Evaluating Healthcare Operations Against Regulatory Requirements
Compliance becomes visible in the small decisions a revenue cycle team makes every day: which record it relies on, which adjustment it posts, whose information it accesses, and whether an exception gets escalated. An audit examines whether those decisions match the rules that actually apply.
A payment posting discrepancy, unsupported charge, missing record, or inappropriate disclosure can raise different kinds of risk. Some are operational errors. Others may trigger payer repayment obligations, privacy investigations, contractual consequences, or regulatory scrutiny. The first responsibility is to establish the facts before deciding which rules and corrective processes apply.
An audit needs a defined requirement, a population worth testing, and evidence that reflects what staff and systems actually did. A policy may describe the intended process; the transaction record shows whether that process held.
Evidence Behind Compliance
Regulatory compliance means meeting applicable laws and regulations. Program compliance includes requirements imposed by government programs, while contractual compliance addresses obligations established in payer or vendor agreements. Internal policy compliance means following an organization's own documented procedures. These requirements can overlap, but they are not interchangeable.
An audit is a structured examination of evidence against defined criteria. An internal audit can evaluate process performance before a problem reaches a regulator. An external audit may be conducted by a payer, Medicare contractor, regulator, independent auditor, or another authorized reviewer, each with a different scope and authority.
A finding is not automatically proof of fraud. Fraud-related conclusions involve specific legal elements and evidence, and should be referred to designated compliance or legal professionals. HHS-OIG distinguishes general compliance risks from enforcement of laws such as the False Claims Act, Anti-Kickback Statute, and physician self-referral law. [1][2]
Where Requirements Come From
Healthcare organizations operate within several overlapping sources of requirements. The correct standard depends on the provider, service, patient, payer, date, jurisdiction, and transaction under review.
For example, a Medicare medical necessity review may compare records against a National Coverage Determination, a relevant Local Coverage Determination, coding guidance, and the applicable billing manual. A commercial-payer dispute could instead require an executed agreement, plan documents, and payer-specific policy. The fact that one program uses a rule doesn't make it universal.
Understanding major regulatory risk areas
The False Claims Act, Anti-Kickback Statute, physician self-referral law, exclusion rules, and civil monetary penalty provisions are important healthcare fraud and abuse frameworks. They address different conduct and have different legal tests. This foundational guide introduces their significance rather than teaching staff to make legal determinations. HHS-OIG provides an accessible official overview, and CMS publishes specific physician self-referral guidance. [2][3]
HIPAA privacy, security, breach notification, and patient access rules form another major compliance area. Coding, claims, medical necessity, payment, retention, and financial-assistance requirements may involve other agencies and legal authorities. These are covered in greater depth in their respective foundational guides.
Who Is Responsible for Compliance?
Compliance is an organizational responsibility, but authority is divided across roles. Frontline staff may recognize and report errors, while specialized teams evaluate regulatory meaning and authorize particular actions.
HHS-OIG's General Compliance Program Guidance discusses seven elements of compliance program infrastructure, including written policies, leadership and oversight, training, communication, monitoring and auditing, enforcement, and responses to detected offenses. It explicitly describes this framework as voluntary, nonbinding guidance rather than a single federally mandated checklist for every entity. [1]
How Audits Are Selected and Scoped
An audit can be scheduled as part of a routine monitoring plan, prompted by a complaint, triggered by an unusual report, or initiated by an external request. Risk-based selection is often more useful than reviewing a random collection of accounts without a defined question.
Before testing, document the objective, criteria, population, period, data sources, sampling method, and limitations. An audit of outpatient units billed has different criteria from a HIPAA access review or a cash-posting reconciliation.
CMS describes Medicare Fee-for-Service medical review as using clinical records, billing data and coverage rules to evaluate payments. Contractors including MACs, RACs and others conduct reviews within their respective programs. An Additional Documentation Request (ADR) is a request for records to support particular Medicare claims, not a universal request format for every payer. [4][5]
Sampling needs context
A ten-account sample with two errors has a 20% observed sample error rate, but it does not establish that 20% of an organization's entire claim population is wrong. The selection method, sample size, case mix, and representativeness affect what can be inferred. Targeted high-risk samples are useful for finding problems; they generally should not be extrapolated as though randomly selected without a defensible methodology.
The Practical Audit Workflow
Step 1: Define the question and applicable criteria
Describe what is being tested in clear operational terms: for example, whether charges billed for a specified laboratory procedure were supported by completed tests and correct units. Identify the authoritative rule, applicable effective date, and policy owner before pulling records.
Step 2: Secure the evidence and establish the population
Request authorized access to relevant source systems. Record extraction dates, inclusion and exclusion logic, transaction identifiers, and report totals. Protect PHI and limit disclosures according to applicable requirements and organizational procedures. Avoid distributing identifiable patient extracts unnecessarily.
Step 3: Select and document the sample
Use a sampling approach matched to the objective. Random samples may support certain estimates; targeted samples can examine a suspected problem. Preserve how each record was selected and what the sample can and cannot establish.
Step 4: Reconstruct each transaction
Compare primary source documentation against claims, edits, remittances, ledger changes, and any relevant authorization or contract terms. Account for corrected claims, reversals, retractions, and time differences rather than treating every repeated transaction as a duplicate.
Step 5: Test against the actual standard
Record the requirement, evidence, result, and reviewer. Separate confirmed exceptions from missing evidence or pending clarification. A failed screen alert may indicate that staff bypassed a control, but a warning alone doesn't prove the underlying charge was improper.
Step 6: Verify findings with the responsible function
Check whether a record exists in another system, a policy exception applies, or the transaction was subsequently corrected. Have qualified reviewers handle clinical, coding, legal, privacy, or contract questions. Keep an audit trail of changes to preliminary findings.
Step 7: Determine scope, impact, and action
Investigate how far a confirmed issue extends. Record amounts with care: billed charges, expected reimbursement, overpayments, underpayments, patient liability, and recoverable cash are different quantities. The response may include correction, education, hold or escalation, repayment review, and control change.
Step 8: Test whether the corrective action worked
Retest new transactions after implementation, not just previously corrected accounts. Check for unintended consequences such as a new edit increasing legitimate claim holds. Close a finding only when the organization has documented an appropriate resolution or a clearly assigned unresolved action.
Worked Audit: Incorrect Laboratory Units
Fictional educational scenario. A hospital identifies an increase in outpatient laboratory units after an interface change. A reviewer selects 40 high-risk claims from a defined month; this is a targeted sample, not a statistically representative population.
For the eight confirmed claims, the combined gross charge overstatement is $1,600. Those charges don't necessarily equal incorrect payer reimbursement. Remittance review shows $560 in related payer payments requiring further overpayment assessment, while $240 in patient cost sharing is also being checked for potential correction. These amounts can't simply be added and declared a legally established overpayment without reviewing the final adjudications and affected accounts.
The audit team traces the issue to a new unit-conversion rule that multiplies selected quantities twice. System support reproduces the error in a test environment; coding and department staff validate the proper service units; compliance reviews repayment and notification obligations if applicable. Authorized teams correct affected transactions, update configuration, and independently retest new charges.
After the fix, 100 relevant new charge transactions are tested and none displays the original multiplication defect. That demonstrates improvement in the tested control, not a guarantee that every charge across the organization is accurate. Further monitoring is scheduled.
Worked Audit: Posting Automation and Unsupported Adjustments
Fictional educational scenario. An automated posting routine reports that all 200 assigned records were processed. A quality sample identifies 12 accounts where $40 of patient responsibility was written off without the authorization or supporting reason required by the organization's adjustment policy.
The potentially incorrect adjustment amount is 12 × $40 = $480 within the reviewed records. It is not automatically $480 in collectible revenue. Some accounts may have valid later corrections, secondary coverage, or other restrictions that affect actual liability.
The reviewer preserves the source ERA, rule configuration version, automated transaction logs, and account histories. Operations confirms that the adjustments aren't supported by the designated workflow. System owners investigate the rule condition and determine whether other transactions were affected. The authorized team reverses or corrects verified entries when appropriate, documents account outcomes, and tests a modified rule under approval before deployment.
This illustrates three separate controls: stopping further incorrect changes, correcting affected accounts, and preventing the defect from recurring. A 100% bot execution rate did not establish compliance with financial posting policy.
External Audits, Requests, and Responses
External audit correspondence should be reviewed promptly, logged, and routed to the responsible department. Identify who issued the request, what records and claims are in scope, the response method, and the actual deadline. An ADR, a payer audit letter, and a government subpoena are not interchangeable processes.
For a Medicare ADR, reviewers should assemble records relevant to the requested claims and follow the specified contractor instructions. The organization may need clinical documentation, orders, signatures, claims, and other supporting materials. Missing or unavailable documentation should be handled accurately, not recreated or backdated to make a file appear complete. [5]
A reviewer may disagree with a finding. The appropriate path may involve clarification, a contractor-specific discussion, a formal appeal, repayment review, or another authorized response. The correct process and deadline depend on the program and decision issued. Maintain proof of submissions and track subsequent adjustments or collections so that an external review isn't treated as closed merely because the response was sent.
Overpayments, Disclosure, and Escalation
An audit may identify payments that appear inconsistent with documentation, program rules, or contractual terms. Suspected overpayment, identified overpayment, and reportable or returnable overpayment are not interchangeable findings. Determine the applicable payer/program and legal standard before applying a timeline.
For Medicare Parts A and B, 42 CFR §401.305 contains reporting and returning requirements, including a general 60-day rule with qualifying exceptions and investigation provisions. That legal framework is not a universal deadline governing all commercial-payer, patient, or internal ledger credits. Because the regulation can change, the organization should use the current text and obtain compliance or legal review for actual cases. [6]
Other findings may require privacy incident review, internal notification, licensing review, contractual disclosure, or regulator contact. Staff discovering an issue should preserve accurate evidence and follow established escalation channels; they should not independently declare fraud, send external disclosures, or erase records to make a result look corrected.
Designing and Monitoring Effective Controls
Controls may be preventive (reject an unsupported quantity before claim submission), detective (compare service records and charges daily), or corrective (approved account corrections and root-cause remediation). Strong programs often need more than one type because no single automated rule catches every issue.
GAO's 2025 Green Book is a federal internal-control framework emphasizing risk assessment, preventive controls, monitoring, documentation, and corrective action. It is useful educational context, but its federal agency requirements must not be presented as binding on every private healthcare provider. [7]
Measures that can mislead
A falling audit exception rate may reflect improved operations, but it can also reflect a changed sample, narrower scope, or incomplete data. Track a consistent population and define the metric before comparing periods. Similarly, a large total of adjusted charges shouldn't be described as cash lost or recovered without reimbursement analysis.
Common Audit Problems and How to Resolve Them
The distinction between evidence, interpretation, and action should remain visible in audit workpapers. That prevents a tentative finding from turning into a financial or legal conclusion merely because it appears on a report.
Practical Audit Readiness Checklist
- Identify the correct law, rule, contract, or organizational standard and its applicable date.
- Define the audit population, scope, inclusion criteria, and data source.
- Record the sampling method and its limitations.
- Validate source totals and transaction-level identifiers.
- Match sampled entries to supporting documentation and account history.
- Separate confirmed findings from unresolved questions.
- Protect PHI, workpapers, and sensitive investigation evidence.
- Assign actions to personnel with the proper approval authority.
- Evaluate financial impact using the correct reimbursement and liability measures.
- Track response deadlines and any external correspondence.
- Document the corrective action, retest, and monitoring owner.
Compliance and auditing aren't finished when a discrepancy is entered into a spreadsheet or a claim is adjusted. The work becomes meaningful when the organization can explain which requirement applied, what evidence established the finding, what correction was authorized, and how it knows the same problem is less likely to happen again.
References and Further Learning
These official resources support the information in this guide. Check current versions and applicability before using them operationally.
References
Additional Learning
Educational Disclaimer
Revenue Cycle Uncovered is an independent educational resource. Content is provided for general informational purposes and does not represent the policies, practices, or positions of any employer or organization. Workflows, payer requirements, regulations, and operational practices may vary. Information should be independently verified when applied to specific situations.