Medical practices: what an audit looks like

OSHA or a State Plan agency

The bloodborne pathogens standard covers any employee with reasonably anticipated exposure to blood or other potentially infectious materials. OSHA's inspection priority runs from imminent danger and fatalities or catastrophes to complaints and referrals, then programmed inspections.

How often. No fixed cycle; programmed inspections rank fourth in Table 2-1 of the Field Operations Manual. In the 22 states whose State Plans cover private employers, the state agency inspects in place of federal OSHA.

Source ↗

Medicare contractors (MAC, CERT, Recovery Auditor, UPIC)

Claim-level documentation review for practices that bill Medicare. Targeted Probe and Educate selects providers with high claim error rates or unusual billing, CERT reviews a random sample, Recovery Auditors review claims after payment, and UPICs run benefit integrity reviews where fraud is suspected.

How often. A Targeted Probe and Educate round is generally 20 to 40 claims, for up to three rounds, with at least 45 days to improve between rounds. CERT draws a new random sample every year and allows 45 calendar days to respond.

Source ↗

CLIA surveyors (CMS, a state survey agency or an accrediting body), if the practice tests in the office

A practice holding a Certificate of Compliance or Accreditation for nonwaived testing is surveyed against 42 CFR Part 493 by CMS, the state agency or an accreditor such as COLA, CAP or The Joint Commission. A survey includes a tour, record review, observation of testing and personnel interviews.

How often. Nonwaived laboratories are surveyed every two years, and CMS and state surveys are generally announced with up to two weeks' notice. Waiver and provider-performed microscopy laboratories, 255,184 of the 285,940 non-exempt laboratories CMS listed in September 2026, have no routine surveys, only complaint and cause inspections.

Source ↗

Exposure Control Plan with training, vaccination and exposure records

The plan must be available to OSHA on request. It holds the exposure determination, the schedule and method for each protective measure, the post-exposure evaluation procedure, an annual review with documented consideration of safer devices, and documented input from non-managerial staff with patient care duties. Training records are kept 3 years, and medical records including hepatitis B vaccination status are kept for the length of employment plus 30 years.

29 CFR 1910.1030(c)(1) and (h)Source ↗

Medical records for sampled Medicare claims

Reviewers specify in the request only the documents needed to decide each claim, and they weigh the totality of the medical record, including progress notes and any required signatures. Providers have 45 calendar days to respond to a MAC, Recovery Auditor, SMRC or CERT request and 30 to a UPIC request, and contractors may accept late records for good cause.

Medicare Program Integrity Manual ch. 3, 3.2.3.2 and 3.3.2.4; 42 CFR 424.5(a)(6) and 424.516(f)(2)Source ↗

Laboratory procedure manual, quality control and competency records

For nonwaived tests CLIA surveyors review a written procedure manual that is available to and followed by testing staff, plus quality control and proficiency testing records kept at least 2 years. The laboratory also needs written policies to assess employee competency, and waived testing is held to the manufacturer's instructions.

42 CFR 493.1251, 493.1235, 493.1105 and 493.15(e)Source ↗

Medicare documentation and E/M level coding

$6.6 billion improper for physician services; $3.9 billion of it insufficient documentation FY 2025 (claims July 2023 to June 2024)

CMS's CERT review found $6.6 billion in improper payments for physician services across all settings, including $3.9 billion for insufficient documentation and $1.5 billion for incorrect coding. Established-patient office visits had a 5.3% improper payment rate, 65.2% of it incorrect coding, and the top root cause was documentation that supported a lower E/M level than billed (120 sampled claims). The Part B improper payment rate was 8.4%.

Source ↗

Written Exposure Control Plan

Ranked 1st of the 10 most cited provisions; OSHA publishes no counts October 2013 to August 2025

OSHA ranks the written Exposure Control Plan first among the bloodborne pathogens provisions it cites most often, ahead of employee training and hepatitis B vaccination and follow-up. The annual plan review ranks fourth and the annual safer device documentation ninth. OSHA publishes the ranking without counts.

Source ↗

Laboratory procedure manual and competency policies

Procedure manual: 635 labs (3.9%). Competency assessment policies: 778 labs (4.8%). 2024

In CMS's 2024 data the written procedure manual (D5401) was cited in 635 laboratories and the personnel competency assessment policy requirement (D5209) in 778. Among condition-level findings, successful proficiency testing participation led with 738 laboratories (4.39%). The CMS list covers all laboratories and does not split results by certificate type.

Source ↗