Ethics and Regulatory Requirements
What the candidate must know
Apply the ethical standards and legal framework around health information. Know HIPAA Privacy and Security Rules - the minimum necessary standard, permitted disclosures, the role of business associate agreements, and breach notification. Understand protected health information (PHI), the accounting of disclosures, patient rights (access, amendment, restriction requests), and the Security Rule safeguards (administrative, physical, technical). Recognize the AHIMA Code of Ethics principles: integrity, confidentiality, accuracy, and the duty to report unethical or illegal coding practices.
Traps in questions
- Assuming all disclosures require authorization - many are permitted (treatment, payment, operations) without one.
- Confusing privacy (who may see PHI) with security (how PHI is protected).
- Forgetting that minimum necessary applies to uses and disclosures, not to treatment disclosures to providers.
- Overlooking the duty to report fraud or unethical conduct rather than complying with a directive to miscode.
Rule of thumb
When a request conflicts with ethical or legal standards, document, refuse the improper action, and escalate through the compliance process.
Worked example: A manager pressures a coder to assign a higher-paying diagnosis unsupported by the record. The coder should decline, document the request, and report it through the compliance program - this is upcoding and a reportable ethical violation, not a discretionary judgment.