Care Advisor
Back to blog
Medical Billing QA

The Types of Errors QA Audits Actually Catch

Upcoding, unbundling, documentation gaps, and claim denials — based on official OIG, CMS, and AAPC sources, here is a clear look at the errors medical billing QA auditors encounter in the field.

케어 어드바이저 2026.09.11

Note on scope: This article is based on U.S. systems and hiring realities. Content related to Korea is marked with 🇰🇷 Korea in the body.

🇺🇸 U.S. The medical billing QA (quality review and auditing) role involves finding and categorizing errors before or after claims are submitted to payers, or after a denial has occurred, and then reporting on the root causes. The types of errors that repeatedly surface in actual audits fall into a recognizable set of patterns. Understanding these patterns is the fastest way to grasp what this job truly involves.

🇺🇸 U.S. One of the most frequently identified errors is upcoding. The OIG (Office of Inspector General), the audit body under the U.S. Department of Health and Human Services, defines upcoding as the practice of using a code that reflects a higher level of severity or cost than the services actually rendered. The reverse — assigning a lower code, known as undercoding — is equally something QA must catch, because it leads to lost revenue. Both errors are treated as compliance violations regardless of intent.

🇺🇸 U.S. Unbundling is another error commonly found during audits. It refers to billing multiple individual codes for procedures that should be billed under a single bundled code. The NCCI (National Correct Coding Initiative) edit tables, maintained by CMS, specify code combinations that cannot be billed together, and QA auditors use these tables as the standard for identifying unbundling. When this error recurs, payers may escalate beyond claim denial and raise a fraud flag.

🇺🇸 U.S. Modifier misuse is also a core audit item. According to OIG materials, Modifier 25 is frequently abused for the purpose of billing additional charges even when no separately identifiable E/M service exists, and Modifier 59 is repeatedly misapplied as a way to bypass bundling edits. When these modifier errors are not supported by documentation, they result in claim denials or recoupment actions.

🇺🇸 U.S. Documentation gaps are one of the root causes of claim denials. When the medical record does not support the level of service billed, the claim is either denied or flagged for audit. In updating its Medicare Advantage compliance guidance in early 2026, OIG explicitly identified the practice of carrying forward diagnosis codes without actual evaluation or treatment evidence in the medical record as a problem. QA auditors routinely perform line-by-line comparisons to verify that codes align with the corresponding medical record entries.

🇺🇸 U.S. The following is a summary, to the extent verified, of the qualifications actually required for this role. The CPC (Certified Professional Coder) credential from AAPC is the most widely recognized foundational qualification in outpatient (physician office) coding. AAPC requires 2 years of professional coding work experience for full CPC certification; candidates who pass the exam without that experience are designated "CPC-A (Apprentice)." As of 2026, the CPC exam consists of 100 questions and is administered over 4 hours. To maintain the credential, holders must earn and submit the CEUs required by AAPC on a 2-year cycle. 🇰🇷 Korea Work experience at Korean medical institutions or domestic healthcare-related credentials in Korea are not directly recognized toward AAPC or AHIMA certification requirements in the United States. That said, a background in medical terminology and anatomy can genuinely be an advantage during the learning process.

🇺🇸 U.S. Applicants residing outside the United States face structural barriers in this field. HIPAA follows PHI (Protected Health Information) regardless of geographic boundaries. For a U.S. healthcare organization to grant a person living abroad access to PHI, a BAA (Business Associate Agreement) must be in place; however, enforcing a BAA across national borders is far more limited in practice than enforcing one within the United States. In addition, some payer contracts include clauses that explicitly prohibit the transfer of PHI outside U.S. territory. On the employment side, it is difficult for U.S. companies to hire overseas residents as W-2 employees, and large outsourcing firms based in India and the Philippines dominate the remote coding and QA market internationally, making it structurally difficult for individual applicants to compete.

Hiring requirements, visa matters, tax obligations, and contract terms vary by individual circumstances. Before actually applying, please confirm the latest standards with the relevant institution and a qualified professional.

Sources: Official HHS OIG reports and guidance (oig.hhs.gov), publicly available materials related to CMS NCCI edit tables, AAPC official website (aapc.com) — CPC exam format and CEU policy, HHS OCR publicly available guidance on HIPAA Business Associate Agreements (BAA).

Note: This article was compiled by AI from the sources cited above. We strive for accuracy, but for decisions about your specific situation, please confirm the latest guidance from a professional or the relevant agency.

Have a question?

A care advisor will guide you one-on-one, tailored to your situation.

Request a consultation