Do not treat the visible denial or audit finding as the entire problem. Trace the defect to the earliest point where the workflow should have prevented it, then correct that control and re-test.
GOHEALTHCARE PM&R SPECIALTY GUIDE™
PM&R Compliance and Audit Readiness
Compliance architecture for medical necessity, documentation, therapy, coding, HIPAA, AI, billing, audits and corrective action
Developed by Pinky Maniri, Founder & Chief Executive Officer, GoHealthcare Practice Solutions
COMPLIANCE FOCUS
Medical necessity, documentation, billing integrity, privacy, audit readiness, governance and corrective action.
OPERATIONAL FOCUS
Compliance architecture for medical necessity, documentation, therapy, coding, HIPAA, AI, billing, audits and corrective action
REFERENCE YEAR
2026 — verify current payer, coding, coverage and regulatory requirements before use.
GoHealthcare Operational Results
98%Company-reported prior authorization approval rate
50 StatesNational prior authorization and utilization-management support
PM&R FocusPhysiatry, rehabilitation therapy, diagnostics, functional outcomes, access and revenue-cycle operations
Company-reported performance. Results vary by client, payer, specialty, documentation quality, benefit design and case mix. No authorization or payment outcome is guaranteed.
Page Contents
Use the links below to move directly to the clinical, payer, documentation, coding, reimbursement, performance and operational sections.
Foundation & Core Guidance
Operations, Controls & Performance
- OIG Therapy Lessons: Use Historical Enforcement as an Internal Control Blueprint
- Risk-Based Audit Program
- Potential Overpayments and Corrective Action
- HIPAA, Privacy and Security in PM&R Workflows
- AI Compliance: Do Not Let Convenience Bypass Governance
- Workforce, Credentialing and Exclusion Controls
- Compliance Governance Cadence
- GoHealthcare Clinical Insights
- GoHealthcare Leadership Perspective
- GoHealthcare Prior Authorization Insight
01
Clinical, Coverage, Documentation & Operations
Evidence at a Glance
Compliance framework for PM&R medical necessity, therapy documentation, billing integrity, referral relationships, privacy, scope of practice and AI governance.
| Domain | Summary (verify against current payer policy & date of service) |
|---|---|
| Compliance objective | Prevent, detect, investigate and correct material clinical, documentation, privacy and billing risks. |
| Highest-risk themes | Medical necessity, unsupported services or units, documentation defects, authorization mismatch, modifier misuse, duplicate/cloned records and privacy failures. |
| Audit principle | Sample the full episode and test the control that should have prevented the defect. |
| Corrective action | Identify root cause, owner, remediation, education, repayment or disclosure analysis when applicable, and re-test. |
| Privacy focus | Use minimum necessary access, appropriate safeguards, vendor controls and incident response. |
| AI focus | Govern PHI, source traceability, hallucination risk, human review and accountability. |
| Leadership priority | Create an auditable control environment rather than a collection of policies. |
This page follows the GoHealthcare Clinical Procedure Guide information architecture: evidence first, then clinical and operational requirements, payer and authorization controls, coding/revenue integrity, GoHealthcare insight, case application, FAQs, key takeaways, future outlook and authoritative sources. Verify every payer, coding, regulatory and clinical statement against the controlling source at the point of use.
02
Clinical, Coverage, Documentation & Operations
Executive / Direct Answer
PM&R compliance should focus on whether services are medically necessary, properly ordered and authorized, delivered by qualified professionals, completely documented, accurately coded and billed, and supported by defensible referral, privacy and governance controls.
03
Clinical, Coverage, Documentation & Operations
Medical Necessity and Skilled Care
Audit whether the record demonstrates why the service was needed and, for therapy, why skilled professional involvement was required. Repetitive documentation without objective reassessment is a common risk signal.
OIG has repeatedly identified outpatient therapy risk involving medical necessity, documentation and coding, making therapy audit readiness a core PM&R control.
04
Clinical, Coverage, Documentation & Operations
Documentation and Signature Controls
Maintain policies for timely completion, signatures, corrections, addenda, certification and recertification where required. Ensure templates assist documentation without auto-populating unsupported findings or services.
Late or inconsistent documentation should trigger a defined query and remediation process.
05
Coding, Billing & Revenue Integrity
Billing Integrity
Review timed services, units, modifiers, same-day combinations, drug quantities, unlisted services, incident-to arrangements where applicable and professional-versus-facility responsibilities.
High utilization, repeated identical treatment patterns, unusually high units and mismatch between authorization and billing should be part of routine monitoring.
06
Clinical, Coverage, Documentation & Operations
Referral and Financial Relationships
Apply applicable fraud-and-abuse, self-referral and state-law review to referral arrangements, therapy ownership, DME relationships, marketing, transportation, gifts and compensation structures.
Use legal counsel for arrangement-specific analysis rather than relying on generalized operational guidance.
07
Clinical, Coverage, Documentation & Operations
Privacy and Security
Apply HIPAA and organizational privacy rules to clinical records, therapy documentation, psychological and neuropsychological information, injury claims, patient communications, remote tools and AI-enabled workflows.
Use minimum-necessary access, role-based permissions, secure transmission, audit logs and documented vendor oversight.
08
Clinical, Coverage, Documentation & Operations
Scope, Credentialing and Supervision
Verify licensure, enrollment, credentialing, supervision and assistant requirements for the service and setting. State practice acts and payer contracts may impose requirements beyond federal billing rules.
Credentialing and enrollment should be treated as active operational controls, not one-time onboarding tasks.
09
Clinical, Coverage, Documentation & Operations
AI and Automation Compliance
AI may assist intake, summarization, coding review, documentation quality, authorization preparation and analytics, but outputs require governed validation. Do not allow an AI system to silently alter the clinical record, invent evidence, create unsupported codes or bypass privacy controls.
Maintain an AI inventory, permitted-use policy, human oversight rules, validation testing, access controls, incident response and periodic governance review.
10
Clinical, Coverage, Documentation & Operations
PM&R Compliance Risk Inventory
| Risk Area | Example Exposure | Control |
|---|---|---|
| Medical necessity | Therapy or testing continues without patient-specific skilled rationale or measurable reassessment. | Documentation standards, utilization review and episode audits. |
| Time/units | Therapy units exceed documented time or reflect appointment duration rather than furnished service. | Time capture, billing rules and pre-bill edit. |
| Assistant services | PTA/OTA participation not reflected correctly for payer/modifier/supervision rules. | Schedule/rendering data, supervision policy and modifier validation. |
| EMG/NCS utilization | Excessive or unsupported testing; study/report does not support billed service. | Clinical indication, provider qualification, report reconciliation and utilization outlier review. |
| Drug/product billing | Administered dose, discarded amount and billed units do not reconcile. | Inventory-to-note-to-claim reconciliation. |
| Authorization | Service exceeds approved scope or staff misrepresent criteria. | Structured PA fields, policy source and ethics standard for submissions. |
| Diagnosis coding | Diagnosis altered to satisfy a coverage policy rather than reflect the record. | Nonleading query process and coder education. |
| Privacy/security | PHI exposed through unsecured workflows, vendors or AI tools. | HIPAA risk analysis, access control, vendor review and incident response. |
| Injury cases | Clinical decisions influenced by legal/financial stakeholders or jurisdictional billing rules ignored. | Clinical independence and state-specific operational playbooks. |
WATCH-OUTS — HIGH-RISK FAILURE MODE
11
Clinical, Coverage, Documentation & Operations
OIG Therapy Lessons: Use Historical Enforcement as an Internal Control Blueprint
HHS OIG has repeatedly examined outpatient therapy. In a 2018 nationwide review, OIG reported that 61 percent of the sampled Medicare outpatient physical therapy claims it reviewed did not comply with Medicare requirements related to medical necessity, coding or documentation. The audit period was historical, so the statistic should not be treated as a current industry error rate. Its continuing value is the pattern of risk it illustrates.
The operational lesson is to test the same categories internally: Is the service medically necessary under current rules? Does the plan and treatment documentation support the service? Does the coding match what was actually furnished? Are therapist and assistant roles captured correctly? Are repetitive or unusually high utilization patterns reviewed? A compliance team should use current Medicare guidance for today's standards while using OIG findings to identify where controls commonly fail.
12
GoHealthcare Operational Guidance
Risk-Based Audit Program
Do not select only random claims. Combine random sampling with targeted sampling. Target services with high utilization, high reimbursement, high denial rate, recent code changes, new providers, repeated documentation defects, unusual unit patterns, modifier-heavy billing, high-cost drugs or external enforcement relevance.
| Audit Layer | What to Test |
|---|---|
| Eligibility/benefit | Payer/product and benefit routing were accurate for the service. |
| Authorization | Correct policy, evidence, approval scope and date/quantity reconciliation. |
| Clinical | Medical necessity, skilled need, functional rationale and treatment response. |
| Documentation | Required plan, progress, time, units, signatures and service details. |
| Coding | Code, diagnosis, modifier, units, NCCI and provider/site accuracy. |
| Payment | Claim adjudication, credit balance, refund or overpayment implications. |
Every finding needs severity, financial impact, compliance impact, owner, corrective action, due date and re-test date. Education without re-testing is not a closed corrective-action process.
WATCH-OUTS — HIGH-RISK FAILURE MODE
Do not treat the visible denial or audit finding as the entire problem. Trace the defect to the earliest point where the workflow should have prevented it, then correct that control and re-test.
13
Coding, Billing & Revenue Integrity
Potential Overpayments and Corrective Action
When an audit identifies potential overpayment, the organization should follow its compliance and legal process to determine scope, quantify exposure and evaluate refund or reporting obligations under applicable law and payer contracts. Do not silently write off the balance or alter documentation after the fact to make the original claim appear supported.
Corrective action should address the cause. If the defect is a template design, fix the template. If it is a misunderstanding of a Medicare therapy rule, retrain and monitor. If it is a system configuration, correct the edit logic and test historical impact. If it reflects intentional misconduct or a serious pattern, escalate immediately under the compliance program.
14
GoHealthcare Operational Guidance
HIPAA, Privacy and Security in PM&R Workflows
PM&R organizations handle ePHI across EHRs, therapy systems, payer portals, imaging systems, patient communication, referral exchange, remote monitoring, vendors and sometimes legal or case-management channels. HHS describes risk analysis as foundational to the HIPAA Security Rule's security management process. The organization should identify where ePHI is created, received, maintained or transmitted and evaluate threats, vulnerabilities and safeguards across those environments.
Use role-based access, secure transmission, minimum-necessary practices where applicable, vendor/business associate controls, device security and incident-response procedures. Behavioral, psychological and neuropsychological information may require particular care because of sensitivity and other applicable laws. Legal counsel and privacy leadership should evaluate state-specific or substance-use-record requirements when relevant.
15
GoHealthcare Operational Guidance
AI Compliance: Do Not Let Convenience Bypass Governance
AI may summarize records, identify missing authorization evidence, draft appeal language, prioritize work queues, extract structured fields or assist documentation. None of those uses eliminates accountability. Before deployment, define intended use, prohibited use, data inputs, PHI handling, vendor terms, human review, accuracy monitoring, escalation and audit logs.
Use the NIST AI Risk Management Framework as a governance reference: Govern, Map, Measure and Manage. In practical PM&R operations, that means documenting the use case and owner, mapping who can be harmed by an error, measuring accuracy and bias where applicable, and managing residual risk with review, fallback and monitoring.
Do not allow a generative tool to invent payer criteria, diagnosis, exam findings, treatment history or patient response. AI-generated authorization or documentation content must be traceable to the source record and reviewed by the appropriate human before use.
16
Clinical, Coverage, Documentation & Operations
Workforce, Credentialing and Exclusion Controls
Before staff or clinicians perform or bill services, confirm licensure, scope, enrollment, credentialing and required competency for the setting and payer. Maintain expiration alerts and a process for sanctions/exclusion screening consistent with organizational policy and applicable program requirements.
For services with special training or qualification expectations, such as electrodiagnostic medicine or certain testing services, document how qualifications were verified. Do not assume that a professional license alone establishes payer eligibility for every service.
17
GoHealthcare Operational Guidance
Compliance Governance Cadence
Monthly: high-risk denials, audit findings, overpayment investigations, privacy/security incidents, unusual utilization and corrective-action aging.
Quarterly: targeted service audits, payer-policy change review, coding update validation, training completion, AI use-case review and repeat-finding analysis.
Annually and upon material change: compliance risk assessment, HIPAA security risk analysis process, policy review, audit plan, code-year update, vendor/BAA review and service-line risk assessment.
Leadership should receive enough detail to act, not a compliance score with no explanation. The key question is whether identified risk is decreasing after intervention.
18
GoHealthcare Operational Guidance
GoHealthcare Clinical Insights
GOHEALTHCARE CLINICAL INSIGHTS — COMPLIANCE SHOULD BE BUILT INTO THE WORKFLOW
A policy that sits outside daily operations will not reliably prevent defects. PM&R compliance is strongest when documentation requirements, authorization checks, coding rules, privacy safeguards and escalation logic are embedded in standard work and measurable through routine quality control.
19
GoHealthcare Operational Guidance
GoHealthcare Leadership Perspective
GOHEALTHCARE LEADERSHIP PERSPECTIVE — AUDIT FINDINGS SHOULD CHANGE THE SYSTEM
A recurring defect after education usually means the underlying process, template, technology or accountability model has not changed. Corrective action should modify the control environment and then re-test whether the defect rate actually improved.
20
GoHealthcare Operational Guidance
GoHealthcare Prior Authorization Insight
GOHEALTHCARE PRIOR AUTHORIZATION INSIGHT — AUTHORIZATION IS NOT A COMPLIANCE SAFE HARBOR
An approval does not prove that the service was documented, coded, billed or performed correctly. Compliance review should independently assess medical necessity, documentation and claim integrity.
21
GoHealthcare Operational Guidance
GoHealthcare Case Study / Operational Scenario
Operational scenario. An audit identifies repeated therapy notes with identical language and the same treatment pattern across multiple visits. The organization could simply retrain therapists, but a deeper review shows the EHR template encourages copy-forward and hides objective progress fields. The corrective action includes template redesign, focused education, pre-bill sampling and a 60-day re-audit.
This scenario is illustrative and is not represented as a specific patient case or guaranteed outcome.
22
GoHealthcare Operational Guidance
GoHealthcare Best Practices
- Verify the current authoritative source before operational reliance.
- Define the owner, minimum required data, readiness status and escalation rule.
- Reconcile the clinical record, authorization and final claim before billing.
- Track defects by root cause and feed them back to the workflow that produced them.
- Use AI and automation only within a governed process with human accountability.
GOHEALTHCARE BEST PRACTICES — BUILD THE CONTROL INTO THE WORKFLOW
The strongest PM&R organizations make the correct action easier to perform than the incorrect one. Standard work, structured data, readiness rules, pre-bill reconciliation and visible exceptions reduce dependence on memory and heroic follow-up.
23
GoHealthcare Operational Guidance
Common Mistakes
- Using generic payer rules instead of the patient’s current plan and product.
- Scheduling before all service-specific readiness requirements are complete.
- Allowing authorization, documentation, coding and billing data to diverge.
- Relying on copied or templated language without patient-specific clinical evidence.
- Fixing denials one case at a time without correcting the upstream defect.
24
GoHealthcare Operational Guidance
Pearls and Pitfalls
- Make the clinical purpose of the service unmistakable.
- Capture objective baseline data before measuring progress.
- Start authorization extensions before the existing approval is exhausted.
- Preserve source/version traceability for payer and coding decisions.
- Audit complete episodes periodically, not only individual notes or claims.
25
Clinical, Coverage, Documentation & Operations
Frequently Asked Questions
What is the difference between a billing error and a compliance issue?
A billing error may be isolated and administrative; a compliance issue may involve systemic, material or knowingly unresolved risk. The facts and applicable law/policy determine the response.
Should PM&R compliance audits be random?
Use a mix of routine sampling and targeted audits driven by risk, denials, outliers, complaints, payer changes and prior findings.
Does prior authorization prove medical necessity?
No. It is one payer process and does not replace accurate clinical documentation or compliant billing.
How should AI be governed?
By approved use case, data/PHI controls, source traceability, validation, human review, monitoring and incident escalation.
26
GoHealthcare Operational Guidance
Key Takeaways
- Prevent, detect, investigate and correct material clinical, documentation, privacy and billing risks.
- Medical necessity, unsupported services or units, documentation defects, authorization mismatch, modifier misuse, duplicate/cloned records and privacy failures.
- Sample the full episode and test the control that should have prevented the defect.
- Identify root cause, owner, remediation, education, repayment or disclosure analysis when applicable, and re-test.
- Use minimum necessary access, appropriate safeguards, vendor controls and incident response.
27
Policy, Evidence & Source Guidance
Future Outlook
- Audit analytics will become more data-driven and cross-reference claims, authorization and documentation.
- AI governance will become a formal healthcare compliance domain.
- Payer post-payment review will increasingly use automated outlier detection.
- Organizations will need stronger evidence that corrective actions are effective, not merely completed.
28
GoHealthcare Operational Guidance
Related GoHealthcare Resources
https://www.gohealthcarellc.com/physical-medicine-rehab-specialty-pmr-hub.htmlhttps://www.gohealthcarellc.com/pmr-specialty-overview.htmlhttps://www.gohealthcarellc.com/pmr-practice-operations.htmlhttps://www.gohealthcarellc.com/pmr-prior-authorization.htmlhttps://www.gohealthcarellc.com/pmr-revenue-cycle-management.htmlhttps://www.gohealthcarellc.com/pmr-clinical-documentation.htmlhttps://www.gohealthcarellc.com/pmr-coding-billing.htmlhttps://www.gohealthcarellc.com/pmr-kpis-performance-metrics.htmlPM&R Specialty HubGoHealthcare MSK Specialty Procedure Library™Prior Authorization Resource CenterRevenue Cycle Management Resource CenterCase Study LibraryElectromyography (EMG)Nerve Conduction Studies (NCS)PM&R Clinical Guidelines
GOHEALTHCARE CODING INTELLIGENCE
Use the dedicated coding libraries for current code-family navigation and crosswalk methodology: PM&R CPT & HCPCS Coding Library, PM&R ICD-10-CM Diagnosis Crosswalk Library, and PM&R Modifiers, NCCI & MUE Reference. The service-specific page remains the controlling operational context.
29
Policy, Evidence & Source Guidance
Guidelines, Standards & Authoritative References
Applicable Guidelines, Coverage Policies and Professional Standards
GoHealthcare separates clinical guidance from coverage policy. A clinical practice guideline helps inform care; an LCD, NCD, billing article, payer medical policy or utilization-management rule determines coverage and administrative requirements for a specific payer, jurisdiction, benefit and date of service. Verify both layers before relying on this page operationally.
| Source | Guideline / Policy Resource | How to Use It Operationally |
|---|---|---|
| OIG | Outpatient PT Audit | Historical audit findings demonstrating medical-necessity, coding and documentation risk. |
| CMS | Therapy Services | Current therapy payment-policy controls. |
| AANEM | EDX Model Policy | Professional framework to reduce electrodiagnostic misuse and quality risk. |
| CMS | DMEPOS Prior Authorization | Pre-delivery coverage and coding controls for selected items. |
GUIDELINE CONTROL — DO NOT TREAT A LINK AS THE POLICY
Confirm the current version, effective date, patient payer/product, Medicare Administrative Contractor when applicable, state rules, site of service, provider qualifications and benefit limitations. Retired or superseded policies should remain in the audit trail but should not drive current authorization or billing decisions.
Authoritative sources; verify the current version and effective date before relying on any policy, coding, coverage or clinical requirement.
- https://oig.hhs.gov/reports/all/2018/many-medicare-claims-for-outpatient-physical-therapy-services-did-not-comply-with-medicare-requirements/. https://oig.hhs.gov/reports/all/2018/many-medicare-claims-for-outpatient-physical-therapy-services-did-not-comply-with-medicare-requirements/
- https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html. https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html
- https://www.nist.gov/itl/ai-risk-management-framework. https://www.nist.gov/itl/ai-risk-management-framework
- https://www.cms.gov/medicare/coding-billing/therapy-services. https://www.cms.gov/medicare/coding-billing/therapy-services
- https://www.cms.gov/regulations-and-guidance/guidance/manuals/internet-only-manuals-ioms-items/cms012673. https://www.cms.gov/regulations-and-guidance/guidance/manuals/internet-only-manuals-ioms-items/cms012673
- https://www.cms.gov/regulations-and-guidance/guidance/manuals/internet-only-manuals-ioms-items/cms018912. https://www.cms.gov/regulations-and-guidance/guidance/manuals/internet-only-manuals-ioms-items/cms018912
- https://www.cms.gov/medicare-coverage-database/search.aspx. https://www.cms.gov/medicare-coverage-database/search.aspx
- https://www.cms.gov/medicare/coding-billing/national-correct-coding-initiative-ncci-edits. https://www.cms.gov/medicare/coding-billing/national-correct-coding-initiative-ncci-edits
- https://www.cms.gov/medicare/payment/fee-schedules/physician. https://www.cms.gov/medicare/payment/fee-schedules/physician
- https://www.hhs.gov/hipaa/for-professionals/index.html. https://www.hhs.gov/hipaa/for-professionals/index.html
- https://oig.hhs.gov/. https://oig.hhs.gov/
- https://www.aapmr.org/about-physiatry/about-physical-medicine-rehabilitation. https://www.aapmr.org/about-physiatry/about-physical-medicine-rehabilitation
- https://www.apta.org/. https://www.apta.org/
- https://www.aota.org/. https://www.aota.org/
- https://www.asha.org/. https://www.asha.org/
- Centers for Medicare & Medicaid Services. https://www.cms.gov/
- Medicare Coverage Database. https://www.cms.gov/medicare-coverage-database
- GoHealthcare Practice Solutions Knowledge Center. https://www.gohealthcarellc.com/
Build a Defensible, Scalable PM&R Workflow
GoHealthcare supports prior authorization, medical-necessity documentation, payer policy interpretation, coding and revenue integrity, appeals, PM&R operations and AI governance.
Developed By
Pinky Maniri
MSc, BSc, CRCR, CSAPM, CSPPM, CSBI, CSPR, CSAF, Certified in Healthcare A.I. Governance
Founder and Chief Executive Officer, GoHealthcare Practice Solutions
Educational and Operational Disclaimer
This content is provided for educational and operational planning purposes and is not medical, legal, coding, reimbursement or payer-contract advice. Coverage, authorization, coding, payment and clinical requirements vary by patient, plan, product, jurisdiction, Medicare Administrative Contractor, date of service, setting and current policy. Verify the controlling source before scheduling, authorization, billing, appeal or clinical decision-making. Authorization does not guarantee coverage or payment.
GoHealthcare Knowledge Center
Search GoHealthcare Practice Solutions
Search our procedure library, specialty guides, prior authorization resources, revenue cycle guidance, case studies, AI governance content, compliance resources and healthcare operations insights.