Information Governance
Information Governance tests the organization-wide framework for managing information across its lifecycle and the operational rules that follow from it: what the legal record is, how long it is kept, when it may be released, and when destruction must stop.
Principles and lifecycle
AHIMA defines IG as an organization-wide framework for managing information throughout its lifecycle while supporting strategy, operations, and regulatory, legal, risk, and environmental requirements. The eight principles are accountability, transparency, integrity, protection, compliance, availability, retention, and disposition. The lifecycle runs capture and creation, maintenance and use, retention, then disposition by destruction or archiving.
Legal record versus designated record set
The legal health record is what the organization designates as its official business record for disclosure. The HIPAA designated record set is broader and includes billing and other records used to make decisions about the individual. Amendments are appended and attributed; entries are never obliterated or back-dated.
Retention, holds, and destruction
Retention follows the strictest applicable requirement: state law, Medicare Conditions of Participation (hospitals retain records at least five years under 42 CFR 482.24(b)), payer contracts, and statutes of limitation. Records of minors are commonly kept past the age of majority. A legal hold suspends the retention schedule; destroying records under hold, audit, or investigation is spoliation. Destruction must be secure and documented with a certificate of destruction.
Release of information
- A valid authorization under 45 CFR 164.508 includes a description of the information, the discloser, the recipient, the purpose, an expiration, the signature, a right to revoke, and a redisclosure statement.
- Patient access requests need no authorization and cannot be withheld for unpaid balances; HIPAA allows 30 days plus one 30-day extension.
- Apply minimum necessary and track accounting of disclosures. Information blocking exceptions include preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, and licensing.
Worked example
A patient requests records through the portal while a balance is outstanding, and the ROI clerk plans to hold the records. The reasoning runs through access rights first: the request is a right-of-access request, not a disclosure requiring authorization, and nonpayment is not a permitted basis for denial. The correct action is to release within 30 days, charge only permitted cost-based fees, and log the request.
Traps that cost marks
Equating the legal health record with the entire EHR; withholding records for unpaid bills; destroying records during a hold or open audit; releasing on a subpoena without authorization or satisfactory assurances; and assuming HIPAA overrides stricter state retention or access rules.