If the medical record isn’t solid, nothing else is. Coding, billing, denials management, even payer relationships—all of it rides on how we document, protect, and share patient information. Here’s the tight, real-world version I teach my teams when we build audit programs that actually hold up.
What “good” looks like
Great documentation isn’t just “charting more.” It’s:
- Accurate, attributable, legible, and complete—and it supports medical necessity for what was billed.
- Traceable across systems (EHR, portals, clearinghouses, BA vendors).
- Privacy-aware by design (who accessed what, why, and how it was safeguarded).
Auditors don’t just check codes; we verify the entire chain from service to submission.
HIPAA, quickly—but precisely
HIPAA gives us the rulebook for how protected health information (PHI) must be handled. A few anchors your audit plan should always cover:
Covered entities & business associates (BAs)
Health plans, clearinghouses, and most providers are covered entities. Anyone handling PHI on their behalf (billing companies, IT vendors, analytics firms, transcription, etc.) is a business associate—and directly liable for misuse. Contracts must strictly define allowed uses, safeguards, breach reporting, and what happens to PHI at termination. Auditors should verify BAAs exist, match services in scope, and are current. (HHS.gov)
Minimum necessary
Use, disclose, or request only the PHI needed for the task. Pulling the entire chart “just in case” is not compliant unless you can justify it. Build this into access controls and workflows. (HHS.gov)
Permitted uses & disclosures
Treatment, payment, operations; patient authorization; and specific public-interest purposes (e.g., certain law-enforcement and public-health activities). Your audit should confirm disclosures align with policy and are logged when required. (CDC)
Why this matters right now (numbers that get attention)
- Enforcement is active: HHS OCR reports 152 settlements/CMPs to date totaling $144.9M+—from large systems to small offices. (HHS.gov)
- Breach scale is massive: In 2024, PHI for an estimated 276.8 million individuals was exposed/stolen; 14 incidents topped 1 million records each, most due to hacking—and 8 involved business associates. (The HIPAA Journal)
- Penalty tiers bite: Civil penalties range up to $50,000 per violation, with annual caps (per identical provision) historically up to $1.5M—and higher effective totals possible depending on circumstance. Criminal charges apply for intentional misuse. (eCFR, ADA)
Translation for leadership: privacy and documentation failures aren’t “IT problems.” They’re enterprise risk—with price tags.
What great auditors test (my short checklist)
- Record integrity: Authorship, timestamps, amendments, and version history make sense and support medical necessity.
- Access governance: Role-based access, MFA where available, termination/transfer controls, and periodic access reviews. (Watch this space: HHS has proposed tougher cybersecurity requirements—MFA, encryption, vendor response SLAs, and formal incident response.) (Reuters)
- BA oversight: Current BAAs mapped to every vendor touching PHI; breach notification timelines and data return/destruction are explicit and followed. (HHS.gov)
- Minimum necessary in practice: Requests to external entities and internal “super-user” access reflect true need; whole-chart pulls are justified and rare. (HHS.gov)
- Disclosure management: Accounting of disclosures where required; patient rights processes (access, amendments) are real, not theoretical. (CDC)
- Security/incident playbooks: Tested, timed, and documented—especially with business associates. (BAs featured in many of the largest breaches.) (The HIPAA Journal)
Red flags I see all the time
- “One-size” access—front desk has the same permissions as clinical staff.
- Missing BAAs for niche tools (dictation apps, niche analytics, small IT shops). (HHS.gov)
- Over-reliance on screenshots or exports as the only source of truth (no metadata trail).
- Whole-chart downloads for routine payer requests—no justification. (HHS.gov)
- BA breach notices that don’t match contract timelines—or no notice at all. (HHS.gov)
Talk track for your exec team
- “Here’s our BA map and the last time each contract was reviewed.”
- “Here’s our minimum-necessary audit: % of whole-chart pulls vs. targeted requests.” (HHS.gov)
- “Here’s our breach drill timing from detection to notification, including BA partners.”
- “Here’s our OCR penalty exposure if this control fails.” (eCFR)
Bring it home
Medical record standards aren’t paperwork—they’re your compliance scaffold and revenue shield. If you audit them with the same rigor you bring to CPT® and ICD-10-CM, you prevent denials, avoid penalties, and protect patients.
Want to go deeper? Our Director of Auditing & Education, Maya Turner, teaches an advanced auditing curriculum that turns this checklist into a living program—policy builds, sampling, reporting, and exec-ready dashboards. If you’re serious about leading in compliance, that’s where we’ll take you next.