Health Information Management, Privacy, and Record Documentation
This domain tests how the record is created, corrected, protected, and released. Expect questions on HIPAA privacy and security rules, patient rights, breach notification, documentation integrity, and core HIM functions such as chart analysis and release of information.
The record as a legal document
- Documentation must be timely, authenticated, complete, and legible, and must support every code reported.
- Original entries are never altered or deleted. Corrections are made by addendum or a dated, signed late entry that is identified as late, preserving the audit trail. Electronic audit trails are discoverable.
- HIM functions include the master patient index, chart assembly and analysis, incomplete record tracking, release of information, retention and destruction, and registries.
- Quantitative analysis checks for missing items such as signatures or required reports; qualitative analysis checks content for consistency and clinical accuracy.
HIPAA Privacy and Security
- Protected health information may be used or disclosed without authorization for treatment, payment, and healthcare operations. Other disclosures need a valid authorization with all required core elements.
- Minimum necessary applies to most uses and disclosures, with exceptions that include treatment, disclosures to the patient, and disclosures required by law.
- Patient rights: access and copies within 30 days with one possible 30-day extension; amendment; accounting of disclosures; restriction requests; confidential communications; and notice of privacy practices.
- The Security Rule requires administrative, physical, and technical safeguards, a risk analysis, and business associate agreements.
- Breach notification: individuals without unreasonable delay and no later than 60 days, plus HHS, with media notice when more than 500 residents of a state are affected.
- More stringent state law applies over HIPAA. Psychotherapy notes and 42 CFR Part 2 records carry extra protections.
Worked example
An attorney faxes a request for a patient's full chart with a patient-signed authorization attached.
- Verify the authorization: patient identification, description of the information and date range, purpose, expiration date, signature and date, statement of the right to revoke, and the redisclosure statement.
- Apply minimum necessary. If the authorization covers only a specific date range, release only that range. If the chart contains psychotherapy notes or Part 2 substance use records, a separate authorization is required.
Traps that cost marks
- Releasing the entire chart because the patient signed something.
- Mixing up the 30-day access deadline with the 60-day breach notification clock.
- Disclosing to a family member without the patient's agreement or authorization.
- Assuming HIPAA preempts a stricter state law.
- Allowing an addendum to replace rather than supplement the original entry.