Medical auditing: regulations and how to work in the field

Medical auditing is the qualified technical analysis of the acts, processes and procedures related to the care provided to the patient, in public or private healthcare settings. It is an act reserved to physicians, as established by Law No. 12,842/2013, and it ranges from verifying clinical compliance to controlling denials and reviewing hospital claims.

In Brazil, the field underwent a relevant regulatory update in November 2025 with the publication of CFM Resolution No. 2,448/2025, which revoked CFM Resolution No. 1,614/2001 and redefined the competencies, rights and duties of physician auditors, attending physicians and health plan technical directors. The rule establishes important protections for provider hospitals, especially the prohibition of denials of pre‑authorized procedures.

Understanding what a physician auditor does, what the new regulation requires and how this function connects to the hospital’s financial management is the starting point for any manager who wants to structure or improve their institution’s audit process.

What a physician auditor does

The physician auditor assesses the technical appropriateness and ethical compliance of the procedures performed in healthcare, based on scientific evidence, clinical guidelines and regulatory standards. Their work ensures that the care provided to the patient is necessary, properly indicated and correctly recorded.

In practice, the physician auditor’s work covers three main fronts. The first is care review: checking medical records, prescriptions, clinical decisions and the justifications for highly complex procedures.

The second is denial control: reviewing hospital claims before they are submitted to the payer, identifying inconsistencies that could result in nonpayment.

The third is ensuring that records and charges are aligned with current tables and rules, including the TISS standard and each health plan’s contractual rules.

Physician auditors work both at health plans, reviewing the claims submitted by providers, and at hospitals, structuring internal audit to protect billing before submission.

Regulation of medical auditing in Brazil

In its longest-lasting version, medical auditing was regulated by CFM Resolution No. 1,614/2001, in force from 2001 to 2025. The rule established the basic rules for practicing the activity and remained in force for more than two decades until it was revoked by CFM Resolution No. 2,448/2025, published in the Federal Official Gazette (Diário Oficial da União) on November 4, 2025.

The most recent resolution keeps the central principle of the previous rule (medical auditing is an act reserved to physicians, under Law No. 12,842/2013) but goes further: it defines more precisely the competencies of each party involved in the process, sets express prohibitions for the auditor and the health plan’s technical director and protects the attending physician’s autonomy.

One specific point of the rule deserves attention: CFM Resolution No. 2,448/2025 expressly prohibits the roles of “reviewing physician,” “specialist consulting physician” and similar functions as substitutes for the physician auditor. This practice, common among health plans, is now considered irregular from a regulatory standpoint.

What changed with CFM Resolution No. 2,448/2025

CFM Resolution No. 2,448/2025 introduced changes that directly affect the relationship between provider hospitals and health plans. The most relevant points for hospital management are:

Prohibition of denials of pre‑authorized procedures

The rule expressly prohibits the physician auditor from denying a procedure that was previously authorized or pre-authorized and demonstrably performed by the attending physician. For the hospital, this provides regulatory support to dispute denials in this situation.

Remote auditing prohibited in irreconcilable disagreements

In the event of an irreconcilable disagreement about the diagnosis or the indication for a procedure, the physician auditor must examine the patient in person, with the patient’s prior consent. Reviews based only on complementary tests, without the clinical history and physical examination, are prohibited.

Direct contact between auditor and attending physician

The validity of the audit now depends on documented contact between the physician auditor and the attending physician, without intermediation by third parties. The record of this contact must be available for consultation by the physicians involved, the patient and their legal representatives.

Accreditation programs are not auditing

The rule establishes that health plan accreditation programs are not a form of medical auditing and cannot be used to deny procedures, refuse OPME (implants and special materials) coverage or dispute physician fees, daily rates and hospital fees. The health plan’s technical director is responsible for compliance with this prohibition.

Expanded responsibility for the technical director

The resolution assigns to the health plan’s technical director the responsibility for ensuring that denials are described with clear reasons and in writing, and that responses to disputes are formalized directly with the attending physician.

Types of medical auditing

Medical auditing is divided into three types, each acting at a different point in the care cycle.

Prospective audit acts at pre-authorization, checking whether the planned care has contractual coverage and an appropriate clinical indication before it is performed. It is the type that most reduces the risk of denial, because it intervenes at the source.

Concurrent audit is performed during the hospital stay, with real-time access to the medical record, making it possible to correct inconsistencies before the claim is closed. It is the type with the greatest impact on highly complex hospital stays.

Retrospective audit takes place after the patient’s discharge, in the review of the claim before it is submitted to the payer. It is the most common type in hospital routine and the last control step before the claim is submitted. The three types are complementary and form a control cycle that covers billing from pre-authorization to submission.

How to work in medical auditing

To practice medical auditing, the professional must be registered with the Regional Council of Medicine (CRM) of the jurisdiction where they work, as required by CFM Resolution No. 2,448/2025. Medical auditing companies and their technical directors must also be registered with the corresponding CRM.

In terms of training, the field requires a combination of clinical skills and technical-administrative knowledge. The physician auditor needs to master procedure coding, payment tables, contractual rules and regulatory standards, as well as have enough clinical background to assess the appropriateness of the decisions recorded in medical records.

The medical auditing market includes health plans, hospitals, companies specialized in claims auditing and RCM service providers. The field has grown steadily with the expansion of private healthcare and stricter regulatory requirements for the quality of clinical records and billing compliance.

Medical auditing and technology: the role of AI

The volume of hospital claims processed every day makes manual review of 100% of billed items unfeasible. Artificial intelligence expands the capacity of medical auditing by automating consistency checks between the medical record, prescriptions and posted charges, identifying recurring error patterns and flagging inconsistencies in real time for the audit team.

Rivio applies artificial intelligence to audit 100% of hospital claims directly from the ERP, automatically identifying inconsistencies between the medical record, authorization and billing before submission to the payer, with oversight from specialists at every stage of the process.

Frequently asked questions about medical auditing

What is medical auditing?

Medical auditing is the qualified technical analysis of the medical acts, processes and procedures related to the care provided to the patient, in public or private healthcare settings. It is an act reserved to physicians, under Law No. 12,842/2013.

How is medical auditing regulated in Brazil?

Medical auditing is regulated by CFM Resolution No. 2,448/2025, published on November 4, 2025, which revoked CFM Resolution No. 1,614/2001. The new rule defines the competencies, rights and duties of physician auditors, attending physicians and health plan technical directors.

Can a pre-authorized procedure be denied?

CFM Resolution No. 2,448/2025 expressly prohibits the physician auditor from denying a procedure that was previously authorized or pre-authorized and demonstrably performed by the attending physician.

What is the difference between prospective, concurrent and retrospective auditing?

Prospective auditing takes place before the procedure, at the authorization stage. Concurrent auditing is performed during the hospital stay, in real time. Retrospective auditing takes place after discharge, in the review of the claim before it is submitted to the payer. The three types are complementary and form a control cycle that covers billing from pre-authorization to claim submission.

Can a reviewing physician replace the physician auditor?

CFM Resolution No. 2,448/2025 expressly prohibits the roles of “reviewing physician,” “specialist consulting physician” and similar functions as substitutes for the physician auditor. Only a physician auditor duly registered with the CRM of the jurisdiction can carry out medical auditing.