EHR Compliance Audit Checklist: How to Find and Fix Risks in Your Medical Practice

A medical practice can deliver the right care, submit a claim, and still struggle to defend that claim during an audit. The missing piece might be a detail in the clinical note, a mismatch between the documented service and the billed code, or a record change that the team cannot easily explain.

These problems are easier to address when you find them during an internal review rather than while responding to a payer’s documentation request.

In this blog, I will show you how to review:

• EHR records
• Match claims to clinical documentation
• Test audit trails, 
• Check user access, and 
• Turn audit findings into corrective actions

It focuses on practical steps for US medical practices, using guidance from CMS, HHS, and the Office of Inspector General (OIG) to distinguish regulatory requirements from recommended practices.

1. Identify the Type of Audit Risk You Need to Review

Before opening your EHR, define what you are checking. Your medical practice may face several types of reviews, and each has a different purpose.

Review type	What it examines	What your practice should prepare
Medicare or commercial payer review	Whether services meet applicable coverage, medical necessity, coding, and billing requirements	Medical records, orders, test results, treatment plans, claims, and other requested documentation
Clinical documentation and coding audit	Whether the record supports the services and codes reported	Encounter notes, diagnoses, procedure details, time or medical decision-making documentation where applicable, and coding rationale
HIPAA Security Rule review	Whether required safeguards protect electronic protected health information (ePHI)	Risk analysis, security policies, access records, incident documentation, and evidence of implemented safeguards
Internal EHR workflow review	Whether staff follow the practice’s documentation, access, and billing procedures	Workflow records, user permissions, exception reports, training records, and corrective-action logs

CMS explains that Medicare medical review examines records to determine whether claims meet applicable coverage, coding, billing, and medical necessity requirements. Its E/M guidance also outlines documentation problems that can contribute to improper payments.

• Start with the risk that matters most to your practice. For example, a practice receiving repeated documentation-related denials should begin with a claim and clinical-record review. A practice investigating inappropriate access to patient records needs a security-focused review.
• Do not treat an internal checklist as a substitute for the specific requirements of a payer, government program, state law, or applicable regulation.

2. Review Clinical Documentation in the EHR

The first question is straightforward: does the medical record support what happened during the encounter and what the practice reported on the claim?

For applicable evaluation and management (E/M) services, CMS identifies documentation elements such as the reason for the encounter, relevant history and examination findings, assessment or diagnosis, rationale for diagnostic services, care plan, and date of service. The record must also support the codes reported. Documentation requirements vary by service and circumstances, so apply the guidance relevant to the service being reviewed.

Use the following checklist to examine a sample of completed encounters.

Area to inspect	Potential issue	What to do next
Encounter details	Missing or unclear reason for the visit	Compare the note with the appointment reason and other relevant encounter information
Assessment and diagnosis	Diagnosis is absent, unclear, or inconsistent with the documented assessment	Ask the responsible clinician to review the record and address any legitimate documentation gap
Treatment plan	Plan does not explain the next steps or follow-up where relevant	Check whether the plan reflects the care provided and the clinician’s decisions
Orders and results	An order or result is missing, incorrectly associated, or difficult to locate	Trace the order through the EHR and connected systems; investigate interface or workflow failures
Medication documentation	Medication details or changes are incomplete where documentation is required	Compare the record with the prescribing workflow and applicable documentation requirements
Procedure documentation	The note does not adequately support the procedure or service reported	Review the relevant service-specific documentation and coding requirements
Amendments	A correction has no clear explanation or does not follow the practice’s amendment process	Review the amendment history and follow the applicable record-correction policy
Timeliness	Notes remain incomplete beyond the practice’s established workflow	Identify the cause, assign responsibility, and monitor completion

How to conduct the review

• Select a defined sample: Include different clinicians, service types, and locations where relevant. Prioritize records associated with denials, complaints, unusual billing patterns, or known workflow problems.
• Compare the note with the encounter: Review the assessment, plan, orders, results, and other relevant supporting information.
• Check the billed service separately: Determine whether the documentation supports the reported code under the applicable coding and payer rules.
• Record the specific gap: For example, write “procedure report missing from the encounter record” rather than “poor documentation.”
• Assign follow-up: Route clinical documentation questions to the responsible clinician and coding questions to the appropriate coding or billing professional.

Do not add unsupported information to an existing note simply to make it appear audit-ready. Any correction or amendment should follow applicable requirements and the practice’s documented process.

For further guidance, use the official CMS guidance on E/M documentation.

3. Match Claims to the Clinical Record

A complete clinical note does not automatically mean that the claim is correct. The service documented, the code selected, and the information submitted to the payer must align with the requirements that apply to that claim.

Review a sample of submitted claims and trace each one back to the source record.

What to compare	Questions to ask	Corrective action
Diagnosis codes	Does the documented diagnosis support the code submitted under applicable coding rules?	Send discrepancies for qualified coding review
Procedure or service codes	Does the record support the service reported?	Verify the service documentation and code selection
Medical necessity	Does the record support the medical necessity requirements applicable to the service?	Review the relevant payer policy and supporting clinical information
Units, modifiers, and dates	Are the submitted details consistent with the record and applicable billing rules?	Identify whether the error originated in documentation, charge entry, coding, or claim configuration
Orders and results	Are required orders, results, or supporting records available when applicable?	Investigate missing documentation or system-interface issues
Claim adjustments	Are corrections and resubmissions supported and documented?	Follow the payer’s correction process and retain relevant records

How to investigate a discrepancy

Suppose a claim contains a service code that the corresponding clinical note does not appear to support. Do not immediately assume the clinician made the mistake.

Trace the information through the workflow:

• Was the service documented correctly?
• Did the coding team select a different code from the one supported by the record?
• Did a charge-entry rule, interface, or claim configuration change the information?
• Was supporting documentation stored elsewhere or linked to the wrong encounter?
• Did the applicable payer policy change?

Record the cause, not just the final error. This helps the practice distinguish an isolated mistake from a recurring workflow or system problem.

CMS publishes service-specific compliance guidance covering documentation, billing, and common denial issues. Check the relevant guidance and payer policy before deciding how a claim should be corrected.

4. Check Whether EHR Audit Trails Support an Investigation

An EHR audit trail can help you understand activity within a system. Depending on the system and its configuration, available records may show actions such as viewing, creating, changing, or deleting information, along with associated users or accounts and timestamps.

The exact information recorded varies by product, configuration, and applicable requirements. Do not assume every EHR captures every action in the same way.

The HIPAA Security Rule requires regulated entities to implement mechanisms that record and examine activity in information systems containing or using ePHI. HHS explains these obligations in its Security Rule summary.

What to inspect

Audit-trail check	What to look for
User or account identification	Can you identify the account associated with the activity being investigated?
Relevant actions	Does the history capture the types of actions needed for the investigation?
Timestamps	Are timestamps available to establish the sequence of relevant events?
Record changes	Can you investigate changes to the record and identify relevant amendment history?
Access activity	Can you review available records to investigate potentially inappropriate access?
Privilege changes	Can you establish whether user permissions changed during the period under review, where relevant records are available?
Log protection	Are appropriate safeguards in place to help prevent or detect unauthorized alteration or deletion of audit records?
Review procedures	Does the practice review relevant activity and follow up on suspicious findings?

How to test an audit trail

• Select a test record and identify a known, legitimate activity.
• Ask the EHR administrator or vendor to help locate the corresponding audit history.
• Check whether the available history contains enough information to investigate the activity, including the relevant user or account, action, and timestamp where applicable.
• Review how the system handles corrections, amendments, and other record changes.
• Document any limitations, missing information, or configuration issues and determine whether additional safeguards or procedures are needed.

Confirm the specific logging requirements that apply to your system and the standards under which it is used. Certain audit-event and tamper-resistance requirements apply to certified health IT criteria; certification does not establish that a practice has met every HIPAA obligation.

A usable audit trail is only one part of security and compliance. The practice also needs appropriate review procedures, access controls, risk management, and follow-up.

5. Review EHR User Access and Permissions

Staff access should reflect their job responsibilities. A billing employee may need access to billing information, while a clinician needs access to the records required for patient care. The precise permissions depend on the role, system, and legitimate work requirements.

Review access for current staff, former employees, contractors, temporary workers, and other users who can access ePHI.

Access-control area	What to check	Follow-up
Active accounts	Does each account belong to a current, authorized user or approved service?	Investigate accounts with unclear ownership or purpose
Former employees	Was access removed or disabled when no longer needed?	Follow the account-termination process and investigate lingering access
Role-based permissions	Are permissions appropriate for each user’s responsibilities?	Correct unnecessary access under approved procedures
Privileged accounts	Are administrator-level accounts appropriately restricted and monitored?	Review the business need, approval, and safeguards for elevated access
Shared accounts	Can activity be reliably associated with an individual user?	Assess whether individual accounts and stronger accountability controls are needed
Periodic access reviews	Is access reviewed according to the practice’s policies and risk?	Document findings, decisions, and changes
Remote access	Are safeguards appropriate for remote connections and devices?	Review authentication, device security, and remote-access configuration

How to perform the review

• Obtain the current user and permission list from the EHR administrator.
• Compare it with the current staff roster and approved roles.
• Identify inactive accounts, excessive permissions, and access that cannot be readily explained.
• Confirm that any changes are approved and implemented by authorized personnel.
• Retain evidence of the review and document unresolved issues.

HIPAA does not prescribe one universal access-review calendar for every practice. Set a review schedule based on your risk, system configuration, workforce changes, and applicable requirements. Review access promptly when employment or responsibilities change.

Also, do not rely on the EHR’s role settings alone. HHS expects regulated entities to evaluate risks to ePHI and implement reasonable and appropriate safeguards for their circumstances. See the HHS Security Rule guidance.

6. Review Your HIPAA Security Risk Analysis

A HIPAA Security Rule risk analysis evaluates potential risks and vulnerabilities affecting the confidentiality, integrity, and availability of all ePHI a regulated entity creates, receives, maintains, or transmits.

It is broader than reviewing EHR settings. Your practice may also need to consider connected applications, devices, networks, cloud services, data exchanges, backups, and other locations where ePHI is handled.

HHS explains that the analysis must cover ePHI across its electronic environments and that there is no single risk-analysis method that guarantees compliance. See the official HHS risk-analysis guidance.

What your review should cover

Area	Questions to investigate
ePHI locations and movement	Where is ePHI created, received, stored, maintained, and transmitted?
Threats and vulnerabilities	What could expose, alter, destroy, or make ePHI unavailable?
Existing safeguards	Which administrative, physical, and technical safeguards are in place?
Risk assessment	What is the potential impact and likelihood of each identified risk?
Risk management	What measures will reduce risks to a reasonable and appropriate level?
Third-party services	How do vendors and business associates handle ePHI, and what assurances or safeguards are needed?
Security incidents	Have incidents, near misses, or changes revealed additional risks?
Documentation	Is the assessment recorded, and are decisions and remediation activities documented?

How to turn findings into action

For each identified risk:

• Describe the affected system, information, or workflow.
• Document the threat or vulnerability and its potential impact.
• Evaluate the risk using a consistent method appropriate to your organization.
• Identify safeguards that are already in place and determine whether they are sufficient.
• Assign a responsible owner and document the planned risk-reduction measures.
• Set a target date, track progress, and record the outcome.

Keep the assessment and its supporting documentation current. HHS requires documentation of specified Security Rule activities and periodic review and updating of documentation when environmental or organizational changes affect ePHI security. The Security Rule does not prescribe one universal interval for completing every risk-analysis activity.

Revisit the analysis when changes to technology, operations, vendors, or security incidents could affect the risks to ePHI. Document why decisions were made and how identified risks will be addressed.

7. Turn Audit Findings into Corrective Actions

An audit is useful only when the practice follows through on what it discovers. A list of errors does not establish whether the underlying problem has been fixed.

The OIG identifies internal monitoring, appropriate training, responses to detected offenses, and corrective action among the components of a voluntary compliance-program framework for physician practices. This framework can help practices structure their internal review process, but it should not be presented as a universal checklist of mandatory elements for every practice. See the OIG’s physician guidance.

Use a corrective-action log to track findings from discovery through verification.

Finding	Root cause	Corrective action	Owner	Evidence of completion
Encounter notes are frequently left incomplete	Workflow responsibilities or reminders are unclear	Clarify responsibilities, improve reminders, and train affected staff	Clinical operations lead	Follow-up sample shows improved completion
Claims contain recurring code discrepancies	Coding rules or review steps are inconsistent	Review the affected claims, clarify coding guidance, and test the revised process	Billing or coding lead	Subsequent sample shows the issue has been addressed
Former staff accounts remain active	Offboarding does not reliably trigger access removal	Correct affected accounts and update the offboarding workflow	EHR administrator or security lead	Account review confirms completion
Audit logs are difficult to use in investigations	Staff do not know how to retrieve or interpret available logs	Document the retrieval process and confirm system capabilities with the vendor	EHR administrator	A test investigation can retrieve the relevant available history
A security risk lacks a documented response	Risk ownership or follow-up is unclear	Assign an owner, document the risk-management decision, and track the safeguard	Security or compliance lead	The risk record shows the decision and follow-up status

Verify that the fix worked

For each action, ask:

• Was the correction actually implemented?
• Is there evidence that the change was completed?
• Does a follow-up sample show that the original problem has been reduced or resolved?
• Has the practice addressed the root cause, or only the individual case?
• Does the finding need to be escalated or reviewed under a formal compliance, privacy, security, or billing process?

If a finding may involve improper billing, unauthorized access, or a security incident, follow the practice’s applicable escalation and response procedures. Do not assume that every finding can be handled as routine staff training.

8. Use This EHR Audit-Readiness Checklist

Use the checklist below as an internal review aid. However, please note that it is not an official CMS or HHS checklist, and completing it does not guarantee compliance. Adapt it to the requirements that apply to your practice, services, payers, and systems.

Clinical documentation and claims

• Review a defined sample of clinical records.
• Check that applicable documentation supports the services reported.
• Compare diagnosis and procedure codes with the underlying record.
• Investigate missing orders, results, or other supporting documentation where relevant.
• Document discrepancies and assign follow-up to the appropriate person.
• Confirm that any corrections follow applicable documentation and billing procedures.

Audit trails and access controls

• Confirm how to retrieve available EHR audit history.
• Test whether the available logs support investigation of relevant activity.
• Review active accounts and role-based permissions.
• Investigate access that appears unnecessary or cannot be explained.
• Confirm that account changes and offboarding follow approved procedures.
• Document access-review findings and unresolved limitations.

HIPAA security risk management

• Confirm that the risk analysis covers ePHI across relevant systems and locations.
• Review whether identified risks have documented management decisions.
• Check whether safeguards reflect the risks and circumstances of the practice.
• Review relevant vendor and business-associate arrangements.
• Confirm that required security documentation is maintained and updated when needed.
• Reassess risks when significant operational, technical, or security changes occur.

Corrective action and follow-up

• Record each finding with enough detail to investigate it.
• Identify the root cause where possible.
• Assign an owner and target date.
• Keep evidence of actions taken.
• Test whether corrective actions resolved the problem.
• Escalate potential security incidents or billing concerns through the appropriate process.

9. Establish a Review Schedule That Fits Your Practice

A consistent review process helps teams identify recurring problems before they become harder to investigate. The right frequency depends on the type of review, the risks involved, applicable requirements, and the practice’s experience.

HIPAA does not set one universal schedule for every internal EHR audit or every risk-analysis activity. Use the table below as a planning framework, not as a statement of regulatory deadlines.

Review activity	How to determine the schedule
Clinical documentation and coding	Consider denial patterns, service complexity, prior findings, and the volume and type of claims
User access	Align periodic reviews with risk and policy, and review access promptly when roles or employment change
Audit-trail testing	Test when introducing or changing relevant systems, when concerns arise, and as part of the practice’s risk-based review process
HIPAA risk analysis	Maintain an ongoing process and revisit the analysis when circumstances or risks change
Corrective-action verification	Set a target based on the risk and verify completion before closing the finding
Staff training	Provide training appropriate to roles, identified gaps, policy changes, and applicable requirements

A small practice may assign different tasks to the practice manager, clinician, billing lead, and EHR administrator. Larger practices may have dedicated compliance, privacy, security, or internal-audit teams. Regardless of structure, each finding should have a clear owner and a documented outcome.

Conclusion

EHR audit readiness depends on being able to explain what happened, why it happened, and how the practice addressed any problem it found. Clinical records need to support the services reported, access to ePHI needs appropriate safeguards, and audit history needs to be useful for investigating relevant activity.

Start with a defined sample of records and claims. Check the audit trail and user permissions. Review your HIPAA risk analysis and document the risks that need attention. Then assign corrective actions and verify that they worked.

An EHR can support these activities, but software alone cannot establish that a practice has met every applicable requirement. The practice needs appropriate processes, trained people, accurate documentation, and ongoing review.