HEDIS Audit Guide: What Auditors Check and How to Prepare
A HEDIS audit checks whether a health plan's quality rates rest on reliable data, and much of that evidence comes from provider charts. This guide covers the audit stages, record requests, and the documentation habits that keep your organization ready.
Health plans need proof that their quality scores hold up, and a surprising amount of that proof sits in your charts. HEDIS (Healthcare Effectiveness Data and Information Set) is the measure set behind those scores, and a HEDIS audit confirms the data is reliable before it goes public.
When a plan's audit clock starts, the record requests, documentation follow-up, and overlapping deadlines land on your health information management (HIM) and quality teams.
In this article, we cover what the National Committee for Quality Assurance (NCQA) audit checks, how auditors validate data, where medical records enter, and how to prepare your organization.
TL;DR: HEDIS Audits at a Glance
The essentials for quality, HIM, and revenue cycle leaders:
Your role: Plans pull your charts, and auditors trace that data back to its source.
The stakes: A measure rated biased or not reported gets one star in Medicare Star Ratings.
Next steps: Route record requests through one owner, close documentation gaps at the visit, and fix recurring gaps each season.
What's changing: NCQA's shift to digital data moves validation closer to the point of care.
What Is a HEDIS Audit?
A HEDIS audit is the NCQA HEDIS Compliance Audit, an independent review of whether an organization processes medical, member, and provider information accurately enough to support HEDIS reporting. Only certified HEDIS Compliance Auditors who work for, or contract with, NCQA-licensed organizations can conduct one.
NCQA states that the audit examines six areas:
Information practices and control procedures: How the organization manages the systems and processes that produce its data.
Sampling methods and procedures: How members are selected when a measure relies on a sample.
Data integrity: Whether the data behind each rate is complete and accurate.
Compliance with HEDIS specifications: Whether each measure follows NCQA's published rules.
Analytic file production: How the organization builds the files that calculate its rates.
Reporting and documentation: Whether results and their supporting records are reported and documented correctly.
Inside provider organizations, the phrase often refers to the narrower season when health plans request charts to support their measures. Both meanings meet in the medical record, which is why your documentation matters to an audit your organization never formally undergoes.
Why Do HEDIS Audit Results Matter to Provider Organizations?
HEDIS rates feed public health plan ratings, accreditation, and many payer quality programs. Many plans also tie quality incentives in provider contracts to these measures, though the terms vary by payer.
For Medicare Advantage plans, the audit result carries a direct consequence. The Centers for Medicare and Medicaid Services (CMS) uses the designation the HEDIS auditor assigns, and the current CMS Star Ratings technical notes give a measure one star when it receives a biased rate or not reported designation.
Plans feel the risk directly, so many start chart retrieval early and follow up with network providers on documentation gaps. For your organization, the exposure shows up as staff time spent on record requests and as quality results that depend on what your clinicians documented.
How the HEDIS Audit Process Works
NCQA divides the audit into two parts, and the auditor then validates data and assigns a result to every measure in scope.
The work moves through four stages:
1. Information Systems Capabilities Review
Part 1 reviews how the plan collects, stores, analyzes, and reports health information. Auditors look for effective systems, information practices, and control procedures across the plan's core business functions.
2. Measure Review Against HEDIS Specifications
In Part 2, the auditor learns the plan's information systems and designs verification steps for specific measures.
The review spans domains such as effectiveness of care, access and availability of care, experience of care, utilization, and measures collected using electronic clinical data systems (ECDS).
3. Verification of Chart and Supplemental Data
Auditors confirm that the clinical data behind a rate traces back to its origin, such as an electronic health record (EHR) or a medical chart.
NCQA calls this check primary source verification (PSV), and an unclear date or an unrecorded result can turn into a finding at this stage.
4. Audit Designations and Final Rates
The final audit report assigns each audited measure one designation.
NCQA defines these outcomes:
Designation | Meaning |
|---|---|
R (reportable) | The plan submitted a reportable rate for the measure. |
NA (small denominator) | The plan followed the specifications, and the denominator was too small for a valid rate. |
NB (benefit not offered) | The plan did not offer the benefit the measure requires. |
NR (not reported) | The plan chose not to report the measure. |
NQ (not required) | The plan was not required to report the measure. |
BR (biased rate) | The calculated rate was materially biased. |
UN (unaudited) | The plan reported a measure that NCQA does not require to be audited. |
Plans then lock and submit their audited results to NCQA in June. The HEDIS data submission timeline sets the plan-lock date early in the month so auditors have time to validate results, and Medicare plans also send a patient-level detail file to CMS's vendor.
Where Do Medical Records Enter a HEDIS Audit?
Many HEDIS measures draw on claims and encounter data, which the industry calls administrative data. NCQA introduced the hybrid method to capture clinical information that administrative data does not contain.
Hybrid measures rely on a sample of members, and plans review medical records to find care that never appeared in claims. Measures that have used the hybrid method include Controlling High Blood Pressure, Prenatal and Postpartum Care, and Care for Older Adults.
That chart review drives the record requests your HIM team receives in the months before plans lock their results. Each plan sets its own schedule and delivery options, which is why a single practice can field overlapping requests from several plans at once.
What Do Auditors Need to See in Your Documentation?
Abstractors and auditors can count care only when the record clearly shows it. Our VP of Business Operations, Gautam Kumar, describes the downstream effect of a weak note this way: "If the note is incomplete, or for whatever reason it is inconsistent, or if there is some, you know, clinical specificity is missing, every downstream process becomes reactive."
That description fits a HEDIS chart chase closely, since each measure's specifications define exactly what counts as evidence.
These documentation elements make evidence easier to find and verify:
A clear date of service: Each finding needs a date that places it inside the measurement period.
The result itself: Record the value, such as the actual blood pressure reading or the lab result, so an abstractor can count it.
The rendering provider: Show who provided the service, with the signature or authentication your policies require.
Exclusions stated plainly: When a measure exclusion applies, document the reason in the record so the plan can apply it.
Care received elsewhere: When a service happened outside your organization, note what was done, when, and where, following the measure's rules.
The same traceable record supports your medical coding compliance reviews, so improvements here carry into other audits.
Complete documentation is easier to sustain when the note takes shape during the visit, which also reduces the documentation burden on your clinicians.
At DeliverHealth, we provide AI-powered clinical documentation and coding solutions that carry each encounter from the note to the code. InstaNote turns ambient conversations or dictation into a structured note across inpatient and outpatient care, and InstaCode turns that documentation into accurate, defensible codes.
InstaNote's speech recognition is designed not to add anything that wasn't said, and your clinicians review and sign every note. Its coding suggestions are drawn from the note to help your providers hand off a more complete record, and your coders approve the codes.
Formats and templates follow your organization's and each provider's requests, so the details your quality team needs follow a structure you define.
Book an InstaNote demo to walk through sample notes aligned to your specialty and watch each one come back structured for review.
How to Prepare Your Organization for a HEDIS Audit
Preparation works well as a year-round routine shared by HIM, quality, and clinical leadership.
These five steps cover the work:
1. Assign One Owner for Every Record Request
Name one person or team to receive, log, and route plan requests. A single intake path keeps requests out of clinic fax queues and makes every deadline visible.
2. Release Only What Each Request Covers
Plan requests typically list the members, measures, and service dates they need. Follow your organization's Health Insurance Portability and Accountability Act (HIPAA) policies and send the records that answer the request, which also shortens abstraction on the plan's side.
3. Close Documentation Gaps at the Visit
Record requests can surface only what the note already contains. Tools for ambient clinical documentation help your clinicians capture results, counseling, and screenings while the patient is still in the room.
4. Share Supplemental Data During the Year
Ask each plan how it accepts supplemental data, such as structured EHR feeds, during the measurement year. Data a plan receives early can reduce the charts it needs to request later.
5. Review Each Season and Correct the Patterns
After plans close their submissions, review which requests needed follow-up and which measures returned the most gaps. Feed those patterns into templates and clinician education before the next measurement year begins.
How Digital HEDIS Changes Audit Readiness
Most organizations treat HEDIS audit preparation as a spring project built around chart retrieval. That routine still matters, and NCQA is steadily moving measurement toward data your systems already hold.
NCQA has published its plan to retire hybrid measures, moving some to administrative-only reporting and others to ECDS. Once a measure leaves the hybrid method, plans report on the full population with no sample, so evidence must come from electronic data.
Validation is shifting in the same direction. NCQA has announced it is moving away from PSV as a universal requirement for health plan reporting and will keep it as a targeted, risk-based check, as described in NCQA's update on primary source verification.
NCQA's stated aim is to build HEDIS data quality checks into the workflows that generate clinical data. For provider organizations, that places the weight on the note your clinicians sign at the visit.
The same pattern appears in the revenue cycle's upstream problem, where gaps in the note travel into every downstream workflow. The clinical note is where quality reporting starts, just as it is where the revenue cycle starts.
Frequently Asked Questions (FAQs)
Quality and HIM leaders often raise these questions as record requests begin:
Who Performs a HEDIS Audit?
Certified HEDIS Compliance Auditors who work for, or contract with, NCQA-licensed audit organizations perform the audit.
The health plan engages the audit organization, and your organization contributes by supplying the records the plan requests.
When Does HEDIS Record Request Season Happen?
Most plans request records in the first half of the year, before they lock and submit audited results to NCQA in June. Each plan sets its own dates, so ask your plan contacts for their schedule as the measurement year closes.
Do Providers Have to Respond to HEDIS Record Requests?
Many health plan contracts require network providers to supply medical records for quality reporting, often within set timelines. Check the records and quality provisions of each agreement, since terms vary by payer and product.
How Does a HEDIS Audit Differ From Risk Adjustment Review?
HEDIS measures whether recommended care happened and was documented, such as a screening or a controlled blood pressure reading.
Risk adjustment uses documented diagnoses to estimate expected cost, which is the focus of HCC medical coding.
Can AI Documentation Tools Support HEDIS Audit Readiness?
AI documentation tools can help clinicians record results and services during the visit, giving abstractors clearer evidence later.
Look for tools that keep the clinician as the reviewer and signer of every note and that are designed not to add details the clinician did not state.
Final Thoughts on HEDIS Audit Readiness
A HEDIS audit tests a health plan's data, and more of that data now begins as your clinicians' notes. Organizations that treat documentation quality as a daily discipline tend to spend less time chasing charts and provide evidence that holds up.
The right documentation workflow builds that discipline into the visit itself.
Our AI-powered solutions at DeliverHealth serve small and mid-size practices through enterprise-level health systems, from the first draft of a note to the final coded encounter. InstaNote is trusted by more than 40,000 healthcare providers and returns a near-final, structured note, including its coding suggestions, in about three minutes.
When that note reaches coding, InstaCode keeps every coded encounter auditable. InstaCode tracks the AI's output, each human change and the reasoning behind it, and any further edits by human auditors.
Schedule an InstaNote demo to see how a structured note moves from clinician sign-off to coding in a specialty workflow like yours.
Stay Updated
Subscribe to our newsletter for the latest healthcare AI insights and company updates.