What outpatient coding compliance audit services examine

An outpatient coding audit validates CPT, HCPCS, and ICD-10-CM assignment on each line of a sample of outpatient claims, and tests whether the documentation supports medical necessity for each service.

The auditor checks:

  • CPT and HCPCS code selection, including evaluation and management levels, procedure codes, and drug and supply codes.
  • Modifiers, which are the most common outpatient error class, because a wrong or missing modifier changes payment or triggers a National Correct Coding Initiative edit.
  • Diagnosis-to-procedure linkage, because an outpatient service with no supporting diagnosis fails medical necessity.
  • Units of service, especially for drugs, infusions, and observation hours.
  • Charge capture, because outpatient coding and the chargemaster interact: a correct code attached to a wrong charge is still a wrong claim.

Where outpatient risk concentrates: volume and variety. An inpatient audit of 50 discharges covers 50 claims. An outpatient audit of the same number of encounters may cover hundreds of line items across the emergency department, infusion center, imaging, and clinics, each with its own coding conventions. The errors are smaller per claim and far more numerous, and they repeat across thousands of encounters a month.

Outpatient audits also touch the chargemaster directly. A pattern of errors in one department often traces to a chargemaster entry rather than a coder, which is why outpatient coding compliance audit services and chargemaster review are frequently scoped together.

How to choose coding compliance audit services for both sides

Five questions separate a firm that can do both from one that can do one.

Who specifically will audit each side, and what are their credentials?

Inpatient auditing calls for coders credentialed and experienced in ICD-10-PCS and MS-DRG logic, typically CCS or RHIT/RHIA holders with inpatient histories. Outpatient auditing calls for depth in CPT, HCPCS, modifiers, and OPPS edits, often CPC or COC holders. Ask for the named auditors on each side, not the firm's aggregate credential list.

Are the auditors U.S.-based and under a business associate agreement?

Audit work means full access to protected health information. The firm should state in writing that all auditors are in the United States, that no review work is sent offshore, and that it operates under a signed business associate agreement with the hospital.

How is the sample built?

A random sample measures baseline accuracy. A focused sample, built around high-risk DRGs, high-volume outpatient departments, or claim types already under payer scrutiny, measures specific exposure. The firm should be able to explain which it is proposing and why, and most hospitals need both over time.

What does the report look like, and what happens after it?

Ask for a sample report. It should show each variance at the chart level, the financial impact in both directions, the root cause, and a recommendation. Then ask what happens next. A firm that delivers the report and leaves has done half the job. The other half is education: the auditor reviewing findings chart by chart with the coders and, where documentation is the cause, with the physicians.

Does the firm work in your EHR and encoder?

An auditor who already works in Epic, Cerner, Meditech, 3M, or TruCode spends the engagement reviewing charts, not learning navigation. Ask.

How HMI approaches inpatient and outpatient coding audits

HMI LLC is a Nashville, Tennessee, healthcare-exclusive health information management firm founded in 1989. Our compliance services include inpatient coding reviews, outpatient coding reviews, compliance audits, RAC audit support and appeals, physician documentation review, and chargemaster maintenance, which lets us scope an outpatient audit and a chargemaster review together when the findings point that way.

Every HMI auditor is U.S.-based and holds AHIMA and/or AAPC credentials. Inpatient reviews check ICD-10-CM and ICD-10-PCS sequencing, MS-DRG assignment, present-on-admission indicators, and discharge disposition. Outpatient reviews check CPT, HCPCS, and ICD-10-CM assignment and whether documentation supports medical necessity. Every engagement ends with education for the coders and, where warranted, the providers whose documentation drove the findings.

Our clients are named by title and organization on our testimonials page, and several describe audit findings delivered with education their staff could apply immediately.

Frequently asked questions about coding compliance audit services

Can one firm audit both inpatient and outpatient coding?

Yes, if it staffs each side with auditors credentialed and experienced in that setting. Ask for the named auditors and their inpatient or outpatient histories rather than relying on the firm's overall credential count.

Which should a hospital audit first?

Inpatient, if case-mix index has moved or a RAC has shown interest in specific DRGs, because the dollar impact per error is larger. Outpatient, if denials are rising or a department's charges look wrong, because the error count is larger. Hospitals with no recent audit on either side usually start with a baseline on both.

How often should each be audited?

At least annually for both, with focused inpatient reviews after coding guideline updates each October and after staffing changes, and focused outpatient reviews when a department's denial pattern shifts or the chargemaster is updated.

What happens if an audit finds overpayments?

The hospital is obligated to report and return identified Medicare overpayments. That obligation exists whether the hospital finds the error or a RAC does; finding it first avoids the response cost and demonstrates a functioning compliance program.

The decision

Inpatient and outpatient coding audits are different disciplines. Before engaging coding compliance audit services, know which exposure you are trying to measure, insist on named and credentialed auditors for each side, and require that the engagement end with education rather than a report. To scope a review of either or both, contact HMI.