What a Compliance Audit Actually Looks Like: A Guide for Clinic Leaders
The word audit carries a weight in healthcare settings that is often disproportionate to what audits actually involve. Most compliance audits, whether internal or external, are structured reviews of documentation, billing practices, and policy adherence. They are not investigations. They are not accusations. They are systematic checks that any well-run clinic should be able to pass with standard preparation.
The clinics that struggle with audits are typically those that have never built documentation habits into daily operations. The ones that do well are not necessarily the ones with perfect records. They are the ones with consistent records and a clear trail of how decisions were made.
Types of Audits Clinic Leaders Encounter
Internal Compliance Audits
Internal audits are conducted by the clinic's own compliance officer, a designated staff member, or an outside consultant hired for the purpose. They typically review a sample of medical records against billing claims to confirm that what was billed matches what was documented. They also review HIPAA policy adherence, staff training records, and business associate agreements.
Internal audits should occur at minimum annually. Clinics with active billing programs or Ryan White funding are better served by quarterly reviews of at least 20 to 30 records per provider.
Payer Audits
Payer audits can be prepayment or postpayment. Prepayment audits place claims on hold pending additional documentation. Postpayment audits review claims already paid and can result in recoupment requests if documentation does not support the billed service. Medicare and Medicaid audits are conducted through RAC (Recovery Audit Contractor) and MAC (Medicare Administrative Contractor) programs.
Federal and State Investigations
These are the audits that carry genuine legal risk and are typically triggered by a pattern of unusual billing, a whistleblower complaint, or a statistical outlier identified through data analysis. They are relatively uncommon for small clinics operating in good faith but are not impossible.
What Auditors Actually Look For
In a medical record and billing audit, reviewers compare the clinical documentation in the chart to the CPT and ICD-10 codes submitted on the claim. They are asking: does the note support the level of service billed? Does the diagnosis code match what is described? Is the provider's signature present? Is the date of service consistent?
They are also looking for patterns. Billing a 99214 or 99215 for nearly every encounter without corresponding documentation complexity is a red flag. Billing for services on days when the provider was not scheduled raises questions. Unusually high utilization of specific procedure codes compared to peers triggers attention.
How to Prepare Without Panic
Conduct a self-audit before anyone else does. Pull 10 records per provider from the last 90 days and compare the documentation to the codes billed. If the documentation consistently supports what was billed, you are in good shape. If you find gaps, address them through provider education and documentation improvement before they become a pattern that attracts external scrutiny.
Maintain a current compliance manual, signed staff training acknowledgments, and a HIPAA risk assessment dated within the last 12 months. These three items alone address a large percentage of what routine auditors look for and demonstrate that compliance is an active function in your clinic, not an afterthought.
What to Do Next
If your clinic has not conducted an internal audit in the past 12 months, that is the place to start. Pull a sample of records, compare them to what was billed, and document what you find. The process itself will tell you where your compliance gaps are.
If you want support building an internal audit program or preparing for an external review, our team can help.