Rules for medical auditing: CFM Resolution 2,448/25 explained

CFM (Federal Council of Medicine) Resolution No. 2,448/2025 consolidated the rules for practicing medical auditing in Brazil. The resolution aims to bring clarity to the duties and the ethical and technical limits of this essential function. For managers and health professionals, understanding this regulation is essential, because it affects the relationship between payers, hospitals and health professionals.

This article details what medical auditing is, who can practice it and the main guidelines of the new resolution.

What is medical auditing and why does it matter?

Medical auditing is the critical, systematic review of the care provided to the patient. It is not limited to checking hospital claims; its main function is to verify that procedures comply with clinical protocols and current regulations.

• For the hospital: it ensures that resources are used optimally, avoiding waste and denials (refusals of payment) by payers.

• For the patient: it ensures that the treatment received followed the necessary standards of safety and technical quality.

• For management: it provides valuable data to improve internal processes and for the institution’s strategic planning.

Who can be a physician auditor?

Under Article 2 of Resolution 2,448/2025, the role of physician auditor is exclusive to physicians. The professional must be duly registered with the Regional Council of Medicine (CRM) of the jurisdiction where they practice.

In addition, the rule recommends that auditors have specific knowledge of healthcare management and medical ethics to fully perform the role.

Pillars of CFM Resolution No. 2,448/2025

The new rule reinforces the auditor’s role as a technical and ethical evaluator, setting clear limits:

Autonomy and professional confidentiality (Art. 12)

The auditor has technical autonomy to review medical records and the course of care. However, the resolution reinforces the duty of confidentiality: the auditor may not disclose information outside the scope of the audit, protecting the patient’s privacy and the physician‑patient relationship.

Prohibition on acts of care (Art. 12)

A crucial point of the resolution is that the physician auditor may not intervene directly in the patient’s treatment. Their role is to analyze what was done or what was proposed. If they find irregularities, they must report them through the proper channels, but never change the attending physician’s prescription or procedure in real time.

Medical record audits (Art. 10)

Access to the medical record is guaranteed to the auditor for the performance of their duties. The resolution highlights that the medical record must be complete and legible, reinforcing the importance of good clinical documentation (including correct medication scheduling and nursing records) for the audit to be fair and accurate.

The Rivio view

Resolution 2,448/2025 turns medical auditing into an instrument of clinical governance. This is a fundamental step for quality of care and the hospital’s financial sustainability.

Rivio is a company that uses artificial intelligence to manage the entire hospital revenue cycle, increasing revenue and operational efficiency.

From audit to payment, our technology analyzes clinical records, cross-checks information against hospital claims, identifies and corrects denials, submits the XML and manages denial appeals, all automatically.

With Rivio, hospitals and clinics leave the bureaucracy to AI and can focus on what really matters: caring for the health of the Brazilian population.