Responding to Audits: Corrective Action Plans and Overpayment

Why Audit Response Matters

When an internal review, a payer audit, or a government contractor identifies billing errors, the provider organization must respond in a structured, documented way. A weak or incomplete response can signal to payers and regulators that the problem is not being taken seriously, which may invite further scrutiny or trigger formal investigations. A well-executed corrective action plan (CAP) paired with prompt repayment of any overpayment demonstrates good faith, reduces legal exposure, and protects patients by improving care documentation.

As a coder or biller, you may be asked to contribute to—or even draft—a CAP. Understanding the full process is a core professional responsibility.

What Is a Corrective Action Plan?

A corrective action plan is a formal written document that responds to audit findings by identifying what went wrong, why it went wrong, and exactly how the organization will fix it. A complete CAP contains five essential components:

1. Root cause identification — A clear explanation of why each finding occurred. Common root causes include coder knowledge gaps, lack of documentation templates, inadequate physician training, or failure to follow established coding guidelines.

2. Corrective steps — Specific, actionable interventions that address each root cause. Vague language such as "improve coding" is not acceptable. Instead, state measurable actions: "Provide a two-hour E/M level-selection training to all outpatient coders by [date]."

3. Responsible parties — Named individuals or roles (Compliance Officer, Coding Supervisor, Billing Manager) accountable for each corrective step.

4. Timeline — Realistic deadlines for each corrective step. Timelines that are too long suggest low urgency; timelines that are impossible to meet undermine credibility.

5. Re-audit schedule — A commitment to retest the corrected process, typically within 90 days. The re-audit confirms that the corrective steps actually worked and documents ongoing monitoring.

Every finding in the original audit must be addressed individually. If the audit identified three problems, the CAP must contain three separate corrective responses.

Common Audit Findings and Their CAP Responses

Upcoded Evaluation and Management (E/M) visits occur when the level of service billed is higher than the documentation supports. The root cause is often misapplication of E/M guidelines (for example, the 2021 AMA guideline changes). Corrective steps include targeted E/M training and a pre-bill documentation checklist.

Missing modifiers occur when a claim lacks a required modifier (such as modifier 25 or 59), causing incorrect payment or claim denial. Root causes include coder unfamiliarity with modifier rules or a failure in claim-scrubbing software edits. Corrective steps include modifier training and updating scrubber rules.

Unsupported diagnosis codes occur when a diagnosis is coded but the medical record does not contain adequate documentation to support it. Root causes include coders assigning codes from a superbill rather than reviewing the actual record. Corrective steps include requiring review of the full note before code assignment and physician education on documentation requirements.

Overpayments: The Legal and Ethical Obligation to Repay

When an audit reveals that Medicare or another payer paid more than was owed, there is both an ethical and legal obligation to repay the excess. For Medicare, the Affordable Care Act established a "60-day rule": once a provider identifies and quantifies an overpayment, they must report and return it within 60 days. Failure to do so can expose the organization to False Claims Act liability.

For commercial payers, most provider agreements contain contractual language requiring prompt repayment of overpayments. Always check the specific payer contract.

The Overpayment Repayment Process

The repayment process involves several steps:

1. Identify the overpayment — Confirm through the audit that a payment error occurred and determine the correct amount that should have been paid.

2. Calculate the repayment amount — Subtract the correct allowable amount from the amount actually paid. If the payer uses a fee schedule, reference that schedule for the correct allowed amount.

3. Identify the correct reporting pathway — For Medicare, CMS provides guidance on how to report and return overpayments depending on whether the amount was received within the current year's cost report period or in a prior period. Contact the Medicare Administrative Contractor (MAC) for the appropriate mechanism, which may include the Self-Reported Overpayment process or use of the CMS OIG Self-Disclosure Protocol for matters involving potential fraud.

4. Draft the disclosure letter — The voluntary disclosure letter should clearly state the claim or claims involved, the reason for the overpayment, the calculated repayment amount, and the organization's corrective actions. It should be professional, factual, and signed by an authorized representative.

5. Submit payment and retain documentation — Keep copies of all correspondence, calculations, and proof of payment.

Safety and Scope Considerations

Patient safety is directly linked to coding accuracy. Unsupported diagnosis codes can distort a patient's health record, affecting future clinical decisions. Upcoding misrepresents the severity of a visit, which can corrupt quality metrics used to evaluate care. Coders must never alter documentation or back-date entries to support a code after the fact—this constitutes fraud and is a serious legal and ethical violation. If documentation is insufficient to support a code, the appropriate step is to query the provider through a compliant query process, not to assign the code anyway.

Coders operate within scope: the role is to accurately represent what is documented, not to create or improve the clinical record.