The Centers for Medicare & Medicaid Services (CMS) and private payers are on a hunt to retrieve potential overpayments to physicians, and their new focus has put many doctors on edge.

CMS has pledged to hire more medical coders to find coding and billing infractions. They’ll focus mainly on Medicare Advantage Plans, which now serve about 55% of Medicare enrollees.

Doctors and hospitals that don’t take Medicare Advantage Plans are still in the hot seat, however. Commercial insurers continue to audit provider claims and Medicare Administrative Contractors and Recovery Audit Contractors review Medicare payments to identify overpayments and occasional underpayments.

“An external audit from payers scares doctors, who fear that the auditors will find something and extrapolate over all payments — and then they’re going to have to give back a lot of money,” said Betsy Nicoletti, president of CodingIntel, a coding resource for medical practices. “A CMS audit brings the risk that if the situation is really bad, you could lose your privileges with Medicare and face potential criminal charges. With private payers, you may have to pay money back, but you’re not going to need a criminal lawyer.”

In January 2026, Kaiser Permanente affiliates agreed to pay back $556 million following allegations that they submitted invalid diagnosis codes for Medicare Advantage patients. And in early 2026, the Department of Health and Human Services Office of Inspector General (HHS-OIG) reported recovering $814.1 million from audit and evaluation receivables in the prior 6 months. 

CMS feels that providers in Medicare Advantage Plans are reporting Hierarchical Condition Codes without having the substantive support in their notes to demonstrate that they are in fact managing these conditions at every visit, said Pam D’Apuzzo, CPC, CPMA, Managing Director, VMG Health. “Medicare is tracking all of this.”

How Likely Are You to Get Audited?

A doctor or medical practice may be chosen at random for an audit. Or an angry or dissatisfied patient or a staff member may make a complaint against a practice, triggering an audit. The $556 million Kaiser case was initiated by a whistleblower.

More often, CMS and private payers use software to identify billing irregularities; physicians coding above the benchmark for their specialty, or coding too many high risk service categories. “Triggers may include billing more levels 4 and 5 than is typical for your specialty; or billing modifier 25 (indicating two separate E/M [evaluation and management] services by a doctor on the same visit) more than is average for your specialty,” said Nicoletti.

Even careful physicians make inadvertent coding errors. “Many of the challenges for family physicians stem from increasingly complex payment policies and review processes rather than straightforward coding errors,” said Sarah Nosal, MD, FAAFP, president of the AAFP and assistant professor in the Mount Sinai Department of Family Medicine & Community Health, New York City. Physicians have to navigate differing payer rules, proprietary claim-editing programs and retrospective review that can vary from one health plan to another, she said.

“You can’t necessarily prevent an audit, but you can reduce your risk and be prepared for one,” Nosal said. “Early in my career, I recall threatening letters for appropriately coding patient visits which were high complexity — hinting that if I didn’t start downcoding I would be more likely to face the burden of an audit — even if no wrong during was implied or assumed.”

Here are key areas that coding auditors commonly target:

E/M services, which make up 40% of the charges of allowed services for Medicare. E/M services will always be an issue, said Nicoletti. “There’s still disagreement between coders, auditors, and physicians about what’s the correct level of service.” Physicians may feel that they’re doing a lot of work for a patient, but their coding of it doesn’t fit the work done, she said.

Use of modifiers, particularly modifier 25. “This allows you to get paid for two services performed on the same day. You need to make sure your documentation really qualifies these services for this modifier,” said Nicoletti.

Billing for ‘incident to’ services, where a nurse practitioner or physician assistant (PA) treats the patient, but can bill at the physician’s rate. “There’s a 15% differential whether you bill under physician or NP or PA,” said D’Apuzzo. “The rules for ‘incident to’ for a physician to hand over care to an NP or a PA are very specific. It has to be an established patient; an established course of treatment; no changes in the plan, no change in medication. It can’t be used for a new patient. Doctors may think that if they have a discussion with the PA about a new patient that the PA sees, it qualifies as incident to, but it doesn’t.”

Coding patterns above the benchmark for your specialty. If you’re regularly billing top-level codes (like 99214 or 99215), you’ll be outside of the national bell curve for your specialty and will flag your account. “You don’t want to be an outlier, but sometimes it’s hard to know if you are or not. “CMS has some data accessible,” said D’Apuzzo.

Telehealth is an area where physicians need to pay close attention. “The rules and covered services have evolved considerably,” said Nosal. “Documentation needs to support the service and the applicable telehealth requirements, with location, origination and pay parity remaining a moving target. Newer physicians are often surprised that medical codes and even billing codes may exist for certain diagnoses and certain services provisioned, but that doesn’t guarantee payment for these services even when captured.”

To lessen your chances of being audited, here are some important steps you can take:

• Do an internal self-audit every year, advised Nicoletti. Look for different coding patterns between physicians in your practice. Physicians in a group might even periodically review evaluate a sample of each other’s billing records. Consider bringing in an outside auditor to evaluate your medical records and billing.
• Keep up to date with current coding and documentation rules. “If you’re in independent practice, sign up for your payers’ newsletter to stay on top of any changes to their policies,” said Nosal. “If you’re employed, make sure your systems billing and coding offices have done the same.” Become a member of your specialty society and read their newsletter. Check your specialty organization sites because they often post coding information.

Review helpful information, such as the AAFP billing and coding resources. The CMS website has benchmark data available for E/M billing by specialty. D’Apuzzo’s company uses a tool called CRA (compliance risk analyzer), which uses benchmarks and analytics. It’s available to clients and companies that can get it on their own. MGMA has benchmark data.

• Look at Office of Inspector General OIG work plans every year. It will tell you what their upcoming projects and focus will be. “If the OIG is looking at it, I want to look at it,” said Nicoletti.
• Have more interaction with your coders, if possible. “In a big multispecialty practice, the coder works for the head of coding and may have no interaction with the doctor. If the two parties are able to meet, sometimes doctors can explain and can help to educate the coders about clinical issues. The coders can help the physicians understand some of the rules,” said Nicoletti.

What to Do If You’ve Been Targeted for an Audit

“An audit can range from what might seem like a relatively simple request for a few medical records to a more extensive review,” said Nosal. “Even a request for less than a dozen charts should be taken seriously — often findings from a small group of charts are used to extrapolate findings to a much larger contracted patient population.”

“If you’re contacted or informed that you’ll be audited, there is no question that you have to call a healthcare attorney,” said Nicoletti. “You also want to make sure the practice manager and compliance officer know that you received that communication.”

D’Apuzzo added, “Don’t amend any notes and don’t change anything. “Provide everything you can in support of that note, whether it’s labs or a note from another provider. The collective of what you’ve done may support the intensity of the work that was reported.”

Important Reminders About Coding Audits

“Don’t let fear of audits drive your coding decisions,” said Nosal. “Don’t choose a lower code because you’re afraid of scrutiny or a higher code simply because a diagnosis sounds complex or an electronic system suggests it. Always code for the care you actually provided, and document it clearly.

“Remember that undercoding can be harmful, too; it fails to capture the complexity of the patients for whom you care and leaves money on the table for care that you provided needed to sustain your practice,” said Nosal.

The experts cited in this article had no relevant disclosures.