A MGMA's 2025 poll of medical-group leaders found that only 30% check payer payments against contracted rates monthly, while 30% check just once a year. That gap is where revenue quietly disappears.
A contract compliance audit closes it. It measures what your practice agreed to do and receive against what actually happened, across payer contracts, hospital coverage agreements, OPAT and infusion arrangements, staffing deals, and vendor contracts. This article covers how to scope the audit, gather evidence, review ID-specific contract types, act on findings, and decide whether the effort is worth it.
Key Takeaways
- A contract compliance audit tests whether pricing, services, documentation, and performance match what's actually signed
- Prioritize contracts by financial exposure, operational dependence, and regulatory sensitivity, not alphabetically
- Findings need an assigned owner, a deadline, and a retest, not just a report that sits in a drawer
- Measure financial impact against your own payment and labor data, never a generic industry benchmark
What Is a Contract Compliance Audit?
A contract compliance audit is a structured comparison of what an agreement requires against what both sides actually did. That includes pricing, covered services, documentation duties, performance standards, and regulatory responsibilities, not just whether a check cleared.
It's a different exercise from a coding audit, a claims audit, a clinical quality review, or a financial statement audit. Those ask whether documentation supports a code, whether a claim billed correctly, or whether financial statements are accurate. A contract audit asks whether the underlying agreement is being honored.
A payment that looks wrong at the contract level might actually turn out to be a coding problem, and a good contract audit flags that for the right specialist instead of trying to resolve it directly.
Audit Approaches Worth Knowing
Common formats include:
- Proactive or scheduled - a recurring check, such as quarterly payment-variance reviews against contracted rates
- Reactive or issue-driven - triggered by a specific discrepancy or denial pattern
- Financial, operational, or regulatory - focused on rates and payments, service delivery and staffing, or compliance duties, respectively
- Vendor-specific - focused on a single lab, pharmacy, billing, or technology contract
- Risk-based - prioritized by exposure instead of run on a fixed calendar
A sound audit checks both directions. It asks whether the practice is meeting its own obligations, and whether the payer, hospital, or vendor is delivering what was promised in return.
How the Contract Compliance Audit Process Works
Define Scope Before You Touch a Record
Start by deciding what you're actually testing. Name the contracts, counterparties, service lines, time period, and specific obligations in scope, and write down what's excluded. A scope that tries to cover every contract at once rarely finishes.
Build a small team with the right mix of perspectives:
- A physician or group leader who understands clinical commitments
- A practice administrator who knows daily operations
- Finance or revenue-cycle staff who can pull payment data
- Legal or compliance counsel, when interpretation or regulatory risk is involved
Gather the Documents That Control the Agreement
Pull every document that governs the agreement:
- Executed contract, amendments, and side letters
- Fee schedules, exhibits, and payer manuals
- Renewal notices and correspondence
- Invoices, remittance data, and performance reports
Amendments and side letters often change terms without anyone updating the master file. Reconcile those documents in date order first, so the team audits against the current controlling version instead of an outdated one.
Turn Contract Language Into Testable Requirements
Convert clauses into specific, checkable items:
- Rates and payment timing
- Covered services and deliverables
- Response times and staffing commitments
- Documentation duties and reporting deadlines
- Audit rights and termination provisions
Compare, Document, and Report
Test actual activity and payments against each requirement. For every exception, record the contract clause, the transaction or event, supporting evidence, the estimated impact, and your confidence level.
ID-specific examples show up often:
- A drug claim paid below the contracted rate with no rejection or alert
- An OPAT task, like weekly monitoring, handled informally by the practice despite the contract placing it elsewhere
- An infusion service that's being delivered but not reimbursed as the agreement describes
- A hospital coverage commitment that lacks the operational support promised in writing
Issue a findings report that separates confirmed discrepancies, open questions, process weaknesses, and ambiguous clauses. Every corrective action needs an owner and a deadline.
Follow Up Like It Matters
Retest corrected payments or workflows. Update internal controls. Track which exceptions keep recurring. Schedule the next review based on risk, not habit.
What an Infectious Disease Practice Should Audit
Payer and Health-Plan Agreements
Check these terms against actual payments:
- Contracted rates and service definitions
- Authorization requirements and filing deadlines
- Appeal provisions and carve-outs
Medicare Part B drug payment shifts quarterly, independent of what the practice paid for inventory. The resulting spread is specific to your practice, your drug, and the quarter. Verify disputed amounts against CMS's payment manual rather than a number from memory.
Commercial contracts rarely mirror Medicare, so check those against their own negotiated terms.
Hospital, Facility, and Coverage Contracts
Review required clinical coverage, consultation availability, call expectations, documentation duties, and payment responsibilities.
ID groups frequently bundle medical directorship, stewardship leadership, coverage availability, and clinical consultation into one fee. That's a problem waiting to happen: obligations tend to expand while the fee stays flat. Separate these into distinct agreements, each with a defined scope and a trigger for renegotiation when volume changes.
OPAT and Infusion Service-Line Agreements
Compare who supplies drugs, nursing, space, equipment, lab coordination, and follow-up against what's actually happening in your workflow.
Home OPAT models differ meaningfully. A weekly-nursing-visit model and a teach-and-train, self-administered model carry very different labor and cost allocations, as IDSA's OPAT guideline describes.
Coordination work is often uncompensated unless the contract explicitly accounts for it:
- Authorization and vascular access
- Lab chasing and complication triage
Vendor and Operational Contracts, Plus Your Own Obligations
Audit lab, pharmacy, billing, staffing, technology, and supply agreements for:
- Pricing, minimums, and service levels
- Data access, renewal dates, and termination rights
If a vendor touches protected health information, confirm the business associate agreement still matches how data actually moves.
Don't just audit the other side. Check whether your own practice is meeting its documentation, credentialing, and notification duties. A finding might be a missed practice obligation just as easily as a counterparty shortfall.
Benefits and How to Prioritize Contract Audits
What You Actually Gain
A contract compliance audit pays off in several distinct ways:
- Financial - surfaces underpayments, overpayments, missed credits, and costs the contract assigns to someone else, quantified against your own payment records
- Operational - clarifies who owns OPAT monitoring, infusion scheduling, and documentation, reducing rework and uncompensated labor
- Risk and governance - surfaces expired terms, missing amendments, weak audit rights, and dependence on a single payer, facility, or vendor
- Relationship and negotiation - gives you evidence, not guesses, when you ask a payer to fix a rate or a hospital to formalize an arrangement
A drug claim paid below the contracted rate often produces no rejection and no alert. It just sits there, underpaid, until someone checks.
Building a Prioritization Framework
Rank agreements using:
- Financial exposure (dollar volume at stake)
- Transaction or patient volume
- Clinical or operational criticality
- Contract complexity and regulatory sensitivity
- History of disputes and upcoming renewal dates
- Quality of available records
A high-volume payer contract with a history of short-pays deserves quarterly review. A low-volume vendor agreement with a clean payment history might only need a look once a year, around renewal.
Is It Worth the Effort?
Compare expected recoverable value against staff time, data preparation, outside expertise, and legal or accounting review where needed.
Pricing for outside help varies by scope, contract complexity, data quality, transaction volume, and reviewer expertise. Fees can be hourly, fixed, or contingent. There's no universal number to quote.
A scope-based estimate from whoever does the work tells you more than any industry average.
Persistex's practice reviews start from a group's actual payment and denial data rather than assumed figures, which is the only honest way to answer the cost-benefit question.
Turning Audit Findings Into Sustainable Practice Improvements
Keep a Findings Register
Track every issue in one place: the contract, the clause, the evidence, estimated impact, the owner, the corrective action, the deadline, and retest status. A spreadsheet works. What matters is that nothing falls off the list.
Resolve findings proportionately:
- Correct payment or workflow errors directly
- Request credits or repayment where the evidence supports it
- Put clarified terms in writing with the counterparty
- Amend the contract when the arrangement has outgrown the signed document
- Escalate disputed interpretations to qualified counsel or a contract specialist
Prevent the Same Issue From Coming Back
Put controls in place so the same gaps do not reappear:
- Centralize contract storage and track amendments in one place
- Set renewal reminders and assign an owner to every obligation
- Build standardized payment checks into your revenue-cycle workflow
- Review high-risk service lines, like OPAT and infusion, on a schedule instead of waiting for a complaint
GrowInfectiousDisease's guides, checklists, and browser-based calculators can help a practice apply its own audit findings to its own numbers, whether that's modeling infusion contribution margin or mapping OPAT coordination hours. None of it replaces legal, accounting, compliance, or payer-contract advice. It's built to help you understand what the numbers mean once you have them.
Frequently Asked Questions
How much does a compliance audit cost?
Cost depends on scope, number and complexity of contracts, transaction volume, data quality, and whether an external reviewer or legal specialist gets involved. Ask for a scope-based estimate rather than relying on a generic figure.
What is a contract audit?
It's a review of an agreement and its related records that checks whether pricing, services, obligations, documentation, and performance match the signed terms.
What does a contract compliance audit review?
It reviews the contract, amendments, invoices or payment records, performance data, required documentation, reporting, and each party's obligations, including regulatory duties where they apply.
How often should an infectious disease practice conduct a contract compliance audit?
Frequency should follow risk: financial exposure, operational importance, contract complexity, renewal timing, and any history of discrepancies. A single universal schedule doesn't fit every agreement.
What documents are needed for a contract compliance audit?
Executed contracts, amendments, fee schedules, invoices, remittance records, performance reports, correspondence, workflow documentation, and evidence of services actually delivered.
What should a practice do after finding a contract discrepancy?
Validate the finding, preserve the evidence, notify the appropriate counterparty, and document the corrective action taken. Seek qualified advice when interpretation is unclear, then retest once it's resolved.
