Medical practices: what an audit looks like

HHS Office for Civil Rights (HIPAA)

Complaints, breach reports and compliance reviews, plus an audit program that tests selected Privacy, Security and Breach Notification provisions. Through October 31, 2024, private practices and physicians were the second most common type of entity alleged to have violated the rules.

How often. No fixed cycle. OCR audited 166 covered entities and 41 business associates in 2016-2017 and began a 50-entity Security Rule round in 2024-2025.

Source ↗

OSHA or a State Plan agency

The bloodborne pathogens standard covers any employee with reasonably anticipated exposure to blood or other potentially infectious materials. OSHA's inspection priority runs from imminent danger and fatalities or catastrophes to complaints and referrals, then programmed inspections.

How often. No fixed cycle; programmed inspections rank fourth in Table 2-1 of the Field Operations Manual. In the 22 states whose State Plans cover private employers, the state agency inspects in place of federal OSHA.

Source ↗

Medicare contractors (MAC, CERT, Recovery Auditor, UPIC)

Claim-level documentation review for practices that bill Medicare. Targeted Probe and Educate selects providers with high claim error rates or unusual billing, CERT reviews a random sample, Recovery Auditors review claims after payment, and UPICs run benefit integrity reviews where fraud is suspected.

How often. A Targeted Probe and Educate round is generally 20 to 40 claims, for up to three rounds, with at least 45 days to improve between rounds. CERT draws a new random sample every year and allows 45 calendar days to respond.

Source ↗

CLIA surveyors (CMS, a state survey agency or an accrediting body), if the practice tests in the office

A practice holding a Certificate of Compliance or Accreditation for nonwaived testing is surveyed against 42 CFR Part 493 by CMS, the state agency or an accreditor such as COLA, CAP or The Joint Commission. A survey includes a tour, record review, observation of testing and personnel interviews.

How often. Nonwaived laboratories are surveyed every two years, and CMS and state surveys are generally announced with up to two weeks' notice. Waiver and provider-performed microscopy laboratories, 255,184 of the 285,940 non-exempt laboratories CMS listed in September 2026, have no routine surveys, only complaint and cause inspections.

Source ↗

Risk analysis and risk management records

OCR asks for the written risk analysis, the analysis that preceded it, and the policies for how it is done. It looks for a defined scope covering all systems that hold ePHI, threats and vulnerabilities, current security measures, impact and likelihood, and a risk rating, and then for the security measures chosen in response.

OCR Audit Protocol; 45 CFR 164.308(a)(1)(ii)(A) and (B)Source ↗

HIPAA policies in force, training and sanction records

OCR requests the versions in use on the date of the audit notification and does not search compilations for the right document. Training evidence is sampled from new hires in the audit period, with proof that staff were trained after material policy changes, and the Security Rule adds a sanction policy and documentation that sanctions were applied.

OCR Audit Protocol; 45 CFR 164.530(b), (i) and (j); 164.308(a)(1)(ii)(C) and (a)(5)(i)Source ↗

Right of access file

The 2016-2017 audits requested access requests, extensions, request forms, the notice of privacy practices and the access policies and procedures. The protocol reads granted and denied requests against the 30 day response limit, one 30 day extension with a written reason, and the cost-based fee rule.

2016-2017 HIPAA Audits Industry Report (P65); OCR Audit Protocol; 45 CFR 164.524(b) to (d)Source ↗

Exposure Control Plan with training, vaccination and exposure records

The plan must be available to OSHA on request. It holds the exposure determination, the schedule and method for each protective measure, the post-exposure evaluation procedure, an annual review with documented consideration of safer devices, and documented input from non-managerial staff with patient care duties. Training records are kept 3 years, and medical records including hepatitis B vaccination status are kept for the length of employment plus 30 years.

29 CFR 1910.1030(c)(1) and (h)Source ↗

Medical records for sampled Medicare claims

Reviewers specify in the request only the documents needed to decide each claim, and they weigh the totality of the medical record, including progress notes and any required signatures. Providers have 45 calendar days to respond to a MAC, Recovery Auditor, SMRC or CERT request and 30 to a UPIC request, and contractors may accept late records for good cause.

Medicare Program Integrity Manual ch. 3, 3.2.3.2 and 3.3.2.4; 42 CFR 424.5(a)(6) and 424.516(f)(2)Source ↗

Laboratory procedure manual, quality control and competency records

For nonwaived tests CLIA surveyors review a written procedure manual that is available to and followed by testing staff, plus quality control and proficiency testing records kept at least 2 years. The laboratory also needs written policies to assess employee competency, and waived testing is held to the manufacturer's instructions.

42 CFR 493.1251, 493.1235, 493.1105 and 493.15(e)Source ↗

HIPAA risk analysis and right of access

Risk analysis: 14% rated 1 or 2. Right of access: 89% did not show correct implementation. 2016-2017 audits, report published December 2020

In OCR's 2016-2017 audits, 9 of 63 covered entities audited on risk analysis and 11 of 103 audited on right of access were rated 1 or 2 on OCR's five-point scale, where 1 and 2 mean the criteria are met or substantially met. OCR noted submissions of third-party template policy manuals with no entity-specific review or evidence of implementation. OCR has announced 56 right of access enforcement actions through October 8, 2026, and in April 2025 it settled with a small New York neurology practice for $25,000 over a missing risk analysis.

Source ↗

Medicare documentation and E/M level coding

$6.6 billion improper for physician services; $3.9 billion of it insufficient documentation FY 2025 (claims July 2023 to June 2024)

CMS's CERT review found $6.6 billion in improper payments for physician services across all settings, including $3.9 billion for insufficient documentation and $1.5 billion for incorrect coding. Established-patient office visits had a 5.3% improper payment rate, 65.2% of it incorrect coding, and the top root cause was documentation that supported a lower E/M level than billed (120 sampled claims). The Part B improper payment rate was 8.4%.

Source ↗

Written Exposure Control Plan

Ranked 1st of the 10 most cited provisions; OSHA publishes no counts October 2013 to August 2025

OSHA ranks the written Exposure Control Plan first among the bloodborne pathogens provisions it cites most often, ahead of employee training and hepatitis B vaccination and follow-up. The annual plan review ranks fourth and the annual safer device documentation ninth. OSHA publishes the ranking without counts.

Source ↗

Laboratory procedure manual and competency policies

Procedure manual: 635 labs (3.9%). Competency assessment policies: 778 labs (4.8%). 2024

In CMS's 2024 data the written procedure manual (D5401) was cited in 635 laboratories and the personnel competency assessment policy requirement (D5209) in 778. Among condition-level findings, successful proficiency testing participation led with 738 laboratories (4.39%). The CMS list covers all laboratories and does not split results by certificate type.

Source ↗