CCA (AHIMA) cheat sheet

The medical record must be complete, accurate, timely, and authenticated; 42 CFR 482.24 (CMS Conditions of Participation) defines the required content and authentication requirements for hospital records.

History and physical: must be completed and documented no more than 30 days before admission, or within 24 hours after inpatient admission, and updated on admission if older than 30 days.

A discharge summary is required for every inpatient discharge and must document the reason for admission, significant findings, procedures performed, discharge condition, and discharge instructions or plan of care.

Verbal and telephone orders must be documented when received and authenticated by the ordering practitioner within the period set by medical staff bylaws or state law (commonly 24 hours).

Corrections are made by dated, timed, authenticated addendum or single-line strike-through with initials; original content is never obliterated and the record must stay legible and auditable.

Hospitals must document in the record whether the patient has an advance directive and must not condition care on the presence or absence of one.

Every page must carry patient identification, and each entry must be dated, timed, and signed with the author's unique identifier; electronic signatures must be non-repudiable.

Documentation must support medical necessity and the codes assigned; copy-and-paste content must be reviewed, verified, and edited by the author before authentication.

Retention periods are set by state law, facility policy, and payer contracts; Medicare requires records supporting claims and cost reports be kept at least five years.

ICD-10-CM codes are 3 to 7 characters; the 7th character, when present, is a placeholder 'X' or an encounter/severity extension (e.g., initial, subsequent, sequela).

Excludes1 means NOT CODED HERE (the two conditions cannot occur together); Excludes2 means NOT INCLUDED HERE (both codes may be reported when both conditions are documented).

Sequencing: inpatient uses the principal diagnosis (condition after study chiefly responsible for admission); outpatient uses the first-listed diagnosis (reason for the encounter).

The Official Guidelines for Coding and Reporting take precedence over the Tabular List and Alphabetic Index; AHA Coding Clinic is the official interpretation for ICD-10-CM/PCS.

ICD-10-PCS uses 7 alphanumeric characters with no decimal point; each character is independent: section, body system, root operation, body part, approach, device, qualifier.

CPT Category I codes are 5 digits; Category II are 4 digits plus F (performance measures); Category III are 4 digits plus T (emerging technology); HCPCS Level II covers supplies, drugs, and non-physician services.

Modifier 25 reports a significant, separately identifiable E/M service on the same day as a procedure by the same physician; modifier 59 reports a distinct procedural service to bypass an NCCI edit.

Present on admission (POA) indicators are required on inpatient claims: Y = present when the admission order was written; hospital-acquired conditions with POA = N are excluded from higher payment.

Query the physician when documentation is ambiguous, incomplete, or conflicting; never assign a diagnosis or procedure the provider has not documented.

Measurement scales: nominal (named categories, no order), ordinal (ranked, unequal intervals), interval (equal intervals, no true zero), ratio (equal intervals plus true zero).

Central tendency: mean for interval/ratio data but sensitive to outliers; median for skewed or ordinal data; mode for nominal data.

Rate = (number of events / population at risk) x 100 (or 1,000 or 10,000 as specified).

Hospital occupancy rate = (inpatient service days / [bed count x days in the period]) x 100.

Case mix index = sum of the relative weights of all DRGs paid in the period / number of discharges; a higher CMI indicates greater resource intensity.

UHDDS is the minimum inpatient data set: patient identifier, birth date, sex, race, ethnicity, residence, principal and other diagnoses, procedures, disposition, expected payer, and admission date.

AHIMA data quality characteristics include accuracy, accessibility, comprehensiveness, consistency, currency, definition, granularity, precision, relevancy, and timeliness.

Other standard data sets: OASIS (home health), MDS (long-term care), HEDIS (NCQA performance measures), and DEEDS (emergency department).

The HIPAA Privacy Rule permits use and disclosure for treatment, payment, and health care operations; all other purposes require a valid authorization or a specific regulatory exception.

Patients have a right to an accounting of disclosures covering the six years before the request, excluding disclosures for treatment, payment, operations, and to the individual.

Breach notification: affected individuals within 60 days of discovery; HHS immediately when 500 or more individuals are affected, annually for smaller breaches; media notice for 500+ in a state or jurisdiction.

Core federal fraud and abuse authorities: False Claims Act, Anti-Kickback Statute, Stark Law (physician self-referral), and Civil Monetary Penalties Law.

MS-DRG assignment uses the principal diagnosis, procedures performed, secondary diagnoses designated as CC or MCC, discharge disposition, and patient age and sex.

IPPS pays a fixed amount per discharge (DRG weight x base rate x wage index, plus IME, DSH, and outlier adjustments); OPPS pays by APC; physicians are paid under the MPFS.

MPFS payment = [(work RVU x work GPCI) + (PE RVU x PE GPCI) + (MP RVU x MP GPCI)] x conversion factor.

Audit programs: MAC performs claim review and edits, RAC recovers improper payments, CERT measures the fee-for-service error rate, and OIG investigates fraud, waste, and abuse.

An Advance Beneficiary Notice (ABN) must be issued before a potentially non-covered Medicare service; when signed, the beneficiary accepts financial liability.

HITECH Act (2009) expanded HIPAA enforcement and penalties, added breach notification, and funded EHR incentive programs now known as Promoting Interoperability.

Exchange and messaging standards: HL7 v2 (ADT, orders, results), HL7 CDA (clinical documents), FHIR (RESTful APIs), DICOM (imaging), and ASC X12 (administrative transactions).

X12 837P and 837I submit professional and institutional claims; 835 is remittance advice; 270/271 is eligibility inquiry/response; 276/277 is claim status.

HIPAA Security Rule safeguards are administrative, physical, and technical; required technical controls include access control, audit controls, integrity, person or entity authentication, and transmission security.

Access control principles: role-based permissions, unique user IDs, strong authentication, automatic logoff, and an immutable audit trail of protected health information access.

Disaster recovery metrics: RPO is the acceptable amount of data loss measured in time (drives backup frequency); RTO is the acceptable downtime before restoration; alternate sites are hot, warm, or cold.

The master patient index assigns a unique identifier across the enterprise; duplicates are resolved by merge (survivor and retired record) or unmerge, with the action retained in an audit trail.

Computer-assisted coding applies natural language processing to clinical text to suggest codes, but a credentialed coder remains accountable for validating every code assigned.