Find out everything about the vision, mission, and the people who shape CompuGroup Medical worldwide. Investors will also find helpful information, documents, and other publications.
Most providers think of a medical auditor as someone looking for mistakes. That framing gets it backwards. "It is my passion that I get the maximum reimbursement for my providers," says Sheila McCarthy, a certified professional coder with ARIA Coding Services. "That is always my goal."
Auditors work best as an extension of the clinical team—identifying documentation gaps, flagging missed billing opportunities, and recommending improvements to EMR templates that are, as Sheila puts it, "a detriment more than a help" for a surprising number of providers.
The goal isn't fault-finding. It's making sure the work clinicians are already doing gets properly recognized and reimbursed.
Evaluation and Management services represent the cognitive work of medicine: assessing a patient’s health status, weighing the complexity of their problems, reviewing and interpreting data, and managing risk. Unlike procedural billing, there’s no single measurable output. A skilled auditor is reconstructing clinical judgment from a written record, and that record needs to tell a coherent story.
Since 2021, E&M levels of service have been determined by one of two criteria: Medical Decision Making (MDM) or total time spent on the date of the encounter. The old bullet-counting method for history and physical exam components is gone. Many providers—and many EMR templates—haven’t fully caught up.
The chief complaint frames everything that follows. A vague CC weakens the entire note.
Brad Sirota, coding supervisor and certified professional medical auditor, is blunt about the difference.
"A weak chief complaint reads simply: 'Follow-up.' Follow-up for what? A strong one reads: 'Follow-up for uncontrolled type 2 diabetes with worsening fasting sugars despite Metformin®.''"
From my perspective as an auditor, the chief complaint frames the medical necessity. If it’s vague, the whole encounter weakens.
Best-practice chief complaints are problem-oriented, specific, tied to medical necessity, and they set up the risk and complexity that will justify the level of service billed. Everything else in the note should be congruent with it.
Under current AMA guidelines (CPT® 2026, page 7), the nature and extent of a patient’s history and physical examination are determined by the treating physician or qualified healthcare professional—not by a checklist. The extent of the history and physical exam is no longer an element in selecting the E&M level of service. What matters is whether it’s medically appropriate, and that determination belongs to the provider.
"We are no longer counting multiple bullet points for that," Brad said.
The exam should correlate with the complaint. If a patient presents with left foot pain and the documentation goes into detail about the right shoulder, the note loses credibility. “Does the exam correlate with the complaint?” is exactly the question an auditor asks. If the answer is no, the note may not support the level billed—regardless of how thorough the exam itself was.
For the history, best practice means telling a story, not templating one. The HPI no longer drives level of service selection, but it supports problem complexity, data reviewed, and risk. Document progression or stability, symptom severity when relevant, response to treatment, and compliance issues when clinically significant. Non-compliance due to cost or forgetfulness belongs in the note—it informs both the clinical picture and the complexity of management.
Medical Decision Making is defined by three elements—the three columns of the AMA MDM Audit Grid. To achieve a given MDM level, a provider must meet the threshold in at least two of the three columns.
"You have to achieve two out of the three levels to meet your medical decision making requirement," said Brad. "A moderate in Column I, a low in Column II, and a moderate in Column III still yields moderate MDM—because two of the three columns meet the moderate threshold."
Auditors use an acronym to evaluate whether a condition was genuinely addressed at the encounter: M.E.A.T.—Monitored, Evaluated, Addressed, and Treated.
Consider a 55-year-old male with hypertension, hyperlipidemia, and type 2 diabetes who presents for routine follow-up. His fasting glucose readings have been running 140–180 over the past month despite Metformin®. In the assessment, hypertension gets no plan. Hyperlipidemia gets no plan. Diabetes gets a medication refill and a follow-up A1C. “If it doesn’t meet MEAT, it doesn’t count,” Sirota says. Only the diabetes contributes to MDM complexity—the other diagnoses appear on the problem list but were never addressed.
Two or more self-limiting or minor problems document as straightforward. Two or more stable chronic illnesses being actively managed—blood pressure medication, thyroid medication, both stable—reach low complexity in Column I. What pushes a visit into moderate is a chronic illness showing exacerbation or progression, or a new problem with an uncertain prognosis. The difference has to be in the note. “You need to document that in your chief complaint,” Sirota says, pointing back to how the CC sets the stage for everything downstream.
Column II is, as Brad describes it, "probably the most commonly under-documented and misunderstood part of your medical decision-making grid." It encompasses five distinct data elements.
The provider's own review and interpretation of a test, distinct from any reading already performed by another clinician. The documentation must reflect personal review, the provider’s own clinical interpretation, and how it affected the plan of care. Simply noting "labs reviewed" or "radiology reviewed" does not meet this standard. Neither does reviewing only a radiologist's impression—the provider must engage with the underlying data themselves.
The double-dipping rule is where this gets nuanced. An oncologist who independently interprets a CT of the abdomen without contrast and also bills for it using modifier 26 cannot count it again toward MDM. The same oncologist who performs the independent interpretation and does not separately bill the professional component? She can count it.
The distinction relies on whether the professional component is being reported and reimbursed separately.
External records from outside the group or from a different specialty. Multiple documents from the same cardiology group count as one source regardless of how many pages arrive. Documents from cardiology, nephrology, and neurology each count as separate unique sources. Source count is what matters, not document count.
Tests ordered during an encounter are presumed analyzed when results are reported—the provider gets credit at the time of ordering, not when results come back. Tests ordered in a series, like recurring INRs for a patient on anticoagulation therapy, work differently: each result is counted in the encounter where it’s reviewed. And once a test has been credited in a prior visit, it cannot be counted again when reviewed later.
A parent, guardian, spouse, or other individual who provides history the patient cannot reliably provide themselves. Translation services do not qualify. For pediatric practices especially the provider cannot assume a parent’s presence implies their contribution.
"The auditor cannot and will not assume that someone else provided the additional symptomatology and give credit for MDM components," Brad said. It has to be in the note explicitly—who provided the history and what they reported.
A direct, interactive exchange with a provider outside the group or of a different specialty. Sending chart notes doesn’t qualify. Communicating through ancillary staff doesn’t qualify. The exchange has to be interactive and the source genuinely external. This category can also include non-clinicians involved in the patient’s care management—lawyers, parole officers, case managers—but not family members acting as informal caregivers.
Column III is frequently misread as a reflection of how sick the patient is. That’s not what it measures.
"This element is distinct from the risk of the condition itself," Brad said. "It reflects the risk inherent in what the provider decided to do—or decided not to do—at that encounter."
The two most common high-risk elements in outpatient practices are prescription drug management and decision for surgery.
Requires documented evidence that the provider evaluated medications and made a clinical decision about their use. Writing a new prescription, adjusting a dose, discontinuing a medication, or continuing one with documented clinical rationale all qualify. “Meds refilled” does not—refilling without assessing the patient is not prescriptive authority. An EMR-generated medication list is not a clinical decision. What auditors need to see: the name of the medication, the decision made, the clinical reason for it, and its connection to the patient’s current condition.
Requires documentation of a substantive conversation—risks, benefits, alternatives, and the patient’s demonstrated understanding. “Patient consented to surgery” is not enough. The note should name the specific risks discussed, the alternatives considered, and confirm the patient’s informed decision to proceed. A thorough example covers infection, bleeding, clotting risk, anesthesia complications, implant failure risk, and reasonable non-operative alternatives—and it shows the patient understood all of it before agreeing. That’s the kind of note that holds up.
Based on the many audits that I’ve done for our clients, reporting by time is often a huge missed opportunity
Providers regularly spend significant time reviewing prior records, counseling patients through complex decisions, coordinating care across specialties, and documenting extensively—then bill based on MDM alone and leave time on the table. Total time on the date of service counts toward the threshold, including pre-service and post-service work, not just face-to-face minutes.
Qualifying time includes: preparing to see the patient; obtaining or reviewing history; performing the exam; counseling and educating the patient or family; ordering medications and tests; communicating with other health professionals when not separately reported; documenting clinical information; independently interpreting test results; and coordinating care when not separately billed.
What does not count: travel, services reported separately under their own CPT codes, and general teaching that isn’t specific to the management of that individual patient.
The difference between a documented time statement and no time statement can be an entire level of service. Sheila recommends writing the qualification statement around the specifics of that patient's visit rather than pulling from a generic template.
"You really want to kind of cater this to what your practice needs are," Sheila sad. A patient being counseled about cranioplasty has a different story than one being referred to hospice—the time statement should reflect that.
One distinction that catches providers off guard: CPT and Medicare use different thresholds for prolonged services. Under CPT, 99205 can be extended with add-on code 99417 once the visit reaches 75 minutes. Under Medicare, the prolonged service code G2212 doesn’t apply until the visit reaches 89 minutes. Billing the CPT prolonged service code for a Medicare patient at 76 minutes will cause a denial.
The documentation is often already there. The time statement just needs to be added.
Modifier denials are common and often avoidable. The modifiers that come up most frequently in E&M auditing:
A note that withstands audit tells a continuous, congruent story.
The chief complaint establishes medical necessity. The history shows the progression of the patient’s condition. The exam addresses what brought the patient in. The data section captures what was reviewed, ordered, and interpreted—specifically. The assessment and plan reflect genuine clinical decision-making, with documented risk.
Brad frames it as a set of questions every note should answer:
Answer those questions clearly, from the top of the note to the bottom, and the documentation will support the level billed.
