Healthcare is the industry where the customer rarely pays the bill, the price is set by the payer rather than the seller, and the law treats a billing error as potential fraud. Those three facts shape internal audit in hospitals, health systems, physician groups and health plans more than anything else: the revenue cycle is a regulatory process as much as a commercial one, the compliance function is a legal expectation rather than a management choice, and the risks that end careers are not the ones a manufacturer’s auditor would recognize (a physician contract above fair market value, a coding pattern that overstates severity, a referral arrangement that looks like a kickback, a drug discount program whose eligibility records are incomplete). Add the duty of care to patients, the data protection regime HIPAA imposes, and the fact that most US providers are nonprofits or public bodies with their own governance rules, and the function has a universe unlike any other industry’s.
This guide explains how the function works at providers and payers: why healthcare audit is different, the legal frame, the revenue cycle and where it leaks, the clinical and quality dimension, HIPAA and information security, the payer side, the specialist areas, the shape of a health system’s audit universe, how internal audit works beside compliance, what the board committee sees, careers and pay, the failures that recur, and a worked example from Ashgrove Health System, the nonprofit hospital system used in the healthcare examples on this site. The HIPAA compliance audit guide gives the privacy and security program in depth and the hospital revenue cycle controls guide the revenue cycle’s control failures.
In this guide
- Why healthcare internal audit is different
- The legal frame: fraud and abuse law and the compliance program
- The revenue cycle and where it leaks
- The clinical and quality dimension
- HIPAA and health information security
- The payer side
- Specialist areas: physician arrangements, 340B, research, pharmacy, supply chain
- The shape of a health system’s audit universe
- Internal audit beside the compliance function
- What goes to the board committee
- Careers and pay in healthcare internal audit
- Failures that recur
- A worked example: Ashgrove Health System’s FY26 audit year
- Questions about internal audit in healthcare
- Related guides
Why healthcare internal audit is different
Four features of the business shape the function. Third-party payment under rules: Medicare, Medicaid and commercial insurers pay for services according to coding systems (ICD-10 diagnoses, CPT and HCPCS procedures, DRGs for inpatient stays), documentation requirements and coverage rules, so that revenue depends on the accuracy of clinical documentation and coding, and errors in the government’s favor are repaid while errors in the provider’s favor are overpayments that must be reported and returned within 60 days of identification under the False Claims Act’s reverse false claims provision. Fraud and abuse law with criminal and civil teeth, enforced by the Department of Justice, the HHS Office of Inspector General and whistleblowers who share in recoveries. Clinical risk: the organization’s core product is patient care, measured by quality and safety indicators, accredited by bodies such as the Joint Commission, and conditioned by Medicare’s Conditions of Participation, so that internal audit’s universe includes processes whose failure harms people rather than balances. Mission and structure: most US hospitals are nonprofit or public, with tax-exemption obligations (community benefit, financial assistance policies under Internal Revenue Code section 501(r)), governance by community boards, and, increasingly, membership in large systems formed by mergers whose integration is itself an audit subject. Health plans share the legal frame and add actuarial, network and member-service risks of their own. The function that results is larger relative to the organization than in most industries, works beside a compliance function of similar size, and spends more of its time on regulatory assurance than any other sector except banking.
The legal frame: fraud and abuse law and the compliance program
| Law or program | What it prohibits or requires | Consequence | Audit relevance |
|---|---|---|---|
| False Claims Act | Knowingly submitting, or causing the submission of, false claims to federal programs; knowingly retaining identified overpayments beyond 60 days | Treble damages plus per-claim penalties (inflation-adjusted, now exceeding $14,000 to $28,000 per claim); whistleblower (qui tam) suits with the relator sharing 15 to 30 percent of recoveries; most healthcare recoveries come this way | Billing and coding accuracy; overpayment identification, quantification and refund process |
| Anti-Kickback Statute | Knowingly offering, paying, soliciting or receiving remuneration to induce referrals of federal program business, unless a safe harbor applies | Criminal felony; civil penalties; exclusion; False Claims Act liability for tainted claims | Physician and referral-source arrangements; discounts, free services, recruitment, medical directorships |
| Stark Law (physician self-referral) | Physicians referring designated health services payable by Medicare to entities with which they or family members have a financial relationship, unless an exception is met; strict liability | Denial of payment; refunds; civil penalties; False Claims Act exposure | Physician compensation at fair market value and commercially reasonable; written, signed, current agreements; compensation not tied to referrals |
| Civil Monetary Penalties Law; exclusion authorities | Various prohibited conduct including employing or contracting with excluded individuals and entities; beneficiary inducements | Penalties; exclusion from federal programs | Monthly screening of workforce and vendors against the OIG exclusion list and state lists |
| Medicare Conditions of Participation; Medicaid state plans | Standards hospitals and other providers must meet to be paid (governance, patient rights, quality, nursing, medical records, infection control, emergency services, discharge planning) | Loss of certification and payment; surveys and plans of correction | Quality and clinical governance; survey readiness; corrective action tracking |
| EMTALA | Emergency screening and stabilization regardless of ability to pay | Penalties; exclusion | Emergency department processes and transfers |
| Price transparency and the No Surprises Act | Hospital standard charges published in machine-readable form (since 2021); good-faith estimates and protections against surprise billing (since 2022) | Civil penalties; payment disputes | Chargemaster governance; estimate and billing processes |
| Section 501(r) (tax-exempt hospitals) | Community health needs assessment every three years; written financial assistance and emergency care policies; limits on charges to eligible patients; billing and collection restrictions | Loss of exemption; excise taxes | Financial assistance determinations; collection practices |
| HHS OIG compliance program guidance | Seven elements: written policies, compliance officer and committee, training, communication lines, enforcement and discipline, auditing and monitoring, response and prevention (the General Compliance Program Guidance of November 2023, with industry-segment guidance following) | Expected as a mitigating factor in enforcement; required under corporate integrity agreements | The compliance function’s design and effectiveness is an audit subject in itself |
| Information blocking (21st Century Cures Act) | Practices that interfere with access, exchange or use of electronic health information | Disincentives for providers (final rule 2024); penalties for developers and exchanges | Health information exchange and patient access processes |
The compliance program the OIG describes is the organizing structure for most of this: a chief compliance officer with board access, a compliance committee, risk-based auditing and monitoring of high-risk billing areas, hotline and investigation processes, exclusion screening, training and discipline. The OIG’s annual work plan and its audit and evaluation reports signal the billing areas under scrutiny each year, and a healthcare internal audit function reads them as a banking function reads supervisory priorities. Medicaid financing changed with federal legislation in 2025 (limits on provider taxes and state-directed payments, and work requirements taking effect from 2027 in most states), and the funding risk that follows for safety-net providers is a strategic matter boards have added to their risk reporting.
The revenue cycle and where it leaks
The revenue cycle runs from scheduling and registration (demographics, insurance verification, authorization) through charge capture (every service recorded), coding (diagnoses and procedures assigned from documentation), claim submission (scrubbed against payer edits), payment posting and contractual adjustment (the difference between charges and the contracted or regulated rate), denial management (claims rejected or underpaid and appealed), patient billing and collection, and bad debt or charity write-off. It leaks everywhere, and the leakage runs in both directions: undercoding and missed charges lose revenue the organization earned, while overcoding, upcoding of severity, unbundling, medically unnecessary services and billing for services not documented create overpayments that are fraud if knowing and repayable if not. Internal audit’s revenue cycle work has three layers: process controls (registration accuracy, authorization before service, charge reconciliation between clinical systems and billing, the chargemaster’s governance and annual review, denial root-cause analysis, write-off authority), coding and documentation accuracy (statistically valid samples of claims by service line re-coded by certified coders against the record, with error rates and dollar effects extrapolated under the OIG’s protocols where repayment is at stake), and analytics (outlier physicians by evaluation-and-management level distribution, DRG pairs with unusual severity ratios, modifier usage, same-day duplicate charges, credit balances aged beyond the 60-day refund rule). The hospital revenue cycle controls guide covers the control failures and the order-to-cash guide the generic process the revenue cycle is a regulated version of.
| Revenue cycle stage | Leak or risk | Audit test | Finding that recurs |
|---|---|---|---|
| Registration and authorization | Wrong payer or demographics causing denials; services without required authorization | Denial analysis by root cause; authorization sample | Authorization denials of 2 to 4 percent of scheduled procedures written off without appeal |
| Charge capture | Services performed and not charged (supplies, drugs, procedures); duplicate charges | Reconcile clinical system activity to charges by department; late charge analysis | Surgical supply and implant charges missing on 5 to 10 percent of cases |
| Coding and documentation | Overcoding and undercoding; severity capture; documentation not supporting the code; copy-forward notes | Certified coder re-review of samples by service line; physician E/M distribution analytics; DRG validation | Inpatient DRG error rates of 5 to 15 percent in both directions; outlier physicians |
| Claims and edits | Claims held or rejected; edit overrides | Scrubber override analysis; aged unbilled accounts | Override codes used routinely without review |
| Payment posting and contract compliance | Payers paying below contract; contractual adjustments masking underpayment | Contract modeling against remittances; variance analysis | Underpayments of 1 to 3 percent of commercial revenue unidentified |
| Denials and appeals | Denials written off; appeals untimely | Denial rate and overturn rate by payer; timeliness | Appeal deadlines missed for high-value denials |
| Credit balances and overpayments | Patient and payer credits unrefunded; identified overpayments held past 60 days | Credit balance aging; overpayment log with identification dates | Credit balances aged over a year; no overpayment log |
| Patient billing and collection | Financial assistance not screened; collection practices breaching 501(r) and state law | Financial assistance determination sample; collection agency practices | Eligible patients sent to collection without screening |
The clinical and quality dimension
Internal audit does not audit the practice of medicine, and it does audit the systems that are supposed to assure its quality: the quality and patient safety program’s governance (board quality committee, medical staff peer review, credentialing and privileging of physicians against primary-source verification, ongoing professional practice evaluation), incident and adverse event reporting and root cause analysis, infection control program compliance, medication management (ordering, dispensing, administration, high-alert drugs, controlled substance diversion), survey readiness for the Joint Commission and state surveys and the tracking of plans of correction, the integrity of quality data reported to Medicare’s quality programs (which affect payment through value-based purchasing and readmission penalties) and to accreditation bodies, and clinical documentation integrity programs whose incentives can tilt toward revenue. The method is the same as in any process audit: criteria from the Conditions of Participation, accreditation standards and the organization’s policies; tests of process, evidence and data; and clinical expertise borrowed from the quality department or co-sourced where the auditor needs to read a chart. The operational audit criteria guide covers setting criteria where the standards are clinical.
HIPAA and health information security
Healthcare is the most breached sector in the United States by individuals affected, and the HIPAA Privacy, Security and Breach Notification Rules are the regime; the HIPAA compliance audit guide gives the full program, from the risk analysis that OCR’s enforcement turns on to the business associate inventory and the January 2025 Security Rule proposal. For the pillar, three points: the HIPAA program is a standing High entity in every healthcare audit universe, audited at the enterprise level every two to three years with high-risk components (access monitoring, device encryption, release of information, business associates) in between; the 2024 Change Healthcare ransomware attack, which disrupted claims processing across the industry and exposed about 190 million people’s records through one clearinghouse, made third-party concentration and operational resilience board-level questions for every provider and payer; and the sector’s cybersecurity baseline is converging on HHS’s 405(d) practices and Cybersecurity Performance Goals, which internal audit can use as criteria alongside the rule. The cyber resilience audit and backup and recovery audit guides cover the recovery capability that a hospital’s clinical operations depend on.
The payer side
Health plans share the fraud and abuse frame and add their own regulatory and operational risks. Medicare Advantage plans are paid risk-adjusted capitation based on members’ diagnoses, which creates the industry’s largest enforcement exposure: diagnoses submitted without support in the medical record inflate payment, CMS’s Risk Adjustment Data Validation audits (with extrapolation of error rates under the 2023 final rule) and Department of Justice actions target them, and internal audit’s chart-to-diagnosis validation program is the control. Medical loss ratio rules require plans to spend at least 80 or 85 percent of premium on claims and quality improvement, with rebates otherwise, so the classification of expenses is audited. Claims payment integrity (paying the right amount to the right provider for a covered member for a service that happened) is the operational core, tested by claims adjudication accuracy samples, duplicate and overpayment analytics, and provider contract loading accuracy. Provider networks must meet adequacy standards, credentialing requirements and directory accuracy rules. Pharmacy benefit management arrangements, rebates and formulary governance are a growing audit subject under state and federal scrutiny. Member services, appeals and grievances, marketing and enrollment (particularly for Medicare and Medicaid products), and actuarial pricing and reserving (claims incurred but not reported) complete the picture; the internal audit in insurance guide covers the reserving and actuarial process controls that health plans share with other insurers.
Specialist areas: physician arrangements, 340B, research, pharmacy, supply chain
| Area | Risk | What internal audit tests |
|---|---|---|
| Physician arrangements | Compensation above fair market value, not commercially reasonable or varying with referrals (Stark and Anti-Kickback exposure); arrangements unsigned, expired or unwritten; time records for medical directorships absent | Contract inventory completeness; a sample against fair market value opinions and the written agreement; payments reconciled to contract terms; time records; the arrangement database’s governance |
| 340B drug pricing program | Eligibility of patients and sites for discounted drugs; diversion to ineligible patients; duplicate Medicaid discounts; contract pharmacy oversight; manufacturer restrictions and litigation changing the rules | Covered entity eligibility; patient definition applied in the split-billing software; sample of 340B dispenses to eligibility; contract pharmacy reconciliations; HRSA audit readiness |
| Research | Grant compliance (Uniform Guidance effort reporting, allowable costs), human subjects protection and institutional review board processes, clinical trial billing (research versus routine care), conflicts of interest, research security requirements for federal funding | Effort certification sample; trial billing coverage analysis; IRB process; COI disclosures |
| Pharmacy and controlled substances | Diversion by staff; DEA recordkeeping; automated dispensing cabinet discrepancies; wastage documentation | Discrepancy analytics; reconciliation of purchases to dispensing to administration; surveillance program |
| Supply chain | Implant and high-cost supply tracking; group purchasing contract compliance; vendor representatives in procedure areas; expired product; recalls | Implant charge capture and traceability; contract price compliance; vendor credentialing; recall closure |
| Mergers and integration | Acquired practices and hospitals with different compliance cultures, systems and arrangements | Pre-close compliance diligence; post-close integration audits of arrangements, billing and systems |
| Charity care and community benefit | 501(r) compliance; community benefit reporting; state requirements | Financial assistance policy application; collection practice sample; Schedule H support |
The shape of a health system’s audit universe
Ashgrove Health System’s universe, below, has 96 entities in eight domains and is built by process and program rather than by hospital, with the hospitals and clinics as locations within each process entity and a rotation across sites; the audit universe guide gives the method and the bank audit universe guide a comparison from banking.
| Domain | Representative entities (Ashgrove Health System, 96 in total) | Typical rating and cycle |
|---|---|---|
| Revenue cycle (14) | Registration and insurance verification; authorization; charge capture by service line (surgery, emergency, pharmacy, imaging); inpatient coding and DRG validation; professional coding and E/M; chargemaster governance; claims and edits; payment posting and contract compliance; denials and appeals; credit balances and overpayment refunds; patient financial services and 501(r); price transparency and good-faith estimates; physician practice revenue cycle | High (annual) for coding, charge capture, credit balances and 501(r); others two years |
| Compliance and regulatory (13) | Compliance program effectiveness; physician arrangements and Stark/AKS; exclusion screening; 340B; EMTALA; Conditions of Participation survey readiness; information blocking; conflicts of interest; hotline and investigations; corporate integrity obligations (if any); state licensure; Medicare cost report; OIG work plan responses | High for arrangements, 340B, compliance program (annual); others two to three years |
| Clinical quality and safety (11) | Quality program governance; credentialing and privileging; peer review; incident reporting and root cause analysis; infection control; medication management; controlled substance diversion; quality data integrity (Medicare quality programs); clinical documentation integrity; patient rights and grievances; emergency department throughput | High for credentialing, diversion and quality data (annual); others two years |
| Privacy and information security (12) | HIPAA enterprise program; risk analysis and risk management; access monitoring; device encryption; release of information and right of access; business associates; incident and breach management; identity and access management; medical device security; backup and recovery; cyber incident response; web and tracking technologies | High (annual or two years) across the domain |
| Finance and administration (16) | Financial close; payroll (14,000 employees); accounts payable and procurement; supply chain and implants; capital projects; treasury and investments; debt covenants (tax-exempt bonds); grants and research accounting; physician practice finance; foundation and philanthropy; fixed assets; cost allocation; tax (Form 990, Schedule H); insurance and risk financing; travel and expense; the financial assistance fund | Payroll, supply chain, capital projects High; others two to three years |
| Technology (12) | EHR governance and change management; interfaces and integration; data governance and analytics platform; cloud; disaster recovery; vendor technology risk; clinical systems (laboratory, imaging, pharmacy); end-user computing; AI governance; telehealth platform; patient portal; network and infrastructure | EHR change, DR and AI governance High; others two years |
| Operations (10) | Pharmacy operations; laboratory; imaging; surgical services; emergency services; facilities and environment of care; food and nutrition; transport; security; parking and ancillary revenue | Pharmacy and surgical services High; others rotated across sites |
| Governance and strategy (8) | Board governance; ERM; strategic planning and growth; mergers and integration; medical staff governance; human resources; community benefit and CHNA; the internal audit function (QAIP) | ERM, integration High; others two to three years |
Internal audit beside the compliance function
Every healthcare organization of size has a compliance function the government expects, and the two functions must be designed together or they will duplicate and leave gaps. The OIG’s guidance assigns compliance the auditing and monitoring of high-risk billing and arrangement areas, which means a compliance department typically has its own coding auditors, arrangement reviewers and 340B analysts; internal audit’s role is independent assurance over the whole organization, including over the compliance program itself (its design against the seven elements, its risk assessment, the quality of its monitoring, its investigation and discipline processes, its board reporting). The division that works: the compliance function performs the recurring monitoring (coding accuracy by service line, arrangement database currency, exclusion screening, 340B eligibility) and reports to the compliance committee; internal audit tests whether that monitoring is reliable (re-performing samples, testing coverage against the risk assessment) and relies on it where it is, audits the areas compliance does not cover (finance, technology, operations, governance) and the compliance program itself, and reports to the audit committee; both report to a joint board committee in most systems, and the chief compliance officer and chief audit executive meet regularly to coordinate plans and share risk assessments. Legal privilege adds a complication: compliance investigations and billing reviews that may lead to repayment are often conducted under counsel’s direction, and internal audit’s access and documentation must respect that structure. The internal audit vs SOX vs compliance vs ERM guide covers the general division, the compliance risk assessment guide the assessment the compliance function should run, and the assurance mapping guide the map that shows the board who covers what.
What goes to the board committee
Beyond the standard reporting the Global Internal Audit Standards require, a health system’s board compliance and audit committee receives the compliance program’s effectiveness assessment (the OIG expects the board to oversee it, and the Department of Justice’s corporate compliance evaluation criteria ask whether the board did), the billing audit results with repayment status, the physician arrangement program’s status, the HIPAA program and breach picture, the quality data integrity results, the exclusion screening confirmation, the regulatory calendar (surveys, cost report, 990, 340B recertification), the status of any corporate integrity agreement obligations, and the integration audits of acquired entities. Public and nonprofit boards add community benefit and 501(r) compliance. The audit committee annual agenda guide gives the calendar and the board risk reporting guide the risk pack beside it.
Careers and pay in healthcare internal audit
Healthcare internal audit hires accountants and IT auditors like every industry and adds coders (certified through AHIMA or AAPC), nurses and clinicians who moved into quality, compliance or audit, revenue cycle professionals and pharmacy specialists; the Certified in Healthcare Compliance credential and the Association of Healthcare Internal Auditors’ resources are the sector’s own, alongside the CIA, CISA and CFE. Pay in nonprofit health systems sits at or slightly below the general market (the salary guide‘s ranges apply, with large systems and payers at the upper end and community hospitals below), with strong benefits and job security; payers pay closer to financial services. Career paths out of the function run to compliance leadership (the chief compliance officer role is a common destination), revenue cycle leadership, risk management, finance and, for clinicians, quality and operations. The function’s breadth across clinical, financial, regulatory and technology risk makes it one of the few places in a health system where someone sees the whole organization, which is the argument the is internal audit a good career guide makes in general and which applies with force here.
Failures that recur
| Failure | How it shows | What the function should do |
|---|---|---|
| Internal audit as a second compliance department | Both functions audit coding; nobody audits payroll, capital projects or the EHR change process | Assurance map; rely on compliance’s monitoring after testing it; cover the rest |
| Arrangements database incomplete | Physician agreements found in drawers; expired contracts paid; fair market value opinions missing | Inventory reconciliation to payments; annual arrangement audit |
| Overpayments identified and held | Credit balances aged; audit findings quantifying overpayments without a refund process | Overpayment log with identification dates; 60-day process owned by compliance; internal audit tests it |
| Quality data taken on faith | Metrics reported to Medicare and accreditors never tested to source | Quality data integrity entity in the universe |
| HIPAA risk analysis scoped to the EHR | The finding OCR writes most | Enterprise ePHI inventory; see the HIPAA guide |
| Acquisitions integrated without audit | Acquired practices billing under legacy practices for years | Pre-close diligence; integration audits within twelve months |
| 340B treated as a pharmacy matter | Eligibility errors found by a HRSA audit | 340B as a High compliance entity with annual testing |
| Diversion undetected | Controlled substance discrepancies unanalyzed until a staff member is caught | Diversion analytics program; audit of the surveillance program |
A worked example: Ashgrove Health System’s FY26 audit year
Ashgrove Health System is the nonprofit health system used in the healthcare examples on this site: five hospitals (a 520-bed tertiary center and four community hospitals), about 190 clinics and an employed physician group of 640, $2.1 billion of revenue (about 58 percent from Medicare and Medicaid), 14,000 employees, tax-exempt bonds outstanding, a chief compliance officer with a department of 22 reporting to the board’s compliance and audit committee, and a twelve-person internal audit function reporting to the same committee. The FY26 plan covered 26 of the 96 universe entities in 17,200 hours, with 900 hours co-sourced (HIPAA technical testing, a coding re-review by an outside firm for an independence reason, and clinical expertise for the diversion audit), and relied on the compliance department’s coding monitoring for two service lines after re-performing 10 percent of its samples.
| Engagement (hours) | What it found | Outcome |
|---|---|---|
| Enterprise HIPAA program (520, 120 co-sourced) | Risk analysis covered 41 of 68 applications and none of 2,100 networked biomedical devices; 320 vendors with PHI and no business associate agreement; right of access requests untracked at the clinics; access monitoring alerts 61 percent open (described in the HIPAA audit guide) | Five High findings; enterprise risk analysis re-performed; program rated Needs Improvement |
| Physician arrangements (680) | Arrangement database listed 1,180 agreements; reconciliation to physician payments identified 94 payment streams without a current written agreement (31 expired, 63 never in the database, mostly call coverage and medical directorships at acquired hospitals); 12 medical directorships paid without time records; fair market value opinions current for 88 percent of the sample | High; agreements executed or payments stopped; the 94 streams reviewed by counsel for Stark exposure; database ownership moved to compliance with monthly reconciliation to payments |
| Inpatient coding and DRG validation (420, 180 co-sourced) | Re-review of 300 inpatient claims across the five hospitals: 9.3 percent DRG error rate (5.0 percent overcoded, 4.3 percent undercoded) with a net overpayment of $186,000 in the sample; sepsis and respiratory failure documentation the main driver; one community hospital at 16 percent | High; overpayments extrapolated and refunded under the compliance department’s protocol with counsel; clinical documentation program retrained; the outlier hospital placed under monthly monitoring |
| Credit balances and overpayment refunds (260) | $4.1 million of credit balances, $1.2 million aged over a year; the overpayment log recorded identification dates for audit-identified overpayments but not for those found by patient financial services | High; aged credits resolved or refunded; log extended to all sources with the 60-day clock |
| 340B program (340) | Split-billing software patient definition configured correctly; 2 of 60 sampled contract pharmacy dispenses to patients whose eligible encounter fell outside the lookback; one child site’s registration lapsed for a quarter | Medium; dispenses reversed; registration calendar |
| Controlled substance diversion surveillance (380, 60 co-sourced pharmacy) | Automated dispensing cabinet discrepancy reports generated and reviewed at four of five hospitals; the fifth had 1,400 unresolved discrepancies over the year; the surveillance analytics flagged two nurses whose waste documentation patterns had not been investigated | High; investigations opened (one substantiated and reported to the board of nursing and DEA); surveillance program centralized |
| Quality data integrity (300) | Readmission and infection measures reconciled to source for a sample; one measure’s exclusion logic applied inconsistently across hospitals, overstating performance at two | Medium; logic standardized; prior submissions reviewed with the quality department |
| Payroll and timekeeping (520) | 14,000 employees; 38 terminated employees paid after termination ($61,000); overtime approval bypassed in two nursing units; no finding on pay rates | Medium; recovered; approval control enforced |
| EHR change management (440) | Change control process documented; 11 percent of changes in the sample implemented without the required clinical informatics approval; emergency changes not reviewed after the fact | Medium; approvals enforced; emergency change review added |
| Integration of the acquired community hospital (480) | Eighteen months after acquisition: legacy billing system still in use with its own chargemaster; 23 physician arrangements not migrated to the system’s standards (part of the 94 above); compliance training completion 54 percent | High; integration plan re-based with dates; the committee asked for quarterly reporting |
The chief audit executive’s annual report rated the year’s results against the universe and noted the pattern: four of the six High findings traced to the acquired hospital or to arrangements and devices that had never entered the system’s inventories, which is the integration risk the universe had rated High and the plan had covered. The committee’s response was to fund two additional auditors for FY27, one a certified coder and one a nurse auditor, and to ask the chief compliance officer and the chief audit executive to present a joint assurance map at the next meeting. The HIPAA audit guide tells the privacy and security chapter in detail, and the assurance mapping guide the map the committee asked for.
Questions about internal audit in healthcare
What does internal audit do in a hospital?
It provides independent assurance over the revenue cycle (coding, charge capture, denials, credit balances), compliance with fraud and abuse law (physician arrangements, 340B, exclusion screening), HIPAA and information security, clinical quality systems (credentialing, diversion surveillance, quality data), finance and payroll, technology including the EHR, and the compliance program itself, reporting to a board committee.
How is healthcare internal audit different from compliance?
The compliance function the OIG expects owns the compliance program and performs recurring monitoring of high-risk billing and arrangement areas. Internal audit provides independent assurance over the whole organization, including over the compliance program, relies on compliance’s monitoring only after testing it, and covers the areas compliance does not.
What are the main healthcare fraud and abuse laws?
The False Claims Act (false claims and retained overpayments; treble damages and whistleblower suits), the Anti-Kickback Statute (remuneration for referrals), the Stark Law (physician self-referral with strict liability), the Civil Monetary Penalties Law and exclusion authorities, and the program conditions of Medicare and Medicaid, with HIPAA governing health information.
What is the biggest audit risk at a health plan?
For Medicare Advantage plans, risk adjustment: diagnoses submitted for payment that the medical record does not support, which CMS’s RADV audits and the Department of Justice pursue with extrapolated recoveries. Claims payment integrity, medical loss ratio classification and network compliance follow.
What should a health system’s audit universe include?
The revenue cycle by stage and service line, compliance and regulatory programs, clinical quality and safety systems, privacy and information security, finance and administration, technology including the EHR, operations by department with site rotation, and governance entities including integration of acquisitions and the compliance program itself.
Do healthcare internal auditors need clinical or coding credentials?
Not every auditor, but every function needs access to them: certified coders for coding reviews, clinicians for quality and diversion work, pharmacy expertise for 340B and controlled substances. Functions hire them, borrow them from compliance and quality, or co-source them; the Certified in Healthcare Compliance credential and the AHIA’s resources are the sector’s own alongside the CIA.
Related guides
- How to audit HIPAA compliance — the privacy and security program in depth.
- Hospital revenue cycle controls — the revenue cycle’s control failures.
- How to audit order-to-cash — the generic process the revenue cycle regulates.
- How to audit payroll — 14,000 employees’ pay.
- How to audit capital projects — hospital construction programs.
- Third-party risk management program — business associates and vendors.
- Auditing cyber resilience — recovery a hospital depends on.
- Backup and recovery audit — the contingency core.
- Compliance risk assessment — the compliance function’s assessment.
- Internal audit vs SOX vs compliance vs ERM — the division of roles.
- Assurance mapping — who covers what, for the board.
- Fraud risk assessment — billing and diversion fraud.
- Internal audit in insurance — the health plan’s actuarial side.
- Internal audit in higher education and nonprofits — academic medical centers and research.
- How to build an audit universe — the method behind the 96 entities.
- The audit committee annual agenda — the committee’s calendar.
Leave a Reply