Ethics, Confidentiality, and Professional Conduct
What this domain tests
You must know the professional and legal boundaries of the reviewer's role. Concepts: confidentiality of PHI under HIPAA (minimum necessary, permitted uses, safeguards); professional ethics (accuracy, objectivity, independence, no conflicts of interest); the reviewer's scope - document and report, do not diagnose or direct care; conflict-of-interest disclosure; whistleblower protections and the duty to report; data security practices (access controls, secure transmission, no PHI on personal devices); and professional conduct with providers (respectful, evidence-based, non-punitive).
Traps that show up in questions
- Accessing records for a legitimate review but sharing them with someone who lacks a need to know - a HIPAA violation despite good intent.
- Accepting a gift or favor from a provider whose records you review - a conflict of interest.
- Using the reviewer role to 'coach' a provider toward a higher-paying diagnosis - unethical and potentially fraudulent.
- Assuming that because you are internal, HIPAA minimum-necessary does not apply.
- Failing to report a suspected violation because 'it's not my department.'
Rule of thumb
Apply the need-to-know + minimum-necessary test to every disclosure, and the independence test to every relationship: if your objectivity could be questioned, disclose it.
Worked example
A reviewer finds a colleague's relative in a record she is auditing. She continues the review (access is legitimate) but does not discuss the case outside the audit, does not access records she does not need, and discloses the relationship to her supervisor if it could affect her objectivity.