CEHRS cheat sheet

The medical record is a legal document; entries must be contemporaneous, dated, timed, and authenticated by the author.

Correct errors with a single line, correction, initials, date, and time; erasures, white-out, and deletion of original text are prohibited.

Late entries must be labeled "late entry," include the actual entry date/time, and reference the date of service.

HIPAA requires six-year retention of compliance documentation and policies; state law governs medical record retention, so apply the longer requirement.

Audit trails must capture user ID, date, time, and action for record access and modification; protect and retain them for compliance and legal discovery.

Concurrent audits review open records during care; retrospective audits review closed records after billing or discharge.

A legal hold suspends routine destruction of records relevant to litigation, investigation, or audit until written release.

Documentation must support medical necessity, the diagnosis, and the level of service billed; unsupported claims risk denial and recovery.

Destruction must be secure and documented, with a certificate of destruction and a retention log.

HIPAA permits use or disclosure without authorization for treatment, payment, and health care operations (TPO), subject to minimum necessary except for treatment.

A valid authorization includes patient identification, recipient, purpose, expiration, signature, date, and right to revoke.

Minimum necessary applies to routine uses and disclosures but not to treatment disclosures or the patient's own access.

Breach notification: individuals without unreasonable delay and no later than 60 days after discovery; HHS within 60 days; media notice if 500+ individuals in a state.

Psychotherapy notes require separate authorization; 42 CFR Part 2 requires consent for most substance use disorder disclosures and prohibits redisclosure.

Accounting of disclosures covers the prior six years and excludes TPO, the patient, and authorized disclosures.

Patient access: respond within 30 days, with one 30-day extension by written notice; provide the requested format if readily producible.

Parental access to a minor's record is governed by state law and exceptions for confidential services.

ICD-10-CM codes diagnoses; CPT and HCPCS Level II codes report procedures, services, and supplies.

Office/outpatient E/M level is selected by medical decision making or total time, not by history and exam under the 2021 guidelines.

Modifier 25 reports a significant, separately identifiable E/M service on the same day as a procedure.

Modifier 59 reports a distinct procedural service; use only when NCCI edits permit and documentation supports separateness.

NCCI column one/column two edits bundle code pairs; a modifier may bypass an edit only for clinically distinct services.

CMS-1500 is the professional claim form; UB-04 is the institutional claim form.

Allowed amount = payer-approved charge; patient responsibility includes deductible, copay, and coinsurance; contractual adjustment is the difference between billed and allowed.

Clean claim rate = clean claims divided by total claims; denial management tracks denials by reason and timely filing limits.

Core demographics: legal name, date of birth, sex, address, phone, medical record number, and guarantor.

Insurance data: payer name and ID, member ID, group number, subscriber name and DOB, patient relationship to subscriber, and effective date.

Coordination of benefits: primary pays first; secondary pays after primary; tertiary after secondary.

Birthday rule: for dependent children, the plan of the parent whose birthday occurs earlier in the year is primary.

Medicare Secondary Payer: Medicare is secondary when the patient has active employer group health coverage through an employer with 20 or more employees.

Electronic eligibility: 270 inquiry and 271 response; claim status: 276 inquiry and 277 response.

NPI is a 10-digit identifier with no embedded intelligence; taxonomy codes identify provider specialty.

Verify demographics and insurance at each visit; incorrect data causes claim rejection, denial, or misdirected PHI.

EHR vs EMR: an EMR is a local clinical record; an EHR is longitudinal and shared across providers and settings.

Interoperability standards: HL7 for messaging, FHIR for APIs, DICOM for imaging, LOINC for labs, SNOMED CT for clinical terms.

CCD/CCDA is a summary of care document used for transitions; it includes problems, medications, allergies, and results.

Promoting Interoperability (formerly Meaningful Use) requires certified EHR use, e-prescribing, health information exchange, and patient access.

Security controls: role-based access, audit logs, encryption, multifactor authentication, and a documented risk analysis.

Clinical decision support delivers alerts, reminders, order sets, and guidelines at the point of care.

CPOE enters orders electronically; eMAR documents medication administration at the bedside.

Downtime procedures require a backup access plan, paper forms, and reconciliation of data after system restoration.