Podcast
Feb 19, 2026
Roetzel HealthLaw HotSpot: Got an Audit Letter? Here’s What Every Health Care Provider Should Do
In this episode of the HealthLaw HotSpot, Ericka Adler sits down with Lori Cox of AAPC to talk all things healthcare audits. What should you do when an audit letter lands on your desk? Should you review records before sending them? What happens if you disagree with the results or owe money back?
They break down how to respond to audits, when to involve legal counsel and why annual self audits are one of the best ways to protect your practice. If you are a physician, practice manager, or healthcare executive, this is a must watch to reduce risk and strengthen your compliance plan.
To watch the episode on YouTube, click here. To listen, download the episode on Apple Podcasts or click here.
Transcript
Ericka Adler:
Hi, everyone. Welcome to the HealthLaw HotSpot. I'm Erica Adler, shareholder and leader of the health care practice at Roetzel and Andress. Today, I'm here with Lori Cox. Lori's the Director of Client Engagement at AAPC, and has been working in health care for the past 30 years. She's one of our go-to people when our clients have an audit situation. And so, as you might have guessed, today we're going to be talking about how to respond to an audit request, and then what kind of auditing should you be doing in advance to make sure that you're prepared, you know, as a preventative approach as well. So, welcome, and thanks for being here, Lori.
Lori Cox:
Thank you, I'm happy to be here.
Ericka Adler:
Well, we're very excited, and audits are a topic that come up all the time, at least once a week. We have a client that's receiving an audit. Sometimes they're just innocuous requests for records, sometimes they're a little bit more significant. Obviously, we often will put them in touch with someone like you when they get an audit request. So, what I want to do is really, for those out there that either have never gotten an audit request, or think they're doing it right, and may not be, or aren't sure what to do. Let's talk about what you should do when you get an audit request.
Lori Cox:
Absolutely, and it can be a little frightening, but the first thing to not do is to toss it aside, right? You don't want to ignore that. When you get an audit request you need to pay attention. This could be a very slap on the hand situation, or it could be serious enough where they're going to need to call specialists like you and me, right?
Don't ignore it, read through it, what is it asking you to do, and follow through with it. So there's several thousand different ways that you could get an audit request, right? It could be, from a MAC, it could be from a RAC, I mean, we could go through a thousand acronyms.
But follow the request. What is it asking you to do? Is it asking you for medical records? Get those submitted, get them submitted timely, because one thing that we see is that providers, they get that letter. And it says that they want the medical records in 30 days, and 90 days later, it's still sitting on their desk, or sitting on someone's desk somewhere, right? So, respond. That's step one.
Ericka Adler:
Okay, perfect. Now, should they just send what they have, or should somebody be looking at what they're sending before it gets sent?
Lori Cox:
That's a very good question, and a lot of providers will just go ahead and send what they have, but we always say you should review them first, either If you have the staff to do it internally, great, but with the way staff is these days, that may not be, so that's when you get ahold of a specialist, get ahold of your attorney, get ahold of an ABC-certified auditor to get that reviewed first, and you still need to stay within your timely, so you can go ahead and send the records if you've got a very short time timely window, but still have somebody else review them, because what's going to happen is you're going to get the audit back one way or another, and we need to be able to respond.
Ericka Adler:
Okay, so when we're reviewing it before we send it, we're obviously looking to make sure everything's complete, right? What happens, though, if you notice that documentation is inadequate, or coding is wrong, and you have to send those records? What should you, or should you not do?
Lori Cox:
Well, you don't want to change your documentation to make it look better just on the basis of the audit report, right? Addendums and things can be done to documentation, but if the only reason that you're doing it is because you got this audit, and you want to beef up your documentation, obviously that's not correct. If it's something along the lines of you missed something, or something just didn't get documented, you could do an addendum, but keep in mind, most payers are going to see that. You can't just go in and just change your medical record. It's going to be some type of addendum that was done, and they're going to look at that and say: well, you did this addendum after you got your letter for your appeal, so they may not take it into consideration. Either way, you've got to get the records sent in, but if that is a situation that you're facing, and you're going through your documentation before you send it, and you realize, well, it doesn't look like we were on the ball with that. That's where you really want to get, again, like, an attorney or a specialist involved.
Ericka Adler:
Right, when we work with our clients to look at records before they send it in, I mean, obviously we're not changing things, but it gives us some additional time if we've spotted a problem to take the steps to make sure that the issue is corrected as soon as possible going forward. We can actually, when the audit results come back, say, we recognize we did this, we've corrected it, this is what we've done.
We might also start to try and figure out what possible response might we get back? What kind of error rate? What kind of money might we be talking about to kind of wrap our head around that.: And then I would say the third thing would be to try and figure out do we have any arguments to make about, you know, why it might be okay or not okay? So, you know, I mean, I don't know that it's really going to change things too much to look at the records before or after, but using the time effectively and correcting a problem so you don't dig yourself into a deeper hole.
Lori Cox:
Right.
Ericka Adler:
It is a great idea, right?
Lori Cox:
Yeah, absolutely.
Ericka Adler:
You know, one thing you and I should mention is that if you are going to bring in an outside company like AAPC, that you still want to do it through council, right? Yes. So that any of the audit results that you do for yourself are privileged. So just kind of want to mention, don't hire an audit on your own, because, you know, they can be, you know, at risk of having to share information that you wouldn't want shared. Okay, so we're at the point now, you've sent in the records, hopefully in a timely manner. Well, let's just talk about what happens if you miss that deadline first.
Lori Cox:
Well, and in some cases, there could be a little leeway, and that'll be noted in the appeal, or the documentation request, or whatever the payer has sent you. There are some times where you can say, hey, we've got your request.
I remember working with a client who was going through an EMR. change, right? They were going from one EMR system to another EMR system, and so we let the payer know we are happy to send you these records. We are very short-staffed right at the moment due to this EMR update. Can we have an extension? So as long as you reply and ask if you can have that extension, you'll be okay. Now, if it got thrown aside, and now your time is up to send the documentation, I would at least, again, get an attorney, see if you can write to the payer, or whoever it is that's requested your audit, explain the circumstances, hey. Can we still send our medical records to you and get this reviewed? Maybe you'll get somebody that's a little lenient and allow you to do that. Maybe they're going to say, nope, sorry, we're taking our money back on all of these. Hopefully not.
I think they'll give you a little bit of leeway if you can at least give a reason as to why it just got pushed aside. You know, every office is pretty much having some staffing shortages right at the moment, so sometimes you can get a little leeway with that, but you definitely want to get an attorney involved in that aspect.
Ericka Adler:
Okay, so what happens then when you get the audit result back? What are the possible responses that you see, and how do you respond to them?
Lori Cox:
Right, great question. So, there's a couple different ways that it could go. It could be as simple as, well, we reviewed your documentation, maybe one of the 100 claims that we looked at was incorrect, so just do better, and it's kind of a slap on the wrist. That's what you want, right? And then you get the really bad ones, where they're like, well, you owe us $100 million, and you, you have to weigh your own practice. Some very small practices, maybe are going to have to look at outside counsel. Larger practices, like I do work for the University of Missouri, we have internal counsel, obviously we're going to get them involved, but sometimes they even need to reach out and get other entities involved. So you've got to kind of look at what was the results.
Either way, you've got to review them. Were they right? Or were they wrong? I've participated in hearings where the payer said that they're going to hold their appeal, that the company owed them all this money because it wasn't documented correctly, and we went in and said, yes, it was documented correctly, and you're not going to get all your money back. And it works, but you've got to dig into it and see why they're saying that, and then learn from it. If it was your mistake, how can you do better?
Ericka Adler:
Right, and I guess, you know, it's about how much money they're asking for, because if it's not a lot, then it could cost you more to fight it. Yes. But what you're saying is, most of these letters will give you an appeal option, which you'll want to decide if you want to take or not based on the circumstance, right?
Lori Cox:
Absolutely.
Ericka Adler:
If they don't have every record out there, so how do they know how much to ask for if they've only just looked at a sample? Right, and what a lot of the payers will do is extrapolate. So, say if they audited your services and 80% of them they felt like were correct, they're going to apply that 80% to across the board, what they've paid you in the past, you know, however far they can go back when they're looking at.
Lori Cox:
Those payments that they made, and just say, okay, well, you billed us, you know, $100,000 worth of these, we think 80% of them were correct, so you owe us the difference.
Ericka Adler:
Right? Now, there's a lot of different kinds of audits that can happen. Some are civil, some are a little bit more serious, right? So, depending on who it is that's asking for the audit, you'll talk with your lawyer and kind of figure out, you know, what do we need to do to properly respond. In some cases, if it's a lot of money, we can work out payment plans and a lot of payers, though, I think you'll agree, will just take the money back.
Lori Cox:
Money that they owe you, which can really hurt the cash flow of a property. It can, yes, it can, and you don't have a choice. It’s your next check that you're getting from them is going to be decreased by that amount of money, and it's hard to fight those. And again, you're right, you've got to weigh the expense of doing so against. You know, and not just the money, it's your staffing, your time, your resources, all of that added together. Is it worth fighting? And in some cases, yes, it absolutely is, and I say, get an attorney and go for it.
Ericka Adler:
Right. There's so much to think about here, and I think a lot of times practices feel overconfident about being able to handle things themselves, and they do, and it can be to their detriment. What I really want to talk about is what you haven't gotten an audit letter, or let's say you did get an audit and you did just fine. A lot of times that creates a very false sense of confidence. Hey, you know, we did great. But you don't know what a particular payor was looking for when they did that audit. You might need something else that's completely wrong, right? Or potentially fraudulent. And different payers have different rules. So, you know, there's a little bit of when, you know, oh, we've been audited many times, we've always done fine, doesn't mean you're going to be fine. You know, one of the things the government is looking for, and many commercial payors are looking for, is a proactive approach.
Lori Cox:
Yes.
Ericka Adler:
Compliance. And a big piece of that is billing, auditing, coding, and implementation. So, what I want to talk to you about, and what I want here, the practices who are listening to this, is that part of your compliance plan needs to be a self-audit.
Lori Cox:
Yeah.
Ericka Adler:
I don't mean that you have your regular billing people look at some charts, because you can't have the same people doing your billing, overseeing, you know, whether you're doing things.
Lori Cox:
Absolutely.
Ericka Adler:
Obviously, they think they're doing it right.
Lori Cox:
With a billing company, they're really no different. The same people doing your billing probably shouldn't be the ones that are on.
Lori Cox:
Yeah.
Ericka Adler:
Impossible. So, what we usually recommend is an outside billing audit, and it does not have to be huge, and it does not have to be expensive. What it needs to be is some kind of sample of what's going on. So, why don't you take us through that process for a practice that, has been doing Pretty good, maybe they've had a few tiny audits, but they really are using, you know, just a local billing company or in-house billing people.
For compliance purposes, what are your recommendations for them?
Lori Cox:
Absolutely, and you make a very good point when you talk about the separation, the checks and balances. You cannot have your coders doing your audits or your billers doing your audits. You've got to have a separate team. So at the University of Missouri, for example, we have a compliance team, we have a revenue integrity team, and they do the audits. They're not involved in the coding or the building whatsoever. It's completely separate, but we still outsource to some vendors, because it's good to have that outsourced, even if you've only been audited internally for years. You need to have an external company come in that's unbiased, doesn't know that much about your company, because they're going to find things that you wouldn't have realized that they would find. So, yes, we recommend every clinician is audited every year. That needs to be in your compliance plan. You're going to be audited every year, and it could be 10 charts. That's what a lot of clients do. Some do 20, some do 50. 10's kind of the minimum. I wouldn't do less than 10 a year. But you need to be audited, every clinician, every year, at least 10 charts. And you're right, it doesn't have to be expensive. It does not cost that much to have a vendor come in and audit 10 charts.
Ericka Adler:
It can be way more expensive not to, right?
Lori Cox:
Yeah, very much so.
Ericka Adler:
So, once you do this audit, and usually when we're involved, let's say there's 5 doctors, we might do 10, 15, 20 charts, across the board. We're looking at documentation, we're looking at coding, we're looking at other relevant aspects, depending on the type of practice, like modifiers or whatever might. But there's other things that you can audit for as well, whether they're doing Incident 2 billing properly, right? And other nuances of a practice that, you know, depending on your particulars of your practice.talk with the auditor or your lawyer about things we need to make sure you're doing right. So, what happens once you come back and you say, look, this is our results for you?
Lori Cox:
And it's pretty much the same thing as if they had gotten an audit like the ones we were just talking about. Read through an appeal. So if AAPC comes in and they do your audit, your external audit for you, first go through the results. Do you agree with them, or was there one that maybe we said should have been a 9, 9, 2, and 4, and you're thinking, no, I really feel this was a 5, and here's why. And then rebut. And we do this with not only clinicians, with our coders, too. Our coders are audited as well. So audit your coders, and then they rebut, you know. I don't agree with this, and here's why. So again, it shouldn't be an audit that comes in and says, we're right and you're wrong. It's a, here's what we think, what do you think, and let's figure it out together. It should be an educational, communicative process, not a derogatory one, so to speak.
Ericka Adler:
Okay, and then typically, would the process then be followed up with education, I would assume, right? The problem is that you really did do the work, and it was coded properly, but the document didn't support it, then we need education on documenting, or vice versa. You, you know, you wrote down what you did, but it wasn't the level that you thought it was, right?
Lori Cox:
Education, absolutely.
Ericka Adler:
So, education, and then, it's interesting, because when we do year-over-year audits, we should see improvements.
Lori Cox:
Yes.
Ericka Adler:
But sometimes, usually it's the same people that just, you know, might need a little bit extra help, right?
Lori Cox:
Right.
Ericka Adler:
Right. This is where the lawyers come in, because a lot of times in our contracts, we might hold particular doctors responsible if there is.recruitment for, you know, amounts due to their billing or coding, where they were educated, and they disregarded, or didn't follow the education, or something like that. So, your lawyer can kind of help.
So, let's talk about extrapolating the results of a private audit. Now, you did it for educational purposes, but now, now we're aware that, let's say we overbilled. I mean, underbilling is one thing, obviously, don't really talk about that, although that can be its own issue, obviously, but where we've discovered that we've overbilled, and let's say it's a commercial payor versus a federal payor, because a big difference - right?
Lori Cox:
Yeah.
Ericka Adler:
What do you usually talk to your clients, or what do they like to do when they see that that's happened?
Lori Cox:
And we have clients that'll go to the extremes or not really care. Not that they don't care about it, but I mean, it's educational, or is it really something that we need to do a payback on? So, again, we kind of go back to the analogy we used earlier, where if it was one claim out of 100, maybe that's just, hey, do better. But if it's 60 claims out of 100, now we have a problem, right? So you kind of have to look at what was the audit result itself, how risky is this? And maybe that's when you go to an attorney and say, what do you think about this? But generally, if it's a very small, like, onesie-twosie thing, our clients will say, hey, let's just educate our providers, and we'll use the education and move on. Then we have some clients that even if one claim was wrong, they're going to go ahead and send their money back. When it's a government payer, you want to do that for sure, because they have some different guidelines. But our commercial payers, sometimes you can be a little lenient. And we do have clients that will say, well, yes, we realized we overcoded this, we billed a 5, it should have been a 4, we realized it was an error, let's go ahead and send that money.
And then you'll have the clients that, again, they get a larger audit, and it's a little bit more risky, and in that case, you do want to get an attorney, and possibly Use extrapolation and figure out, okay, if we really were wrong 60% of the time.are 60% of our claims really incorrect? Do we want to audit some more and see where we are? And then get an attorney and figure out, okay, what's the best way to approach them? We're self-disclosing now because we found the problem internally. And how can we move forward?
Ericka Adler:
Right. Yeah, it can definitely be a complicated process. You know, this is another reason we like those audits, even private ones, to run through Council, because if we do find out something, we want to privileged. It's a tough situation, you know, no client wants to give money back, right?
It's a risk assessment. Obviously, from a legal standpoint, we want you to comply. If it's federal dollars, and you have found that you've actually received money improperly. You’re kind of wading into some federal laws if you choose to return it, and that's a risk assessment that you should talk to your lawyer about. But, you know, there's so many pros and cons. We want to do it to be better, but then we find ourselves in a situation where, oh, no, now we have to get back.
That's why, you know, auditing early and repetitively repeatedly, it really kind of saves you money in the long run. Yes. You don't have to deal with little lawyer fees or large, you know, audit refunds. So, yeah, I mean, there's a lot to think about when it comes to that process, right?
Ericka Adler:
Alright, so you've come in, you've done the audit, you've educated, and then you've already said that you recommend people do this at least annually, right? Is there anything else about the audit process that you would want people to know or understand?
Lori Cox:
I mean, there are a thousand different ways to go with it, but I think the biggest thing is, again, don't ignore it. Follow the process that's in the letter or the request that you received from whoever, the government or the payer, or an external auditor. Just follow the guidelines and you should really be okay. It's not, unless you're really doing things wrong, you know, and you're really out to fraud the government, then, you shouldn't have too much of an issue. It's just figuring out what is the risk to your organization, and how can you move on from that.
Ericka Adler:
Right. No, I agree, audits are super important, and my biggest fear is practices that are using, home-trained billers and coders, not certified people who - and I'm not saying you can't educate yourself on how to do this - but the laws and the rules change so quickly and so often, it can be really hard to stay on top of it. So, if you're using your own auditors, your own builders, your own coders, make sure you're spending money on education and coding classes, and doing whatever you need to do. And the one piece of advice, if I have doctors listening to this, is I always tell my doctors, you be the best builder and coder in the room, right? Whether you're in a hospital or in a practice, you know, don't assume that, you know, they're going to catch whatever it is that you're doing wrong. Educate yourself, and doctors really should be doing this as part of their continuing education requirements.
Lori Cox:
Great.
Ericka Adler:
You know, they're so smart, and they're totally able to understand how to build and code properly, and, you know, I know it's not their job, but there is a lot of pressure on them in most employment agreements I'm looking at to be doing it right. So, they should be taking it upon themselves, whether they're the owner of a practice or just an employee somewhere, to be responsible for doing it properly.
Lori Cox:
Absolutely.
Ericka Adler:
Alright. Well, thanks for joining us, Lori, I really appreciate it. If anybody has any questions about the audit process, they're interested in having the audit done, they've received something on their desk that scares them, please feel free to reach out to me, Lori, get some guidance, you know, you're not alone. There's a lot of help out there, and let's just make sure we're doing what you need to do to protect your practice.
This has been the HealthLaw HotSpot. Thanks for joining us, and you can check out the rest of our podcast at ralaw.com. We'll see you next time.
