Castleport Test Prep

CPMA Exam Prep: Free Study Guide for AAPC's Medical Auditor Exam

Everything you need to start preparing for AAPC's Certified Professional Medical Auditor (CPMA) exam: where the points are, a worked audit, 25 original practice questions with explanations, and an 8-week study plan.

Start with one audit

Auditing isn't picking a code. It's checking a record against a rule and saying exactly what the evidence does and doesn't support. Try this one before reading the answer.

Practice audit (original and unofficial). Medicare physician-office visit, September 15, 2026. You're reviewing only the time that counts toward time-based office E/M (evaluation and management) level selection, not the final code or payment.

The physician's signed note breaks down the activity below. All of the physician's activities happened on the visit date, none overlap, and the separately reported procedure is distinct from the E/M work. An internal billing worksheet added all five rows and recorded 41 minutes of E/M time.

Practice audit ledger: documented activity and minutes
Documented activity Minutes
Physician evaluates and counsels the patient 15
Physician reviews relevant records and test results before the visit 8
Physician documents the encounter afterward 7
Medical assistant rooms the patient 5
Physician performs a separately reported procedure 6

Your task: How many minutes does this record support for office E/M time? Write one sentence stating your finding and one sentence stating what the finding doesn't establish.

Answer: 30 minutes. Add the physician's qualifying work: 15 + 8 + 7 = 30. The medical assistant's 5 minutes of rooming don't count, because staff time is excluded. The 6 minutes spent on a separately reported procedure don't count either. The physician's preparation and documentation do count, even though they weren't face to face, because they happened on the date of the encounter. Time spent on a different date wouldn't count. (AMA, Time-Based Billing; AMA office/outpatient time guidance, pp. 2-3; Noridian E/M Q&A)

A good finding: "The worksheet's 41-minute E/M total includes 5 minutes of staff rooming and 6 minutes of a separately reported procedure; the documented activity supports 30 minutes of qualifying physician E/M time."

Its limit: "This time review doesn't, by itself, select the final code, determine coverage or payment, or prove fraud."

Why the tempting totals are wrong: 15 counts only the face-to-face part. 35 adds staff time. 41 adds staff time and the procedure.

Next step in a real audit: Correct the calculation through the organization's normal review process, then check the remaining coding and payer requirements. If the worksheet routinely adds excluded time, fix the worksheet and recheck a later record. Never change the clinical record to fit the claim. (CMS documentation requirements; CMS Program Integrity Manual, ch. 3, §3.3.2.5)

By Castleport Test Prep Editorial Team · Last verified October 21, 2026: AAPC's CPMA format, content breakdown, allowed books, fees, and the rules cited in the explanations.

At a glance: 100 multiple-choice questions · 4 hours in one sitting · 70% to pass · open book (approved references only) · online with a live remote proctor or at a testing center. (AAPC)

Where the points are

AAPC splits the 100 questions into seven content areas. Use this table alongside your error log to choose what to review next.

CPMA exam questions by content area
Content area Questions
Medical record auditing abstraction (case-based) 36
Compliance and regulatory guidelines 21
Medical record standards and documentation guidelines 17
Coding and reimbursement concepts 13
Scope and statistical sampling methodologies 7
Communication of results and findings 4
Quality assurance and risk analysis 2
Total 100

Source: AAPC, Taking the CPMA exam, "Breakdown of the 100-question CPMA exam."

What that means for your prep:

  • Audit cases are the biggest block. The abstraction questions come from about 15 audit cases, and they count toward the 100; they aren't extra. AAPC's case list spans E/M, surgery, physical therapy, radiology, psychiatry, and hematology/oncology and infusion services. Practice auditing records every week, not just in the final stretch.
  • Compliance and documentation are next. Together they're 38 questions. Learn the frameworks (who a law applies to, what it requires, what triggers it) rather than memorizing trivia.
  • The smaller areas still matter. Sampling, communication, and quality assurance add up to 13 questions. Review sampling limits, clear reporting, and support for audit decisions rather than skipping them.

You'll see sources describe a 150-question CPMA or a six-area outline. Those do not match AAPC's current posted 100-question, seven-area breakdown. Use AAPC's current page for your exam date.

How to audit any record

The worked audit above follows five steps. They work for E/M, surgery, diagnosis coding, and compliance questions alike.

  1. Set the context. Payer, setting, date of service, and exactly what you're testing.
  2. Pull the evidence. What does the record actually say, and where?
  3. Find the rule and its version. Which guideline, edit, or regulation controls, and was it in effect on that date?
  4. State the finding. Supported, not supported, or can't be determined, with the reason.
  5. Name the limit and the next step. What the finding doesn't prove, and who fixes what.

Keep three questions separate. Does the record support the code? Does the payer cover the service? Is there evidence of misconduct? A "yes" or "no" to one doesn't answer the other two. A valid code isn't proof the service was covered or medically necessary, and missing documentation isn't proof of fraud. (CMS documentation requirements, pp. 2-3; CMS improper payments fact sheet)

Audit worksheet

Copy this for practice cases. It's a study tool, not an official AAPC form, and you can't bring it into the exam.

Audit worksheet: field, what to write, and the worked audit filled in
Field What to write The worked audit, filled in
Audit question The one element you're testing Does the 41-minute E/M total match the record?
Context Payer, setting, date, scope Medicare, physician office, Sept. 15, 2026, time only
Evidence The record facts and where they are Activity breakdown: 15, 8, 7, 5, and 6 minutes
Rule and version Source, section, effective date Office E/M time rules; staff time and separately reported services excluded
Finding Supported, not supported, or unresolved, and why 30 qualifying minutes; worksheet included 11 excluded minutes
Limit What this doesn't decide Final code, MDM level, coverage, payment, intent
Action and owner Correction needed and who does it Coding/billing reviewer corrects the time calculation
Follow-up How you'll know the fix worked Recheck a later record after the worksheet logic is fixed

Report line you can reuse: "For [scope and record], [evidence] does / does not support [claim element] under [rule and version]. [Limit]. [Owner] will [action], and a follow-up review will check [evidence of correction]."

25 free CPMA practice questions

These are original, unofficial questions written by Castleport Test Prep, not AAPC exam questions. They cover all seven content areas, with five case-based items, but they're a starter set, not a full-length or weighted mock exam. Choose one answer, then read the explanation, even when you got it right. Your score here is feedback on these 25 items, not a predicted CPMA result.

Medical record standards and documentation guidelines

CPMA-01 · Patient right of access

A patient sends a written request for a copy of her records to a physician practice that is a HIPAA covered entity. No state law sets a shorter deadline. Under the HIPAA Privacy Rule, what is the practice's outer time limit to act on the request?

  • A. 15 days, with no extension
  • B. 30 days, with one extension of up to 30 more days if the patient gets a written reason and a completion date within the first 30 days
  • C. 60 days, plus one more 30-day extension
  • D. 90 days, to allow time to check the record for completeness
Reveal answer and explanation for CPMA-01

Answer and explanation: B. The Privacy Rule requires action within 30 days of receiving the request and allows only one extension of no more than 30 days. The practice has to send the written reason and expected date inside the first 30 days. A is stricter than federal law (some states are stricter, so check yours). C and D go past the federal limit.

Source: 45 CFR 164.524(b)(2), timely action

CPMA-02 · Retention rules

A practice manager tells the audit team, "HIPAA requires us to keep every patient chart for six years." Which response is most accurate?

  • A. That's correct. HIPAA sets a six-year retention period for all medical records.
  • B. That's wrong. HIPAA has no record-keeping time requirement of any kind.
  • C. That's wrong. HIPAA requires ten years for every medical record.
  • D. Not quite. HIPAA's six-year rule applies to required HIPAA documentation, such as policies and procedures. How long charts must be kept is generally set by state law and other applicable rules.
Reveal answer and explanation for CPMA-02

Answer and explanation: D. HHS says the Privacy Rule does not include a medical-record retention period and that state laws generally govern it. HIPAA's six-year documentation rules cover required Privacy Rule documentation under 45 CFR 164.530(j)(2) and required Security Rule documentation under 45 CFR 164.316(b)(2)(i); the period runs from creation or the date last in effect, whichever is later. A turns that documentation rule into a chart rule, C invents a number, and B ignores the documentation requirement. Records still need safeguards for as long as they're kept, including at disposal.

Source: HHS FAQ: Does HIPAA require medical records to be kept for any period?; 45 CFR 164.316(b)(2)(i), documentation time limit; 45 CFR 164.530(j), Privacy Rule documentation and retention

CPMA-03 · Signature authentication

During a Medicare medical review, a progress note has an illegible handwritten signature and no printed name. Which documentation can the practice use to show who wrote the note?

  • A. A signature log or a signature attestation from the author
  • B. A new copy of the note, rewritten and signed today, replacing the original
  • C. A rubber-stamped signature added to the original note
  • D. Nothing. An illegible signature automatically invalidates the service.
Reveal answer and explanation for CPMA-03

Answer and explanation: A. Medicare review guidance accepts a signature log or an attestation, signed and dated by the author, to identify an illegible signer. Replacing the original note (B) isn't an accepted way to authenticate it. Stamped signatures (C) are generally not accepted, apart from a narrow disability exception. D is wrong because this defect can be cured. (Other signature defects depend on the governing requirement. An attestation cannot backdate a signature that had to be in place before a specified event or date.)

Source: CMS Medicare Program Integrity Manual, ch. 3, section 3.3.2.4, pp. 42-45

CPMA-04 · Amendments and record integrity

A clinician needs to add information that was left out of a Medicare encounter note. What should the auditor expect the amendment to look like?

  • A. A replacement note written to look like the original entry
  • B. An undated replacement, so only the original encounter date shows
  • C. An entry with an identifiable author and date, clearly marked as an amendment
  • D. A change that leaves no sign anything was altered
Reveal answer and explanation for CPMA-04

Answer and explanation: C. CMS expects amendments, corrections, and late entries to be clearly identified, with the author and date of the change recognizable. A, B, and D all hide who changed the record or when. Even a properly marked addendum still has to be reviewed on its merits; it doesn't automatically support the claim.

Source: CMS Medicare Program Integrity Manual, ch. 3, §3.3.2.5 (p. 46)

CPMA-05 · Minimum necessary access

A workforce member is doing an authorized internal billing audit for a HIPAA covered entity. Which access approach best fits the minimum necessary standard?

  • A. Access suited to the assigned audit under the entity's role-based policy, with broader access when it's justified
  • B. Unrestricted access to every chart, because all audit work counts as treatment
  • C. Copying every chart to a personal device so the audit goes faster
  • D. Never opening an entire chart, even when that's necessary and justified
Reveal answer and explanation for CPMA-05

Answer and explanation: A. Minimum necessary means access that fits the purpose and the entity's policy. B misuses the treatment exception; a billing audit isn't treatment. C ignores scope and security controls. D invents an absolute ban; whole-record access is allowed when it's justified for the task.

Source: HHS, Minimum Necessary Requirement

Compliance and regulatory guidelines

CPMA-06 · Stark Law vs. Anti-Kickback Statute

A physician refers her Medicare patients' clinical laboratory tests (a designated health service) to a lab her spouse owns. No exception applies. Nobody offered, paid, solicited, or received remuneration (cash or anything else of value) to induce or reward these referrals. Which law is most directly implicated?

  • A. The Anti-Kickback Statute, which requires knowing and willful intent
  • B. Neither, because nobody intended to break the law
  • C. The HIPAA Privacy Rule
  • D. The physician self-referral law (Stark Law), which prohibits these referrals and is strict liability
Reveal answer and explanation for CPMA-06

Answer and explanation: D. Stark prohibits a physician's referrals for Medicare-payable designated health services to an entity with which the physician or an immediate family member has a financial relationship, unless an exception applies. The referral prohibition does not require proof of specific intent. The Anti-Kickback Statute (A) concerns knowing and willful offers, payments, solicitations, or receipts of remuneration to induce or reward federal health care program referrals or business; those facts are absent here. C is a privacy law. B fails because Stark is strict liability.

Source: HHS-OIG, Fraud & Abuse Laws; CMS, Physician Self-Referral: definition and designated health services

CPMA-07 · Medicare overpayment deadline

In 2026, a physician practice's internal audit confirms it received and kept a Medicare Part B overpayment on several claims. It isn't investigating any related claims. No corresponding cost report applies, and no disclosure-protocol or extended-repayment suspension applies. When must the overpayment be reported and returned?

  • A. Within 60 days after the overpayment was identified
  • B. By the end of the calendar year
  • C. Within 180 days after identification, in every case
  • D. Only after the Medicare contractor sends a demand letter
Reveal answer and explanation for CPMA-07

Answer and explanation: A. For Medicare Parts A and B, report and return an identified overpayment by the later of 60 days after identification or the corresponding cost-report due date, if applicable. The stem excludes the alternative deadline and suspensions, so A applies. The 180-day limit is not the standard repayment deadline. Neither year-end nor a contractor demand determines the deadline here.

Source: 42 CFR 401.305(a)(2), (b)(1)-(3), current reporting and return requirements

CPMA-08 · Compliance program elements

Which of these is NOT one of the seven elements in HHS-OIG's General Compliance Program Guidance?

  • A. Written policies and procedures
  • B. Compliance risk assessment, auditing, and monitoring
  • C. A required annual external audit by a certified medical auditor
  • D. Responding to detected offenses and developing corrective action initiatives
Reveal answer and explanation for CPMA-08

Answer and explanation: C. OIG's seven elements are: written policies and procedures; compliance leadership and oversight; training and education; effective lines of communication; enforcing standards through consequences and incentives; risk assessment, auditing, and monitoring; and responding to detected offenses with corrective action. Auditing is an element, but OIG doesn't mandate a yearly external audit by a credentialed auditor. The guidance is voluntary, not a regulation.

Source: HHS-OIG General Compliance Program Guidance (Nov. 2023)

CPMA-09 · NCCI modifier indicators

A Medicare NCCI procedure-to-procedure (PTP) edit is active for the date of service and has a modifier indicator of 0. The same provider reports both codes for the same patient on that date, appending modifier 59 to the column 2 code. What should the auditor expect?

  • A. Both codes are paid, because modifier 59 bypasses the edit
  • B. The column 2 code is paid and the column 1 code is denied
  • C. The modifier cannot bypass the edit; the column 2 code is denied under the edit, while the column 1 code remains subject to other payment requirements.
  • D. Both codes are paid if modifier XS is used instead of 59
Reveal answer and explanation for CPMA-09

Answer and explanation: C. NCCI stands for National Correct Coding Initiative. An indicator of 0 means an NCCI-associated modifier cannot bypass this active edit. The column 2 code is denied under the edit; column 1 eligibility does not guarantee payment. A incorrectly treats modifier 59 as an override, and B reverses the columns. D fails because the X modifiers (XE, XS, XP, XU) are NCCI-associated modifiers too. Watch the opposite trap as well: an indicator of 1 only means a modifier may be used when the circumstances and documentation support it. It doesn't make a modifier automatic or guarantee payment.

Source: CMS Medicare NCCI FAQ Library, PTP Edits and NCCI Modifiers

CPMA-10 · Targeted Probe and Educate

A Medicare Administrative Contractor tells a practice it's been selected for Targeted Probe and Educate (TPE). Which description is accurate?

  • A. A single review of 100 claims, followed automatically by extrapolation
  • B. A random survey with no education component
  • C. A criminal investigation opened by the OIG
  • D. A review of 20 to 40 claims per round for up to three rounds, with education between rounds; problems that continue after three rounds can be referred to CMS
Reveal answer and explanation for CPMA-10

Answer and explanation: D. TPE reviews 20 to 40 claims per round, for up to three rounds. Providers with denials get one-on-one education and at least 45 days to improve before the next round. If problems continue after three rounds, CMS can take further action, such as 100% prepayment review, extrapolation, or referral to a Recovery Auditor. Extrapolation isn't automatic (A), and TPE isn't a criminal probe (C) or education-free (B).

Source: CMS, Targeted Probe and Educate

CPMA-11 · Improper payment vs. fraud

A Medicare payment review finds the record doesn't contain enough documentation to show the billed service met the applicable requirements. Nothing else is known about the clinician's conduct. Which description fits best?

  • A. Proven criminal fraud
  • B. Proof that the patient received no care
  • C. A documentation and payment finding that needs follow-up; on its own, it doesn't establish fraud or intent
  • D. A harmless issue that needs no action
Reveal answer and explanation for CPMA-11

Answer and explanation: C. CMS counts insufficient documentation as an improper payment, and it explicitly says improper payments aren't necessarily fraud. A and B go beyond the evidence: missing support doesn't prove the care never happened. D dismisses a finding that can still mean money has to be returned. Record the gap and follow the organization's review process.

Source: CMS, Fiscal Year 2025 Improper Payments Fact Sheet; CMS MLN909160, Complying with Medical Record Documentation Requirements (pp. 2-3)

Coding and reimbursement concepts

CPMA-12 · Modifier 57

For a Medicare patient, on Monday, a surgeon evaluates a patient and makes the initial decision to perform a major procedure (90-day global period) on Tuesday. Which modifier belongs on Monday's E/M service?

  • A. 25
  • B. 24
  • C. 57
  • D. 79
Reveal answer and explanation for CPMA-12

Answer and explanation: C. Modifier 57 marks the E/M visit that results in the initial decision for surgery when that visit falls on the day before or the day of a major procedure. Modifier 25 (A) identifies a significant, separately identifiable E/M service by the same provider on the same day as a procedure or other service, beyond the usual included work. Modifier 24 (B) is for an unrelated E/M during a postoperative period. Modifier 79 (D) is for an unrelated procedure during a postoperative period.

Source: CMS MLN907166, Global Surgery Booklet (Dec. 2025)

CPMA-13 · Modifier 24

For a Medicare patient, five weeks after a major knee procedure with a 90-day global period, the same surgeon evaluates the patient for a new, unrelated shoulder complaint. How should the E/M service be reported?

  • A. With modifier 24
  • B. With modifier 57
  • C. With modifier 78
  • D. It can't be billed during the global period
Reveal answer and explanation for CPMA-13

Answer and explanation: A. Modifier 24 reports an unrelated E/M by the same provider during a postoperative period. The documentation needs to show the visit was unrelated. Modifier 57 (B) is for the decision for surgery. Modifier 78 (C) is for an unplanned return to the operating or procedure room for a related problem. D is wrong because unrelated services can be reported separately.

Source: CMS MLN907166, Global Surgery Booklet (Dec. 2025)

CPMA-14 · Modifier 79

For a Medicare patient, during the 90-day global period after a hernia repair, the same surgeon performs an unrelated procedure on a different part of the body. What's the correct modifier, and what happens to the global period?

  • A. Modifier 78; the original global period simply continues
  • B. Modifier 79; a new postoperative period begins for the unrelated procedure
  • C. Modifier 24; no new global period starts
  • D. Modifier 58; the original global period is extended by 90 days
Reveal answer and explanation for CPMA-14

Answer and explanation: B. Modifier 79 reports an unrelated procedure by the same provider during another procedure's postoperative period, and a new postoperative period starts with the unrelated procedure. Modifier 78 (A) is for a related, unplanned return to the operating room. Modifier 24 (C) is for E/M services, not procedures. D doesn't describe any global surgery rule.

Source: CMS MLN907166, Global Surgery Booklet (Dec. 2025)

Scope and statistical sampling methodologies

CPMA-15 · Limits on extrapolation

Under the Social Security Act, when can a Medicare contractor use extrapolation to determine an overpayment amount?

  • A. Only when there's a sustained or high level of payment error, or documented education hasn't corrected the error
  • B. Whenever a sample shows any error
  • C. Only with the provider's written consent
  • D. Never for physician (Part B) claims
Reveal answer and explanation for CPMA-15

Answer and explanation: A. Section 1893(f)(3) limits extrapolation by Medicare contractors to cases with a determination of a sustained or high level of payment error, or where documented educational intervention has failed to correct it. Finding any error is not sufficient by itself (B). The provision does not require the provider's consent (C) or exclude physician Part B claims (D).

Source: Social Security Act §1893(f)(3)

CPMA-16 · Choosing the right denominator

A fictional review covers 20 claims containing 50 code lines. Four different claims contain a total of six erroneous lines. What percentage of the reviewed claims have at least one error?

  • A. 12%
  • B. 20%
  • C. 30%
  • D. 8%
Reveal answer and explanation for CPMA-16

Answer and explanation: B. Count each of the four affected claims once and divide by the 20 claims reviewed: 4 / 20 x 100 = 20%. A is a different measure, the erroneous-line rate: 6 / 50 x 100 = 12%. C divides lines by claims, and D divides claims by lines; both mix units. Label the unit on every number before you calculate.

Source: Original fictional inputs; arithmetic shown in the explanation

CPMA-17 · Payment error rate

An auditor reviews 20 claims that were paid a total of $2,000. Four claims have errors, and the overpayment on them totals $250. No underpayments were found. Using payment error rate = dollars in error / dollars reviewed, what's the payment error rate?

  • A. 20%
  • B. 87.5%
  • C. 6.25%
  • D. 12.5%
Reveal answer and explanation for CPMA-17

Answer and explanation: D. $250 / $2,000 = 0.125, or 12.5%. A (4 / 20) is the claim error rate, a different measure. B is payment accuracy (100% - 12.5%). C doesn't follow from the inputs. Organizations define error rates differently (for example, whether underpayments are netted against overpayments), so an audit report should always state its formula.

Source: Original fictional inputs; arithmetic shown in the explanation

CPMA-18 · Limits of a targeted sample

An auditor deliberately picks ten claims that were already denied, to investigate a specific documentation problem. Six of the ten show the problem. Which report statement stays within the evidence?

  • A. Exactly 60% of all the practice's claims have the problem.
  • B. The practice has a 60% fraud rate.
  • C. Six of these ten selected claims have the problem; this targeted sample doesn't establish how common it is across all the practice's claims.
  • D. No other documentation problem exists in the practice.
Reveal answer and explanation for CPMA-18

Answer and explanation: C. The claims were chosen for a reason, not drawn to estimate a population rate. Estimating a rate across all claims needs a properly designed probability sample. A overgeneralizes. B adds a legal conclusion the evidence can't support. D claims knowledge about records nobody reviewed. A targeted review is still useful; it just answers a narrower question.

Source: CMS Medicare Program Integrity Manual, ch. 8, §§8.4.2-8.4.3

Quality assurance and risk analysis

CPMA-19 · Staying within your expertise

During a Medicare claims review, a coding auditor runs into a disputed medical-necessity question that's beyond their clinical expertise. What's the most defensible next step?

  • A. Infer unnecessary care from how often the code appears
  • B. Pick whichever conclusion produces the lowest payment
  • C. Treat a valid code as proof the service was medically necessary
  • D. Document the issue and get review from an appropriately qualified clinician
Reveal answer and explanation for CPMA-19

Answer and explanation: D. OIG's compliance guidance expects audits to use people with the right expertise. A treats a billing pattern as a clinical conclusion. B substitutes a financial goal for evidence. C confuses a valid code with medical necessity, and CMS is clear that documentation must support the service, not just the code. The auditor can identify and document the question without deciding something outside their scope.

Source: HHS-OIG General Compliance Program Guidance (Nov. 2023); CMS MLN909160, Complying with Medical Record Documentation Requirements (pp. 2-3)

Communication of results and findings

CPMA-20 · Reporting findings and corrective action

A focused review finds that one provider's 99215 visits weren't supported in 9 of 10 sampled encounters. Which next step best fits an effective compliance program?

  • A. Share the specific findings and documentation examples with the provider, provide education, send potential overpayments to compliance for evaluation and timely repayment, and schedule a follow-up review
  • B. Quietly correct the codes in the billing system without telling the provider
  • C. Do nothing until a payer audits the practice
  • D. Report only the practice-wide error rate so the provider isn't singled out
Reveal answer and explanation for CPMA-20

Answer and explanation: A. OIG's guidance calls for responding to detected problems with corrective action, education, and ongoing monitoring to confirm the fix worked. For Medicare Parts A and B, the general report-and-return deadline is 60 days after identification or the applicable cost-report due date, if later; qualifying suspensions can apply. B skips both the education and the overpayment process. C ignores a known problem. D hides the provider-specific pattern that the correction has to target.

Source: HHS-OIG General Compliance Program Guidance (Nov. 2023); 42 CFR 401.305(a)(2), (b)(1)-(3), current reporting and return requirements

Medical record auditing abstraction

CPMA-21 · Uncertain outpatient diagnosis · Case

An auditor reviews a September 15, 2026 physician-office encounter. The final assessment says "possible pneumonia." The record documents cough and fever, and no definitive diagnosis was made at this visit. Which coding approach follows the outpatient guideline?

  • A. Report the documented signs and symptoms rather than treating pneumonia as established
  • B. Report pneumonia as confirmed, because the physician considered it
  • C. Apply the inpatient rule for uncertain diagnoses
  • D. Report the diagnosis the physician expects to confirm at the next visit
Reveal answer and explanation for CPMA-21

Answer and explanation: A. In the outpatient setting, diagnoses documented as possible, probable, suspected, or similar aren't coded as if confirmed; you code to the highest degree of certainty for that encounter, such as signs and symptoms. B overstates the record. C borrows a rule from a different setting. D codes a future expectation instead of what was documented. (This item asks for the approach, not a specific code.)

Source: FY2026 ICD-10-CM Official Guidelines, April 1, 2026 update, Section IV.H (p. 114)

CPMA-22 · E/M level by medical decision making · Case

Case: An established patient's office visit. The physician documents poorly controlled hypertension above the patient's goal and type 2 diabetes at goal. The physician reviewed this week's hemoglobin A1c result and increased the dose of the patient's prescription blood pressure medicine. No total time is documented. The claim reports 99215. What level does the documentation support?

  • A. 99213
  • B. 99215
  • C. 99214
  • D. 99212
Reveal answer and explanation for CPMA-22

Answer and explanation: C. With no time documented, the level rests on medical decision making (MDM), and two of the three MDM elements must be met or exceeded. Problems are moderate: the physician documents a poorly controlled chronic illness requiring treatment adjustment. Risk is moderate: prescription drug management. The single reviewed test result does not reach the limited-data threshold, which requires two qualifying items or an independent historian; the data element is minimal or none here. Two elements at moderate means moderate MDM, which supports 99214. 99215 needs high MDM, and no element reaches high here. 99213 (A) and 99212 (D) fall below the supported MDM level.

Source: AMA, CPT E/M guidelines, Table 1 pp. 8-11 and chronic-illness definitions p. 15; AMA, office visit code descriptors (99213-99215); Noridian JE Part B, E/M Top Provider Q&A; AMA, CPT code 99214: established-patient office visit, care components

CPMA-23 · Modifier 25 with a minor procedure · Case

Case: An established Medicare patient comes in for a scheduled removal of a skin lesion. The physician examines the lesion, explains the risks, gets consent, and performs a minor procedure with a 10-day global period. No other problem is addressed. The claim reports the procedure plus an E/M with modifier 25. What's the audit finding for the E/M?

  • A. Supported, because modifier 25 always allows an E/M with a minor procedure
  • B. Not separately supported: the evaluation was the usual pre-procedure work included in the global package, and modifier 25 requires a significant, separately identifiable E/M
  • C. Supported, but modifier 57 should replace 25
  • D. Supported only if the E/M is billed on the next day
Reveal answer and explanation for CPMA-23

Answer and explanation: B. For minor procedures, the initial evaluation is part of the global surgical package. An E/M is separately reportable with modifier 25 only when it's significant and separately identifiable from that usual work. A overstates what modifier 25 does. C applies to the decision for major surgery. D would misreport the date of service.

Source: CMS MLN907166, Global Surgery Booklet (Dec. 2025); AMA, CPT E/M guidelines, MDM table

CPMA-24 · Postoperative visit in a global period · Case

Case: Three weeks after a major procedure with a 90-day Medicare global period, the same surgeon sees the patient for a routine wound check and suture removal. The claim reports 99213 with no modifier. What's the audit finding?

  • A. Supported as billed
  • B. Supported only with modifier 24
  • C. Not separately payable: routine postoperative follow-up and suture removal are included in the global surgical package
  • D. Supported with modifier 25
Reveal answer and explanation for CPMA-24

Answer and explanation: C. Postoperative recovery visits and routine care like suture removal are included in the global package. Modifier 24 (B) is only for unrelated E/M services. Modifier 25 (D) doesn't make included postoperative care billable.

Source: CMS MLN907166, Global Surgery Booklet (Dec. 2025)

CPMA-25 · New vs. established patient · Case

Case: Two years ago, a patient received an office E/M service from Dr. A, a general cardiologist in a multispecialty group. Today the patient sees Dr. B, also a general cardiologist in the same group, for the first time. The claim reports a new-patient office visit. What's the audit finding?

  • A. Supported, because the patient has never seen Dr. B
  • B. Not supported, because new-patient codes require a referral
  • C. Supported, because the visit is in a different calendar year
  • D. Not supported: the patient is established, because a physician of the exact same specialty and subspecialty in the same group provided professional services within the past three years
Reveal answer and explanation for CPMA-25

Answer and explanation: D. A new patient is one who hasn't received professional services from the physician or other qualified health care professional, or from another physician or other qualified health care professional of the exact same specialty and subspecialty in the same group, within the past three years. A ignores the same-group rule. B and C describe rules that don't exist.

Source: AMA, CPT E/M guidelines, New and Established Patients, p. 3; CGS Medicare, new patient definition (citing CMS Pub. 100-04, ch. 12, §30.6.7)

Audit math you'll need

The sampling area is only 7 questions, but the math shows up in case work and reporting too. Here's one fictional review worked three ways.

Inputs: 20 claims reviewed, paid $2,000 in total. 4 claims have errors, and the overpayment on them is $250. No underpayments.

Audit math: measure, formula and result
Measure Formula Result
Claim error rate Claims with an error / claims reviewed = 4 / 20 20%
Payment error rate Dollars in error / dollars reviewed = $250 / $2,000 12.5%
Payment accuracy rate 100% - payment error rate 87.5%

These rates measure different things: how many claims had an error and what share of reviewed payments was overpaid. Neither number is "the" error rate. Your organization's audit policy defines which one it uses (and whether underpayments are netted), so always state the formula in your report.

Before you project a number onto all claims: a rate only describes the population if the sample was designed to estimate it. A probability sample drawn from a defined universe can support an estimate; a sample you chose because the claims looked suspicious can't. (CMS Program Integrity Manual, ch. 8, §§8.4.2-8.4.3)

When Medicare can extrapolate: a Medicare contractor can use extrapolation only when there's a sustained or high level of payment error, or when documented education hasn't fixed the error. (Social Security Act §1893(f)(3)) The HHS Office of Inspector General publishes free software, RAT-STATS, that assists with drawing random samples and estimating improper payments. (HHS-OIG, RAT-STATS)

The 60-day clock: Under Medicare Parts A and B, report and return an identified overpayment by the later of 60 days after identification or the corresponding cost-report due date, if applicable. An overpayment is identified when knowingly received or retained. A timely, good-faith investigation of related overpayments can suspend reporting and return until the earlier of completed investigation plus calculation of the total initial and related overpayments, or 180 days after initial identification. Section 401.305(b)(2) separately suspends the return deadline in specified OIG/CMS disclosure and extended-repayment situations. (42 CFR 401.305(a)(2), (b)(1)-(3))

Your 8-week CPMA study plan

Assumptions: about 6 hours a week (48 hours total), and you already code professionally. AAPC strongly recommends two years of experience in the field before taking the CPMA. If auditing regulations or statistics are new to you, extend the plan until you can explain and apply the relevant rules; if you already audit for a living, use the 4-week version below. This is an editorial plan, not an AAPC requirement or a guarantee. (AAPC, exam registration prerequisites)

Use the worked audit, 25 questions, worksheet, error log, and linked free official readings. Budget about two hours for reading, two for practice and source lookup, and two for writing findings and correcting errors each week. The five case questions do not cover every specialty in AAPC's abstraction outline.

Eight-week CPMA study plan by week: focus, tasks and expected outcome
Week Focus What to do What you'll have at the end
1 Baseline and setup Work all 25 questions cold and log every miss (see the error log below). Work the opening audit without peeking. Check the approved reference rules and decide print or eBook. An initial error log and a confirmed book setup; this small set does not measure all your weak areas
2 Records and documentation Study signatures, amendments, record access, retention, and minimum necessary using the sources under CPMA-01 to 05. Redo those questions and explain every wrong option out loud. A one-page record-integrity checklist
3 Compliance frameworks Read the OIG summaries of Stark, Anti-Kickback, and False Claims Act rules, the current overpayment rule under CPMA-07, and the OIG compliance elements and CMS TPE passages under CPMA-08 and 10. Rework CPMA-06 to 11. A comparison table of the laws in your own words and a corrected explanation of the repayment deadline
4 NCCI, modifiers, global surgery Read the PTP, modifier, and Medically Unlikely Edits sections of the CMS NCCI FAQ and pp. 5-6, 9-10, and 13-14 of the CMS Global Surgery booklet. Redo CPMA-09 and 12 to 14, then apply the rules to CPMA-23 and 24. A modifier decision sheet you wrote yourself
5 E/M auditing Drill the MDM table (two of three elements), same-date time rules, and new vs. established patients using the sources under the opening audit and CPMA-22 and 25. Complete a worksheet for the opening audit and each of CPMA-22 to 25. Five completed worksheets with a rule, finding, and limit
6 Specialty scope and evidence Compare AAPC's listed abstraction specialties with the cases actually practiced here. Read pp. 2-3 of CMS's documentation requirements, revisit CPMA-21, and use the worksheet to distinguish evidence present, evidence missing, and conclusions outside the review. Mark unpracticed specialties on your next-study list. A specialty gap list and a record-evidence checklist; this is not a substitute for additional specialty-case practice
7 Sampling, reporting, timed work Rework CPMA-15 to 20 and the audit math. Read the probability-sampling and universe sections, 8.4.2-8.4.3, of the CMS Program Integrity Manual, chapter 8. Write one full findings report with the reusable report line. Allow 60 minutes to repeat the 25 questions with answers hidden, then review every explanation. A finished report and a timed review of this set, with remembered answers marked
8 Close the gaps Re-drill your two most persistent error types and write one audit finding without looking at the model. Repeat selected questions only after explaining the governing rule from memory. Check your ID, appointment requirements, and reference setup; make any book-format change within AAPC's permitted window. A short final-review list and a checked exam setup

Repeating questions you've already seen is review, not a fresh test. The 60-minute exercise uses this page's 25 questions; it is not a 100-question simulation or a readiness score. Completing this plan does not establish that every exam topic has been mastered.

4-week version (for working auditors): Combine weeks 1-2, 3-4, 5-6, and 7-8. Keeping all the work means about 12 hours a week for four weeks, still 48 hours total. If that workload does not fit, keep the eight-week schedule or extend it.

Retaking the exam? Reorder the plan around the areas where your results and your error log show the most misses. For attempt rules, see our AAPC exam retake policy guide.

Error log

A wrong answer is only useful once you know why it was wrong. Log every miss, including lucky guesses.

Error log: question, answer, error type, rule, reasoning and next action
Question My answer Error type Rule and where it lives Correct reasoning Next action
CPMA-16 (example) 30% Mixed units Affected claims / claims reviewed 4 affected claims / 20 claims = 20%; the 6 errors are lines, not claims Label the unit over each number before calculating
Your next miss Rule / scope / missing fact / arithmetic / lookup

Pick the next session from the error type. A scope error (wrong payer, setting, or date) means rechecking context first. A rule error means rereading the cited source. An arithmetic error means labeling units. A lookup error means practicing that path through your code book.

What to bring on exam day

The CPMA is open book, but only these references are allowed. (AAPC Examinee Instructions, CPMA row)

  • CPT: AMA Professional Edition only (no other publisher)
  • ICD-10-CM: your choice of publisher
  • HCPCS Level II: your choice of publisher

Book rules:

  • Print: the current year or the prior year, one copy of each book. Upcoming-year books and books more than a year old aren't allowed. (AAPC, Which year's books should I use?)
  • eBook: current-year eBooks from a shared library inside the exam platform. You can change your book format up to 48 hours before the exam.
  • Everything else the exam needs is provided inside the exam platform. Don't plan on bringing your own audit worksheet or documentation guidelines; older advice to do that predates the current rules.
  • Not allowed: study guides (including AAPC's), phones, smartwatches, paper, and other prohibited references listed in AAPC's instructions.

AAPC builds each year's exams on that calendar year's code sets, with January updates and any separately announced transition. For 2026 HCPCS Level II, the transition was March 2, 2026. If your second attempt falls in the next calendar year, you'll take that year's exam. (AAPC, Which year's books should I use?)

Exam year and service date are different checks. CPMA-21's September 15, 2026 encounter uses the FY2026 ICD-10-CM guidelines updated April 1, 2026. The FY2027 service-date release began October 1, 2026; that change does not itself switch a calendar-2026 AAPC exam to a new exam year. (CDC, ICD-10-CM files and effective dates)

Pacing: 240 minutes / 100 questions = 2.4 minutes per question on average. Several questions share one case, so move quickly through standalone regulatory questions and spend the time you save on case reading.

Cost, registration, and results

Step-by-step help: AAPC exam registration, AAPC exam results, retake policy, and keeping your credential active.

CPMA exam prep FAQ

Do I need my CPC before taking the CPMA? No. AAPC lists the CPMA as a stand-alone certification, and there's no required amount of experience. AAPC does highly recommend two years of experience in the field. If your coding foundation is shaky, our CPC exam prep guide is a good place to shore it up. (AAPC, exam registration prerequisites)

How hard is the CPMA? AAPC describes CPMA as a high-level exam for people with relevant training or experience and strongly recommends two years in the field. For CPMA preparation, practice judging whether documentation supports what was billed, which law or rule applies, and what a finding does and doesn't prove. (AAPC, exam registration prerequisites; AAPC, Taking the CPMA exam)

How long should I study? The plan above budgets about 8 weeks at 6 hours a week if you already code professionally. Its 4-week version keeps the same 48 hours at about 12 hours a week. Extend either schedule where your error log or the official content map shows gaps; this is an editorial workload, not an official study-time minimum.

Is the CPMA exam online? You can take it online with a live remote proctor or on a computer at a testing center. Either way, you get four hours in one sitting. (AAPC, Taking the CPMA exam)

Sources

Exam facts:

Teaching sources (also linked under each question):

Last verified October 21, 2026. The Castleport Test Prep Editorial Team checked the exam facts above against AAPC's current pages and checked each teaching point against the source linked beside it. That's a source check, not a professional review of the questions.

Castleport Test Prep is an independent exam prep publisher and is not affiliated with, endorsed by, or approved by AAPC. CPMA and other exam and credential names identify their subjects; trademarks belong to their respective owners. The practice questions and audit case on this page are original and unofficial, not AAPC exam questions. This guide doesn't guarantee an exam result.

CPMA Exam Prep: Free Study Guide + 25 Practice Questions