Audit, Compliance & Risk. Independent eyes.Defensible outcomes.
Independent audits of coding, clinical documentation and revenue integrity, and standing compliance programs that keep you ready all year instead of scrambling before a review. We apply the same scrutiny to AI and data systems.
A short call with a senior expert. No patient information needed.
What gets reviewed
- Coding & documentation
- Charges & revenue integrity
- Policies & controls
- AI & data systems
- Vendor risk
How an audit runs
- 1Scope and sample agreed up front
- 2Tested against the rules
- 3Root cause, not just error counts
- 4Corrective actions tracked to close
What you get
- Findings you can act on
- A defensible record
- Audit-ready all year
- Risk reduced early
Audited against the rules that apply to you
- Official coding guidelines
- CMS Medicare manuals
- NCCI edits
- HIPAA Privacy, Security and Breach Notification Rules
- False Claims Act
- OIG compliance program guidance
- Joint Commission standards
- NIST AI Risk Management Framework
Watch 45 seconds
Audit-ready all year: how audit and analytics work
Read the film as text
- Audit-ready all year.Not just the week before a review.
- What gets audited: the work, and the systems around it.Coding and documentation. Charges and revenue integrity. Policies and controls. AI and data systems. Vendor risk. Independent eyes on each one.
- How findings feed the next audit: every audit sets up the next one.Scope and sample agreed up front. Tested against the rules. Root cause, not just error counts. Corrective actions tracked to close. Then retest, and the findings shape the next scope.
- What gets measured: the numbers behind the findings.Error rate by category. Repeat findings. Time to close actions (illustrative charts). Agree the measure first. Report plainly.
- During Health.Know what an audit would find, before one is called. Book an audit-readiness call, or take the free readiness scorecard, at duringhealth.com.
What is changing in audit and enforcement right now
Dated facts, each with its source. This part of the page is refreshed regularly; the rest is built to last.
710
large health data breaches reported to HHS in 2025
About 36% happened at business associates, the vendors that hold data for providers and plans. Who builds and runs your data layer is a security decision, not just a technical one.
22,000+
organizations the Joint Commission plans to offer a voluntary AI certification
With the Coalition for Health AI, it issued guidance on responsible AI use on September 17, 2025, and said governance playbooks and a voluntary certification would follow.
CHAI, Joint Commission and CHAI release initial guidanceAs of Oct 2026$28.8B
Medicare fee-for-service improper payments in FY 2025 (6.55%)
Medicare Advantage (Part C) was 6.09%, or $23.67 billion, mostly diagnoses its documentation did not support. Medicaid was 6.12%, or $37.39 billion, and insufficient documentation drives most Medicaid errors, which is generally not a sign of fraud.
CMS, Fiscal Year 2025 Improper Payments Fact SheetAs of Oct 2026~550
Medicare Advantage contracts CMS says it will audit every year
Up from about 60 a year, with CMS growing its medical coders from 40 to about 2,000. CMS has been notifying plans of new risk-adjustment audit rounds through 2026, including payment year 2024 on August 28, 2026.
CMS, strategy to accelerate Medicare Advantage auditsAs of Oct 2026
$6.8B
False Claims Act recoveries in fiscal year 2025, a record
More than $5.7 billion related to health care, led by managed care, prescription drugs and medically unnecessary care. A record 1,297 whistleblower suits were filed.
Every number links to its source.
What most organizations get wrong about audits
Myth
“We had no findings last year, so we are fine.”
Fact
A clean result depends on what was sampled and how. Independent testing finds the patterns an internal check can miss, and shows a regulator that you looked.
Myth
“Compliance is a once-a-year project.”
Fact
Regulators ask what you did when you found a problem, and how fast. A standing program with routine testing, training and tracked fixes holds up. A binder assembled the month before does not.
Myth
“Our vendors and AI tools are their problem.”
Fact
Business associates and AI systems that touch your data are part of your risk. Contracts, access reviews and monitoring need an owner on your side.
Four things you can hold us to.
Coding & documentation audit
Independent review of coding accuracy, documentation completeness and classification validation, with root-cause findings.
What you get
- Random and targeted samples across inpatient, outpatient and professional coding
- Accuracy and documentation findings with root causes
- Provider and coder education plans
- Repeat testing to show improvement
Revenue integrity audit
Charge capture, tariff and charge-master review to surface leakage before it becomes recovery work.
What you get
- Charge capture and charge-master review
- Missed and incorrect charge detection
- Billing tested against payer and CMS rules, including NCCI edits
- Overpayment findings with a documented process for returning them
Compliance programs
Policies, controls, training and audit-readiness run as an ongoing program, aligned to the regulations and accreditation standards of each market.
What you get
- Policies, procedures and a written code of conduct
- A risk assessment and an annual work plan
- Training, a reporting line and an investigation workflow
- Monitoring dashboards for leadership and the board
AI & data governance audit
Review of model oversight, PHI handling, traceability and explainability across agentic and analytical systems.
What you get
- An inventory of AI tools and data flows
- Review of oversight, bias testing and explainability
- Checks on PHI handling, access and logging
- Findings mapped to your policies and to the NIST AI Risk Management Framework
Everything we do in audit, compliance and risk
Ten service areas, from a single coding audit to a standing compliance program. Most engagements start in one and grow into the others.
Coding & documentation audit
Is the record supported, and is the code right?
- Inpatient, outpatient and professional coding
- Documentation completeness and specificity
- Risk-adjustment diagnosis support
- Provider and coder education
Revenue integrity audit
Is every charge captured and billed correctly?
- Charge capture and charge-master review
- Missed and duplicate charges
- Billing against payer and CMS rules
- Leakage and overpayment findings
External audit response
When a payer or contractor asks for records.
- Additional documentation requests and post-payment reviews
- Risk-adjustment documentation reviews
- Appeal support
- An audit calendar with owners and deadlines
Compliance program design & operation
A program that works between audits.
- Policies, code of conduct and committee structure
- Annual risk assessment and work plan
- Training and reporting line
- Board and leadership reporting
HIPAA privacy & security assessment
Finding gaps before an incident does.
- Security risk analysis
- Access and audit-log reviews
- Breach response planning
- Policy and training review
Risk assessment & monitoring
Knowing where to look next.
- Enterprise compliance risk assessment
- Data analytics to find outliers
- Continuous monitoring of key measures
- Issue tracking to closure
AI & data governance audit
The same scrutiny for models and pipelines.
- AI tool and data-flow inventory
- Oversight, bias and explainability review
- PHI handling in AI workflows
- Alignment with recognized frameworks
Vendor & business associate oversight
Risk that arrives through your suppliers.
- Business associate inventory and agreements
- Vendor security and compliance reviews
- Access reviews and offboarding
- Contract clauses that matter
Training & culture
People who know what good looks like.
- Role-based compliance training
- Coding and documentation education
- Leadership briefings
- Measuring whether training changed behavior
Corrective action & remediation
Proof that the fix worked.
- Root-cause analysis
- Corrective action plans with owners
- Retesting after changes
- Evidence packages for regulators and boards
How an audit runs: scope it, test it, then prove the fix
You see the method before the work starts and the evidence when it ends.
Scope
Agree what is reviewed, the rules applied and how the sample is drawn.
You get
A written scope and sampling planTest
Independent reviewers test the sample against the rules and the record.
You get
Documented test resultsReport
Findings with root causes, risk ratings and the fix for each.
You get
A findings report and a prioritized action planClose
Track the corrective actions, retest and report progress.
You get
Evidence the fixes worked, ready for a regulator or your board
Who we audit for
Hospitals and health systems
The problem
Many audit sources at once: payers, contractors, accreditors and your own team.
A good first project
A focused coding or revenue integrity audit.
Physician groups and MSOs
The problem
Fast growth outpaces the compliance program.
A good first project
A baseline compliance risk assessment and work plan.
Medicare Advantage and risk-bearing organizations
The problem
Risk-adjustment documentation must hold up under review.
A good first project
A diagnosis documentation audit.
Health-tech companies and vendors
The problem
Customers ask for proof of security and AI controls before they sign.
A good first project
An independent AI and data governance review.
Are you audit-ready all year?
If you cannot tick most of these today, the program is the project, before the next audit arrives.
- You have a written compliance program and a named compliance officer.
- A risk assessment and an annual work plan exist, and were followed.
- Coding accuracy is tested on a sample, and the results are shared and fixed.
- You know your open audits, their deadlines and who owns each response.
- Overpayments you find are tracked and returned within the required timeframes.
- Staff training is recorded and tied to the risks you found.
- Your HIPAA security risk analysis is current and covers every system with PHI.
- Business associates and AI tools are inventoried, each with an owner.
Three questions to ask your team on Monday
- 01
If a payer or regulator asked for 50 records tomorrow, how long would it take to assemble and check them?
- 02
The last time we found an error, what did we change so it would not recur?
- 03
Which vendors and tools touch our patient data, and who reviews them?
If the answers are slow or different in every room, that is where we start.
Check our thinking before you call us
We publish how we read the rules and give away the tools. Judge the depth for yourself.
- Article
NCCI edits explained: PTP edits, MUEs, modifiers and add-on codes
How Medicare decides what can be billed together.
- Article
Agentic AI in US health systems: a governance checklist
Autonomy tiers, sign-off and the audit trail.
- Tool
NCCI edit helper
A plain-English answer to a Medicare coding denial.
- Tool
HIM technology readiness scorecard
Score a new technology in 15 minutes. Nothing is stored.
What makes an audit independent?
The reviewers do not report to the area being tested, and the sample and method are agreed in writing beforehand. That gives you findings that are harder to dismiss and that a regulator or board is more likely to trust.
Do you audit AI systems?
Yes. We review the inventory, oversight, testing for accuracy and bias, handling of PHI and the logs, and map the findings to your policies and to recognized frameworks such as the NIST AI Risk Management Framework.
What happens if you find overpayments?
We tell you what we find and document it. Medicare and Medicaid have rules about reporting and returning overpayments within set timeframes, so we organize the evidence to support your decision with counsel.
Can you help us respond to a payer or government audit?
We can help gather and check records against the rules and prepare responses. We are not a law firm, and legal strategy stays with your counsel.
How do you choose the sample?
We agree it with you in writing. A random sample gives an accuracy rate; a targeted one examines known risks. The size depends on volume and on what you need to be able to say about the result.
How do you protect PHI?
Only under a written agreement, including a business associate agreement where HIPAA applies, signed before any PHI is shared. We use the minimum necessary, role-based access, encryption and audit logging.
How is an audit priced?
By scope: what is reviewed, the sample and the reporting you need. We agree the scope and the deliverables first, so you know what you are buying.
Find the problem before an auditor does.
Tell us what worries you: coding accuracy, a pending audit, a new AI tool. We will tell you what an independent review would cover and how we would report it.
Please do not send patient information. Describe the situation without identifying anyone.