What is the Difference Between a Regulatory Billing Audit and a Revenue Recovery Audit?

Last Updated: August 17, 2026

What a Regulatory Billing Audit Actually Checks

Here's what a regulatory billing audit is actually doing: checking whether your claims can survive a federal auditor walking through your door.

It's purely defensive. It isn't hunting for money left on the table. It's hunting for money claimed incorrectly, documented insufficiently, or submitted in ways that expose your practice to clawbacks, penalties, or worse.

That's a fundamentally different lens than revenue recovery. Recovery asks: what did we miss collecting? A regulatory audit asks: what did we claim that we can't defend?

Both questions matter. And neither one answers the other.

The Compliance Baseline: What CMS and OIG Expect to See

The HHS Office of Inspector General sets the compliance baseline for chiropractic billing — and the OIG doesn't leave much room for interpretation. Published audit data shows that chiropractic billing error rates have historically exceeded 50%. The majority of those errors weren't fraud. They were documentation failures — charts that couldn't support the claims attached to them.

Most practices aren't billing dishonestly. They're billing incompletely.

CMS expects specific documentation in every chart: objective evidence of subluxation, measurable functional goals, and tracked patient improvement over time. When those elements are missing or vague, the claim becomes indefensible. It doesn't matter what actually happened in the treatment room. If it's not in the record, it didn't happen — not to a federal auditor.

So that's what a regulatory billing audit is checking: whether those artifacts exist, whether they're consistent across the billed codes, and whether the clinical record would hold up if a federal reviewer opened the file today.

It's not an evaluation of care quality. It's an evaluation of documentation discipline. That's the OIG's standard — and it's the only standard that matters in an audit.

Why the AT Modifier Is the Most Scrutinized Line Item in Chiropractic Billing

Nothing draws more federal attention in chiropractic billing than the AT modifier. CMS Medicare billing rules require the Acute Treatment modifier on spinal manipulation codes — 98940, 98941, and 98942 — to distinguish active, corrective care from maintenance therapy. Maintenance is excluded from Medicare coverage entirely. That one modifier is the line between a payable claim and a clawback.

Miss the AT modifier and the claim fails. Include it without documentation that supports active treatment status — and the claim isn't just rejected. It's technically fraudulent. That's true even when the provider had zero intent to misrepresent anything.

A regulatory audit isolates AT modifier application across the entire Medicare claim history and cross-references it against the clinical record.

It's one of the highest-stakes checks in the review. Because it's also one of the first things a federal auditor pulls.

The Volume-First Billing Model and Why It Fails Compliance Reviews

Here's the pattern regulatory audits keep finding: volume-first billing is built for speed. Documentation depth isn't part of the equation.

When throughput is the priority, documentation gaps don't announce themselves. The AT modifier gets applied without a chart note that supports active treatment. Subluxation findings get templated identically across different patients. Functional goals go unstated.

The claims go out. They get paid. And the compliance exposure accumulates in the background — invisible until a federal auditor starts pulling files.

This is the defense side of the billing equation in its starkest form. The same diagnostic discipline a practice needs to reveal what's hiding in its AR applies directly to compliance posture.

The two sides of the billing record aren't separate problems. They're the same record — read from different directions.

Volume-first models aren't built to catch these failures. They're built to submit. The comprehensive billing services model that actually protects a practice requires human oversight at the documentation level — someone checking whether the chart supports what's being billed before the claim leaves the building. Software doesn't do that. Throughput doesn't budget for it. That's how exposure becomes a cash flow crisis.

Regulatory Audit Trigger	What Auditors Examine	Common Finding	Consequence if Unresolved
AT Modifier Application	Whether the AT modifier is consistently appended to Medicare spinal manipulation codes 98940, 98941, and 98942 on active treatment claims	Modifier present on claim but absent from or unsupported by the corresponding clinical chart note	Claim reclassified as maintenance therapy — ineligible for Medicare reimbursement; exposure to retroactive clawbacks
Documentation of Subluxation	Whether every billed visit includes objective clinical evidence of subluxation — palpation findings, motion studies, or equivalent diagnostic indicators	Templated or duplicate chart notes that do not reflect patient-specific examination findings	Claim deemed unsupported; pattern of identical notes across patients flags the practice for targeted audit review
Functional Goal Tracking	Whether the clinical record documents measurable functional goals and tracks patient progress toward those goals over the treatment episode	Goals stated generically at intake but never updated, measured, or tied to specific billed visit outcomes	Inability to demonstrate medically necessary active care; entire treatment episode becomes defensible only at the date of first notation
Active vs. Maintenance Care Classification	Whether visits billed as active corrective care are clinically distinguishable from maintenance therapy in the chart record	Active treatment codes billed beyond the point where documented improvement plateaued	False Claims Act exposure — even without fraudulent intent, a claim that cannot be supported by the chart is treated as a misrepresentation
Coding Specificity and Complexity Level	Whether the complexity level billed — 98940, 98941, or 98942 — corresponds to the number of spinal regions documented as treated in the visit note	Higher-complexity code billed without a chart note that documents the additional spinal regions required to justify the level	Overpayment determination on audit; systematic upcoding patterns escalate individual claim errors into programmatic liability
Consistency Between Billed Codes and Clinical Record	Whether the services documented in the clinical chart match the services billed to the payer across the full claim history reviewed	Discrepancies between what the provider documented and what the billing system submitted — often a sign of workflow disconnects rather than deliberate misrepresentation	Payer-initiated recoupment of all claims where documentation does not support the billed service; referral to OIG if pattern is systemic

What a Revenue Recovery Audit Actually Chases

The revenue recovery audit isn't looking for exposure. It's looking for money the practice already earned and never saw.

That's a different mandate entirely. A regulatory review asks whether submitted claims are defensible. A revenue recovery audit asks whether all earned revenue was actually pursued — inside aging accounts receivable, inside denied claims that closed without an appeal, inside underpayments accepted at face value, inside complex insurance submissions that automated systems abandoned.

This is the offense side of the billing equation. And the claims doing the most damage are rarely the simple ones.

Aged AR, Abandoned Denials, and the Claims Nobody Worked

Aged AR doesn't sit quietly. It ages — and the older it gets, the harder it becomes to recover. A revenue recovery audit traces that curve: which claims are still workable, which payers are responsible, and what broke in the original submission cycle to land them in the backlog in the first place.

Abandoned denials are a separate problem. A denial isn't a closed claim — it's an open question from the payer that someone decided not to answer. In a volume-first billing operation, denials requiring documentation review, medical necessity arguments, or multi-step appeals get deprioritized. Working them costs more time than the throughput model allows. So they sit. They age. They expire.

What a revenue recovery audit surfaces, consistently: the most valuable claims in a practice's AR are exactly the ones nobody worked. The complex modifier disputes. The appeals that needed a clinical argument. The underpayments buried in a payer's remittance that look like a normal payment until someone does the math. Those claims represent real collections. Whether anyone went after them depended entirely on the billing operation's structure.

This Is Not the Right Audit for Every Practice — and That Matters

This audit isn't the right tool for every practice. Recognizing that distinction is part of deploying it correctly.

If a practice runs primarily low-complexity claims with clean payer relationships and consistent documentation, the recoverable revenue inside aged AR is limited. The audit still has value — but the return is narrower. Recovery audits hit hardest for practices carrying significant AR, a history of unworked denials, or a prior billing relationship that processed the easy claims and went silent on everything else.

And there's a layer beyond cash flow. Lenders, buyers, and partners read AR aging as a signal of operational health. Practices where billing accuracy shapes valuation outcomes understand that unworked claims aren't just a collections problem — they're a structural signal of what the practice is actually worth. A revenue recovery audit corrects that record. Both for what's collected now and for what any future valuation reflects.

What Human-Led Recovery Finds That Automated Systems Miss

Standard billing software is built to submit clean claims efficiently. That's a real function. But it has a hard ceiling. When a claim requires human judgment — a medical necessity argument, a payer-specific appeal narrative, a documentation correction that depends on clinical context — the software has no pathway. The claim stalls. McKinsey's analysis of healthcare's administrative complexity confirms it: active denial management captures lost margins that automated billing structurally bypasses.

Human-led recovery reads the claim and the chart together. It finds why the denial happened, whether the denial reason holds up, and what the correct response is — not just whether a response was auto-triggered. That's how practices recover revenue that automation can't reach.

Defense and offense are not interchangeable. Regulatory audits protect what the practice has billed. Revenue recovery audits reclaim what the practice earned but never collected. Running only one means the other problem compounds in the background — quietly, and at real cost.

AR Age Bucket	Typical Recovery Difficulty	Recovery Approach Required	Common Abandonment Reason
0–30 days	Low to moderate	Standard follow-up and resubmission with corrected documentation	Clean claims processed first — complex ones deprioritized immediately
31–60 days	Moderate	Denial review, payer-specific appeal with supporting clinical documentation	Volume-first models flag but rarely action — appeal requires human review
61–90 days	High	Medical necessity argument built from the clinical record; payer escalation	Appeals deprioritized — cost to work exceeds what a throughput model tolerates
91–120 days	Very high	Multi-step appeals with documentation correction and direct payer negotiation	Most billing operations close these as losses without contacting the payer
120+ days	Critical — timely filing risk	Expedited human-led recovery before payer filing deadlines close the window permanently	Silent billing relationships let these expire — neither party initiates contact
Underpayments (any age)	Variable — often invisible without manual audit	Line-by-line remittance reconciliation against contracted payer rates	Automated systems accept remittance at face value — discrepancies go undetected

Side-by-Side: How These Two Audits Differ in Scope, Purpose, and Output

Both audits touch the same billing records. That's where the similarity ends.

A regulatory billing audit looks backward. It takes every submitted claim and asks one question: does this hold up under federal scrutiny? The HHS-OIG has documented chiropractic billing error rates historically exceeding 50% — and most of those failures trace to documentation gaps, not fraud. Missing AT modifier notation. Charts that don't establish medical necessity. Records that can't survive a reviewer's second look. The regulatory audit is asking whether the practice's defense is intact.

A revenue recovery audit looks at what was earned and never collected. Not what was submitted — what the practice actually delivered, and how much of that the billing operation failed to bring back. Aging AR nobody worked. Denials that closed without a challenge. Underpayments that got accepted because following up felt like more trouble than it was worth. That gap between delivered care and recovered revenue is where practices lose the most money. The recovery audit measures exactly how wide that gap is — and what's still retrievable.

Different Questions, Different Answers — Why One Cannot Replace the Other

Here's what practices get wrong: they assume running one of these audits covers the other. It doesn't. They're asking different questions of the same records — and the answer to one tells you nothing about the other.

A practice can have a clean regulatory record — every AT modifier correctly applied to Medicare codes 98940, 98941, and 98942, documentation aligned with CMS standards, no meaningful exposure to federal clawback — and still be sitting on months of unworked denials and undercollected insurance payments. Compliance does not produce collections. It protects what was already collected from being taken back. Those are two different problems.

And the reverse is just as true. A practice can run a focused AR and denial recovery effort, pull real cash out of the backlog, and still carry serious regulatory exposure in its Medicare documentation. Collecting more doesn't make the compliance risk disappear. It just means there's more at stake when the audit comes. Running both isn't redundancy — it's the only complete picture of where the practice actually stands.

How Each Audit Affects Practice Valuation

Both audits affect practice valuation. But they work through completely different mechanisms — and most practice owners only understand one of them.

Regulatory exposure creates contingent liability. Any buyer, lender, or partner evaluating a practice is also evaluating the risk that past billing patterns could trigger a federal audit, demand repayment, or require corrective action. That risk gets priced in — as a discount, a contingency, or a deal condition. A clean compliance record removes that discount from the conversation. It's a defensive contribution: it keeps the baseline number from being eroded by risk the practice didn't know it was carrying.

Revenue recovery affects valuation by correcting what the practice looks like on paper. Aging AR and unworked denials suppress demonstrated collections — and standard billing software structurally bypasses the complex denial management work that would close that gap. A practice carrying unresolved AR looks less financially healthy than its actual patient volume justifies. Resolving it doesn't just produce immediate cash flow. It restores the billing record to an accurate picture of what the practice actually generates — and that's what a buyer, lender, or partner is reading when they assess practice valuation and billing data. One audit clears the liability. The other corrects the record. Both serve the number.

Dimension	Regulatory Billing Audit	Revenue Recovery Audit
Primary Question	Is what we submitted defensible under federal scrutiny?	Did we collect everything the practice actually earned?
Audit Direction	Backward-looking — reviews past submitted claims for compliance exposure	Forward-recovery — traces unworked AR, denied claims, and underpayments still open
Scope of Review	Documentation accuracy, modifier application, and chart-to-code alignment	Aging accounts receivable, abandoned denials, underpayments, and complex submission failures
Primary Risk Addressed	Federal clawback, OIG investigation, and False Claims Act exposure	Revenue leakage, cash flow suppression, and collections left permanently unclaimed
Output Delivered	Compliance gap report identifying documentation deficiencies and regulatory exposure	Recovery opportunity report identifying workable claims and estimated uncollected revenue
Effect on Practice Valuation	Removes contingent liability discount by establishing a clean compliance record	Corrects the operational picture by resolving AR that suppresses demonstrated collections
Type of Expertise Required	Regulatory knowledge — federal billing standards, modifier rules, and CMS documentation requirements	Clinical and billing judgment — denial pattern analysis, payer-specific appeal strategy, and chart-to-claim review
Role in the Billing Operation	Defensive — protects revenue already collected from being reclaimed by federal payers	Offensive — reclaims revenue earned but never recovered by the billing operation

Where EHR Software and Automated Billing Fall Short on Both Fronts

The EHR handles it. That's the assumption. And it's the most expensive assumption in chiropractic billing.

EHR platforms are submission engines. They move a documented encounter through the billing pipeline. That function is real. And it stops there.

Both audit types — regulatory and revenue recovery — require clinical and payer-specific judgment no automated system applies. That's not a software bug waiting on a patch. It's a design boundary. Submission is not audit. Audit is not recovery. The software doesn't know the difference.

What EHR Platforms Actually Do — and the Gap They Leave

An EHR captures the encounter and generates the claim. It can flag a missing modifier. It fires a rejection alert when a required field is blank. That's genuinely useful — and it's also the ceiling. The EHR responds to what's visibly absent. It doesn't evaluate whether what's present is actually sufficient.

What EHR software cannot do is read a chart and determine whether the documentation actually supports the billed code at the standard a federal reviewer applies. Research confirms that chiropractic documentation compliance correlates strongly with provider-configured templates. But templates enforce structure. They don't enforce clinical sufficiency. A chart can be perfectly formatted and still fail a regulatory review — because the objective findings don't demonstrate the level of functional limitation the billed code requires. The form passes. The substance doesn't.

The same ceiling shows up on the revenue side. An EHR processes the claim it received. It doesn't cross-reference the payer's remittance against what should have been paid. It doesn't flag an underpayment accepted at face value — or identify a denial as contestable rather than final. That's exactly the gap that separates what a professional billing audit uncovers versus what software reports. And it's where practices find their largest pockets of recoverable revenue.

Why Automation Fails the Hardest Claims in Both Audit Types

Automation is built for clean claim throughput. That's where it earns its keep. The moment a claim requires a documentation gap filled, a modifier disputed, or a denial answered with a clinical narrative — the automation has no path. It just stops.

On the regulatory side, that failure is acute. Medicare's documentation requirements for chiropractic spinal manipulation — objective evidence of subluxation, measurable functional goals tracked over time — carry clinical specificity that no template logic can fully evaluate. Software can confirm the AT modifier was appended to codes 98940, 98941, or 98942. It cannot confirm the chart's documented findings actually justify that modifier under the standard CMS applies during a coverage review. Those are two completely different questions. And only one of them gets asked in a federal audit.

On the revenue side, the failure is the same problem wearing different clothes. The highest-value claims in a practice's AR are the complex ones — modifier disputes, multi-step denial appeals, underpayments buried inside a remittance that looks like a normal settlement. Those are exactly the claims automation deprioritizes. They cost more to work than a volume-first model budgets for. So they sit. They age. A human-led recovery audit is built specifically to find them — and pursue them.

The Documentation Standard Automated Systems Cannot Enforce

The EHR software billing limits that matter most aren't the ones the platform tells you about. They're the ones it never surfaces — because it has no mechanism to measure clinical documentation against the standard a federal reviewer actually uses.

MCD Article A57377 sets explicit documentation criteria for chiropractic coverage: objective evidence of subluxation, measurable structural and functional goals, chart-level tracking of patient improvement over time. Meeting that standard requires clinical judgment applied to specific patient records. No EHR template enforces it. A regulatory billing audit does — because it puts human eyes on the documentation with that exact standard as the measuring stick.

That's where the defense-and-offense frame stops being abstract. Software handles the routine. Human-led audits handle the consequential. Running a practice's full billing risk assessment through software reporting alone keeps both the compliance exposure and the recoverable revenue invisible — right up until the regulatory notice lands, or the AR aging report becomes a problem nobody can walk back.

Billing Task	EHR / Automated System	Human-Led Billing Review	Audit Outcome Impact
AT modifier application	Confirms modifier is appended to the claim before submission	Evaluates whether the chart's documented clinical findings actually justify the modifier under CMS review standards	Regulatory exposure — a modifier present on a claim with insufficient documentation is still a compliance failure
Clinical documentation sufficiency	Flags missing required fields and enforces template structure	Reads the chart against the clinical sufficiency standard a federal reviewer applies — structure alone is not enough	Regulatory exposure — a complete-format chart that fails to demonstrate functional limitation does not survive a coverage review
Denial processing	Records the denial and routes it per payer response codes	Evaluates whether the denial is contestable, identifies the clinical or administrative argument required, and pursues the appeal	Revenue recovery — denials accepted at face value without review represent permanent, unrecovered collections
Underpayment identification	Accepts the remittance as posted and closes the claim	Cross-references the remittance against contracted rates and identifies settlements accepted below the allowable amount	Revenue recovery — underpayments processed without challenge are losses the billing record never flags
Aging AR review	Reports claim status by age bucket; does not evaluate recoverability	Distinguishes workable claims from unrecoverable ones and builds a prioritized pursuit strategy based on payer behavior and claim complexity	Revenue recovery — aged AR without active human review compounds until it exceeds the timely filing window
Medicare documentation standard (MCD A57377)	Cannot evaluate whether objective subluxation evidence and functional goals meet the standard CMS applies during a coverage audit	Applies the specific CMS documentation criteria to chart records and identifies gaps before a federal reviewer does	Regulatory exposure — practices that pass internal EHR checks but fail MCD criteria face clawback risk with no prior warning
Complex modifier disputes	No pathway for modifier disputes that require a clinical narrative to resolve	Constructs the medical necessity argument required to overturn a modifier-based denial	Revenue recovery — modifier disputes left unworked represent the highest-value unresolved claims in most practices' AR
Maintenance vs. active care classification	Cannot distinguish maintenance care from active corrective care at the documentation review level	Reviews chart records to confirm that billed encounters meet the active treatment threshold — not just that the modifier was applied	Regulatory exposure — maintenance care billed as active treatment is the most common driver of Medicare chiropractic audit findings

Frequently Asked Questions

Strategy is one thing. Implementation questions are another.

Here's what practice owners actually ask — answered without the runaround.

What is the primary difference between a regulatory billing audit and a revenue recovery audit?

One audit is defensive. The other is offensive.

A regulatory billing audit checks whether your documentation and coding meet federal compliance standards. The HHS-OIG has documented chiropractic billing error rates exceeding 50% — driven primarily by documentation deficiencies. That exposure is what the regulatory audit finds and corrects before a federal reviewer does.

A revenue recovery audit operates on a completely different objective. It reviews aging AR, unworked denials, and underpayments to identify revenue that was earned but never collected.

Defense protects what was already collected. Offense reclaims what was not. Those are not the same job.

Can a chiropractic practice run both a compliance and a revenue recovery audit at the same time?

Yes — and running them together is almost always faster than running them separately.

The documentation review that compliance work requires surfaces the same chart-level gaps that drive denial patterns. You're pulling the same source material — claims history, remittance data, chart records. Two separate review cycles means two rounds of disruption for what is largely the same information.

But there's a more important reason to run them in parallel. Compliance findings and recovery findings inform each other. A documentation gap that creates regulatory exposure is often the same gap that killed a denial appeal. Fix one in isolation and you've addressed half the problem.

The complete picture requires both. Running them together gets you there faster.

How does a regulatory billing audit protect my clinic from OIG investigations?

It removes the documentation gaps that make your practice a target.

The HHS-OIG has documented chiropractic billing error rates exceeding 50% — driven by missing AT modifier support and insufficient clinical necessity evidence. A regulatory billing audit finds exactly those gaps before a federal reviewer does.

CMS requires the AT modifier on Medicare codes 98940, 98941, and 98942 to confirm active corrective care. Maintenance care is excluded from coverage entirely. If your charts don't clearly distinguish active treatment from maintenance — with objective clinical findings documented — that distinction is invisible to an OIG reviewer.

The audit makes it visible and correctable on your timeline. Not theirs.

Will a revenue recovery audit disrupt my active patient billing workflows?

A well-run recovery audit doesn't touch your active claim workflows. Full stop.

It reviews historical AR — aged claims, unresolved denials, remittance discrepancies from prior billing cycles. Your current patients keep billing on their normal schedule. The recovery work runs alongside that, not instead of it.

What it does require is access: EHR data, payer remittances, denial records. There's a coordination phase to gather that information. That's where the friction lives. It doesn't reach daily billing operations.

Practices that find the process disruptive are usually dealing with disorganized records. That disorganization is typically part of what the audit is there to fix.

Why does EHR software fail to identify the same billing leaks as a human-led recovery audit?

EHR software submits claims. It doesn't evaluate them.

Software can confirm a modifier was appended. It can't tell you whether the underlying chart documentation justifies that modifier under the standard a federal reviewer actually applies. Those are two different questions — and software only answers one of them.

Research published through the National Institutes of Health confirms that chiropractic documentation compliance correlates with structured, provider-configured templates. But templates enforce format. A chart can be structurally complete and still fail a CMS review on clinical sufficiency grounds.

The same ceiling applies on the revenue side. Software doesn't cross-reference remittances against what should have been paid. It doesn't flag a denial as contestable. It doesn't catch an underpayment buried inside a remittance that looks like a clean settlement.

That's human judgment. Software has no mechanism to replicate it — because that's not what it was built to do.

How often should a chiropractic practice conduct each type of audit?

The two audits run on different clocks because they serve different functions.

A regulatory billing audit belongs on a recurring schedule. OIG compliance guidance recommends systematic self-auditing for small and individual practices as a baseline protective measure. Annual is a reasonable floor. More frequent makes sense after a billing staff change, a payer mix expansion, or a documentation workflow shift — any of those events resets your exposure.

A revenue recovery audit is triggered by conditions, not a calendar. A growing AR aging report. A spike in denial volume. A transition away from a prior billing arrangement. A practice valuation event. It's a diagnostic response to a specific signal, not a scheduled maintenance item.

Here's what practice owners get wrong: they wait for those signals to become crises. By then, the recoverable window has already narrowed — and in some cases, the claims that could have been worked are now too old to touch.

The audit doesn't get easier the longer you wait. It gets smaller.

Defense and Offense: Why Your Practice Needs Both Audit Types

Run only a regulatory audit and you know whether you'd survive a federal review. You have no idea how much revenue you walked away from.

Run only a revenue recovery audit and you know what you pulled back. You don't know whether that recovery is sitting on top of a compliance exposure CMS could claw back next year.

Both positions are incomplete. And incomplete, in billing, is a risk that compounds quietly — until it isn't quiet anymore.

Defense without offense protects a revenue baseline that's probably smaller than it should be. Offense without defense recovers money into a billing posture a regulatory action could reverse.

Those aren't edge cases. They're the two failure modes that show up in the same billing cycle — whether anyone's looking for them or not.

Every practice owner is asking the same two questions: are we protected, and are we getting paid everything we earned? One audit answers half. The other answers the other half. Run them separately and you get half a picture twice. Run them together and you finally know where the practice actually stands.

Bushido Billing is built to run both. The regulatory audit establishes the compliance baseline. The revenue recovery audit reclaims what was earned and never collected.

Neither replaces the other. A practice that treats one as sufficient is running blind on the other front — and the billing record doesn't care which one got skipped.

That's the frame this entire article has been building toward: defense and offense are not interchangeable. One protects what you have. The other gets back what you lost. Your practice needs both.