SUD Chart Audit: Full Sweep vs. Sampling (Checklist)

A chart audit in SUD treatment checks whether each record proves that the care billed was delivered, was medically necessary at that level of care, and meets every rule that governs it: ASAM placement, treatment plan deadlines, signatures, 42 CFR Part 2 consent, group notes and documented time. Most programs audit a sample. Sampling finds individual errors, but it cannot tell you whether an error sits in every chart, and that systematic kind does the most damage when a payer or surveyor samples you. A 100% sweep checks every active chart against every applicable rule, so patterns surface and can be fixed once.

In one public case, a sweep of 18 active patients at a full-continuum SUD program in Los Angeles ran 3,433 checks. The two largest sources of findings were two fields missing from the progress note template. Conformance rose 22% in three weeks, without a training day.

The short version

Sampling tells you a problem exists. It cannot tell you how widespread it is, and it never sees charts nobody pulled.
Outside reviewers sample too, and contractors can extrapolate a sample's error rate across your paid claims, so an error built into every chart is the most expensive kind.
A full sweep applies each rulebook by the patient's level of care on the date of service and turns scattered findings into a ranked list of patterns.
In one public case, 5 of 58 controls carried half of all findings, and DHCS conformance was 37% with two missing template fields counted and 81% without them.
Fix in this order: template gaps, then gaps you can prevent at the point of writing, then same-day individual corrections.

How SUD chart audits are usually done

Review	Who runs it	How charts are chosen
Internal QA or utilization review audit	Quality, compliance or clinical leadership	A sample, worked against a checklist
Supervisor co-signature review	Clinical supervisors	Whatever reaches the signing queue
External or mock audit	Consultants, often before a survey or after a payer letter	A sample, sometimes targeted at risk areas
Payer, contractor and survey reviews	Medicare contractors, Medicaid integrity units, commercial payers, surveyors	A sample or targeted pull they choose

The case study below describes the standard internal audit: somebody pulls one chart in ten, works down a checklist and writes up what turns up. HHS-OIG's General Compliance Program Guidance recommends scheduling audits from an annual risk assessment, names medical record documentation as an area to monitor routinely, and says claims audits should include clinical review of medical necessity.

Outside reviews sample as well. In CMS's Targeted Probe and Educate program, a Medicare Administrative Contractor reviews 20 to 40 claims per round, for up to three rounds; problems that fail to improve go to CMS, and next steps may include 100 percent prepayment review, extrapolation or referral to a Recovery Auditor. Your charts will be sampled. The question is whether you know what the sample will find first.

What sampling misses: five blind spots

1. It only sees the charts it pulls

The chance that a sample misses a problem entirely is roughly the share of charts without it, raised to the power of the number of charts pulled. Rare problems and small samples make that chance high. In SUD, that is where expensive errors hide: one expired Part 2 consent, one IOP group without per-patient notes, one late treatment plan.

2. It cannot tell a pattern from an accident

A reviewer who finds a missing field in one sampled note cannot tell whether it is missing from every note. The usual response to a scattered-looking finding is retraining, and retraining cannot fix a form. Only a review that has seen every note can show the same thing missing from all of them.

3. Small levels of care get few checks

Detox, residential, PHP, IOP and outpatient run under different rules. A census-wide sample mirrors where the volume is, so low-census levels get few charts in a cycle, even when their rules are stricter. Unless you sample each level separately, level-specific rules are rarely tested.

4. It arrives after the record can be fixed

Retrospective audits often land after discharge. CMS's Program Integrity Manual expects services to be documented when rendered and says the date and author of any amendment, correction or delayed entry should be identifiable and the change clearly denoted. A labeled addendum is legitimate; reconstructing clinical content weeks later is not.

5. One checklist, one rulebook

An SUD chart sits under state licensing and certification, Medicaid documentation rules, ASAM as each payer applies it, 42 CFR Part 2, payer contracts and accreditation standards at once. A sampled audit usually works one checklist, so the other rulebooks go unchecked even in the charts it pulls.

Why this matters more when someone else samples you

The Medicare Program Integrity Manual requires a determination of a sustained or high level of payment error, or documented failure of educational intervention, before a contractor extrapolates, and it sets out how to draw a valid sample and project an overpayment. A scattered error produces a modest rate. An error built into every record produces a rate approaching total, projected across the whole population of paid claims under review. Sample size cuts the other way too: when a provider estimates damages for an OIG self-disclosure, OIG requires a sample of at least 100 items and treats missing items as errors. This article is general information, not legal advice; talk to counsel about any specific audit or overpayment.

What a full sweep against every rulebook changes

	Sampled audit	Full sweep
Coverage	The charts pulled	Every active chart and document
Rulebooks	Usually one checklist	Every applicable framework, by level of care on the date of service
What it tells you	That a problem exists	How often, where, and why
Typical fix	Correct the chart, retrain staff	Change the template or workflow, then correct the rest
Timing	Retrospective	Concurrent, while patients are in treatment

The denominator becomes your census, so you count instead of estimate: a pass rate per control, level of care, clinician and form. Rules fire by level of care on the date of service, so a patient who stepped down from residential to PHP is checked against residential rules for those days and PHP rules after. And findings cluster: evenly spread findings look like a training problem, while findings concentrated in a few controls point at a template or workflow. A sweep does not replace a statistician's sample for estimating an overpayment; it replaces guessing about where your problems are.

Case study: a full sweep at a full-continuum SUD program

Solutions 2 Recovery is a full-continuum SUD provider in Valley Village, Los Angeles: medical detox, residential, partial hospitalization, intensive outpatient and outpatient. It is Joint Commission accredited and DHCS licensed, runs on Kipu Health, and had a quality process before Adentris arrived. Every move between levels of care has to be justified in writing.

Nine rulebooks, one chart

In September, the active census went under continuous review, read directly from Kipu Health through a direct integration: 18 patients under active treatment, 3,433 checks, 58 controls from nine frameworks, each document measured against the controls for that patient's level of care on that day.

Framework	Checks run
Treatment planning and progress (SUD)	1,989
California DHCS AOD certification	929
ASAM criteria as payers apply them	108
42 CFR Part 2 readiness	108
Consents and agreements	101
Admission and assessment	72
Medication and MOUD	54
Discharge and transitions	36
Incidents and safety	36

What the sweep found

Roughly half came back clean. The rest were not spread across the clinical team. Five of the 58 controls carried half of everything found, and the two largest had nothing to do with clinical judgment: service modality (in person or video) and client location for synchronous services. Both are required under DHCS certification, and neither existed as a field on the progress note form, so every note failed both checks. Those two controls accounted for about a third of all findings.

Against all DHCS controls, conformance on the same records in the same week was 37%. Excluding the two template fields, it was 81%. A 37% reads as an instruction to retrain everyone. An 81%, with two absent fields explaining the rest, points somewhere much cheaper: the clinical work was being done, and the form was not asking for the proof.

"The useful surprise was how concentrated the gaps turned out to be, and that two of the biggest were fields missing from a template. Fixing that once takes a whole category of problem off the table permanently." Nick Summa, the program's CEO

Three piles, three kinds of fix

Gone for good, roughly a third. Add the two fields to the template, and the finding class stops being produced.
Prevented while writing, roughly another third. Plan of care mechanics: goals with measurable targets and dates, interventions with a frequency and a named owner, each session note tied to its goal, enforced before the document is saved.
Caught the same day, the remainder. Co-signatures, timeliness and clinical judgment calls stay human, but now surface within a day, while the record can still be completed properly.

Conformance across the reviewed records rose 22% over the following three weeks, with no policy rollout and no training day. Findings arrived while patients were still in treatment, each carrying the failed control and the needed correction, so a supervisor could assign it that afternoon. The sampling lesson: a certification survey works from a pulled sample, and a field missing from the template is missing from every chart in it, so the finding is guaranteed. A sampled internal audit could have found the gap in one chart. Only the sweep showed it was in all of them.

A practical SUD chart audit checklist

Make each line a yes/no control with its source and the levels of care it applies to. California references are verified examples; substitute your state's rules, payer contracts and accreditor standards.

Level of care and ASAM

All six ASAM dimensions assessed in the edition your payer uses (the Fourth Edition reorders them and adds person-centered considerations).
Level of care tied to dimensional findings, with why this level and why not a less intensive one. Our free ASAM documentation checklist lists what the record should show at each level.
Level billed matches level documented and hours delivered; continued-stay notes show a fresh assessment.
California residential with a DHCS level of care designation: multidimensional assessment within 72 hours of admission by an LPHA, or by a certified or registered counselor with LPHA review and approval.

Treatment plan timing

A deadline table per level of care and payer: when the plan is due, who signs, how often it is reviewed.
California designated residential: full treatment or recovery plan within 10 calendar days of admission; progress reviewed within 30 calendar days of signing and at least every 30 days after (detox phase exempt).
California Medi-Cal: no standalone treatment plan required for DMC and DMC-ODS services, but a current problem list is, and listed exceptions (including DMC-ODS residential and withdrawal management in designated facilities) keep care plan elements.
Goals measurable and dated; interventions with frequency and owner.

Progress notes and signatures

Type of service, date, duration of direct care, location or place of service, typed or printed name, signature and signature date (among the California Medi-Cal minimum elements).
Completed on time: in California Medi-Cal, within three business days (one calendar day for crisis services), with the service day as day zero.
Daily notes for services billed by the day, such as residential.
Required co-signatures present and dated; late entries carry their own date and author.

Written consent on file before any disclosure that requires it, including disclosures to payers for payment.
All required elements: patient name, who may disclose, a specific description of the information, recipients, purpose, the right to revoke and how, expiration date or event, signature and date signed.
Consents for treatment, payment and health care operations include the redisclosure statement and the consequences of refusing to sign.
Not expired, revoked or facially deficient; SUD counseling notes have their own consent.
Forms updated for the 2024 final rule (compliance date February 16, 2026).

Group notes

California Medi-Cal: a participant list for every session, and a note per participant documenting attendance, the required elements and their response to the service.
With co-facilitators, each one's involvement and time documented in each note.
For IOP and PHP, attendance and duration recorded per patient per program day.
California designated residential: services documented within 72 hours with type, start and end times, topic, and staff name and title.

Units, time and telehealth

Billed units match documented start and stop times or total time.
Psychotherapy codes match time thresholds; one Medicare contractor's guidance maps 16 to 37 minutes to 90832, 38 to 52 to 90834, 53 or more to 90837, and bars reporting under 16 minutes.
Remote sessions record modality and patient location, plus telehealth consent as your state requires.

Free scorecard

SUD chart audit checklist and scorecard (Excel)

Run this checklist on your own charts: score up to ten charts against 24 documentation items weighted by how much each matters to payment, and see which items fail most often. It shows whether your misses are scattered or a pattern.

Get the chart audit scorecard Free, with a work email.

How to run a two-week sweep yourself

Day 1: define the universe. Every active patient, with level of care by date, payer and services billed. Add recent discharges with open claims.
Days 2 to 3: build the rulebook matrix. Requirements as rows, levels of care as columns, from state rules, Medicaid documentation rules, payer contracts, ASAM, Part 2 and your accreditor. Write each as a yes/no control with a citation.
Day 4: calibrate. Two reviewers score the same two charts and rewrite any control they disagreed on.
Days 5 to 9: run the sweep. One row per document per applicable control: pass, fail or not applicable, with the evidence location. Use the level of care on the date of service.
Day 10: rank the patterns. Pass rates per control, level, clinician and form. If a few controls carry most findings, check the template before scheduling training.
Days 11 to 12: fix in three piles. Template changes; point-of-writing prompts; individual corrections on open charts as dated addenda by the original author. Never backdate.
Day 13: route money questions. Hold claims that fail payment-critical controls. Send paid claims without support to compliance and counsel. For Medicare, an identified overpayment generally must be reported and returned within 60 days; the deadline can be suspended during a timely, good-faith investigation of related overpayments, up to 180 days after identification.
Day 14: re-run and set a cadence. Re-check new documents, report before-and-after rates per control, and repeat weekly.

How Adentris helps

Adentris reviews every active chart, not a sample, against payer and regulatory rules before claims go out, including ASAM level of care, medical necessity, 42 CFR Part 2, Medicaid and payer documentation rules, and treatment plan and signature timing. Each finding cites the rule that fired, and Adentris drafts the correction for staff to approve. It works on top of any EHR, connecting through its API or FHIR, HL7 feeds, an API our agents build where none exists, or the AI Web Agent, usually with no IT project on your side, and is typically live in about 30 days; with Kipu in the full-continuum case study, it uses a direct integration. To see it on your own charts, book a 30-minute call with our team.

Sources

Frequently asked questions

What is a chart audit in SUD treatment?

A review of patient records to confirm the documentation supports what was billed and meets the governing rules, from ASAM level of care and treatment plan timing to signatures, Part 2 consent, group notes and documented time. Most programs review a sample; a full sweep reviews every active chart.

How many charts should a chart audit include?

No single number is required for internal audits. A Medicare Targeted Probe and Educate round reviews 20 to 40 claims, and OIG requires at least 100 items when a provider samples to estimate damages in a self-disclosure. Small samples spot problems but cannot measure how widespread they are; for that, review every active chart.

What is the difference between sampling and a 100% chart review?

Sampling shows that a problem exists in the charts you pulled. A 100% review checks every chart against every applicable control, so it shows how often each problem occurs, at which level of care, and whether it comes from individual clinicians or from a template that affects everyone.

What should an SUD chart audit checklist include?

ASAM assessment across all six dimensions with the level of care tied to them; treatment plan deadlines by level of care; progress note elements, timeliness and signatures; Part 2 consent elements and expiration; per-participant group notes; and billed units matching documented time, including telehealth modality and patient location.

Can documentation gaps found in a chart audit be corrected?

Some can. Any amendment, correction or delayed entry must show its own date and author and be clearly marked. Missing clinical content cannot be legitimately reconstructed after the fact, and claims already paid without support may need to be reported and returned. Involve compliance and counsel.

What is a chart audit tool?

Anything that structures the review, from a spreadsheet of cited yes/no controls to software that checks charts against payer and regulatory rules automatically. What matters is coverage of every chart, rules applied by level of care on the date of service, a cited rule for every finding, and results while patients are still in treatment.

Chart Audits in SUD Treatment: What a 100% Sweep Finds That Sampling Misses

How SUD chart audits are usually done