Medical Record Documentation Audit: How to Prepare

A medical record documentation audit is a review of clinical notes to confirm that the documentation supports the services billed and meets coverage and coding rules. Audits are run by payers, Medicare contractors, and internal compliance teams. The single most important thing a clinician can do to prepare is keep documentation that is complete, specific, signed, and consistent with the codes submitted, because those are exactly the elements an auditor checks.

What Is a Medical Record Documentation Audit?

A documentation audit compares what was billed against what the medical record shows. The reviewer asks whether the note supports the level of service, the diagnoses, and the medical necessity of what was done. If the record does not support the claim, the payer can deny payment, recoup money already paid, or, in serious cases, refer the matter for further review.

For Medicare, this includes programs such as the Comprehensive Error Rate Testing (CERT) program, which reviews a random sample of claims and their supporting documentation. CMS summarizes what reviewers expect in its guidance on complying with medical record documentation requirements: the record must be legible, complete, and support the medical necessity of the services billed.

Types of Documentation Audits

• Payer and Medicare contractor audits: external reviews such as CERT, Recovery Audit Contractor (RAC), and commercial payer reviews.
• Internal or self-audits: a practice reviews its own notes proactively to find and fix gaps before an external review.
• Prospective vs. retrospective: prospective audits check notes before claims are submitted; retrospective audits review claims already paid.
• Focused audits: targeted at a specific code, service, or clinician, often triggered by billing patterns.

What Auditors Look For

Most audit findings come down to a short list of recurring problems. Knowing them tells a clinician what to check.

Signatures and authentication

Medicare reviewers look for a legible, authenticated signature from the treating clinician. Per CMS guidance on complying with Medicare signature requirements, the signature must be handwritten or electronic (stamp signatures are generally not acceptable), and when a signature is missing or illegible, a contractor may request a signature attestation statement signed and dated by the author of the entry.

Cloned documentation

Copied-forward notes are a frequent audit target. CMS has been explicit that simply changing the date on an entry without reflecting what happened at that encounter is not acceptable, and that each note must show the individual needs of the patient for that visit. Over-copying also produces note bloat, which makes the real content harder to find during a review.

How to Prepare for an Audit

1. Run internal audits regularly: sample your own notes against the codes billed, so problems surface before an external reviewer finds them.
2. Confirm signatures and dates: make sure every note is authenticated by the treating clinician and dated.
3. Check that notes are unique: each encounter should reflect that day's visit, not a copy of the last one.
4. Tie documentation to the code: verify the note supports the service level and diagnoses submitted; see E/M coding and documentation.
5. Respond to records requests on time: late or incomplete responses can result in denials by default.
6. Use addenda correctly: corrections and late entries should be labeled, dated, and signed, never disguised as original documentation.

A structured clinical documentation improvement program supports all of this by improving documentation quality before claims go out. Certain service types carry specific documentation rules that auditors check closely, such as split/shared and incident-to visits.

How an AI Scribe Affects Audit Readiness

An AI scribe can help or hurt audit readiness depending on how it is used. Used well, it produces a specific, encounter-based note every visit, which is the opposite of cloned documentation, and it captures detail in the moment rather than reconstructing it later. Used poorly, an unreviewed AI draft can introduce errors that undermine the record.

DocuMed AI is a HIPAA-compliant AI medical scribe that drafts a note from the actual encounter, so each note reflects that visit. The clinician reviews, edits, and signs every draft, which matters for audits because the signing clinician is the author and is responsible for the content. The AI does not select or submit codes on its own and does not sign notes; those remain the clinician's responsibility. For how to handle that review step, see reviewing AI-generated notes, and for how to document AI scribe use, see AI scribe attestation. To see the workflow, request a demo.

Frequently Asked Questions

What is the most common reason claims fail a documentation audit?

Insufficient documentation is the leading cause: the note does not support the service billed or does not establish medical necessity. Missing or invalid signatures and cloned notes are also frequent findings.

Are copied-and-pasted notes allowed?

Copying forward information is not prohibited outright, but the note must reflect the actual encounter. CMS has stated that changing only the date without reflecting what occurred at the visit is not acceptable, and cloned notes are a common audit target.

What happens if a note is not signed?

If a signature is missing or illegible, a Medicare contractor may request a signature attestation statement from the author. If the documentation still cannot be authenticated, the associated claim can be denied.

Does using an AI scribe increase audit risk?

Not by itself. What matters is that the clinician reviews and signs each note so it accurately reflects the encounter. A reviewed, encounter-specific note supports audit readiness; an unreviewed draft does not.