AMCA EHRC cheat sheet

An EHR is a longitudinal, digital record of a patient's health information shared across multiple care settings; an EMR is a narrower record used within a single practice or organization.

Core EHR functions include clinical documentation, order entry, results management, medication management, and clinical decision support.

The EHR is the legal health record when the organization designates the electronic system as its official record of care.

Interoperability is the ability of systems to exchange and use health data; standards such as HL7 and FHIR govern messaging and data exchange formats.

The 2009 HITECH Act established the EHR incentive programs (Meaningful Use) that tied federal payments to certified EHR adoption and use.

Certified EHR technology must meet criteria for functionality and security set by an authorized testing and certification body.

A patient portal is a tethered application that lets patients view results, request refills, and message providers through the EHR.

Health information exchange (HIE) allows sharing of patient data among organizations; models include directed exchange, query-based exchange, and consumer-mediated exchange.

The transition from paper to electronic records requires data migration, downtime planning, and staff training before go-live.

HIPAA Privacy Rule governs use and disclosure of protected health information (PHI); the Security Rule sets safeguards for electronic PHI (ePHI).

The minimum necessary standard requires limiting PHI use and disclosure to the least amount needed for the purpose.

The three HIPAA safeguard categories are administrative, physical, and technical safeguards.

The Security Rule's technical safeguards include access controls, audit controls, integrity controls, and transmission security.

Breach notification: covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery.

Treatment, payment, and health care operations (TPO) are permitted uses of PHI without patient authorization.

The accounting of disclosures rule lets patients request a list of certain PHI disclosures for up to six years prior.

Role-based access and the principle of least privilege limit each user to the minimum ePHI needed for their job.

A business associate agreement (BAA) is required before a vendor can handle PHI on behalf of a covered entity.

Documentation must be accurate, complete, timely, and attributable to the author with date, time, and credentials.

Copy-and-paste and cloning of prior notes can cause documentation errors and must be used with caution and verified for accuracy.

Late entries are added after the fact and must be labeled as late with the date and time of the actual entry.

Corrections to an electronic record are made with an addendum or amendment, never by deleting or overwriting the original entry.

Structured data entry (coded fields, drop-downs) supports reporting and quality measures; free-text narrative supports clinical detail and nuance.

Problem lists, medication lists, allergy lists, and immunization records are structured EHR data elements that require routine reconciliation.

A medical record must reflect the who, what, when, and why of care; documentation supports billing, quality, and legal defensibility.

Patient identifiers (name, date of birth, MRN) must be verified before entering or retrieving data to prevent wrong-patient errors.

Downtime procedures define how staff document and retrieve information when the EHR is unavailable; paper forms and read-only access are common fallbacks.

Registration and scheduling workflows create and maintain the patient record, verify demographics and insurance, and link encounters to the correct record.

Master patient index (MPI) management and patient identity matching prevent duplicate records and overlays.

Release of information (ROI) requests are processed per HIPAA and state law, with verification of the requester and valid authorization.

Audit logs record who accessed what data and when; they support compliance reviews and breach investigations.

Consent management tracks patient authorizations and restrictions (e.g., opt-out of HIE) within the EHR.

EHR training and role-based provisioning ensure users have appropriate access and competency before system use.

Data quality and integrity checks (validation rules, required fields) reduce errors at the point of entry.

Each note entry must include author identity, date, time, and credentials to establish attribution and accountability.

Copy-and-paste or cloning of prior notes can cause documentation errors and must be verified for accuracy before signing.

Late entries are added after the fact and must be labeled as late with the date and time of the actual entry.

Corrections to an electronic record are made with an addendum or amendment, never by deleting or overwriting the original entry.

Structured data entry (coded fields, drop-downs) supports reporting and quality measures; free-text narrative supports clinical detail and nuance.

Problem lists, medication lists, allergy lists, and immunization records are structured EHR data elements that require routine reconciliation.

A medical record must reflect the who, what, when, and why of care; documentation supports billing, quality, and legal defensibility.

Patient identifiers (name, date of birth, MRN) must be verified before entering or retrieving data to prevent wrong-patient errors.

Downtime procedures define how staff document and retrieve information when the EHR is unavailable; paper forms and read-only access are common fallbacks.

Registration and scheduling workflows create and maintain the patient record, verify demographics and insurance, and link encounters to the correct record.

Master patient index (MPI) management and patient identity matching prevent duplicate records and overlays.

Release of information (ROI) requests are processed per HIPAA and state law, with verification of the requester and valid authorization.

Audit logs record who accessed what data and when; they support compliance reviews and breach investigations.

Consent management tracks patient authorizations and restrictions (e.g., opt-out of HIE) within the EHR.

EHR training and role-based provisioning ensure users have appropriate access and competency before system use.

Data quality and integrity checks (validation rules, required fields) reduce errors at the point of entry.