CPAs support healthcare practices with compliance and reporting by keeping the books audit-ready, reconciling billing and revenue to payer rules, preparing accurate tax, payroll and regulatory filings, and designing internal controls that catch errors before a regulator or payer does. They do not replace your compliance officer or health care attorney, but they produce the clean numbers and documented processes the rest of your compliance program relies on.
Firms that focus on medical clients, such as Conway accounting, tend to see the same pressure points repeatedly: messy revenue records, weak cash controls, late reports and a scramble when an audit letter arrives. This guide explains what a healthcare CPA actually does, which rules they help you work within, what the monthly and annual workload looks like, what to expect on cost, and how to pick the right firm.
Healthcare CPA Compliance Support at a Glance
| Area | What the CPA Does | What It Protects You From |
|---|---|---|
| Bookkeeping and reconciliation | Ties charges, deposits and payer remittances together every month | Missing cash, unapplied payments, unreported credit balances |
| Internal controls | Separates duties, writes procedures, reviews adjustments | Embezzlement, unauthorized write-offs, undetected errors |
| Tax and payroll | Prepares entity, payroll and information returns; reviews worker classification | Penalties, back taxes, misclassification claims |
| Regulatory reporting | Supports cost reports, grant reports and Single Audits where they apply | Reimbursement errors, repaid grant funds, failed audits |
| Audit response | Organizes records and explains financial entries to auditors | Missed deadlines, incomplete responses, avoidable findings |
Why Compliance Is a Financial Problem as Much as a Clinical One
Most compliance failures in small and mid-sized practices do not begin with bad intent. They begin with numbers nobody reviewed: a patient refund that was never issued, a batch of claims coded the same way for months, a daily deposit that does not match the day’s charges, or a payroll entry that treats an employee as a contractor.
Regulators and payers ultimately want proof of three things, and all three live in your financial records:
- You billed only for care you delivered, at the level your documentation supports.
- You protected patient information everywhere it travels, including billing and accounting systems.
- You reported income, costs and pay honestly to tax authorities, payers and funders.
A CPA’s job is to make those three things provable. When your records reconcile and your processes are written down, an inquiry becomes a document request instead of a crisis. When they are not, even an innocent error can look like a pattern.
The Rules a Healthcare CPA Helps You Work Within
Healthcare practices sit under several overlapping rule sets. A CPA is not the legal authority on any of them, but each has a financial side that an accountant deals with every week.
HIPAA Privacy and Security
The HIPAA Privacy and Security Rules, enforced by the HHS Office for Civil Rights, cover protected health information wherever it sits, including remittance files, patient statements and collection reports. An outside accountant who sees that data is usually a business associate, so you need a signed business associate agreement before they start.
In practice, a careful CPA will:
- Keep patient-level detail out of the general ledger wherever possible, posting summarized totals instead.
- Use a secure client portal or encrypted file transfer rather than email attachments.
- Document who can access billing, banking and accounting systems, and remove access promptly when staff leave.
- Limit their own requests to the minimum data needed for the task.
Medicare, Medicaid and Commercial Payer Rules
Rules from the Centers for Medicare & Medicaid Services and state Medicaid programs govern what you can bill and how you handle overpayments. Medicare generally expects an identified overpayment to be reported and returned within 60 days, subject to CMS timing rules. Commercial payer contracts add their own refund and recoupment terms.
A CPA helps by reconciling payments to claims, flagging credit balances sitting on patient and payer accounts, tracking refunds to completion and spotting unusual coding or payment patterns that deserve a closer look from your coder or compliance lead. A credit balance report that grows month after month is one of the clearest early warning signs an accountant can catch.
Fraud and Abuse Laws
The False Claims Act, the Anti-Kickback Statute and the Stark Law are legal questions for your attorney, but they often surface through money: medical director fees, rent paid to or by referral sources, marketing arrangements and physician compensation formulas. A CPA can confirm that payments match signed agreements, check that compensation is calculated consistently and raise questions early. The HHS Office of Inspector General’s General Compliance Program Guidance is a useful public reference for how these pieces fit together.
Tax and Payroll
Practices file federal and state income tax returns for their entity type, quarterly payroll returns, year-end W-2 and 1099 forms and, in some states, gross receipts or similar filings. Worker classification is a recurring risk: locum providers, part-time therapists and billing contractors are not automatically independent contractors just because they invoice you. For help deciding when an accountant is enough and when you need a lawyer, see our guide to tax attorney vs CPA.
Grants and Public Funding
Community health centers, rural clinics and practices with federal grants must show how funds were spent. Organizations that spend $1,000,000 or more in federal awards in a fiscal year (the threshold was $750,000 before the 2024 Uniform Guidance update) generally need a Single Audit. Auditors follow the Government Accountability Office’s Yellow Book standards, and a CPA who keeps your records with those standards in mind makes the audit faster and less expensive.
How a CPA Builds a Compliant Financial System
Good reporting is the result of good daily habits. When a CPA takes on a healthcare client, the first few months usually focus on structure rather than reports.
- A healthcare chart of accounts. Revenue is split by payer class (Medicare, Medicaid, commercial, self-pay), service line and location, with contractual adjustments, bad debt and refunds tracked separately so you can see true net collections.
- Daily and monthly reconciliations. Charges in the practice management system tie to bank deposits, and payer remittances tie to posted payments. Gaps get investigated, not quietly written off.
- Segregation of duties. The person who opens mail or collects copays should not also post payments and approve write-offs. In small offices where that is not possible, the CPA designs a compensating review, such as the owner reviewing the adjustment report each month.
- Written procedures. Clear steps for refunds, write-offs, petty cash, credit balances and month-end close, so the process does not live in one employee’s head.
- A record retention schedule. HIPAA policies and related documentation generally must be kept for six years, tax records for at least three years and often longer, and state rules for medical records vary. The CPA maps your financial records against those periods.
Red Flags a CPA Looks For
Experienced healthcare accountants learn to spot patterns that often point to a deeper problem:
- Daily deposits that regularly fall short of recorded copays and cash payments.
- Write-offs or adjustments concentrated with one staff member or one payer.
- Old credit balances that never get refunded.
- A sudden jump in one billing code or level of service without a change in patient mix.
- Vendor payments to names or addresses no one in the practice recognizes.
- Provider pay that does not match the formula in the employment agreement.
None of these proves wrongdoing, but each one deserves a documented explanation.
Reporting: What You Should Receive and When
The reporting calendar depends on your size and funding, but an independent practice working with an outside CPA typically sees something like this:
| Frequency | Report or Task | Why It Matters for Compliance |
|---|---|---|
| Monthly | Bank and payment reconciliations, profit and loss, balance sheet, A/R aging by payer | Catches missing deposits, unapplied payments and credit balances early |
| Monthly | Key metrics such as days in A/R, denial rate and net collection rate | Unusual shifts can signal coding or billing problems |
| Quarterly | Payroll returns, estimated taxes, review of provider compensation | Keeps tax deposits current and pay consistent with contracts |
| Annually | Year-end financial statements, tax returns, W-2 and 1099 filings | Core filings that payers, lenders and tax authorities rely on |
| Annually, if applicable | Medicare cost report, grant reports, Single Audit support | Required for certain provider types and funded organizations |
Medicare cost reports apply to provider types such as hospitals, skilled nursing facilities, home health agencies, federally qualified health centers and rural health clinics, not to most physician offices. If your organization files one, a CPA with cost report experience is worth the extra fee, because errors can affect reimbursement for years.
How to Read Your Monthly Package
A reporting package is only useful if someone reads it. Each month, practice owners should look at three things first: whether net collections moved in line with visit volume, whether A/R older than 90 days is growing, and whether any refund or credit balance items remain open from the prior month. Ask your CPA to add a one-page summary that explains anything unusual in plain language.
How CPAs Help When an Audit or Inquiry Arrives
Audit letters come from many directions: Medicare contractors, commercial payers, state Medicaid programs, the IRS or a grant funder. The CPA’s role is practical:
- Read the request with you and confirm the deadline, the period under review and exactly which documents are requested.
- Pull financial records, reconciliations and payment histories and organize them in the order the auditor asked for.
- Explain entries, adjustments and refunds, and answer the auditor’s financial questions.
- Flag anything that looks like legal exposure so you can bring in a health care attorney before responding further.
That last point matters. Clinical documentation reviews and potential fraud questions belong with counsel, and communications with an attorney carry protections that communications with an accountant may not. A good CPA knows where their role ends.
Audit Readiness Checklist
- Bank, merchant and payer reconciliations completed for every month in the review period.
- Signed contracts for every provider, medical director and referral-related arrangement.
- A current business associate agreement for every vendor that touches patient data.
- Written refund and write-off policies, plus evidence that they were followed.
- Payroll records that match W-2 and 1099 filings.
CPA vs In-House Staff: Who Does What
Many owners ask why they need a CPA when they already employ a biller and an office manager. The roles overlap but are not the same.
| Task | In-House Admin or Billing Staff | Healthcare-Focused CPA |
|---|---|---|
| Daily patient billing | Enters charges and submits claims | Reviews patterns and reconciles payments to claims |
| Financial statements | Runs basic reports from software | Prepares, reviews and explains full statements |
| Internal controls | Follows office routines | Designs controls and tests whether they work |
| Audit support | Gathers records on request | Plans the response and speaks with auditors |
| Tax planning | Tracks receipts and expenses | Advises on entity structure, estimates and retirement options |
The best results come when both work together: staff keep daily data accurate, and the CPA checks it, reports on it and fixes the system when something breaks.
What Healthcare CPA Services Usually Cost
Fees vary widely with region, practice size, number of providers and how clean your records are at the start. Most firms offer a monthly retainer covering bookkeeping review, reconciliations and reporting, plus project fees for tax returns, cost reports and audit support. Expect a higher first-year cost if the CPA must clean up prior periods.
Ask for a written engagement letter that lists exactly what is included, how extra work is billed and who on the team will handle your file. Comparing proposals on scope rather than headline price avoids surprises later.
How to Choose a CPA for Your Practice
General small-business accountants can do a good job on taxes but may miss payer-specific issues. Before you sign, ask:
- How many healthcare clients do you serve, and in which specialties?
- Will you sign a business associate agreement, and how do you secure patient data?
- Do you have experience with cost reports, grant reporting or Single Audits, if those apply to us?
- Which practice management and accounting systems do you already work with?
- What will the monthly routine look like, and when will we meet to review results?
- Who will be our day-to-day contact, and who reviews their work?
A firm that works well with practice owners also understands that systems only work when the team buys in. Our piece on why culture eats strategy for breakfast explains why process changes stick only when staff understand the reasons behind them.
A 90-Day Plan to Put CPA Support to Work
- Days 1 to 30: sign the engagement letter and business associate agreement, grant read access to your accounting and practice management systems, and let the CPA review the last 12 months of books, deposits and write-offs.
- Days 31 to 60: fix the chart of accounts, clear old credit balances through proper refunds, set up reconciliations and write the core procedures.
- Days 61 to 90: receive the first full monthly reporting package, agree on the metrics you will watch and set the calendar for tax, payroll and any regulatory filings.
After that, the work becomes routine: a monthly review, quarterly planning and annual filings, with compliance built into the process rather than bolted on when an auditor calls.
Bottom Line
A healthcare CPA turns compliance from a reaction into a routine. Choose a firm with real medical-practice experience, sign a business associate agreement before sharing data, insist on monthly reconciliations and reporting, and know when a question belongs with your attorney instead. This article is general information, not legal, tax or financial advice, so speak to a qualified professional about your practice’s specific situation.
Frequently Asked Questions
Can a CPA be my practice’s compliance officer?
A CPA can support your compliance program with financial controls, reconciliations and reporting, but the compliance officer role also covers clinical documentation, staff training and legal issues. Most practices assign that role internally and use the CPA as a key adviser.
Does my CPA need a business associate agreement?
If the CPA will access protected health information, such as patient names on remittances or statements, they are generally a business associate under HIPAA. Have a signed agreement in place before you share any data.
How often should a healthcare practice get financial reports?
Monthly is the practical standard. Monthly reconciliations and statements let you spot missing deposits, credit balances and billing pattern changes while they are still easy to fix.
Do all medical practices file a Medicare cost report?
No. Cost reports are required for certain provider types such as hospitals, skilled nursing facilities, home health agencies, federally qualified health centers and rural health clinics. Most physician offices do not file one.
When should I call an attorney instead of my CPA?
Call a health care attorney when an audit raises possible fraud, kickback or self-referral questions, when you receive a subpoena or civil investigative demand, or when you are structuring arrangements with referral sources.
What is the difference between a healthcare CPA and a medical billing company?
A billing company submits claims and follows up on payments. A healthcare CPA reviews the financial results of that work, reconciles it to the bank, prepares tax and regulatory filings and designs the controls that keep billing errors from going unnoticed.
