After the self-audit: fix forward, refund back when owed

Sort every finding into one of three lanes

A self-audit finding is not one thing, and the most common mistake after a good self-audit is treating every finding the same way. Split what you found into three lanes before you fix anything: documentation habits to correct going forward, a specific dollar amount to refund, and — rarely — a pattern serious enough to weigh against OIG's formal self-disclosure protocol. Which lane a finding belongs in decides what happens next.

The test for the first two lanes is simple: did money change hands based on the problem? A note that's missing a signature, or an MDM element that's thin but the visit clearly happened as billed, is a documentation-lane finding — you correct it going forward and move on. A code that billed a higher level than the note supports, or a service billed that the note doesn't establish at all, is a money-lane finding — you owe a refund, whether or not anyone outside your practice ever asks. If your findings came from a running practice like the quarterly ten, most months you'll land almost entirely in the first lane; that's the audit doing its job, not a sign you got lucky.

The third lane exists for pattern, not for a single slip. One under-documented note is a documentation problem. The same gap repeated across a year of notes, or a billing pattern that only makes sense if it was deliberate, is a different category of finding — and it's the one where OIG's self-disclosure protocol becomes worth reading before you decide your next move.

Fix forward: correct the documentation, don't alter the record

Fixing a documentation gap forward means changing what you do in future notes, and — where the specific note allows it — adding a dated addendum to the note in question. It never means opening a signed, closed note and rewriting it to look like the gap was never there. Medicare treats an unsigned or improperly authenticated service as needing correction through attestation, not through a quiet rewrite of the original entry 1Ref 1Centers for Medicare & Medicaid Services (2023).Complying with Medicare Signature Requirements.That Medicare requires authentication by signature and that attestation, not a rewritten note, is the correct way to cure a missing or defective signature found in your own review..

An addendum is the honest fix: date it, sign it, and state plainly what it adds and why, leaving the original entry untouched and readable. This is the same discipline that makes the defensible note the standard to write toward the first time — a note that documents the medical decision-making or the time actually spent, contemporaneously, needs far fewer of these after-the-fact fixes. If your self-audit turns up the same gap in note after note, the forward fix is a template or workflow change, not six months of individual addenda.

Track the fix the same way you'd track any process change: what the gap was, what you changed about how you chart, and the date you changed it. That record is what turns 'we found a problem' into 'we found and fixed a problem,' which is the version of the story you want on file if anyone ever asks.

When the finding is a code, check it against the note before touching billing

A code-level finding — a visit billed at a level the note doesn't support — gets checked against the current documentation framework before anything else. Under the 2021+ E/M framework, an office visit's level is set by medical decision making or by total time, not by how much history or exam got written down, so re-read the note against whichever element you actually used to select the level 2Ref 2Centers for Medicare & Medicaid Services (2023).Evaluation and Management Services Guide.That E/M office-visit levels are set by medical decision making or total time under the 2021+ framework, the standard to re-apply when checking whether a note supports the code billed..

If the note supports the level once you apply the current MDM or time standard correctly, the finding resolves itself — no refund, just a note for your own record that you checked. If it doesn't, you have a money-lane finding, and the coverage conditions and documentation each service requires — including what counts for incident-to billing — come from CMS's own Benefit Policy Manual, worth keeping open next to the note while you work through it 3Ref 3Centers for Medicare & Medicaid Services (2026).Medicare Benefit Policy Manual (Pub. 100-02).That coverage conditions and required documentation, including for incident-to billing, come from the Benefit Policy Manual — the reference to check when confirming a code-level finding..

When it's money: refund it through the normal channel

Once you've confirmed an overpayment — a real dollar amount, tied to a specific claim or set of claims — refund it through your payer's or your MAC's standard overpayment process rather than waiting to be asked. A refund you initiate is a routine administrative correction; the same dollar figure found by someone else's review looks very different.

That difference is contractual as much as regulatory: most payer contracts carry their own audit and lookback clauses that set how far back a payer can reach if it finds the same problem before you report it, and those clauses are often less forgiving than a refund you send unprompted. If a payer's own review gets there first, you're answering the takeback letter instead of controlling the correction — a materially worse position for the same underlying error. Confirm the amount, refund it, and keep the calculation with your remediation file.

When it's bigger than a refund: OIG's self-disclosure protocol

A pattern of conduct that implicates the federal fraud statutes — not an isolated documentation lapse — is what OIG's Health Care Fraud Self-Disclosure Protocol exists for, and it's worth reading before you decide your practice needs it. OIG describes what a submission must contain and how the process resolves, and self-disclosure is the path providers use specifically when a finding goes beyond a simple overpayment refund 4Ref 4HHS Office of Inspector General (2026).Health Care Fraud Self-Disclosure Protocol.That OIG's self-disclosure protocol exists for findings that go beyond a simple overpayment refund and describes what a submission must contain..

This is the lane most self-audits never reach, and that's the right outcome — most findings genuinely are documentation-lane or refund-lane problems. The signal that pushes a finding here is repetition plus intent: the same overbilling pattern across many claims, or a finding that only makes sense as a deliberate choice rather than a documentation habit. Reading the self-disclosure protocol doesn't commit you to using it; it tells you what the more serious lane actually requires, so you can recognize the difference before a finding forces the question.

Screening and retention gaps get fixed administratively, not clinically

Not every self-audit finding touches a note or a code. Some are administrative: a staff member never screened against the federal exclusion list, or records held past the point your own retention practice calls for. Both get fixed the same way — close the gap, document when you closed it, and build the check into your regular routine so it doesn't recur.

No federal program payment may be made for services furnished by someone on OIG's exclusion list, which is why screening yourself and anyone you hire against the LEIE is a standing obligation, not a one-time task 5Ref 5HHS Office of Inspector General (2026).Exclusions Program.That no federal program payment may be made for services furnished by an OIG-excluded person, making exclusion screening of staff a standing self-audit item.. Retention is softer ground: professional guidelines suggest a starting point — commonly seven years after last service for an adult patient, longer for a minor — but state law controls, and your state's rule is the one that governs, not the guideline 6Ref 6American Psychological Association (2007).Record Keeping Guidelines.APA's record-keeping guideline retention example — commonly seven years after last service for an adult — as a starting point that always yields to the reader's state law..

Keep a remediation record for every finding

A remediation record is the paper trail that turns a self-audit from a private worry into evidence of a working compliance process: what you found, which lane it landed in, what you changed, and the date. Keep it whether or not the finding ever surfaces again — the record is what makes 'we catch and fix our own problems' a demonstrable fact instead of a claim.

Store it with your other compliance documentation, not buried in email. If a payer audit or a credentialing review ever asks about your internal controls, a running remediation log is the single most persuasive thing you can hand over — it shows the self-audit is a habit, not a one-time scramble.