Stark Law, Anti-Kickback & HIPAA: what your CLM must prove in an audit

Healthcare compliance audits rarely turn on exotic legal theories. They turn on paperwork. A physician arrangement that expired eighteen months ago while payments continued. A compensation rate no one can tie to a fair-market-value analysis. A billing vendor that has been handling PHI for three years without an executed Business Associate Agreement anyone can find. In each case the organization may have believed it was compliant, but belief is not evidence, and auditors work from evidence.

That makes your contract system a compliance control, not a filing cabinet. When OIG, CMS or OCR, or a whistleblower’s counsel, asks for the record, the question is whether your CLM can produce it in minutes, complete and unaltered. This article lays out what auditors expect contract records to prove under Stark Law, the Anti-Kickback Statute and HIPAA, and maps each expectation to the CLM capability that satisfies it.

Stark Law: can you produce every physician arrangement, current and justified?

Stark Law scrutiny centers on financial relationships with referring physicians, and its expectations are heavily documentary. The written agreement, its signatures, its term and its compensation rationale are the audit substance. Your contract records should demonstrate:

• �??A complete physician-arrangement inventory. Every financial relationship with a referring physician, employment, medical directorships, call coverage, leases, recruitment, identified and retrievable from one repository. An arrangement the compliance team does not know exists is the most dangerous kind.
• �??A signed writing behind every arrangement. Executed agreements with authenticated signatures, not drafts, unsigned renewals or handshake extensions.
• �??No holdover arrangements. Expirations tracked and renewals executed before terms lapse. An agreement that expired while services and payments continued is the classic self-disclosure trigger.
• �??FMV documentation attached to compensation. Contemporaneous fair-market-value support, valuation, survey benchmark or documented methodology, stored with the contract record and refreshed at renewal or amendment.
• �??A complete amendment history. Every rate change and term modification versioned and linked to the parent agreement, so the arrangement’s full evolution is reviewable in sequence.

Anti-Kickback Statute: can you show the terms were set in advance and followed?

Anti-Kickback analysis looks at intent, but safe harbors are built on documentation: written agreements, terms set in advance, compensation consistent with fair market value and not tied to referral volume. The paperwork does not decide intent, it demonstrates it. An organization whose arrangements are consistently papered, approved and performed as written presents a very different posture than one whose terms were assembled ad hoc, deal by deal. In practice, auditors and counsel look for:

• �??Consistent, governed contract language. Compensation, exclusivity and duty terms drawn from approved templates and clause libraries, so safe-harbor-relevant language is enforced by the system rather than re-invented per deal.
• �??Terms fixed before performance. Execution dates, effective dates and approval records that show the arrangement was papered and approved before services and payments began, not backdated after the fact.
• �??Evidence the arrangement was performed as written. Tracked obligations, duties, time commitments, deliverables, with fulfilment recorded against the contract, demonstrating the agreement was real, not a vehicle for remuneration.
• �??Exception visibility. Any deviation from standard language or approval flow flagged and documented with who approved it and why.

HIPAA: can you prove a BAA exists for every vendor touching PHI?

In an OCR review or breach investigation, the first documentary question is simple: show us the executed BAA for this vendor. Your records should establish:

• �??Full BAA coverage. The contract repository reconciled against the vendor master, with every vendor that creates, receives, maintains or transmits PHI linked to an executed, current BAA, and gaps surfaced as alerts, not audit findings.
• �??Tracked BAA duties. Breach-notification windows, permitted-use limits, subcontractor flow-downs and return-or-destroy obligations extracted from each BAA and assigned owners, because the agreement’s duties matter as much as its existence.
• �??Renewals that never lapse. BAA terms and renewal dates on a tracked calendar with escalation, so no vendor operates on an expired agreement.
• �??Access controls on the records themselves. Role-based access and PHI-appropriate handling within the contract system, so the compliance record does not become its own exposure.

Mapping audit expectations to CLM capabilities

Each expectation above corresponds to a system capability. If your current stack, shared drives, spreadsheets, inbox archives, cannot check these boxes, the gap is architectural, not procedural:

How do you know if you would pass today?

Run the checklist against your own repository before someone else does. Three reconciliations expose most of the gaps in an afternoon. Pull the accounts-payable list of physician payees and match it against executed agreements in the repository, every payee without a current signed writing is a finding waiting to be dated. Pull the vendor master, flag every vendor that plausibly touches PHI, and match against the BAA inventory. Then sample ten physician arrangements and check that each has FMV support attached, dated at or before execution.

Organizations that run this exercise on shared drives typically cannot complete it, agreements surface in inboxes, amendments are missing, nobody can say which version is operative. That inability is itself the diagnostic: if the reconciliation is hard for you, it will be hard in front of an auditor, on their timeline, with penalties accruing. In a governed CLM, all three reconciliations are standing reports rather than projects.

The evidence layer: why immutability is the whole game

Everything above collapses without one property: the record must be trustworthy. A spreadsheet can be edited the night before an audit; an immutable trail cannot. Defensible contract records log every action with who, what and when; preserve every version; restrict access by role; and link the executed agreement to its complete negotiation and amendment history. That is what converts "we believe we were compliant" into "here is the record", and it is why audit preparation that took weeks of email archaeology becomes minutes of retrieval.

The same system that produces audit evidence also prevents the findings in the first place. Expiration tracking stops holdover arrangements before they form; clause governance keeps required language on every agreement as it is drafted, the upstream discipline covered in the health system leader’s guide to payer-provider contract automation. And AI obligation management keeps BAA duties, credentialing dates and arrangement terms tracked to closure between audits, so readiness is a standing state rather than an annual scramble.

With published Stark, Anti-Kickback and HIPAA enforcement ranges running to seven figures per violation, the business case is not subtle: an audit-ready contract system costs a fraction of a single finding.