Seven charts are open on the compliance lead’s screen. Three support the reported service. Two are missing a signed plan. One has a copied sentence from the wrong visit, and the last chart is fine but reached the auditor only because somebody skipped the random list. By lunch, the practice has five findings and no reliable denominator.
That is the difference between looking at charts and running an audit. A defensible audit names its question, population, sample, checklist, evidence, reviewer, and follow-up before the first record opens.
This template is an operating aid, not legal, coding, or clinical advice. Have the practice’s compliance, billing, privacy, and clinical leaders approve the scope that applies to the audit.
Copyable chart audit worksheet
MEDICAL CHART AUDIT
Audit question: _________________________
Population and date range: ______________
Sample method: __________________________
Sample size: ____________________________
Reviewer and role: ______________________
Standard or policy version: ______________
CHART IDENTIFIER: _______________________
Do not place unnecessary patient data in the audit log.
ITEM PASS FAIL N/A EVIDENCE / FINDING
Correct patient and encounter [ ] [ ] [ ] ______________
Reason for encounter present [ ] [ ] [ ] ______________
Relevant history or prior results present [ ] [ ] [ ] ______________
Assessment or clinical impression present [ ] [ ] [ ] ______________
Plan for care present [ ] [ ] [ ] ______________
Orders have documented rationale [ ] [ ] [ ] ______________
Progress or response documented when due [ ] [ ] [ ] ______________
Date and author identity present [ ] [ ] [ ] ______________
Reported codes supported by the record [ ] [ ] [ ] ______________
Required review or signature completed [ ] [ ] [ ] ______________
Correction history preserved [ ] [ ] [ ] ______________
Result or referral follow-up owned [ ] [ ] [ ] ______________
Finding class: Isolated / Repeated / Systemic / Undetermined
Immediate action, if any: _________________
Owner: ___________________________________
Due date: _________________________________
Recheck method: ___________________________The checklist is deliberately modest. Add an item only when the audit question and controlling source require it. Forty generic boxes produce fast check marks and weak evidence.
Write one audit question
Start with a sentence that can fail. Examples:
- Do signed office-visit records support the codes reported during August?
- Are test results assigned, reviewed, communicated, and closed under the practice policy?
- Do corrected notes preserve the original entry and the approved amendment history?
- Are AI-drafted notes reviewed and signed by the responsible clinician before use?
Each question requires a different population and reviewer. A billing audit does not become a clinical quality audit because both use charts. If two questions need different expertise, run two audits and connect the findings later.
Name exclusions before sampling. Otherwise reviewers can quietly skip the hard charts and leave a sample that proves only the easy cases were easy.
Define the population before the sample
Write the date range, clinician group, visit type, payer or program when relevant, status, and any approved exclusions. Count the eligible records. Then select from that list.
CMS’s sample manual EHR review checklist describes a random sample of five to ten electronic health records per federal program or provider as an illustrative starting point and suggests that a small practice may spread recurring reviews across the year. That is not a universal sample-size rule. A suspected systemic error, refund question, patient-safety concern, or legal hold can require a different design and specialist advice.
Record the selection method. “Ten charts chosen by office manager” does not show whether the manager chose consecutive visits, random records, denials, high-level codes, or familiar patients.
Tie every row to a source
The core worksheet reflects CMS’s current Evaluation and Management Services compliance tips. CMS tells E/M billers to keep the record complete and legible, document the encounter reason and relevant history, include an assessment and care plan, identify the date and observer, and support reported codes with the record.
That source does not answer every audit question. A specialty procedure, payer contract, state rule, privacy review, or internal quality policy can add different requirements. Put the source and version next to the item. When a rule changes, the team can update the affected row instead of guessing which old checklist was used.
Use N/A only when the reviewer writes why the item does not apply. A blank is not evidence.
Capture evidence, not reviewer mood
For a pass, note the section or event that supports it. For a failure, quote the relevant short phrase or describe the missing event without copying unnecessary patient details into a second file.
Separate four kinds of finding:
- The record lacks required information.
- The record contains information that does not support the reported action or code.
- The workflow failed outside the note, such as an unsigned draft or an unowned result.
- The reviewer cannot decide because the standard or evidence is unclear.
The fourth class is useful. It tells the practice to repair the checklist or escalate the interpretation rather than forcing a false pass or fail.
Review patterns before blaming people
One missing signature may be an isolated miss. The same missing signature across several clinicians can point to a template, permission, training, or queue problem. Preserve that distinction in the summary.
Look at denominator and distribution. “Four failures” means something different in four charts than in four hundred. Break recurring findings down by template, visit type, clinician, location, and time period only when the sample supports that comparison and privacy controls allow it.
Do not turn an audit into a leaderboard. The fastest way to destroy reporting is to punish a person for showing where the system fails.
Correct through the approved record path
An audit log should not silently rewrite a signed chart. Route each correction through the EHR’s amendment or addendum function and the practice’s approved policy. Preserve the author, date, reason, and history.
Billing and compliance leaders should decide what requires claim review, refund analysis, disclosure, counsel, or payer contact. Clinical leaders should own patient-care follow-up. The auditor identifies evidence; the right owner decides the response.
Give each action a due date and a recheck. “Education provided” is not closure. A recheck might sample the next five eligible records after a template fix or confirm that every old result in a queue has an assigned owner.
Audit the tool around the note
CMS’s manual review material includes EHR security settings, audit logs, access restrictions, templates, macros, and copy-and-paste behavior among possible program-integrity review areas. A clean-looking note can still come from a broken process.
Inspect the events around the chart when the audit question calls for it:
- Who created, edited, and signed the entry?
- Did a template carry forward stale text?
- Was the note available to the correct user and blocked from an unauthorized role?
- Did an order, result, referral, or message reach its queue?
- Was a correction preserved rather than overwritten?
For AI scribe use, compare the authorized encounter evidence, draft, clinician edits, and signed note under the practice’s privacy and retention rules. The AI scribe documentation audit guide provides a separate error taxonomy for that narrow question.
Close with a one-page audit record
The final record should state the question, population, sample, checklist version, reviewer, counts, material findings, immediate actions, owners, due dates, and recheck. Link to protected workpapers rather than copying patient data into the summary.
Keep disagreement visible. If a coder and clinician interpret an item differently, preserve both first-pass views and record who adjudicated the final result. That disagreement may expose an unclear policy worth fixing.
Patient Square is an AI clinical platform. Practice Copilot brings the whole practice under one AI copilot — an ambient AI Medical Scribe that hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft minutes after the visit, plus a bundled AI EHR, scheduling, and messaging as you move up the plan. Hospitals get Hospital Copilot.
If the recurring finding is documentation work left until late at night, review the current Practice Copilot scope. Audit the signed output and the review trail exactly as you would for any other documentation workflow.