CPMA Certified Professional Medical Auditor

Case 001 (Random vs Targeted Sampling): During a provider audit workpaper review, the auditor must document a defensible finding. You must estimate an overall error rate across a broad provider population. Which sampling approach is strongest?

• ASelect only the highest-dollar claims to maximize repayment findings.
• BUse a statistically appropriate random sample aligned to the audit objective and defined…
• CUse convenience sampling from whichever records are easiest to retrieve.
• DPull only previously denied claims because they represent all coding risk.

Case 002 (Statistical Extrapolation): In a compliance committee meeting, audit results are being translated into corrective action. Leadership asks whether sample findings can be projected across the full claim universe. What is required first?

• AExtrapolate any targeted sample as long as error severity seems high.
• BProject findings only when at least one provider disputes the audit.
• CConfirm statistically valid sampling methods and documented assumptions before extrapolat…
• DAvoid documenting assumptions because projections are inherently estimates.

Case 003 (Audit Scope and Criteria): While validating sampled claims, the lead auditor is checking coding and documentation consistency. Before record review begins, what should the audit plan define most clearly?

• AOnly projected financial impact, with scope determined after findings emerge.
• BOnly provider specialty, since objective details can be added at report time.
• COnly payer contract terms, without coding/compliance criteria.
• DObjective, scope boundaries, population, criteria, and documentation standards for review.

Case 004 (E/M MDM and Time Validation): At a revenue-cycle QA checkpoint, an auditor is preparing a formal report to leadership. An office E/M level appears overstated. What is the most defensible validation method?

• AReconstruct level selection using documented MDM elements or qualifying total time per cu…
• BDowngrade every visit with limited history regardless of MDM evidence.
• CUse billed diagnosis count alone to validate E/M level.
• DAccept provider-selected level when claim payment was successful.

Case 005 (Modifier 25 Audit Logic): During a payer overpayment response drill, the team is aligning audit evidence with policy timelines. A provider frequently reports modifier 25 with procedures. What evidence supports compliant use?

• AAny same-day E/M and procedure pairing regardless of note content.
• BDocumentation showing a significant, separately identifiable E/M service beyond procedure…
• CAutomatic modifier use for all established-patient visits.
• DA prior payer approval on unrelated claims.

Case 006 (Modifier 59 and NCCI): In a focused E/M audit, notes are reviewed for medical decision making, time, and modifier support. A claim pair edits under NCCI but was bypassed with modifier 59. What should the auditor verify?

• AWhether the provider intended to avoid future denials.
• BWhether both lines share the same diagnosis code.
• CWhether documentation supports a truly distinct service scenario allowed under coding pol…
• DWhether the practice has a historical pattern of using modifier 59.

Case 007 (Global Surgery Audits): During an internal controls review, coding variance trends are being mapped to process owners. Post-op visits are billed separately after a procedure. Which question should the auditor ask first?

• AWere the visits scheduled by front desk staff instead of nursing staff?
• BWas the patient seen on a weekday rather than weekend?
• CDid the provider use an EHR template for every post-op note?
• DDo the billed services exceed routine global-package work and include separately reportab…

Case 008 (Undercoding vs Overcoding): At an education feedback session, auditors are converting error patterns into provider coaching points. An audit shows systematic undercoding in one clinic and overcoding in another. How should this be classified?

• ABoth are compliance risks requiring corrective action, training, and monitoring.
• BOnly overcoding is a compliance issue; undercoding is always acceptable.
• COnly undercoding is a compliance issue because it reduces documentation quality.
• DNeither is actionable if net reimbursement appears neutral.

Case 009 (Medical Necessity Support): In a legal-risk assessment, compliance staff are evaluating potential billing exposure from audit findings. A denied claim cites lack of medical necessity. What should be reviewed first?

• AWhether the claim was filed near month-end closing.
• BWhether the record links patient condition, clinician rationale, and service intensity to…
• CWhether the provider used a standard documentation template.
• DWhether the service was delivered by a high-volume clinician.

Case 010 (Overpayment Refund Rule): During a re-audit cycle, the team is testing whether earlier corrective plans actually reduced risk. An internal audit confirms likely Medicare overpayments. What immediate compliance step is expected?

• ADelay action until annual external audit closes the fiscal year.
• BOffset potential overpayments against unrelated future claims without documentation.
• CQuantify and investigate identified overpayments and follow required return/reporting tim…
• DRefund only if the payer issues a post-payment demand letter first.

Case 011 (False Claims Act Risk): During a provider audit workpaper review, the auditor must document a defensible finding. Repeated high-level coding unsupported by notes continues after education. Why is this high risk?

• AUnsupported coding is low risk if total claim volume is small.
• BRisk exists only when services were never performed at all.
• CRisk is eliminated once one provider signs an attestation statement.
• DPersistent unsupported billing patterns can elevate exposure under fraud and false-claims…

Case 012 (Stark and Anti-Kickback Flags): In a compliance committee meeting, audit results are being translated into corrective action. An audit uncovers referral-linked payment arrangements. What should the auditor do next?

• AEscalate findings through compliance/legal channels for formal review against applicable…
• BDocument informally and close the audit because coding was otherwise accurate.
• CReclassify all affected claims as documentation issues only.
• DDiscuss the issue only with billing staff to avoid wider escalation.

Case 013 (HIPAA Minimum Necessary): While validating sampled claims, the lead auditor is checking coding and documentation consistency. Audit packets are being shared broadly with nonessential staff. Which standard applies?

• AShare complete charts with all team members to speed education.
• BLimit PHI disclosure and access to the minimum necessary information for each audit funct…
• CRemove only patient name while keeping all other identifiers visible.
• DSkip access controls when the audit is internal rather than external.

Case 014 (Cloning and Copy-Forward): At a revenue-cycle QA checkpoint, an auditor is preparing a formal report to leadership. Notes show repeated copied language that does not match current patient status. What is the audit concern?

• ACopy-forward always strengthens coding defensibility by standardizing wording.
• BCloned notes are acceptable whenever diagnosis codes stay the same.
• CCopied documentation may misrepresent medical necessity and can undermine coding and comp…
• DDocumentation cloning matters only for inpatient claims.

Case 015 (Audit Report Structure): During a payer overpayment response drill, the team is aligning audit evidence with policy timelines. A draft report lists errors but no clear recommendations. What is missing?

• AAdditional screenshots from random claims without analysis.
• BOnly aggregate reimbursement totals without error categories.
• CProvider names removed from all sections including action assignments.
• DA structured summary with methodology, findings, impact, root causes, and actionable reco…

Case 016 (Corrective Action Plans): In a focused E/M audit, notes are reviewed for medical decision making, time, and modifier support. Leadership requests a corrective action plan after repeated coding errors. Which element is essential?

• ASpecific owners, deadlines, measurable targets, and follow-up monitoring checkpoints.
• BGeneral reminders to code accurately without timelines.
• CA one-time email blast with no accountability assignments.
• DA plan that defers all changes until next fiscal year.

Case 017 (Provider Education Feedback): During an internal controls review, coding variance trends are being mapped to process owners. How should auditors deliver provider feedback to improve adoption and reduce repeat errors?

• ASend only error percentages without case context.
• BUse case-based, nonpunitive education with examples, rationale, and expected documentatio…
• CProvide coaching only after annual reviews rather than near real time.
• DFocus solely on revenue impact and avoid coding-rule discussion.

Case 018 (KPI and Denial Trend Dashboards): At an education feedback session, auditors are converting error patterns into provider coaching points. Executives request a dashboard that predicts future coding risk. Which KPI set is most useful?

• ATotal billed charges only, without error or denial segmentation.
• BNumber of coders employed, without quality outcomes.
• CDenial reason trends, error rate by category, overturn rate, and time-to-resolution metri…
• DAverage claim size by specialty, without denial linkage.

Case 019 (Appeal Packet Evidence): In a legal-risk assessment, compliance staff are evaluating potential billing exposure from audit findings. A high-value denial is being appealed. What strengthens the appeal package most?

• AA generic request for reconsideration without claim-specific evidence.
• BOnly remittance advice pages and no supporting clinical notes.
• CMultiple unrelated claim examples to show organizational experience.
• DConcise issue summary plus relevant records, coding rationale, and policy-cited medical n…

Case 020 (Re-Audit Monitoring): During a re-audit cycle, the team is testing whether earlier corrective plans actually reduced risk. Three months after remediation, leadership asks if controls are working. What is the best next step?

• APerform a targeted re-audit using the same risk definitions and compare post-intervention…
• BAssume success because no new complaints were filed.
• CRe-audit only if total collections decline materially.
• DClose the issue permanently after staff complete training attendance logs.

An auditor finds an unsigned progress note supporting a billed office visit. Per Medicare signature guidance, what is the most appropriate remediation path for an unsigned medical record entry (other than an order)?

• AIgnore the missing signature if the claim already paid.
• BObtain a signature attestation from the author associated with that medical record entry.
• CHave any available clinician in the practice sign the note retrospectively.
• DDelete the note and recreate it with a current date stamp.

HIPAA requires covered entities to retain HIPAA-required policies, procedures, and related compliance documentation for how long?

• ATwo years from creation only.
• BThree years from the date of the last patient encounter.
• CSix years from the date of creation or the date last in effect, whichever is later.
• DIndefinitely with no regulatory minimum.

Under 42 CFR 424.516(f), physicians and eligible professionals who order, certify, refer, or prescribe Medicare Part A/B services must generally maintain related medical records for how long from the date of service?

• AOne year
• BThree years
• CFive years
• DSeven years

When is an Advance Beneficiary Notice of Noncoverage (ABN) typically required before furnishing a Medicare Part B item or service?

• AWhenever any commercial payer might deny the claim.
• BWhen the provider expects Medicare denial because the item/service is not medically reaso…
• CFor every service that is statutorily excluded from Medicare coverage.
• DOnly after Medicare has already denied the claim.

An auditor reviewing EHR notes finds identical HPI text across multiple dates with conflicting vital signs. What is the primary documentation-integrity concern?

• ATemplates always improve coding accuracy.
• BCloned or copy-forward content may not reflect the encounter and can invalidate medical n…
• CIdentical wording proves consistent quality of care.
• DVital-sign conflicts are irrelevant if ICD-10 codes match.

Which element is essential for a complete, auditable medical record entry supporting a billed professional service?

• APatient demographics alone without clinical content.
• BDate of service, author identification/authentication, and clinically relevant documentat…
• COnly the CPT code selected by the billing office.
• DA blank template saved as 'in progress' indefinitely.

A provider uses a scribe (including AI-assisted drafting) for visit notes. Per Medicare signature guidance, who must authenticate the medical record entry?

• AThe scribe must always co-sign as the treating clinician.
• BThe treating physician/qualified practitioner who provided the care must sign to authenti…
• CNo signature is needed if the EHR auto-saves drafts.
• DFront-desk staff may sign on behalf of the provider.

Which statement best describes the relationship between history/exam and office/outpatient E/M code selection for CPT 99202-99215 under current AMA guidelines?

• AHistory and exam bullet counts still determine the level for all office visits.
• BA medically appropriate history and/or exam is performed as needed, but level is selected…
• CHistory alone always determines new-patient levels.
• DExam findings are prohibited from appearing in the note.

An auditor is asked whether late entries are ever acceptable. Which approach is most compliant?

• ABackdate the entry to the original encounter date without labeling it as late.
• BDocument a clearly identified late entry with the actual date/time of the addendum and re…
• COverwrite the original note silently to insert missing content.
• DNever allow any addendum under any circumstance.

Which privacy standard should guide how much PHI an auditor shares with a billing clerk who only needs claim-level error codes for education?

• AShare the entire chart including unrelated specialty notes.
• BApply the HIPAA minimum necessary standard and limit PHI to what is needed for the educat…
• CHIPAA does not apply to internal staff sharing.
• DShare full records if the clerk signs a one-time NDA.

A hospital Medicare Conditions of Participation baseline for retaining medical records is commonly cited as at least how long (subject to longer state requirements)?

• A90 days
• BOne year
• CFive years
• DTwenty-five years federally mandated for all settings

Which finding most strongly indicates a documentation authentication problem?

• AIllegible handwritten signature with no signature log or attestation identifying the auth…
• BA typed note with a valid electronic signature protocol.
• CA signed addendum clearly labeled as late.
• DA complete note with date, author, and clinical content.

What is the primary purpose of CMS National Correct Coding Initiative (NCCI) Procedure-to-Procedure (PTP) edits?

• ATo set physician fee schedule RVUs annually.
• BTo prevent improper coding/payment when certain code pairs should not be reported togethe…
• CTo replace all LCD medical necessity policies.
• DTo assign ICD-10-CM codes automatically.

An NCCI PTP edit has Correct Coding Modifier Indicator (CCMI) '0'. What does this mean for billing the code pair on the same date by the same provider?

• AEither code may be paid if modifier 59 is appended.
• BThe codes generally may not be reported together; a modifier will not bypass the edit.
• CBoth codes always pay at 100%.
• DOnly the Column 2 code is payable.

CMS prefers which approach when a more specific distinct-service modifier applies instead of modifier 59?

• AAlways use modifier 59 for every NCCI pair.
• BUse XE, XP, XS, or XU (as appropriate) instead of 59 when one of those more specific modi…
• CNever use X{EPSU} modifiers for Medicare.
• DAppend both 59 and XE on the same line.

What does Medically Unlikely Edit (MUE) primarily limit?

• AThe number of different providers who may treat a patient.
• BThe maximum units of a HCPCS/CPT code typically reported for a single beneficiary on a si…
• CThe ICD-10 code count on a claim.
• DThe number of appeals allowed per year.