What Actually Happens When You Try to Clean Up Hospital Records
I've spent years watching organizations try to audit their own internal mess. It rarely goes well. The problem isn't that people are evil. It's that most hospital systems have decades of accumulated data rot, half-finished policies, and processes that were patched together by whoever was on call at the time. When I first ran an actual compliance audit on a mid-size general hospital, I expected to find a few loose ends. What I found was worse. Billing codes that didn't match actual procedures. Patient consent forms missing signatures from three years ago. Internal incident reports that had been edited multiple times. None of it was intentional fraud in most cases. It was just neglect compounded over time. The cleanup process itself is messy because hospitals operate under conflicting requirements. HIPAA says keep records for six years. State regulations sometimes say seven or ten. Insurance auditors want twenty. Nobody keeps everything properly organized because the storage costs alone would bankrupt a small facility.
Here's what I learned doing this repeatedly. Start with the billing department. That's where the easiest patterns surface. Cross-reference procedure codes with supply logs. If a hospital claims to have used twelve units of a specific implant during a quarter but only received four from the vendor, something is off. The answer is usually either inventory miscounting or code stacking. Both are common. Neither is great. I found a case once where a surgeon's office was billing for minimally invasive procedures while the actual surgery happened open. The discrepancy showed up because the recovery time in the notes didn't match what insurance covers for laparoscopic work. Patient stay was double. The billing office had never noticed because they were just transcribing the doctor's handwritten forms without verifying against the electronic health record timestamps. The workaround was straightforward but tedious. Pull every surgical case from the OR scheduling system and match it against the billing submission. Then pull the anesthesia logs and cross-reference again. Three systems that should agree, often don't. Manual comparison took about three weeks for a hospital processing two hundred cases monthly. I built a simple script after that second run. Automated version handles it in about four hours now.
Red Flags That Aren't Actually Red Flags
Most people training for this work focus on the obvious stuff. Fictitious patients. Duplicate billing. Upcoded procedures. These do happen. They represent maybe fifteen percent of actual findings in a thorough review. The rest comes from things like staffing schedule mismatches where overtime was claimed but no staff clocked in, or equipment maintenance logs that predate the equipment purchase date. The counter-intuitive part is that the more compliant a hospital claims to be, the more likely you are to find deeper structural issues. Facilities that advertise perfect audit scores usually have good at test performance and mediocre everything else. The ones with honest self-reported problems tend to have cleaner underlying data because they've been fixing things before someone else forces them to. I stopped trusting internal compliance reports around 2019. That's when I realized that three different hospitals I was working with had identical report formatting despite using completely different EHR platforms. The templates came from the same compliance consulting firm. The substance followed the template, not the actual operations.
Get the Full Details
Practical Steps That Actually Work
Pull the general ledger for the last eighteen months. Not the summary version. The full transactional detail. Look for round-number entries, late-night postings, and transactions posted on holidays. These aren't automatic red flags. They're just where my eyes go first. Interview the people who actually do the work, not the managers. The billing clerk who's been there eight years knows which codes are "normal" and which ones are panic-coding when the system crashes. The night shift charge nurse knows which documentation gets skipped because nobody checks it until morning. Their answers will contradict the policy manual within the first hour. Document everything in a way that someone outside the organization can follow. I use a simple spreadsheet with five columns: what I'm checking, what the data says, what it should say if everything were clean, the gap between them, and my confidence level. Confidence gets marked as high, medium, or low based on how much corroborating evidence exists. A single discrepancy might be medium confidence. Three independent sources pointing at the same issue bumps it to high.
This approach takes longer upfront than just writing a summary report. It saves time later when auditors come knocking and ask for your work papers. I had one hospital board member tell me my documentation was the first thing they'd ever seen that actually let them understand what was happening without hiring another consultant to translate it.
When This Approach Fails Completely
If the hospital uses separate systems for billing, clinical records, and pharmacy that don't share a patient identifier, you're going to hit a wall pretty fast. I worked with one facility where the emergency department used a completely separate admissions tracker from the inpatient units. Patients who arrived by ambulance and stayed three days showed up as two different encounters with no link between them. You can't cross-reference what can't be connected. The workaround in that case was to match by date, room number, and treating physician. It's approximate. You'll get false positives where two patients with the same name were treated on the same day by the same doctor. But it catches enough to be useful. The alternative is spending forty thousand dollars on an integration project before you even know if there's a problem worth integrating. This method also falls apart when leadership actively obstructs. I've been shown altered records, had file access revoked mid-audit, and received deliberately incorrect staffing schedules. In those situations, the data you collect becomes evidence rather than a roadmap. You document the obstruction itself and recommend outside review. The cleanup stops being your responsibility.
Most of what I've described here requires basic data literacy and patience. No special software. No expensive consultants. Just someone willing to look at raw numbers and ask why they don't match. The hardest part isn't the technical work. It's deciding whether finding out matters more than staying comfortable.
