CPAs support healthcare practices with compliance and reporting by keeping the books audit-ready, matching billing and revenue records to payer rules, preparing accurate tax, payroll and regulatory filings, and building internal controls that catch errors before a regulator or payer does. A good healthcare CPA will not replace your compliance officer or your health care attorney, but they supply the clean numbers and documented processes that every other part of your compliance program depends on. Firms that focus on medical clients, such as Conway accounting, see the same pressure points again and again: messy revenue records, weak cash controls, late reports and panic when an audit letter arrives. This guide explains what a CPA actually does for a practice, which rules they help you meet, what the monthly and annual work looks like, and how to choose the right one.
Why compliance is a financial problem as much as a clinical one
Most compliance failures in small and mid-sized practices do not start with bad intent. They start with numbers nobody reviewed: a refund that was never issued, a batch of claims coded the same way for months, a deposit that does not match the day’s charges, or a payroll entry that misclassifies a contractor. Regulators and payers look for three things, and all three show up in your financial records:
- You billed only for care you delivered, at the level the documentation supports.
- You protected patient information everywhere it travels, including billing and accounting systems.
- You reported income, costs and pay honestly to tax authorities, payers and funders.
A CPA’s job is to make those three things provable. When your records reconcile and your processes are written down, an inquiry becomes a document request rather than a crisis.
The rules a healthcare CPA helps you work within
Healthcare practices sit under several overlapping rule sets. A CPA is not the legal authority on any of them, but each one has a financial side that an accountant handles day to day.
HIPAA privacy and security
The HIPAA Privacy and Security Rules, enforced by the HHS Office for Civil Rights, cover protected health information wherever it sits, including remittance files, patient statements and collection reports. An outside accountant who sees that data is usually a business associate, which means you need a signed business associate agreement before they start. A careful CPA will limit what patient detail flows into the general ledger, use secure file transfer instead of email attachments, and document who can access billing and financial systems.
Medicare, Medicaid and commercial payer rules
Rules from the Centers for Medicare & Medicaid Services and state Medicaid programs govern what you can bill and how you must handle overpayments. Medicare generally expects an identified overpayment to be reported and returned within 60 days, subject to CMS timing rules. A CPA helps by reconciling payments to claims, flagging credit balances that sit on patient accounts, tracking refunds and spotting unusual coding patterns that deserve a closer look by your coder or compliance lead.
Fraud and abuse laws
The False Claims Act, the Anti-Kickback Statute and the Stark Law are legal questions for your attorney, but they often surface through money: medical director fees, rent paid to or by referral sources, marketing arrangements and physician compensation formulas. A CPA can document that payments match written agreements, check that compensation is tracked consistently, and raise questions early. The HHS Office of Inspector General’s General Compliance Program Guidance is a useful public reference for how these pieces fit together.
Tax and payroll
Practices file federal and state income tax returns for their entity type, quarterly payroll returns, year-end W-2 and 1099 forms, and in many states sales or gross receipts filings. Worker classification is a common risk area: locum providers, part-time therapists and billing contractors are not automatically independent contractors. For a deeper look at when an accountant is enough and when you need a lawyer, see our guide to tax attorney vs CPA.
Grants and public funding
Community health centers, rural clinics and practices with federal grants must show how funds were spent. Organizations that spend $1,000,000 or more in federal awards in a fiscal year (the threshold was $750,000 before the 2024 Uniform Guidance update) generally need a Single Audit. Auditors follow the Government Accountability Office’s Yellow Book standards, and a CPA who prepares your records with those standards in mind makes the audit faster and cheaper.
How a CPA builds a compliant financial system
Good reporting is the result of good daily habits. When a CPA takes on a healthcare client, the first months usually focus on structure.
- A healthcare chart of accounts. Revenue split by payer class (Medicare, Medicaid, commercial, self-pay), by service line and by location, with contractual adjustments, bad debt and refunds tracked separately so you can see real net collections.
- Daily and monthly reconciliations. Charges posted in the practice management system tie to deposits in the bank, and payer remittances tie to posted payments. Gaps get investigated, not written off.
- Segregation of duties. The person who opens mail or takes copays should not also post payments and approve write-offs. In small offices where that is impossible, the CPA designs a compensating review, such as the owner reviewing adjustment reports monthly.
- Written procedures. Step-by-step instructions for refunds, write-offs, petty cash, credit balances and month-end close, so the process does not live in one employee’s head.
- A record retention schedule. HIPAA policies and related documentation generally must be kept for six years, tax records for at least three years and often longer, and state rules for medical records vary. A CPA helps map financial records against those periods.
Reporting: what you should receive and when
The reporting calendar depends on your size and funding, but a typical independent practice working with an outside CPA sees something like this:
| Frequency | Report or task | Why it matters for compliance |
|---|---|---|
| Monthly | Bank and payment reconciliations, profit and loss, balance sheet, A/R aging by payer | Catches missing deposits, unapplied payments and credit balances early |
| Monthly | Key metrics: days in A/R, denial rate, net collection rate | Unusual shifts can signal coding or billing problems |
| Quarterly | Payroll returns, estimated taxes, review of provider compensation | Keeps tax deposits current and compensation consistent with contracts |
| Annually | Year-end financial statements, tax returns, W-2 and 1099 filings | Core filings that payers, lenders and tax authorities rely on |
| Annually, if applicable | Medicare cost report, grant reports, Single Audit support | Required for certain provider types and funded organizations |
Medicare cost reports apply to provider types such as hospitals, skilled nursing facilities, home health agencies, federally qualified health centers and rural health clinics, not to most physician offices. If your organization files one, a CPA with cost report experience is worth the extra fee, because errors can affect reimbursement for years.
How CPAs help when an audit or inquiry arrives
Audit letters come from many directions: Medicare contractors, commercial payers, state Medicaid programs, the IRS or a grant funder. The CPA’s role is practical:
- Read the request with you and confirm the deadline, period under review and exact documents requested.
- Pull financial records, reconciliations and payment histories, and organize them in the order the auditor asked for.
- Explain entries, adjustments and refunds, and answer the auditor’s financial questions.
- Flag anything that looks like a legal exposure so you can bring in a health care attorney before responding further.
That last point matters. Clinical documentation reviews and potential fraud questions belong with counsel, and communications with an attorney carry protections that communications with an accountant may not.
CPA vs in-house staff: who does what
Many owners ask why they need a CPA when they already have a biller and an office manager. The roles overlap but are not the same.
| Task | In-house admin or billing staff | Healthcare-focused CPA |
|---|---|---|
| Daily patient billing | Enters charges and submits claims | Reviews patterns and reconciles payments to claims |
| Financial statements | Runs basic reports from software | Prepares, reviews and explains full statements |
| Internal controls | Follows office routines | Designs controls and tests whether they work |
| Audit support | Gathers records on request | Plans the response and speaks with auditors |
| Tax planning | Tracks receipts and expenses | Chooses entity structure, plans estimates and retirement options |
The best results come when both work together: staff keep daily data accurate, and the CPA checks it, reports on it and fixes the system when something breaks.
What healthcare CPA services usually cost
Fees vary widely by region, practice size, number of providers and how clean your records are when you start. Most firms offer either a monthly retainer covering bookkeeping review, reconciliations and reporting, or project fees for tax returns, cost reports and audit support. Expect a higher first-year cost if the CPA has to clean up prior periods. Ask for a written engagement letter that lists exactly what is included, how extra work is billed and who on the team will handle your file.
How to choose a CPA for your practice
General small-business accountants can do a good job on taxes but may miss payer-specific issues. Before you sign, ask:
- How many healthcare clients do you serve, and in which specialties?
- Will you sign a business associate agreement, and how do you secure patient data?
- Do you have experience with cost reports, grant reporting or Single Audits, if those apply to us?
- Which practice management and accounting systems do you already work with?
- What will the monthly routine look like, and when will we meet to review results?
A firm that works well with practice owners will also understand that systems only work if the team buys into them. Our piece on why culture eats strategy for breakfast explains why process changes stick only when staff understand the reason behind them.
A 90-day plan to put CPA support to work
- Days 1 to 30: sign the engagement letter and business associate agreement, give read access to your accounting and practice management systems, and let the CPA review the last 12 months of books, deposits and write-offs.
- Days 31 to 60: fix the chart of accounts, clear old credit balances through proper refunds, set up reconciliations and write the core procedures.
- Days 61 to 90: receive the first full monthly reporting package, agree on the metrics you will watch, and set the calendar for tax, payroll and any regulatory filings.
After that, the work becomes routine: a monthly review, quarterly planning and annual filings, with compliance built into the process rather than bolted on when an auditor calls.
Frequently asked questions
Can a CPA be my practice’s compliance officer?
A CPA can support your compliance program with financial controls, reconciliations and reporting, but the compliance officer role also covers clinical documentation, training and legal issues. Most practices assign that role internally and use the CPA as a key adviser.
Does my CPA need a business associate agreement?
If the CPA will access protected health information, such as patient names on remittances or statements, they are generally a business associate under HIPAA and you should have a signed agreement in place before sharing data.
How often should a healthcare practice get financial reports?
Monthly is the practical standard. Monthly reconciliations and statements let you spot missing deposits, credit balances and billing pattern changes while they are still easy to fix.
Do all medical practices file a Medicare cost report?
No. Cost reports are required for certain provider types such as hospitals, skilled nursing facilities, home health agencies, federally qualified health centers and rural health clinics. Most physician offices do not file one.
When should I call an attorney instead of my CPA?
Call a health care attorney when an audit raises possible fraud, kickback or self-referral questions, when you receive a subpoena or civil investigative demand, or when you are structuring deals with referral sources.
This article is general information, not legal, tax or financial advice. Speak to a qualified professional about your practice’s situation.
