Spreadsheet Risk in Medical Practices: How to Find and Replace the Spreadsheets Running Your Operations

Almost every medical practice runs part of its operations on spreadsheets. That isn't a failure. Spreadsheets are fast, flexible and familiar, and they fill gaps that the EHR, the practice management system and the clearinghouse leave open. The risk starts when a spreadsheet stops being a working file and becomes the only place a practice tracks something it can't afford to get wrong: open claims, denials, prior authorizations, credentialing dates.

This guide is a practical way to deal with that. It covers where operational spreadsheets usually hide, how to inventory and document them, how to rank them by risk, and how to decide which ones to replace and which to keep. Any examples are illustrative.

What counts as an operational spreadsheet

An operational spreadsheet is one the practice depends on to get recurring work done, as opposed to a one-off analysis. A quick test: if the file disappeared tomorrow, would someone miss a deadline, lose track of money, or be unable to do part of their job? If yes, it's operational.

Most of them start the same way. A system doesn't show something in the way the team needs, so someone exports it, adds columns, and keeps it up to date by hand. Each workaround is reasonable. Over a few years, a set of them can become the layer that holds the practice's systems together, maintained by one or two people, with no documentation.

Where spreadsheets hide in a medical practice

Start your search in these areas. In a multi-location practice, check each location separately, because each office often keeps its own version.

Revenue cycle

• Open claims and follow-up lists, often color-coded by payer or age.
• Denial and rejection logs, with notes on corrections and appeal dates.
• Patient balance and payment plan tracking.
• Payer fee schedules and contracted rates used to check underpayments.

Front office and clinical operations

• Prior authorization status, because the EHR shows the request but not where it stands.
• Referral tracking: who referred whom, and whether records arrived.
• Recall and follow-up lists for patients due for a visit.
• Provider schedules and coverage across locations, rebuilt by hand each month.

Compliance and administration

• Provider credentialing and payer enrollment dates.
• License, DEA and board certification expirations.
• Staff training and certification renewals.
• Supply orders and stock levels per location.

Reporting

• Month-end reports that combine exports from several systems into one view of visits, collections and no-shows.

Why spreadsheets are risky in a practice

They fail quietly

Software usually stops and shows an error when something is wrong. Spreadsheets usually keep working with wrong or missing data. Raymond Panko's review of spreadsheet research, Spreadsheet Errors: What We Know, concluded that fifteen years of studies agreed spreadsheet errors are common and non-trivial.

The most famous example of silent failure isn't from a practice. In 2020, about 16,000 positive COVID-19 cases were left out of the UK's daily figures because Public Health England used an older Excel file format whose templates could hold only around 65,000 rows. Nothing crashed. The extra rows simply never appeared.

In a practice, the equivalents are ordinary: a filter left on, a row deleted by accident, a formula that stops one row short, a copy saved to a desktop instead of the shared drive. Nobody notices until something is late.

They usually belong to one person

The person who built the spreadsheet knows what each color means, which payer needs a call on day 30, and which location codes a visit differently. When they're out, the work slows. When they leave, much of the logic leaves with them. In a May 2025 MGMA Stat poll, 29% of practice leaders said staff turnover had increased from the previous year, with medical assistants and front-office staff cited most often.

They often hold patient information

A spreadsheet of open claims or prior authorizations usually contains protected health information. The HIPAA Security Rule requires access controls that allow access only to people who have been granted it, and audit controls that record activity in systems holding electronic PHI (45 CFR 164.312). A file emailed between staff or copied to a laptop is hard to square with either.

The deadlines that make claims spreadsheets high-stakes

Claims and appeals run against hard deadlines, which is why a spreadsheet that tracks them deserves the most attention.

• Medicare claims must generally be filed no later than one calendar year after the date of service, with limited exceptions.
• Medicare appeals: a request for redetermination must be filed within 120 calendar days of receiving the initial determination.
• Medicaid limits can be much shorter. New York Medicaid, for example, requires claims to be initially submitted within 90 days of the date of service, with exceptions for delays outside the provider's control.
• Commercial payers set their own filing and appeal limits in each participation agreement. They vary by payer and product, so pull the numbers from your contracts rather than from memory or a blog post, including this one.

Following up by hand is also expensive. The 2024 CAQH Index estimated that a manual claim status inquiry costs a provider about $13.80 in staff time, against $3.64 electronically, and that a status check by phone took an average of 25 minutes. A spreadsheet-driven follow-up process is almost always a phone-and-portal process.

Step 1: Find every operational spreadsheet

You won't find them all by asking once. Use several methods.

1. Ask each role directly. Ask the office manager, billing lead, each location manager and the credentialing coordinator: "What spreadsheets or lists do you update at least once a week to keep things running?" Then ask: "What would break if that file disappeared?"
2. Look at the shared drive. Sort spreadsheets by last-modified date. Files edited every week are almost always operational.
3. Check desktops and email. Recurring attachments, such as a weekly report someone builds and sends, point to a spreadsheet behind them.
4. Follow the exports. Ask which reports people export from the EHR, practice management system or clearinghouse each week, and where those exports end up.
5. Watch a week of work. Sit with the billing team and the front desk for an hour each. Spreadsheets nobody thinks to mention show up when people use them.

Record each one in a single inventory. A simple table is enough:

Step 2: Document how each one works

For every spreadsheet that matters, write one page that someone else could follow. It should cover:

• What each column means, including any codes, colors or abbreviations.
• Where each value comes from: an export, a manual lookup, or typed in from a phone call.
• What triggers an action: for example, "a claim with no payment after 30 days gets a status check."
• Which deadlines apply, by payer where they differ.
• How to check it's complete: for example, "the count of open claims should match the aging report from the practice management system."

Then have a second person run the spreadsheet for a week using only the document. Where they get stuck is where the knowledge is still in one person's head. This step alone reduces key-person risk considerably, even if nothing else changes.

Step 3: Rank them by risk

Score each spreadsheet from 1 (low) to 3 (high) on six factors and add the scores.

As an illustration, a claims follow-up tracker maintained daily by one billing specialist, typed partly from phone calls and full of PHI, would score 17 or 18 out of 18. A holiday rota would score 6 or 7. A credentialing expiration list usually lands in between, but deserves extra weight because a lapse can stop a provider from billing a payer.

Work from the top of the list down. Anything scoring 14 or higher deserves a plan this quarter.

Step 4: Contain the risk while you decide

Before replacing anything, make the high-scoring spreadsheets safer:

• Move them to one controlled location with version history, and remove copies from desktops and email.
• Restrict access to the people who need it, especially for files with PHI.
• Add a completeness check, such as a row count compared against a source report each week.
• Name a backup owner who has run the process using the documentation.
• Put deadlines in front of people: a column that flags items within 15 days of a filing or appeal limit is better than relying on someone to remember.

Step 5: Decide what to replace and what to keep

Not every spreadsheet needs to go. A useful rule: keep spreadsheets for thinking, replace spreadsheets for running.

Keep a spreadsheet when it's used for one-off analysis, budgeting or planning, holds no PHI, is used by one person for their own work, and nothing breaks if it's a week out of date.

Replace it when it's recurring, shared by several people, tied to a payer or regulatory deadline, holds PHI, or is fed by retyping data that already exists in another system.

There are three ways to replace one, from cheapest to most involved:

1. Turn on a feature you already own. Many practice management systems have work queues, denial management or credentialing features that nobody configured. Ask your vendor before buying anything.
2. Connect two systems. If the spreadsheet exists only because two systems don't share data, an integration may remove it.
3. Consolidate the operational layer. When a practice has several high-risk spreadsheets across scheduling, billing follow-up, authorizations and reporting, the root cause is usually that too many separate tools each hold part of the picture. That's the situation we described in why multi-location practices are rethinking best-of-breed.

Whatever replaces the spreadsheet should do what the spreadsheet did and what it couldn't: pull open items in automatically, assign them to people with due dates, show the same view at every location, restrict access by role, and keep a record of who changed what.

A checklist to start this week

1. Ask each role which spreadsheets they update weekly and what would break without them.
2. Sort the shared drive by last-modified date and add the weekly files to the inventory.
3. Record owner, purpose, sources, frequency, PHI and stakes for each.
4. Write a one-page guide for every spreadsheet that tracks money or deadlines.
5. Have a second person run the top-ranked one for a week.
6. Pull filing and appeal limits from your payer contracts into one reference.
7. Move high-risk files to one controlled location and restrict access.
8. Decide, for each high scorer, whether to switch on a feature, connect systems or consolidate.

Pricing the replacement

Before choosing a fix, add up what the current setup costs, including the tools around the spreadsheets and the hours spent maintaining them. Our breakdown of medical practice software cost per provider lists published prices for EHR, claims, messaging and accounting software, and the 30-minute software audit is a quick way to list your own tools. If you're weighing a custom system, the custom software cost guide covers what drives the price and how it compares over three years.

If your practice runs on a set of spreadsheets like these, the page on software for multi-location medical practices explains how we approach replacing them.

Updated October 19, 2026: rewritten as a practical guide to finding, ranking and replacing operational spreadsheets.