How to Conduct a Healthcare HR Compliance Audit

Aug 12

4 min read

A healthcare HR compliance audit is a structured review of your personnel files, required postings, and workforce policies against the federal and state laws that actually apply to your organization — not a vague gut check, but a documented walk through I-9s, FMLA and ADA thresholds, wage and hour records, and whatever your accrediting body expects a surveyor to find in a file pull.

Why This Isn't Optional in Healthcare

I've sat across the table from surveyors and auditors more times than I can count, and the pattern is always the same: the organizations that get flagged aren't the ones with bad intentions — they're the ones that never built a habit of checking their own paperwork. Behavioral health, senior living, and medical practice leaders carry more compliance surface area than most industries. You're managing state licensing, credentialing, HIPAA (the Health Insurance Portability and Accountability Act) training, and often a CARF (Commission on Accreditation of Rehabilitation Facilities) or Joint Commission survey on top of the same federal employment laws every employer has to follow.

What Federal Thresholds Actually Trigger Which Laws?

This is where I see the most confusion, and it's worth getting precise, because these thresholds decide which laws even apply to your organization in the first place:

The Family and Medical Leave Act (FMLA) applies to employers with 50 or more employees within 75 miles of a worksite, per the U.S. Department of Labor.
The Americans with Disabilities Act (ADA) and Title VII of the Civil Rights Act apply to employers with 15 or more employees, per the U.S. Equal Employment Opportunity Commission (EEOC).
The Age Discrimination in Employment Act (ADEA) applies to employers with 20 or more employees, per the EEOC.
The Affordable Care Act's (ACA) employer shared responsibility provisions apply to "applicable large employers" with 50 or more full-time equivalent employees, per the IRS.

State law often layers additional requirements on top of these federal floors — some states extend anti-discrimination protections to much smaller employers, or add paid sick leave and scheduling rules with no federal equivalent. Confirm your specific state's thresholds before assuming federal law is the whole picture.

Where Should the Audit Actually Start?

Start with the file that gets pulled first in almost every survey or investigation: Form I-9. U.S. Citizenship and Immigration Services (USCIS) requires I-9s to be retained for three years after the date of hire or one year after termination, whichever is later. Pull a sample of files and check for missing signatures, expired documents, and I-9s that were never completed within the required window.

From there, move to your EEOC-required postings, your OSHA (Occupational Safety and Health Administration) recordkeeping — the OSHA 300 injury and illness log is required for most employers with more than 10 employees, per OSHA — and your wage and hour classifications under the Fair Labor Standards Act (FLSA). Misclassified exempt employees are one of the most expensive mistakes I see in behavioral health and senior living, where on-call pay and shift differentials make classification genuinely confusing.

What Do Accreditation Surveyors Actually Pull?

If you're preparing for a Joint Commission or CARF survey, your HR compliance audit needs a second layer specific to accreditation. Surveyors typically want to see current job descriptions matched to actual duties, documented orientation and ongoing competency assessments, licensure and credential verification with expiration tracking, HIPAA training completion records, and background check documentation completed before an employee has unsupervised access to patients or residents. None of this is clinical documentation — it's personnel-file hygiene. But it's the personnel-file hygiene that gets organizations cited.

A Practical Audit Framework You Can Actually Run

You don't need a consultant in the room to run a first pass. Here's the framework I use with clients:

Pull a random sample of 10 to 15% of personnel files (or a minimum of 10, whichever is greater) across every department.
Check I-9 completion, retention, and re-verification dates against USCIS requirements.
Confirm every file has a current job description, a signed acknowledgment of policies, and license or credential verification with an expiration-tracking mechanism.
Cross-check FLSA exemption classifications against actual job duties, not just job titles.
Verify HIPAA and any other required annual compliance training is complete and documented for every current employee.
Confirm required postings — EEOC, FLSA, OSHA, and state-specific notices — are current and visible.
Review your OSHA 300 log and injury/illness recordkeeping if your organization meets the size threshold.
Spot-check termination files for consistent, documented reasons and final-pay compliance with your state's timing rules.

If you want a starting checklist before you build your own, our free HR compliance guide covers the same file-by-file basics.

How Often Should You Run This?

I recommend a full audit annually at minimum, with a lighter quarterly check on the items most likely to drift — new-hire I-9s, credential expirations, and training completions. An audit doesn't guarantee a clean survey or eliminate legal risk entirely; framed honestly, it's a risk-reduction habit, not a guarantee. But organizations that audit consistently walk into surveys with far more confidence than the ones treating compliance as a once-a-year fire drill.

Want help building an audit process that actually holds up under a real survey? Book a Free 20-Minute Consultation with Mitchell.

Sources: U.S. Department of Labor (FMLA); U.S. Equal Employment Opportunity Commission (ADA, Title VII, ADEA); Internal Revenue Service (ACA employer shared responsibility provisions); U.S. Citizenship and Immigration Services (Form I-9 retention); Occupational Safety and Health Administration (recordkeeping requirements). Featured photo via Unsplash.