Even a two- or three-provider independent practice benefits from routine coding audits, not just large groups with dedicated compliance staff. The stakes only grow as a practice adds providers, locations, or procedure lines.
This article distinguishes a coding audit from a billing audit or a broader compliance review, then gets practical: what urology auditors actually examine, how to plan an audit, what to do with findings, and when bringing in outside expertise makes sense.
Key Takeaways
- A coding audit compares documentation, codes, modifiers, medical necessity, and payer rules against what was billed
- Audit scope should match your service mix, payer mix, and known denial patterns — not a generic template
- Useful audits find root causes and corrective actions, not just error counts
- External auditors should be vetted for urology knowledge, clear methodology, and PHI safeguards
What Urology Medical Coding Auditors Do
A medical coding auditor reviews whether the diagnoses, procedures, E/M services, supplies, drugs, modifiers, and claim details submitted for an encounter are actually supported by the medical record and applicable payer rules. In practice, that means reading the clinical note and asking: does this story match what was billed?
Auditors check:
- Documentation completeness against the code selected
- Medical necessity for the diagnosis-procedure pairing
- Modifier use, sequencing, and bundling edits
- Payer-specific requirements, including LCDs and prior authorization rules
Coders assign codes. Auditors assess whether those codes, and the workflows behind them, are accurate and defensible. That distinction matters because an audit finding isn't automatically evidence of fraud. Most errors trace back to unclear documentation, an outdated EHR template, a training gap, or a payer policy that changed without anyone noticing.
Where Urology-Specific Risk Concentrates
Four clusters show up repeatedly in urology coding reviews:
- Modifier 25: used for a significant, separately identifiable E/M service on the same day as a procedure; frequently applied without documentation to back it up
- Modifier 59 and the X{EPSU} subset: meant to identify distinct procedural services; the most common source of unbundling denials
- Laterality (RT/LT): missing on kidney and ureteral procedures creates a clean, entirely avoidable rejection
- Medical necessity documentation: the code may be correct, but the note doesn't carry the indication
Bundling rules matter here too. CMS's NCCI manual states that TURP includes meatotomy, urethral calibration or dilation, urethroscopy, and cystoscopy — none of those are separately reportable. Catheterization performed just before surgery falls into the same category.
Drug administration carries its own exposure. BCG instillation is unit-defined (1 mg per unit), so billed units need to match what was actually instilled. Separately payable supplies, devices, and drugs that get used but never captured on the claim are a quiet but recurring urology revenue-leakage point.
A solid audit covers office visits, in-office procedures, diagnostic testing, injections and drugs, endoscopic work, surgery, and the postoperative global period — not just the highest-dollar service line.
Types of Coding Audits and Who Performs Them
Audits get classified along a few independent dimensions, not one universal checklist. Understanding each dimension helps you describe what kind of audit you actually need.
- Reviewer: internal staff versus an external auditor
- Timing: prospective (before billing) versus retrospective (after billing)
- Selection method: random sampling versus risk-based targeting
- Scope: broad compliance review versus a focused, service-specific look
If you've seen the question "what are the four types of audits?", the honest answer is that terminology varies by source. Rather than memorizing a fixed list, define each audit by who's reviewing, when, how records were selected, and what's in scope.
A baseline audit measures overall performance across a representative sample. A focused audit investigates something specific: rising denials, a new modifier pattern, or a single high-risk procedure like intradetrusor onabotulinumtoxinA injections.
Who typically performs these reviews:
- Internal coding or compliance staff
- Qualified external auditors or revenue-cycle specialists
- Multidisciplinary teams combining providers, coders, and administrators
- Payer or government contractors (in response to a specific trigger)
Choosing between internal, external, or a hybrid approach comes down to a few questions:
- Does your staff have the specialty depth to review urology-specific bundling rules objectively?
- Is there a known risk that needs an outside, unbiased look?
- Can you maintain confidentiality and a consistent methodology internally, or does the practice need external benchmarking?
How to Plan and Conduct a Urology Coding Audit
Every audit needs a stated objective before anyone pulls a chart. Are you measuring baseline accuracy? Investigating a denial spike? Validating a new procedure line? Checking the effect of a payer policy change? The objective determines everything downstream.
Setting Scope and Sampling
Define the audit period, providers, payer categories, encounter types, and specific code families you'll review. Include both high-volume services (office visits, cystoscopy) and high-risk ones (lithotripsy, Botox injections, global-period surgical claims). A sample that only covers routine encounters will miss where the real exposure sits.
On sample size, there's no urology-specific formula, but OIG's compliance guidance offers a reasonable starting point: five or more records per federal payer, or five to ten records per physician, as a basic guide rather than a mandate.
The same guidance recommends examining claims from the first three months after any new training, then auditing at least annually afterward.
Pull together before you start:
- Complete medical records and corresponding claims
- Remittance and denial data
- Current coding references and payer policies
- Prior authorization records where relevant
- EHR templates and charge-capture workflow documentation
Reviewing Each Encounter
Work through a repeatable order:
- Confirm patient and service details
- Read the clinical note
- Validate diagnosis and procedure codes
- Check modifiers and bundling edits
- Assess medical necessity and compare against payer-specific requirements
Record the authoritative source for every finding (a payer policy, an NCCI edit, or an LCD) so the result holds up if questioned later.
Urology-specific prompts worth building into the checklist:
- Does the procedure note actually describe what was done?
- Does the diagnosis support the procedure or test ordered?
- Is a separately reported service genuinely distinct, or should it be bundled?
- Does a global-period rule apply to this encounter?
- Are drugs, supplies, imaging, and professional components documented and billed correctly?
A quarterly sample against the four recurring clusters (modifier 25, modifier 59/X{EPSU}, laterality, and medical necessity) tends to catch problems before a payer does.
Protecting PHI Throughout
Whether you're using an outside auditor or cloud-based software, apply minimum-necessary access limits, encrypt data in transit, and document how files move between systems. If an external reviewer touches PHI, a business associate agreement needs to be in place before the engagement starts.
Turning Audit Findings Into Corrective Action
Findings are only useful if they change something. Organize them by severity, frequency, financial exposure, affected payer or service line, and whether the issue is isolated or systemic.
Separate the error types clearly:
- Undercoding and overcoding
- Unbundling
- Modifier errors
- Unsupported diagnoses
- Missing documentation
- Medical necessity gaps
- Claim submission mistakes
Root cause matters more than the error category. Ask whether the issue started with provider documentation, coder interpretation, an EHR default, a charge-capture gap, or a training deficiency. Internal denial-report work often sorts into five root-cause buckets (registration/eligibility, authorization, coding, documentation/medical necessity, and submission/timing), each with its own workflow owner.
If more than about a fifth of denials land in an "other" or unclassified bucket, that taxonomy itself is the first thing to fix.
Rank findings by dollars, not just count. A single denied surgical claim can outweigh dozens of small office-visit denials combined, so a $95 E/M denial and a several-thousand-dollar surgical claim shouldn't be weighted the same way on a report.
Building the Corrective Action Plan
- Name an owner for each finding category
- Define the action and the guidance that supports it
- Set a completion date and education method
- Make a claim-handling decision where one is needed
- Schedule a re-audit point to confirm the fix worked
A practical approach: pick the single largest root-cause category by dollar impact each month, assign it to the owning step, set one measurable target, and check it against the same cut next month.
Present results differently depending on the audience: a short risk-and-action summary for owners, specific documentation feedback for providers, technical rationale for coders, and workflow changes for administrators. Frame corrective education around real urology examples rather than blame; an updated EHR template or a quick coder refresher usually fixes more than a memo does.
Choosing an External Urology Coding Auditor
Bringing in an outside reviewer makes sense in several situations:
- Internal capacity is limited
- You're launching a new service line
- Denials have persisted despite internal fixes
- Coding and clinical staff disagree about how something should be billed
Vendor-evaluation checklist:
- Urology or comparable specialty experience
- Reviewer qualifications (such as CPMA certification)
- Clear audit methodology and sampling rationale
- Cited sources for every finding
- PHI safeguards and a signed business associate agreement
- Conflict-of-interest disclosures
- Re-audit or follow-up support included in scope
Ask for a redacted sample report before signing anything. Ask how the review process works, what provider education looks like, and exactly what the engagement does and doesn't cover.
A credible auditor won't promise a specific recovery amount, and won't label ordinary coding variance as fraud without solid evidence. That distinction matters. It's the same standard GrowUrology applies across its own content: claims carry sources, and numbers that haven't been validated get left empty rather than invented.
If you're trying to frame the economics before or after an audit, GrowUrology's free tools can help. The Practice Health Check, Procedure Profitability Calculator, and Reimbursement & Prior-Authorization Lookup all run in the browser with no email required and nothing stored.
GrowUrology is published by Persistex, a Massachusetts-based medical billing and revenue-cycle management firm. If a practice wants help acting on what an audit turns up, the "Analyze My Urology Practice" conversation with Persistex is available, entirely optional, with no obligation attached.
Frequently Asked Questions
What do medical coding auditors do?
They review documentation, codes, modifiers, medical necessity, and claims against payer rules, then report patterns and recommend corrective action. Unlike production coders, their job is to assess whether coding decisions and workflows hold up, not to assign the original codes.
What is a coding audit?
A coding audit is a structured comparison of clinical records and submitted codes against applicable coding, documentation, compliance, and payer requirements. It's one piece of a broader compliance program, not a synonym for it.
Who typically performs coding audits?
Internal coding or compliance staff, qualified external auditors, multidisciplinary practice teams, or payer and government contractors. Reviewer independence and specialty knowledge both matter for credible results.
What are the four types of audits?
Terminology varies across sources, so there's no single universal list. The common dimensions are reviewer (internal/external), timing (prospective/retrospective), selection method (random/risk-based), and scope (broad/focused).
Which software is used for auditing?
Common categories include EHR and billing-system reports, claims analytics tools, coding reference databases, spreadsheet tools, and secure audit-workflow platforms. No single product is standard across urology practices.
What are the 5 C's of audit?
There's no single, consistently sourced "5 C's" framework specific to coding audits. A related professional model describes five attributes (condition, criteria, effect, cause, and recommendation) used to structure audit findings and reports.
