AMCA EHRC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

EHR definition

A longitudinal, digital record of a patient's health information that is shared across multiple care settings and organizations to support coordinated care.

EMR definition

An electronic record used within a single practice or organization; narrower in scope than an EHR and not typically shared across settings.

HITECH Act

The 2009 law that created EHR incentive programs tying federal payments to certified EHR adoption and meaningful use, and strengthened HIPAA privacy and security.

Interoperability

The ability of different health information systems to exchange data and use the exchanged data, often through standards such as HL7 and FHIR.

Health information exchange

A mechanism or organization that enables sharing of patient health data among providers; models include directed, query-based, and consumer-mediated exchange.

Patient portal

A tethered web application connected to the EHR that lets patients view results, request refills, and message their care team.

Certified EHR technology

EHR software that meets functionality and security criteria set by an authorized testing and certification body, qualifying it for incentive programs.

Legal health record

The record an organization designates as its official record of care; when the EHR is designated, it carries legal and evidentiary weight.

HIPAA Privacy Rule

The regulation governing use and disclosure of protected health information, including permitted uses for treatment, payment, and health care operations.

HIPAA Security Rule

The regulation setting administrative, physical, and technical safeguards for electronic protected health information to ensure confidentiality, integrity, and availability.

Minimum necessary standard

A Privacy Rule requirement to limit use and disclosure of protected health information to the least amount reasonably needed to accomplish the purpose.

Breach notification rule

Requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach.

Business associate agreement

A contract required before a vendor or partner can handle protected health information on behalf of a covered entity, specifying safeguards and obligations.

Accounting of disclosures

A patient's right to request a list of certain disclosures of their protected health information, generally covering up to six years prior.

Role-based access control

A security model that grants each user access only to the data needed for their job role, supporting the principle of least privilege.

Treatment, payment, operations

The three core purposes for which protected health information may be used or disclosed without patient authorization under the Privacy Rule.

Audit controls

Technical safeguards that record and examine activity in systems containing electronic protected health information to detect inappropriate access.

Addendum

A later entry added to an electronic record to correct or supplement an earlier note without deleting or altering the original documentation.

Late entry

Documentation added after the time of care; it must be labeled as late and include the actual date and time of entry.

Copy-and-paste risk

Reusing prior note text can propagate outdated or inaccurate information; copied content must be verified before signing.

Structured data entry

Entry into coded fields or drop-downs that supports reporting, quality measures, and decision support, as opposed to free-text narrative.

Problem list

A structured EHR list of a patient's active and historical diagnoses that supports care coordination, billing, and clinical decision support.

Medication reconciliation

The process of comparing a patient's medication list across care transitions to identify and resolve discrepancies and prevent errors.

Patient identifier verification

Confirming at least two identifiers such as name and date of birth or MRN before entering or retrieving data to prevent wrong-patient errors.

Downtime procedure

A planned protocol for documenting and retrieving information when the EHR is unavailable, often using paper forms and read-only access.

Master patient index

A database that maintains unique identifiers for each patient and supports identity matching to prevent duplicate records and overlays.

Release of information

The process of disclosing patient records to authorized requesters in accordance with HIPAA, state law, and valid authorization requirements.

Audit log review

Examination of system access records to detect inappropriate use of patient data and support compliance and breach investigations.

Consent management

Tracking of patient authorizations, restrictions, and opt-outs, such as declining participation in health information exchange, within the EHR.

Duplicate medical record

Two or more records created for the same patient; prevented through identity matching and resolved through merge processes in the MPI.

Role-based provisioning

Assigning EHR access rights based on job role so users receive only the permissions and data needed for their duties.

Data validation rule

A system check, such as required fields or format constraints, that reduces data entry errors at the point of entry.