Information Technology
Systems plus safeguards
EHR content includes the clinical data repository, results management, CPOE, clinical decision support, eMAR, and the master patient index (MPI). MPI duplicates are a patient-safety risk; organizations need an enterprise MPI with defined merge/unmerge procedures.
Ancillary systems exchange data through interfaces: HL7 v2 messages carry orders and results, CDA is the document standard, and FHIR uses RESTful APIs for app interoperability. Encoders and groupers assign codes and compute DRGs. Computer-assisted coding (CAC) and natural language processing generate suggestions that a credentialed coder must validate - the coder remains accountable for every final code.
HIPAA Security Rule safeguards are administrative, physical, and technical. Technical safeguards include access control, audit controls, integrity controls, person or entity authentication, and transmission security. Audit trails must be reviewed, not merely enabled. Unique user IDs, role-based access, automatic logoff, encryption, and contingency planning (backups, downtime procedures) are standard exam content. Minimum necessary and role-based access limit PHI exposure, and 'break the glass' access must still be justified and audited.
ROI systems support disclosure management, accounting of disclosures, and tracking of requests. Identity-proofing and remote access controls matter for telehealth and mobile users.
Worked example: a nurse opens her neighbor's record. The system permits it, but policy does not. This is a privacy violation discovered through audit-trail review and is sanctionable even though nothing was printed or shared. Rule of thumb: authorization determines whether access is appropriate; the system only enforces permissions.
Traps: assuming CAC output needs no coder review; confusing HL7 v2 messaging with FHIR APIs; treating encryption as forbidden (it is addressable but remains the expected safeguard for transmission security); believing that having audit logs satisfies the Security Rule.