Information Governance
Information Governance tests your understanding of how health information is controlled across its lifecycle: who may see it, how it is protected, how long it is kept, and how release is authorized and documented.
Principles and lifecycle
AHIMA's eight information governance principles are accountability, transparency, integrity, protection, compliance, availability, retention, and disposition. The record lifecycle runs from creation and capture through use, maintenance, retention, and final disposition. Retention periods come from state law and payer requirements rather than from HIPAA, which sets no general retention period; Medicare Conditions of Participation require hospitals to keep records for five years. A legal hold suspends all destruction.
Legal health record versus designated record set
The legal health record is what the organization designates as its official business record for disclosure and legal purposes. The HIPAA designated record set is broader - the medical and billing records used to make decisions about an individual - and it defines the scope of patient access and amendment rights. The accounting of disclosures covers six years and excludes disclosures for treatment, payment, and operations.
Release of information
A valid HIPAA authorization must describe the information, name the disclosing source and the recipient, state the purpose, give an expiration date or event, be signed and dated, and include statements about the right to revoke, re-disclosure, and that treatment is not conditioned on signing. Release is limited to the minimum necessary. A subpoena alone is not enough: the requester needs a court order with a qualified protective order or a valid authorization.
Worked example
A patient emails asking for a copy of her visit notes. The request must be honored within 30 days, with one possible 30-day extension. Verify identity, provide the record in the requested electronic form if readily producible, charge only a reasonable cost-based fee, and do not require an in-person visit. Psychotherapy notes are excluded from the right of access and need a separate authorization.
Traps that cost marks
Treating the legal health record as identical to the complete record; releasing to an attorney on a bare subpoena; counting treatment, payment, and operations disclosures in the accounting; destroying records under legal hold; and forgetting that state law or 42 CFR Part 2 can impose stricter rules than HIPAA.