CHPCN(C) cheat sheet

Health information management (HIM) is the profession responsible for the collection, integrity, security, accessibility, and use of health data across the continuum of care.

The health record is the primary legal and clinical account of a patient's care; it must be accurate, complete, timely, legible, and authenticated by the responsible clinician.

Record retention periods are set by provincial/territorial legislation and organizational policy; adult records are typically kept for a defined minimum after the last encounter, and records of minors are often retained beyond the age of majority.

Chart completion and deficiency tracking follow medical staff bylaws; common deficiencies include missing signatures, missing operative or discharge summaries, and undocumented amendments.

Documentation principles: record only care that was provided, date and time entries, identify the author, correct errors with a dated addendum rather than obliteration, and never alter another clinician's entry.

Quantitative analysis checks for required forms, signatures, and completeness; qualitative analysis assesses whether documentation supports the diagnosis, care plan, and outcomes.

The Canadian Health Information Management Association (CHIMA) is the national professional body; certification is the Certified Health Information Management (CHIM) credential, and provincial colleges/regulators govern practice.

Release of information requires valid authorization, verification of identity and authority, and logging of the disclosure; fees and turnaround times follow provincial rules.

Core health record content includes patient identification, advance directives where applicable, history and physical, progress and consultation notes, orders, medication administration, laboratory and diagnostic reports, operative and procedure reports, and discharge summaries.

Clinical documentation standards require that entries be attributable, contemporaneous, accurate, complete, and readable, and that late entries and corrections be clearly identified as such.

ICD-10-CA is Canada's morbidity classification for diagnoses; CCI (Canadian Classification of Health Interventions) codes procedures; both are maintained by the Canadian Institute for Health Information (CIHI).

Case mix grouping in Canada uses the Case Mix Group Plus (CMG+) methodology, which relies on coded diagnoses, interventions, and patient characteristics.

SNOMED CT is a comprehensive clinical terminology; LOINC standardizes laboratory and clinical observations; these support semantic interoperability alongside classification systems.

HL7 v2 remains widely used for messaging, HL7 FHIR for modern application programming interfaces, and DICOM for medical imaging.

Data quality dimensions include accuracy, completeness, consistency, timeliness, validity, and uniqueness; each can be measured and monitored.

Data governance assigns accountability for data stewardship, definitions, metadata, and quality monitoring across the organization.

The Canadian Institute for Health Information (CIHI) sets national data standards and maintains the Discharge Abstract Database (DAD), National Ambulatory Care Reporting System (NACRS), and other holdings.

Privacy legislation is jurisdiction-specific: provinces such as Ontario, Alberta, British Columbia, and Quebec have health-specific statutes, while others rely on broader privacy laws; federal PIPEDA applies to commercial activity.

Personal health information (PHI) is identifiable information about an individual's health, health care, or payment for care, in any format, including paper, electronic, and verbal.

The circle of care permits use and disclosure of PHI to health care providers involved in the patient's care; disclosure outside that circle generally requires consent or a legal authority.

Consent may be express or implied, depending on statute and context; implied consent commonly covers sharing within the care team, and consent can be withdrawn subject to legal and retention obligations.

Lockbox or masking requests allow patients to restrict access to specific information; clinicians must know how these interact with safety obligations and legal requirements.

Breach management involves containment, risk assessment, notification to affected individuals and the regulator where required, and remediation; many statutes set notification thresholds.

Patients have rights of access to their own health record, subject to limited exceptions such as significant harm to the patient or third-party information; requests are processed within legislated timeframes.

Minimum necessary and need-to-know principles limit collection, use, and disclosure; role-based access controls and audit trails enforce them in electronic systems.

Privacy impact assessments (PIAs) and privacy by design are required or recommended before implementing new systems or data flows.

Electronic medical record (EMR) systems serve ambulatory settings; electronic health records (EHRs) and clinical information systems integrate data across organizations; the terms are often used interchangeably in Canadian practice.

Interoperability levels progress from foundational (data exchange) to structural (format and meaning) to semantic (shared interpretation); standards such as HL7 FHIR, SNOMED CT, and LOINC enable the higher levels.

Data warehouses consolidate data for reporting and analysis; a data dictionary and metadata repository document definitions so metrics are comparable.

Analytics tiers: descriptive (what happened), diagnostic (why it happened), predictive (what will happen), and prescriptive (what action to take).

Common health indicators include length of stay, readmission rates, mortality, wait times, and hospital standardized mortality ratio; each has defined numerators and denominators that must be applied consistently.

Dashboards and key performance indicators support operational and quality improvement decisions; data visualization choices should match the question being answered.

Data quality issues such as missing values, duplication, coding variation, and inconsistent units must be assessed before analysis; results should be interpreted with those limitations stated.

Security safeguards for health IT include authentication, role-based access, encryption in transit and at rest, audit logging, backup, and disaster recovery planning.

Emerging tools such as natural language processing, machine learning, and generative AI raise privacy, bias, validation, and transparency concerns that require governance before clinical use.