Yet many practices still track revenue the way a general internal medicine group might: a denial report here, an aging report there, with no single view connecting referral to final payment.
A healthcare RCM audit closes that gap. It's a structured review of the financial workflow, covering registration, authorization, documentation, charge capture, claims, remittance, and collections, built to find where the breakdown actually happens rather than just where the symptom shows up.
This article covers how to audit the pieces unique to infectious disease: OPAT and infusion workflows, buy-and-bill drug claims, documentation tied to medical necessity, payer-specific authorization rules, denials, underpayments, and aged accounts receivable. No invented benchmarks, just a process you can run with your own data.
Key Takeaways
- An RCM audit traces the full path from service delivery to payment, not just denied claims
- ID practices should reconcile clinical services, orders, documentation, charges, claims, remittances, and accounting records
- Useful audits end with assigned owners, corrective actions, deadlines, and follow-up measurement
- Apply your own payer contracts and claims history instead of generalized industry rates
What Is a Healthcare RCM Audit and Why Does It Matter to Infectious Disease Practices?
A healthcare RCM audit reviews the complete outpatient encounter, from the first eligibility check through the last posted payment. According to HFMA's reference guide, revenue cycle management itself spans registration through final reimbursement, including claims and payer communication. That's the scope an audit is meant to test.
Practices often confuse that full-path review with narrower checks:
| Review type | What it actually checks |
|---|---|
| RCM audit | Full encounter-to-payment path, including unresolved balances |
| Coding audit | Code selection and documentation support for specific claims |
| Financial statement review | Accounting accuracy and reporting compliance, not workflow |
| Payer audit / medical review | Coverage, medical necessity, and billing accuracy, initiated by the payer |
| Compliance audit | Risk controls and regulatory exposure across the practice |
An RCM audit can be end-to-end or focused. An end-to-end review traces every stage for a sample of claims. A focused audit narrows to one failure point: OPAT authorization denials, infusion charge capture, or aged ID claims over 90 days, for example.
Most practices get more value from focused audits run quarterly than from one sprawling annual review.
Why infectious disease adds complexity
ID practices carry audit risk that a typical primary care group doesn't:
- Recurring services across multiple encounters for the same episode of care, not a single visit
- Care delivered in more than one setting: office infusion suite, home infusion, hospital outpatient department
- Drug and supply charges tied to acquisition cost, not just a professional fee
- External infusion or home-health partners who may hold part of the billing chain
- Payer-specific authorization rules that differ by drug, duration, and site of care
Those failure points also determine who can open a review.
Who controls which audit?
- Internal and focused audits are yours to schedule and scope
- Compliance audits should stay practice-initiated
- Payer audits and medical review are not optional: CMS can request records for coverage and billing review at any time
Keeping your own house in order first is the practical response to that last category.
This isn't legal or compliance advice. Treat it as a starting framework, and loop in qualified counsel for anything with regulatory exposure.
What Should an Infectious Disease Practice Review During an RCM Audit?
A thorough RCM audit touches every stage where an ID claim can break down. Walk through each of these areas before calling the audit complete.
Front-end and authorization controls. Check eligibility, coordination of benefits, referrals, and prior authorization, including approved units, duration, and site of service. Watch the handoff between scheduling, clinical staff, and billing when an OPAT course or infusion plan changes mid-treatment.
Clinical documentation and medical necessity. Confirm documentation supports the service billed: complexity, time, place of service, the infusion or OPAT plan, medication administration, and diagnosis codes.
A note that doesn't support the billed level creates a reimbursement problem and weakens audit defensibility if a payer requests records later.
OPAT, infusion, and buy-and-bill workflows. Trace a sample from clinical order through drug acquisition, administration, charge capture, claim submission, remittance, and accounting reconciliation.
Most separately payable Part B drugs are paid at ASP+6% under CMS's Part B drug policy. Confirm claims were paid at the correct rate before comparing it to acquisition cost. A single missed charge line on a high-cost drug claim can outweigh a week of office visits.
Coding, modifiers, and charge capture. Compare documentation against codes, modifiers, units, and diagnosis sequencing, using current CPT, HCPCS, and NCCI resources. Code sets and edit files update quarterly, so last year's cheat sheet won't hold up.
Claims, denials, appeals, and payer rules. Segment denials by payer, reason, service line, and workflow stage. Review timely filing deadlines, appeal windows, and whether the same denial reason keeps recurring from the same root cause.
Payment posting, underpayments, and AR. Reconcile remittances against posted payments and contractual adjustments. Check unapplied cash, secondary billing, payer underpayments against contracted rates, AR aging by payer and service line, and patient balances.
Build an evidence list before you start
Pull these records up front so the audit doesn't stall halfway through:
- EHR clinical and order records
- Practice-management and billing reports
- Clearinghouse rejection data
- Authorization logs and approval letters
- Claims, remittances, and payer contracts
- Fee schedules and denial logs
- AR aging reports by payer and service line
Having this ready before pulling a single claim saves days of back-and-forth later.
How to Conduct a Healthcare RCM Audit: A Practical Process
Running an audit without a defined process produces a pile of observations, not a plan. Follow these seven steps in order.
- Define the objective and scope. Pick a specific question: why OPAT claims are getting denied, whether infusion charges are fully captured, or whether payer payments match contract terms. Document the review period, population, systems, and expected deliverable.
- Map the workflow and assign responsibilities. Document who handles registration, eligibility, authorization, documentation, coding, charge entry, claim submission, payment posting, denials, and reconciliation. Mark every handoff point; that's usually where errors live.
- Collect and validate data. Pull reports from the EHR, billing system, clearinghouse, payer portals, and accounting system. If something doesn't reconcile, document that gap instead of papering over it with an assumption.
- Select a representative sample. Choose claims across payers, service types, providers, locations, denial categories, and aging groups. Five to ten claims per provider or payer is often enough to spot a pattern; size the sample up when the audit carries real compliance exposure.
- Test each claim and workflow stage. Compare the clinical record, authorization, code, charge, claim, remittance, adjustment, and ledger entry. Note whether each issue is a one-off error, a repeatable process failure, or a data limitation you can't yet resolve.
- Classify findings by risk. Separate preventable denials, missed charges, underpayments, documentation weaknesses, and control gaps. Prioritize by what matters to your practice: dollars, recurrence, and compliance exposure, not a generic industry threshold.
- Build and monitor a corrective-action plan. For every material finding, assign a root cause, an action, an owner, a deadline, and a follow-up metric. Then schedule a re-audit. If the workflow didn't change, the finding will show up again.
A worked example: the authorization gap
Say an OPAT denial lands for a course that ran three weeks past its approved authorization window. Trace it backward:
- Was the reauthorization filed before the approval expired?
- Did scheduling know the approval had a defined end date?
- Did the clinical team document a treatment-duration change that should have triggered a new authorization request?
Usually the denial itself isn't the real finding. The real finding is a missing handoff between the clinical team extending a course and whoever owns the authorization queue. Fix that handoff, and the next course doesn't hit the same wall.
Which RCM Metrics and Revenue-Leakage Signals Should Practices Prioritize?
A single denial rate hides more than it reveals. Two practices can report the same 10% denial rate and have completely different problems: one losing money on a handful of high-dollar drug claims, the other dealing with volume on low-value office visits. Segment everything by payer, service line, provider, place of service, and root cause before drawing conclusions.
For drug-heavy ID practices, track denial rate in dollars, not just claim count. A count-based rate can look fine while a handful of denied infusion claims quietly erase a month's margin.
Metrics worth tracking
- Days in A/R and A/R over 90 days, segmented by payer and drug
- Dollar denial rate, tracked separately from hard-denial dollars on drug claims (a realized inventory loss, not deferred revenue)
- Net collection rate, the single number that summarizes the whole cycle
- Payment variance versus contracted rate, checked against a loaded fee schedule
- Referral-to-first-dose time, including the 90th percentile, not just the median
- Coordination hours per OPAT course and contribution per course by site of care
Mapping leakage to its source
| Signal | Likely workflow cause |
|---|---|
| Concentrated denials on one drug | Authorization criteria or coding issue, not a random fluke |
| Rising A/R over 90 days | Unworked claims or a stalled appeal process |
| Payment below contracted rate | Fee schedule mismatch or unposted adjustment |
| High coordination hours, flat revenue | Site-of-care mismatch or uncaptured coordination work |
Skip the generic benchmark hunt. Industry-wide figures rarely isolate independent ID practices, and employed versus independent economics aren't comparable without real adjustment. Your own prior-year data, segmented the same way every quarter, is usually the most reliable yardstick available.
Prioritize by impact, not alphabetically. Rank findings by how often they recur, how much money is at stake, compliance risk, how easy the fix is, and whether it disrupts clinical or patient workflow. A $40,000 recurring authorization gap beats a one-time $200 coding error every time.
How Often Should an Infectious Disease Practice Conduct an RCM Audit and When Should It Seek Support?
Cadence should track risk, not the calendar. Claims volume, payer complexity, staffing changes, new service lines, and recent EHR or billing-system changes all affect how often a practice needs to look.
A workable framework:
- Ongoing monitoring for high-risk transactions: high-dollar drug claims, new authorizations, anything aging over 90 days
- Recurring focused reviews for known problem areas, run quarterly
- A broader periodic review of the full cycle, at minimum annually
OIG's compliance guidance recommends that practices assess compliance risk and conduct at least one audit annually, then reassess whenever a new risk appears. That's voluntary guidance, not a universal legal requirement, but it's a reasonable floor.
Run an audit outside the normal schedule when you see:
- A sudden jump in denials or a new denial pattern
- Repeated authorization failures on the same drug or payer
- Unexplained payment variation
- Rising aged AR with no clear cause
- Staff turnover in billing or authorization roles
- A new OPAT or infusion service launching
- An upcoming payer or compliance review
When to bring in outside help:
- Limited internal bandwidth
- Data scattered across systems that don't talk to each other
- Complex payer contracts
- Suspected underpayments that are hard to pin down
- Denials that keep recurring despite your own fixes
GrowInfectiousDisease publishes free, ungated tools, including a Practice Health Check and an Infusion & OPAT Economics Calculator, so ID practices can run their own numbers before deciding what to tackle next. They're a starting point for self-assessment, not a substitute for a full audit.
For hands-on execution, Persistex's revenue-cycle consulting service reviews the workflow from referral through final payment and builds a prioritized corrective-action plan.
Frequently Asked Questions
What are the 9 steps in RCM?
The nine RCM steps are scheduling, registration, eligibility verification, authorization, documentation and charge capture, coding, claim submission, payment posting and denial management, and patient collections. Labels vary; treat this as a framework, not a fixed standard.
What is a healthcare RCM audit?
A healthcare RCM audit reviews how services become claims, payments, adjustments, and collections. It finds leakage, delays, errors, and risk across that path, not just denials after the fact.
What should an infectious disease practice review during an RCM audit?
Review eligibility and authorization, OPAT and infusion charge capture, medical necessity documentation, coding and modifiers, claims and denials, and contracted-rate payment accuracy. Reconcile underpayments and aged AR by payer and service line.
How often should a medical practice conduct an RCM audit?
Cadence depends on risk and operational change rather than a single universal schedule. Most practices benefit from ongoing monitoring of high-risk claims, quarterly focused reviews, and at least one comprehensive annual review.
What metrics should be reviewed in an RCM audit?
Track denial and rejection rates in dollars, clean claims, AR aging, payment lag, appeal outcomes, charge capture, underpayments, write-offs, and payer-level trends. Segment every metric by payer and service line, not one blended number.
What is the difference between an RCM audit and a coding audit?
A coding audit checks whether code selection matches documentation. An RCM audit covers the broader financial workflow, from authorization before coding through payment posting and collections after.
