Auditing from the Trenches: Spotting OIG Red Flags Before the Feds Do
Article Reference Code: NAMAS.09.04.2026
Written by: Dannilla Morgan, CPC, CBCS
The modern auditing landscape has shifted dramatically, moving far away from the days of manual, randomized chart selections driven by simple bad luck or an isolated patient dispute. Today, the Office of Inspector General (OIG) relies extensively on sophisticated data-mining algorithms to spearhead massive enforcement initiatives, such as the major (Office of Inspector General, 2026). These advanced systems evaluate months or years of billing metrics to isolate statistical outliers long before an investigator ever requests an official record. Fortunately, medical coders and internal compliance auditors have access to these exact same data streams. By transitioning from reactive claim correction to proactive data analysis, professionals can identify and mitigate these systemic billing anomalies internally before they escalate into federal liabilities.
To build an effective internal defensive shield, auditors must analyze the exact same patterns that trigger automated government sweeps. A primary vulnerability is the skewed distribution of Evaluation and Management (E/M) levels. Because every clinical specialty adheres to an established bell curve, a provider who submits top-tier codes like 99215 or 99205 for the vast majority of their patient encounters immediately registers as a statistical anomaly. Additionally, predictive data algorithms are highly synchronized to flag fragmented coding or overutilization. This trend is frequently observed when comprehensive services or routine laboratory panels are systematically unbundled into individual components to artificially boost revenue a vulnerability underscored by significant federal enforcement actions involving multi-million (U.S Department of Justice, 2026) dollar. Finally, electronic medical record (EMR) behavioural habits, such as cloning entire progress notes or copying historical patient data forward click-for-click without an updated, distinct clinical assessment, severely compromise documentation integrity and attract intense regulatory scrutiny.
Implementing a highly realistic internal “smoke test” requires moving beyond standard random sampling and executing targeted utilization reviews. Auditors should pull comprehensive six- to twelve-month reports of the practice’s highest-billed CPT codes, separating the data by individual clinician to spot distinct peer-to-peer outliers. When reviewing the charts, the focus must extend beyond basic text validation to analyze electronic behavior, checking for repetitive blocks of text or historical problem lists that lack updated, active management plans.
Once these vulnerabilities are uncovered, closing the loop requires translating complex data into constructive clinical feedback. Approaching providers with regulatory warnings or fear tactics often causes them to disengage; instead, findings should be framed around patient safety, accurate continuity of care, and data integrity. By delivering targeted, practical documentation insights that clarify the specific clinical differences between code levels, internal auditors evolve from retrospective historians into vital, protective assets for the practice.
REFERENCES
- Office of Inspector General. (2026, June 23). 2026 National Health Care Fraud Takedown [Review of 2026 National Health Care Fraud Takedown]. Office of Inspector General | Government Oversight | U.S. Department of Health and Human Services. https://oig.hhs.gov/newsroom/media-materials/2026-national-health-care-fraud-takedown/
- S Department of Justice. (2026, July 9). Guilford County Woman Pleads Guilty to Health Care Fraud in Connection with Million Dollar Urine Drug Testing Scheme. Justice.Gov. https://www.justice.gov/usao-mdnc/pr/guilford-county-woman-pleads-guilty-health-care-fraud-connection-million-dollar-urine
Connect with Dannilla on LinkedIn by Clicking her Name Below:
Dannilla Morgan, CPC, CBCS
Dannilla Morgan is an experienced medical coder/ Risk Adjustment Coder with over five and a half years in the field, focusing on high-stakes Risk Adjustment Coding. As a dual-certified professional (CPC, CBCS), she has a deep understanding of ICD-10-CM guidelines and regulatory frameworks. Her expertise encompasses various risk adjustment models, including CMS-HCC, HHS-HCC, and RxHCC, where she emphasizes the crucial connection between clinical documentation integrity and accurate code abstraction.
Recognized as a leader within the AAPC, Dannilla has been selected as an AAPC Emerging Leader for the 2026-2027 cycle. She currently serves as the President of the AAPC Carmel, NY Chapter and is an active mentor and published author within the organization. In addition to her role at a local chapter, she advocates for the coding community as the founder and r of “The Risk Adjustment Coder’s Lounge,” a professional network of over 8,000 Healthcare professionals.
Driven by her dedication to the field’s evolution, Dannilla is currently pursuing a Bachelor of Science in Health Information Management (HIM) at Southern New Hampshire University and an extern in Revenue Cycle Management and Compliance with Turner Experts Consulting Services. Her work is marked by a strong work ethic and a commitment to maintaining the accuracy of medical coding practices while promoting professional growth for coders across the nation.
NAMAS BLOG Disclaimer:
The NAMAS Blog features content written by both NAMAS staff and guest contributors. Guest contributors may present opinions or perspectives that differ from those officially instructed or encouraged by NAMAS. We believe in providing space for a range of informed viewpoints to foster dialogue, reflection, and deeper understanding within the auditing and compliance community.
Some contributors may use artificial intelligence (AI) tools in the development of their content. The decision to incorporate AI is left to the discretion of the author and does not reflect an endorsement or directive from NAMAS.
If you have questions, comments, or concerns about a specific blog post, we encourage you to contact the individual author directly. Their name and contact information are provided at the end of each post.
