What is a medical record audit?
A medical record audit compares the record of care with what was billed. Each daily rate, procedure, drug, supply, implant or special device (OPME, the Brazilian acronym for orthotics, prosthetics and special materials) and test must have proof in the medical record that it was ordered, performed and by whom. The hospital runs it before submitting the claim; the health plan (operadora), when it reviews the claim.
At the hospital, it is the clinical part of the pre-audit: nurse and physician auditors add, remove or correct items before the health plan does. At the health plan, it is the basis for clinical denials. The full picture, with the audit types and each council's rules, is in the Medical claims auditing guide.
What is not documented is not paid; what is half documented becomes a dispute. That is why a medical record audit only reduces denial when it sends the gaps back to the people who write the record.
What the rules require in every medical record
Three sets of rules set the minimum content of a medical record in Brazil, whatever the contract with the health plan says.
CFM Resolution 1,638/2002. It defines the medical record as a single document, legal, confidential and scientific in nature, about the patient's health and the care provided [1]. The attending physician, the other professionals involved and the medical chain of command up to the technical director are responsible for it (art. 2) [1]. Article 5 lists what must be in it, on paper or electronically [1]:
- full patient identification;
- history, physical exam, tests ordered and results, working and final diagnoses, and treatment;
- daily progress notes with date and time, every procedure performed and who performed it, with an electronic signature when the record is digital;
- on paper, legible handwriting, signature and CRM number;
- in emergencies where no history can be taken, a full physician report of the procedures.
The same resolution makes a Medical Record Review Committee mandatory in every facility that provides medical care, coordinated by a physician (arts. 3 and 4) [1].
Code of Medical Ethics (CFM Resolution 2,217/2018). Article 87 forbids failing to keep a legible record and requires it to be filled in at each assessment, in chronological order, with date, time, signature and CRM number [2]. Article 80 forbids issuing a medical document that does not reflect the truth [2], which limits what can be “completed” later.
Cofen Resolutions 736/2024 and 754/2024. The nursing process has five steps: assessment, diagnosis, planning, implementation and nursing evaluation (art. 4) [3]. The registered nurse documents every step in the record; the rest of the nursing team writes the nursing notes, checks off administered orders and keeps the other nursing records (art. 8) [3]. Cofen Resolution 754/2024 restates the duty to document and, in article 2, allows a fully digital record signed with an ICP-Brasil certificate (Brazil's public key infrastructure). Without a qualified electronic signature, the entry is printed and signed with the nurse's name and Coren number; a system at security assurance level 2 (NGS2) removes the need for printing and a handwritten signature. The same resolution revoked Cofen Resolution 429/2012 [4].
For digital records, Law 13,787/2018 gives a medical record digitized under the law the same evidentiary value as the original. It also sets a minimum retention period of 20 years from the last entry [5]. CFM Resolution 1,821/2007 only allows paper to be discarded when systems meet NGS2 [6]. An entry without a valid signature weakens the evidence in an appeal. How the record flows into the claim is covered in the Integrating medical records and billing guide.
What does the health plan check for each type of item?
The health plan checks whether each billed item has an order, a record that it was performed and a consistent quantity in the medical record. The exact document depends on the contract, but the review pattern repeats by type of item. The table summarizes market practice; the codes come from table 38 of the TUSS (Terminologia Unificada da Saúde Suplementar), which works much like CARC codes in the US [9].
| Line item | Record that supports the charge | Who documents it | Typical gap | Message that often appears [9] |
|---|---|---|---|---|
| Daily rates (ward, private room, ICU) | Physician progress note and orders for each day; justification for the stay; authorization or extension | Attending physician | Day with no progress note; ICU stay with no documented criteria | 3217 (no justification or insufficient justification) |
| Surgical procedure and physician fees | Operative report with date, time, technique, surgical team and approach; anesthesia record | Surgeon and anesthesiologist | Team or approach not described; procedure billed but not described | 3040 (clinical denial, to be specified) |
| Drugs | Order with dose, route and frequency; nursing check-off for each administration | Physician and nursing team | Dose ordered but not checked off; check-off with no time | 3191 (incorrect quantity) |
| Supplies | Nursing note on the procedure that used the supply; OR usage record | Nursing team | Supply on the claim with no procedure to justify it | 3190 (quantity incompatible with the procedure) |
| OPME (implants and special devices) | Indication, operative report naming the implanted item, traceability label, invoice and authorization | Surgeon, OR nursing, supply chain | Item used differs from the one authorized; missing label | 3292 (quantity above the authorized); 3310 (invoice amount differs) |
| Diagnostic and therapeutic services (SADT) | Order with clinical indication; report or result attached | Ordering physician and performing service | Test with no working diagnosis; missing report | 3217 |
| Medical gases, equipment and fees | Start and stop times, settings and record of use | Nursing and physical therapy | Oxygen billed for the whole stay with no times recorded | 3191 |
The code is the health plan's choice, and the same gap may come back under different codes; their meanings are in the TISS denial codes guide. The contract may also require documents beyond the medical record, such as a physician report to extend a stay. ANS Normative Resolution (RN) 503/2022 requires the contract to set out the audit routine and the grounds for denial [11]; ANS is the National Agency for Supplementary Health, Brazil's private health plan regulator. Those contract requirements belong in the hospital's review. The split between administrative and clinical denials is in the Types of denials guide, and the overview in the Claim denials guide.
What cannot be fixed after the fact
The audit finds the gap after care is delivered, but not every gap can be fixed afterward. The rule comes from the Code of Medical Ethics: the record is filled in at each assessment, with date and time [2], and physicians may not issue documents that do not reflect the truth [2].
| Situation | Can it be added later? | How |
|---|---|---|
| Missing signature, stamp or council number on an existing entry | Yes | The same professional signs, with the date of the correction |
| Drug given but not checked off | With caution | Late nursing note, labeled as such, by the professional who gave the drug |
| A day with no progress note | Not as if it were from the original date | Late entry with the actual date and time, if the professional recalls the facts; never backdate |
| Incomplete operative report | Yes, by the surgeon | Dated addendum, without deleting the original |
| Procedure or supply not delivered | No | Remove the item from the claim |
In an electronic record, the system usually logs the actual time of each entry, so a late note is easy to spot. The way out is to fix gaps during the stay, while an extension can still be requested or the day's note completed. That is the role of concurrent review, covered in the Types of claims audit guide.
How do you send gaps back to the care team?
Sending a gap back means taking each audit finding to the person who wrote the record, with the reason and the expected fix. Without that loop, the pre-audit fixes the same gap every month.
- Log the finding. The auditor notes the item, the missing record, the unit, the professional and the amount at risk.
- Classify. Group by type of gap (progress note, order, check-off, operative report, OPME, test) and by unit.
- Send it back to the unit. While the patient is still admitted, it goes straight to the professional; after discharge, it goes in a batch to the unit coordinator.
- Fix what can be fixed. Within the rules in the previous section, with a deadline.
- Prevent. Recurring gaps lead to a change in routine, form or required field in the system.
- Measure. The metrics show whether the same gap comes back the next month.
Three existing structures support the loop. The Medical Record Review Committee is mandatory and discusses its findings with the Medical Ethics Committee [1]. Under Cofen Resolution 720/2023, auditing is an activity reserved to registered nurses within the nursing team, and the nurse auditor states their Coren (regional nursing council) number in every report [8]. And under Cofen Resolution 736/2024, the unit's registered nurse documents every step of the nursing process [3], which makes them the natural contact for nursing gaps.
| Metric | How to calculate | What it shows |
|---|---|---|
| Items removed for missing records | Amount removed in pre-audit for missing records ÷ amount audited | What is lost before submission |
| Gaps returned and resolved | Gaps resolved on time ÷ gaps returned | Whether the loop to the team works |
| Repeat rate by unit | Gaps of the same type in the unit in the month ÷ claims from the unit | Whether prevention works |
| Clinical denials for missing records | Amount denied for missing justification or record ÷ amount billed | What slipped past the internal audit |
The loop works best in the language of care: “the 10/12 progress note does not say why the patient stayed in the ICU” helps more than a denial code. The amount goes into the management report; the missing record goes to the team.
What changes with CFM Resolution 2,448/2025
CFM Resolution 2,448/2025, published on November 4, 2025, governs physician auditing and revoked CFM Resolution 1,614/2001 [7]. The official text in the CFM's rules database flags the provisions suspended by the decision in case no. 1017752-74.2026.4.01.3400 [7].
The points that most affect the medical record are not flagged as suspended [7]:
- the auditor may ask the attending physician for written clarification and review all necessary records on site, but may not remove records or copies from the facility (art. 10, I and II);
- the auditor must report inconsistencies to the attending physician in writing (art. 11, II);
- the attending physician must respond promptly to the auditor's requests (art. 14).
Flagged as suspended, among others, are the requirement to base disagreements on the clinical history and physical exam (art. 4, sole paragraph) and the ban on denying a procedure that was authorized and proven to have been performed (art. 12, VI) [7]. The list may change as the case moves forward. For the hospital, little changes in practice: with or without the ban, what supports payment for an authorized procedure is the record that it was performed.
Written requests for clarification are, in effect, a list of documentation gaps: answer them on time and feed the cause into the loop. Contesting a denial is covered in the Denial appeals guide.
What we see in operations
At Accrua, medical record audit happens before submission, on every health plan claim, not on a sample. Accrua OS reads the medical record, the prescriptions and the claim items and checks whether each item has the record the health plan will ask for: a progress note with date and time, medication administration records, the operative report, the OPME label, the identity of who performed the act.
Anything missing becomes a task for the unit that produced the record, with the item and the source shown. In our managed operation, billers and auditors with nursing backgrounds take that feedback to the clinical team and track repeat issues by unit, because a late entry has ethical and legal limits.
When a clinical denial arrives, the agent drafts the appeal with the part of the medical record that supports the item. The auditor reviews and decides. What we learn from one appeal becomes a check on the next claim.
Where to start
- Pick a sample of denied claims from the last three months and separate the denials caused by documentation or justification.
- Build your hospital's review table by type of item, with the record required by the rules and by each contract.
- Decide who receives each gap in each unit and the response deadline, with nursing leadership and the technical director.
- Take the findings to the Medical Record Review Committee, with the units and the gaps that repeat most.
- Track the repeat rate every month and change the form or system field when the same gap comes back.