Most hospitals do not call a medical coding audit company because something is obviously wrong. They call because something is quietly off: a case-mix index that drifted, a denial rate that crept up, or a coder who left and took the department's institutional knowledge with them. By the time the problem is obvious, a payer or a Recovery Audit Contractor has usually found it first.

This page lays out five signs that a hospital's coding compliance program needs an external audit, and what to look for in the medical coding audit company you bring in.

Why an external medical coding audit matters

The Office of Inspector General has recommended regular coding audits in its compliance program guidance for hospitals since 1998. The reason is scale: the Centers for Medicare and Medicaid Services reported a Medicare fee-for-service improper payment rate of 7.38 percent for fiscal year 2023, and insufficient documentation and incorrect coding are consistently among the largest categories.

Internal review catches some of this. It cannot catch what the internal reviewer does not know, or what the department has been doing the same way for a decade. An external medical coding audit company brings a second set of credentialed eyes that has seen how other hospitals code the same cases, and no stake in defending past decisions.

Sign one: your case-mix index moved and nobody can explain why

A case-mix index that rises or falls more than a few points without a matching change in patient population or service lines is the single most common trigger for a coding audit.

An unexplained rise invites payer scrutiny. The OIG reported in 2021 that the share of Medicare inpatient stays billed at the highest severity level grew nearly 20 percent between fiscal years 2014 and 2019, and it has treated that trend as an upcoding signal ever since. An unexplained fall is the opposite problem: missed complications and comorbidities, under-documented severity, and revenue the hospital earned but never billed.

An external medical coding audit company tests both directions. A sample of MS-DRG assignments is checked against the documentation to see whether the principal diagnosis, secondary diagnoses, and procedures support the DRG billed.

Every hospital has denials. The sign is a change in the mix. When denial reason codes shift toward medical necessity, diagnosis-to-procedure mismatches, or unsupported modifiers, the cause is usually in coding or in the documentation the coders are working from, not in registration or eligibility.

A medical coding audit company can trace a denial sample back to the chart and tell you which it is. That distinction matters, because the fix for a coder knowledge gap is education, and the fix for a documentation gap is a clinical documentation improvement conversation with physicians. Spending on the wrong one does nothing.

Sign three: you lost an experienced coder, or your coding team turned over

Coding knowledge is institutional as much as it is credentialed. A coder who has worked a hospital's cardiology service line for eight years knows which physicians document which way and where the query triggers are. When that coder leaves, accuracy drops before anyone measures it.

Turnover is also when habits get reset, for better or worse. An audit within the first quarter after a significant staffing change establishes a new baseline and catches drift while it is still small. This is the moment many hospitals first engage a medical coding audit company, and it is a sound one.

Sign four: your last audit was more than a year ago, or was done by the people being audited

Compliance program guidance from the OIG describes auditing as ongoing, not one-time. A program whose last review was two years ago is a program that has been coding to 2024's rules and 2024's habits without a check.

Self-audit has a second weakness. A coding manager reviewing the team's own work, under production pressure, with a stake in the department's reputation, will not find what an outside reviewer finds. That is not a character flaw; it is a structural one, and the OIG guidance recognizes it in recommending independent review. A medical coding audit company owes nothing to how the department has always done it.

Sign five: you are preparing for, or recovering from, a RAC or payer audit

If a Recovery Audit Contractor has issued additional documentation requests, or a commercial payer has opened a focused review, a pre-emptive internal look at the same claim types is the difference between a managed response and a scramble. If a finding has already arrived, an external audit of the surrounding population tells you whether the finding is an isolated error or a pattern that will produce more.

The appeal itself is a specialist task with fixed deadlines. Our guide to responding to a RAC finding walks through the stages.

What to look for in a medical coding audit company

Not every firm that offers audits is built for hospital compliance work. Five tests separate them.

Credentialed, U.S.-based auditors

Every auditor should hold a current AHIMA or AAPC credential, such as CCS, RHIT, RHIA, or CPC, and should be working in the United States under a signed business associate agreement. Ask for the credentials of the specific people who will review your charts.

Both inpatient and outpatient depth

Inpatient audits test ICD-10-CM and ICD-10-PCS sequencing, MS-DRG assignment, present-on-admission indicators, and discharge disposition. Outpatient audits test CPT, HCPCS, and ICD-10-CM assignment and whether documentation supports medical necessity. A firm strong in one is not automatically strong in the other.

Findings delivered with education

An audit report that lists error rates and stops is a compliance artifact, not a compliance improvement. The audit should end with the auditor meeting with the coders, chart by chart, explaining what was found and why. The error rate on the next audit is the real measure of the first one.

Experience in your EHR

An auditor who already works in Epic, Cerner, Meditech, or 3M spends the engagement reviewing charts, not learning navigation.

References with tenure

Ask for clients who have used the firm for recurring audits over several years. Repeat engagements are the clearest evidence that the findings were accurate and the education worked.

How HMI approaches coding compliance audits

HMI LLC is a Nashville, Tennessee, healthcare-exclusive health information management firm founded in 1989. Our compliance services include inpatient and outpatient coding reviews, compliance audits, RAC audit support and appeals, and physician documentation review. Every auditor is U.S.-based and holds AHIMA and/or AAPC credentials.

Our audits validate coding against the documentation and the final billed claim, and every engagement ends with provider and coder education on what was found, because an audit that does not change the next quarter's coding has not done its job. Our clients, named by title and organization on our testimonials page, repeatedly describe findings delivered with education their staff could apply immediately.

Frequently asked questions about engaging a medical coding audit company

How large should an audit sample be?

Large enough to be statistically meaningful for the claim types under review, which depends on volume. A focused review of a specific DRG family may need 30 to 50 charts; a baseline review across service lines needs more. A reputable medical coding audit company will propose the sample size and explain why.

Should the audit be pre-bill or retrospective?

Both have a place. Retrospective audits establish accuracy rates and find patterns. Pre-bill audits stop errors before they become claims and are most useful for high-risk DRGs or new coders. Many hospitals run a retrospective baseline first, then add pre-bill review where the baseline found problems.

Will an external audit create a repayment obligation?

If it finds overpayments, yes: a hospital that identifies a Medicare overpayment is obligated to report and return it. That is a reason to audit, not a reason to avoid it. Overpayments a RAC finds carry the same obligation plus the cost of the response, and the OIG treats a functioning audit program as evidence of good faith.

How often should a hospital audit coding?

At minimum annually, with focused reviews after staffing changes, after new service lines open, and after coding guideline updates each October. Hospitals under active payer scrutiny typically move to quarterly.

The decision

A medical coding audit company is not an admission that something is wrong. It is how a hospital finds out, on its own terms and its own timeline, before a payer does. If any of the five signs above describes your department, contact HMI to scope a review.