RCM Audit Red Flags for a Growing NY Medical Practice

TL;DR. Growing NY medical practices outgrow their RCM setup in predictable ways. Seven KPIs catch the slip early: net collection rate, days in AR, clean claim rate, first-pass resolution, denial rate, charge lag, and bad debt write-off. AR aging shape, denial root-cause clustering, and coding patterns round out the diagnostic. NY-specific payer mix, Medicaid managed care dominance in NYC, Section 3224-a prompt pay, No Surprises Act layered on state rules, makes a generic national audit incomplete. This guide walks the full audit checklist.

Growth is when RCM problems go from manageable to expensive. A four-provider group with one biller can run on habit. A twelve-provider group with two locations and an expanded payer roster cannot. The systems that worked at the smaller scale quietly leak revenue at the larger one, and the leakage compounds across KPIs before any single metric crosses a threshold obvious enough to trigger a response. An RCM audit is the structured way to catch that drift. For a NY practice, the audit has extra work to do, because the payer mix, the prompt-pay rules, and the Medicaid managed care landscape are not what national benchmarks describe. The sections below walk the audit end to end.

The seven KPIs that tell you RCM is slipping

The seven metrics below are the core of any RCM scorecard, and they come from MGMA's practice benchmarking work and the Healthcare Financial Management Association revenue cycle resources. Each has a healthy range, and each signals a different underlying issue when it drifts. Read them as a set, not individually.

Net collection rate

Net collection rate (NCR) measures what a practice actually collected against what it was contractually owed after adjustments. MGMA benchmarking data suggests healthy practices sit at 95% or higher, with top performers above 98%. A slipping NY practice often sees NCR drift from 96% to 92% over two or three quarters, which on a $15M book is $600K in leakage. The drift almost never announces itself; it accumulates inside underpayment variance, unworked denials, and patient balance write-offs.

Days in AR

Days in AR is how long the average dollar sits between date of service and collection. HFMA-aligned benchmarks put a healthy range at 30 to 40 days, with specialty variation, higher for surgical specialties with longer claim cycles, lower for primary care with more patient copay. Growing practices often see days in AR drift from 38 to 52 over a year as new providers, new payers, and new workflows layer on. That ten-day drift represents meaningful working-capital pressure and usually signals clean claim rate or denial rate are also slipping.

Clean claim rate

Clean claim rate is the percentage of claims accepted on first submission without edit or rejection. The Change Healthcare Revenue Cycle Denials Index reports industry-wide first-pass rejection rates that suggest a healthy clean claim target is 95% or higher. A NY practice seeing clean claim rate below 90% is typically dealing with eligibility gaps at the front desk, missing modifier logic, or authorization process breakdowns, any of which compound into denial rate.

First-pass resolution rate

First-pass resolution is the percentage of claims paid in full on first submission, no denial, no appeal, no resubmission. HFMA guidance suggests 85% or higher for mature practices. Growing groups often slip into the 75% to 80% band as new payers and new CPT combinations produce edit errors that no one has yet diagnosed. Every point below the target translates roughly to incremental rework cost and delay in cash.

Denial rate

Industry denial benchmarks from the Change Healthcare index put total initial denial rates around 11% across hospitals and a similar band for physician groups. Top-performing practices sit under 5%, with "hard" denials, those not recoverable through appeal, targeted below 2%. A growing NY practice that sees denial rate move from 6% to 9% over a year is almost certainly dealing with a mix of authorization gaps, coding specificity issues, and COB conflicts that need root-cause clustering rather than claim-by-claim rework.

Charge lag

Charge lag is the time from date of service to charge entry. Healthy practices sit inside 48 hours for office visits and 72 hours for procedures. A lag above a week usually correlates with encounter-documentation delay, which downcodes E/M levels under the AMA CPT Evaluation and Management guidelines. Charge lag is the most operationally actionable KPI on the list, because the fix is documentation-workflow, not payer-facing.

Bad debt write-off rate

Bad debt is what the practice ultimately wrote off after collection efforts failed. MGMA benchmarks put healthy groups under 3% of gross charges on commercial lines, with higher tolerance for payer-mix-heavy self-pay practices. The trend line matters more than the snapshot. A bad debt rate that doubles in a year, even if it is still nominally inside the benchmark, signals that patient-balance workflow has drifted, often because statement cadence, payment-plan availability, or front-desk collection habits changed when the practice grew.

What the AR aging buckets are actually telling you

AR aging is the distribution of outstanding dollars across 0-30, 31-60, 61-90, 91-120, and 120+ day buckets. The healthy shape, per HFMA and MGMA guidance, is 70% to 80% in 0-60 days and under 15% in 120+. A NY practice whose 120+ bucket crosses 20% is either carrying legacy denials that never got worked, sitting on unworked underpayment variance, or accumulating patient balances that the current collection workflow cannot clear.

Three distortions regularly mislead readers of the aging report. First, posting lag artifacts: if payments post slowly, the 0-30 bucket looks artificially thick while the 60-90 bucket looks artificially thin, masking real denial drift. Second, credit balances hiding old AR: negative-balance accounts net against positive-balance accounts in the raw report, so a practice with large payer refund liabilities can look healthier than it is. Third, self-pay creep as high-deductible-health-plan enrollment grows; the KFF 2024 Employer Health Benefits Survey documents continued deductible growth, which shows up as thicker 90+ patient balances.

NY payer mix adds its own wrinkle. Medicaid managed care plans in NYC, Healthfirst, MetroPlus, Fidelis Care, VNS Health, each process claims on slightly different timelines than commercial payers, which means the aging shape for a Medicaid-heavy practice will not look the same as a commercial-heavy practice at the same performance level. The audit scope has to slice aging by payer category, not roll it up, or the diagnosis is wrong. Our piece on the hidden cost of RCM revenue leakage walks through the dollar math on each of those distortions.

Denial root-cause categories and NY-specific patterns

Denial management is the single biggest lever most growing practices have, and root-cause clustering is how the lever turns. Five buckets account for the overwhelming majority of denials nationally, per the Change Healthcare denials index and MGMA's administrative burden work: eligibility and coverage, prior authorization, coding specificity, medical necessity documentation, and coordination of benefits. A structured denials program clusters every denied claim into one of the five, sizes each cluster in dollar terms, and sequences the fixes in descending dollar-impact order.

Two NY-specific patterns appear on top of the national baseline. Medicaid managed care MLTC (managed long-term care) authorization workflows differ plan by plan, and a practice adding a new MLTC plan without mapping the authorization rules will see that plan's denial cluster spike for two quarters before anyone notices. Our companion credentialing and payer contracting playbook covers the upstream enrollment work that feeds into this denial pattern. The NY State Department of Health Medicaid managed care program pages are the authoritative reference for plan lists and MLTC-specific rules. The other pattern is prompt-pay interest recovery, under NY Insurance Law Section 3224-a, NY-regulated commercial carriers owe interest on clean claims paid outside the 30-day window. Most practices never claim the interest, which is effectively money left on the table during the audit year.

Industry-wide, the Change Healthcare 2024 Revenue Cycle Denials Index documents that roughly 60% of denied claims are never resubmitted. On a $15M practice with an 8% denial rate, that is recoverable revenue worth $300K to $500K annually once a structured appeal process closes the no-rework gap. MGMA's 2024 Annual Regulatory Burden Report identifies prior authorization and denials management as the top-cited administrative burden for medical group administrators.

Under-coding vs over-coding: which red flag applies

Coding audits usually find both directions of error, but the direction matters. Over-coding creates compliance risk, an over-coded E/M level that draws a payer audit or a CMS extrapolation demand is meaningfully worse than a single under-coded encounter. Under-coding is the more common pattern at growing mid-size groups, and it is pure leakage. When documentation supports a level 4 visit but the biller submits a level 3, the difference in reimbursement compounds across every encounter that biller touches.

The AAPC coding education resources and AHIMA revenue cycle management resources both recommend periodic external coding review, with sample sizes calibrated to the practice's risk profile. A common audit protocol pulls 20 charts per provider per year, reviewed against the CPT Evaluation and Management guidelines, with variance in either direction, over or under, flagged for provider-level education. Practices that have never run an external review typically see under-coding leakage in the 2% to 4% range on E/M-heavy specialties, which on the scenario of a $15M practice is $300K to $600K per year.

Over-coding risk gets tested when CMS or a commercial payer triggers a prepayment or postpayment review. The CMS Medicare Physician Fee Schedule lookup is the reference for published rates, but the audit risk sits in documentation adequacy, not rate levels. A growing practice that has recently added new providers is especially exposed, because the coding habits of an inbound provider may not match the practice's documentation standards until a few review cycles have normalized them.

How to benchmark against your specialty and geography

The benchmark problem is that a national median is rarely the right comparator. MGMA's DataDive publishes percentile ranges by specialty, region, practice size, and ownership structure, and the right cut for a NY specialty group is usually Northeast-plus-specialty-plus-practice-size. A primary care practice in the Bronx has a different fair benchmark than a surgical specialty in Manhattan, which has a different fair benchmark than a behavioral health practice in Westchester, because payer mix and reimbursement methodology all vary at that level.

Three axes dominate the benchmark work. Specialty shapes AR patterns, surgical specialties with longer global periods carry thicker 30-60 day buckets, behavioral health with frequent short encounters carries thinner ones. Geography shapes payer mix, the five boroughs run heavier on Medicaid managed care than upstate, which shifts aging shape and denial patterns. Practice size shapes what is achievable, a four-provider practice will not hit the same operational efficiency as a twenty-provider group on the same payer mix, and expecting it to produces a bad benchmark.

For NY-specific context, the New York State Department of Financial Services health insurance resources and the KFF state-level coverage data tables are the anchor references on payer landscape. Our companion piece on payer contract renegotiation prep walks the benchmark work as it feeds into a rate negotiation, which is one of the downstream uses of the audit data.

NY payer mix quirks to bake into the audit scope

NY is not a generic state for RCM purposes. Three structural features change the audit:

First, Medicaid managed care dominance in NYC. Medicaid managed care in the five boroughs runs through private plans, primarily Healthfirst, MetroPlus, Fidelis Care, VNS Health, Empire BlueCross BlueShield HealthPlus, and several smaller plans. Each has its own prior-authorization rules, adjudication speed, and denial patterns. An audit that treats Medicaid as one payer category rather than five or six plans misses plan-level denial clustering, and any remediation effort downstream runs on incomplete information. The NY State Department of Health Medicaid managed care program pages maintain the authoritative plan list.

Second, the No Surprises Act federal rules sit on top of the NY Surprise Medical Bill Law that preceded them. For audit scope, the practical implication is that out-of-network emergency and ancillary claims follow a federal dispute process with its own timelines, while NY-regulated fully-insured plans still carry NY-specific notice and payment requirements. A practice with any out-of-network or partially-participating billing activity needs the audit to track both regimes.

Third, the NY prompt-pay window under NY Insurance Law Section 3224-a sets a 30-day clean-electronic-claim standard for NY-regulated commercial carriers, with statutory interest on late payments. Federal ERISA self-funded plans run on different timing rules, and a practice whose payer mix has shifted toward self-funded employer plans over the last few years is aging against a different clock than an older payer-mix snapshot would suggest. For audit purposes, that means aging-bucket expectations need to be segmented by regulatory category of the payer, not rolled up.

Stay and fix vs switch RCM vendors

The decision framework is narrower than most practices assume. Stay and fix is the right answer when the problem is confined to one or two KPIs, the current vendor responds to tickets inside the contractual SLA, and the remediation plan can be sequenced inside the current workflow. Switch is the right answer when multiple KPIs are slipping together, denial rate, days in AR, and net collection rate moving the wrong direction over two or three quarters, AND vendor response time has degraded to where issue tickets routinely sit open for weeks.

The cost of switching is often underestimated. A vendor migration typically produces 60 to 90 days of AR disruption before the new team stabilizes, claims in flight at the cutover date often have to be re-worked on the new platform, and the practice carries two vendor invoices during the transition. HFMA case studies on RCM vendor migrations suggest that practices budgeting less than that AR disruption window often end up extending the old contract mid-migration, at worse terms. The fix-in-place path, properly executed, usually recovers the same dollars on a 4-to-6-month horizon without the cutover risk.

When the switch is the right call, the migration playbook is straightforward. Freeze new build inside the old system at day 0. Run parallel for 30 to 45 days on new claims while the old system continues working the backlog. Set a clean cutover date on the aging population. Assign named ownership on legacy AR so nothing falls between vendors. Renegotiate the old vendor's contract to add a transition-services clause before the switch rather than after.

Putting the audit on a calendar

A growing NY practice that runs the seven-KPI scorecard quarterly, an AR-aging-by-payer review quarterly, a denial-root-cause clustering review quarterly, an external coding review annually, and a full-cycle audit annually will catch most of the drift before it compounds. Practices at physician-owned mid-size groups and multi-site medical practices and clinics that have grown past the threshold where habit alone runs the billing function usually find the first audit recovers multiples of its cost. Companion analysis on the benefits-cost side of growing practice overhead sits in our piece on when a self-funded health plan starts making sense for NY employers.

For practices weighing how to sequence the audit work, our revenue cycle management service overview explains how we structure the diagnostic and the remediation, and the healthcare management service overview covers the broader operational review that often surfaces alongside RCM findings. Practices thinking through total cost of growth also review our employee benefits 101 guide alongside the RCM audit. The audit is the diagnostic; the fix-sequence is the value. Scheduling a consultation through our schedule a consultation page is the fastest way to put a timeline around both.