Why Dermatology Groups Are the Next Target for OIG Audit Extrapolation

A payor reviews 47 charts from one of your locations. It finds documentation gaps in 11 of them — a 23% error rate. Under standard OIG extrapolation methodology, that error rate now applies to every claim your organization submitted over the past three years. You are not looking at 11 bad claims. You are looking at a six- or seven-figure recoupment demand.

This is not a hypothetical. It is how audit extrapolation works under Chapter 8 of the CMS Program Integrity Manual. And as of 2025 and 2026, dermatology groups have moved from a specialty the OIG watched to one it is actively auditing.

Here is what is driving the scrutiny, where dermatology's specific documentation vulnerabilities live, and why multi-location groups — especially PE-backed platforms — face disproportionate exposure.

The OIG Has Dermatology in Its Crosshairs on Multiple Fronts

The OIG does not open audit workstreams without data. The agency uses claims analytics to identify utilization patterns that deviate from peer benchmarks before a single chart is pulled. In dermatology, the data lit up on three separate issues simultaneously.

Modifier 25 on same-day procedures. The OIG added a formal work plan item targeting dermatologist claims for evaluation and management (E/M) services billed on the same day as a minor surgical procedure — the exact scenario where modifier 25 is applied. The trigger: in 2019, roughly 56% of dermatologists' claims with an E/M service also included a same-day minor surgical procedure, a pattern the OIG flagged as potentially indicating abuse. That figure has since been refined — a November 2025 OIG audit found modifier 25 on 61.5% of dermatology E/M claims, approximately four times the specialty average across all of medicine. The audit ultimately found that dermatology providers generally met Medicare requirements, but "generally met" is not the same as clean, and high-volume flagging means dermatology triggers payor audit algorithms at a rate no other outpatient specialty approaches.

Skin substitutes. A separate OIG data review (OEI-BL-24-00420, published 2025) found that Medicare Part B expenditures for skin substitutes in non-institutional settings exceeded $10 billion annually by the end of 2024 — with spending per enrollee growing from $40,051 to $121,501 between early 2023 and Q3 2024, a 153% increase in average payment per patient. The OIG described these trends as raising "major concerns about fraud, waste, and abuse," and a formal audit (OAS-25-09-005) targeting skin substitute claims was announced for 2026. Dermatology practices that perform wound care or apply skin substitutes are already receiving audit notification letters.

Predictive enforcement is replacing reactive enforcement. The 2025 OIG compliance landscape has shifted materially: enforcement agencies now use machine learning and claims pattern recognition to identify likely violators before claims are paid. Providers flagged by predictive models face comprehensive audits rather than limited-scope reviews. For dermatology, a specialty with unusually high modifier 25 usage, a procedure-dense billing pattern, and documented outlier signal density, that model flags practices at high rates regardless of actual documentation quality.

How Extrapolation Turns a Documentation Problem Into an Existential One

Most dermatology compliance conversations focus on individual claim denials. Extrapolation is a different category of risk entirely.

Here is how it works under CMS Program Integrity Manual Chapter 8: the OIG or a Medicare Administrative Contractor (MAC) selects a statistically valid sample of claims — typically 30 to 100 charts — and reviews them for compliance. The error rate identified in that sample is then extrapolated across the full claim universe, often covering a three-year look-back period. OIG uses RAT-STATS, its own statistical software, to calculate overpayment estimates at a 90% or 95% confidence interval.

The math is unforgiving.

A 23% error rate in a sample of 50 charts, applied to 100,000 claims filed over three years, produces an estimated overpayment in the millions even if the actual dollar value of the sampled errors is modest. Providers have the right to rebut the methodology and present their own statistical sample, but doing so requires qualified experts, time, and documentation infrastructure that most multi-location groups do not have at the moment an audit letter arrives.

The conditions under which extrapolation applies are worth understanding: the CMS Program Integrity Manual specifies that it is appropriate when a provider has a sustained or high level of payment error, or when an educational intervention has not produced a significant reduction in error rate. For dermatology, the combination of a documented high modifier 25 utilization rate and active OIG scrutiny creates the predicate conditions for extrapolation without requiring any evidence of intentional fraud.

Dermatology's Specific Documentation Vulnerabilities

The claims-pattern data explains why dermatology is under scrutiny. The documentation picture explains why the risk is real even for well-run practices.

Cosmetic vs. covered is a documentation question, not a clinical one. Dermatology is the only specialty where an identical procedure — removing the same type of lesion from the same location — is either covered by Medicare or entirely excluded from coverage depending solely on what the clinician wrote in the note. A benign lesion removed because the patient asked is cosmetic and not covered. The same lesion removed because it is bleeding, painful, itching, growing, or suspicious for malignancy is medically necessary and covered. The clinical decision may be clear; the documentation often is not. A claim coded with a cosmetic-default ICD-10 diagnosis — even when the clinical note includes fully adequate necessity language — produces an ICD-to-code contradiction that survives a human eye review but fails a systematic audit. This is the highest-value catch category in dermatology compliance, and it is largely invisible to standard billing workflows.

Cloned macros undercut medical necessity. EHR templates designed to auto-insert medical necessity language for lesion removals and destructions are now common in dermatology. The OIG has noted this pattern explicitly. A note that reads identically for a covered removal and a cosmetic removal — because the macro fires regardless of clinical context — does not establish patient-specific necessity. It establishes that the template fired. Payors and auditors are specifically trained to identify templated necessity language that is not individualized to the specific encounter.

Site, size, and pathology documentation gaps accumulate. Procedure codes for lesion excision are size-based — the correct CPT code depends on the greatest clinical diameter of the lesion plus margins. Documentation that states "lesion removed" without a measurement creates downcoding risk. In high-volume derm settings, even small and consistent measurement gaps can shift CPT selection across thousands of visits annually. Similarly, biopsy specimens that are not explicitly tied to a documented lesion, or pathology diagnoses that are inconsistent with the billed service, create the ICD-to-procedure linkage failures that auditors look for.

E/M undercoding is revenue left on the table — and still an audit risk. Dermatology practices routinely default to lower-level E/M codes to reduce audit exposure, a conservative practice that is individually rational and collectively costly. The Coding Module that audits E/M levels catches both directions: documented MDM that supports 99214 but was billed as 99213 represents recoverable revenue. But it also catches 99215 claims where the documented MDM does not support the level — the kind of upcoding that triggers individual audits and flags practices in payor algorithms.

Why PE-Backed Dermatology Platforms Face Amplified Exposure

Dermatology is one of the most consolidated healthcare services markets in the United States. As of 2026, more than 35 PE-backed dermatology platforms are operating across roughly 20 states, with platform-level transactions clearing at 12 to 15 times EBITDA for scaled groups. That consolidation creates a compliance risk structure that is different in kind from a single-practice audit.

At a PE-backed platform with 50 or 100 locations, documentation patterns that are inconsistently applied across sites produce an error rate that is both systemic and large in absolute dollar terms. A 10% documentation error rate at a 500-provider group does not represent 50 individual provider problems. It represents a system-level compliance gap — exactly the pattern that triggers extrapolation rather than targeted provider education.

Clawback risk lands directly on EBITDA. For groups preparing for a recap or secondary transaction, a payor demanding recoupment of $3 million against a $10 million EBITDA practice is not an operational nuisance. It is a direct impact on valuation at a multiple of 10x or more. Diligence buyers in dermatology M&A are increasingly scrutinizing compliance infrastructure — specifically whether the organization has a documented self-correction record, not just a stated compliance policy. A full pre-bill audit history that demonstrates isolated errors, not systemic patterns, is the strongest possible defense in an extrapolated demand and the strongest possible evidence in a diligence process.

The Defense Is Built Before the Audit Arrives

There is no effective reactive strategy for audit extrapolation. By the time a provider receives a sample review request and a demand letter, the sample is already selected, the error rate is already calculated, and the extrapolation is already in motion. The options at that stage are to contest the methodology (expensive, slow, and uncertain), pay the demand, or negotiate a repayment plan.

The only durable defense is pre-bill documentation review that catches the gaps before claims drop. That means reading every visit note — not sampling — for the specific failure patterns that dermatology audits target: cosmetic-default diagnosis contradictions, cloned medical necessity language, site and size measurement gaps, modifier 25 documentation deficiencies, and ICD-to-procedure linkage failures.

At the scale that multi-location dermatology groups operate, that review cannot be done manually. It requires the same systematic, note-level analysis that auditors use — run before the claim is submitted, not after the demand letter arrives.

Brellium Provides Protection

There is a meaningful gap in the current dermatology compliance market. Billing vendors and RCM platforms operate at the claim layer: they optimize code assignment, scrub for formatting and eligibility, and manage denials after they occur. None of them reads the clinical note to determine whether the documentation supports what was billed.

The same engine that protects $1.4B+ in claims across behavioral health, ABA, and hospice is now available for dermatology groups.

Brellium audits 100% of dermatology visit notes before the claim drops, flagging cosmetic-vs-covered documentation gaps, modifier 25 deficiencies, E/M undercoding, and ICD-to-procedure contradictions.

See how Brellium works for dermatology →