CPHIMS cheat sheet

HIPAA Privacy Rule permits PHI use and disclosure for treatment, payment, and operations; all other disclosures require patient authorization, and the minimum necessary standard applies.

HITECH (2009) added breach notification, extended HIPAA security requirements directly to business associates, and created EHR incentive payments.

CMS Promoting Interoperability (formerly Meaningful Use) requires certified EHR technology, e-prescribing, health information exchange, and an annual security risk analysis.

DRG prospective payment: CMS pays a fixed amount per inpatient discharge by diagnosis group, so excess length of stay is not separately reimbursed.

Medicare is federal (age 65 and older, ESRD, or disability); Medicaid is jointly federal-state with state-set eligibility; a dual-eligible patient qualifies for both.

Anti-Kickback Statute is criminal and covers any federal payer; Stark Law is civil and covers physician referrals of designated health services paid by Medicare or Medicaid.

ICD-10-CM codes diagnoses, ICD-10-PCS codes inpatient procedures, CPT codes outpatient services and procedures, and HCPCS covers supplies and drugs.

Joint Commission accreditation is deemed by CMS as satisfying the Medicare Conditions of Participation for hospitals.

ACA value-based programs include Hospital Readmissions Reduction, Hospital-Acquired Condition reduction, and ACO shared savings.

HL7 v2 is pipe-delimited and event-driven: ADT A01 is admit, ADT A03 is discharge, ORM carries orders, and ORU carries observation results.

FHIR uses RESTful APIs over HTTP with JSON or XML resources; standard operations are GET, POST, PUT, and DELETE.

DICOM governs medical image storage, transmission, and display; PACS stores and displays DICOM studies, and modality worklists push orders to scanners.

Interface engine functions are protocol translation, message routing, queuing with retry, and error monitoring with alerting.

Encryption in transit uses TLS 1.2 or higher; encryption at rest commonly uses AES-256; HIPAA requires a documented security risk analysis.

Backup rule 3-2-1: three copies, on two media types, with one offsite; RTO is maximum tolerable downtime and RPO is maximum tolerable data loss.

Authentication: LDAP or Active Directory stores identities, SAML or OIDC enables single sign-on, and MFA combines factors from different categories.

MPI matching: deterministic matching requires exact agreement on identifiers, while probabilistic matching scores candidate pairs and applies review thresholds.

Cloud models: IaaS supplies infrastructure, PaaS supplies a development platform, SaaS supplies the application; a HIPAA business associate agreement is required with the vendor.

Five rights of CDS: right information, right person, right intervention format, right channel, and right time in the workflow.

CPOE removes transcription and handwriting steps; error reduction depends on order sets and on decision support that fires during order entry.

Override rates near or above 90 percent signal alert fatigue; tiering, filtering, and tracking acceptance rates are the standard remedies.

Terminology mapping: LOINC for labs and observations, SNOMED CT for clinical findings and problems, RxNorm for medications, ICD-10-CM for billing diagnoses.

Medication reconciliation is required at admission, transfer, and discharge; anticoagulants, insulin, and opioids get priority review as high-risk drugs.

An eCQM measure equals the numerator (patients meeting criteria) divided by the denominator (eligible population), reported as a percentage.

Usability evaluation methods include heuristic evaluation, think-aloud testing, task analysis, and simulated workflow review before go-live.

BCMA workflow: scan the patient wristband, scan the drug, verify the five rights, then administer; workarounds void the safety benefit.

Workflow analysis compares current-state and future-state process maps to expose handoffs, delays, and duplicate data entry.

Triple constraint: scope, schedule, and cost are interdependent, so a change in one forces a trade-off in the others.

Critical path is the longest dependent task sequence; slack (float) equals late start minus early start, and zero slack marks a task as critical.

NPV equals the sum of discounted future cash flows minus initial investment; accept projects with NPV greater than zero. ROI equals (benefit minus cost) divided by cost.

RACI assigns responsible, accountable, consulted, and informed roles; exactly one accountable owner is designated per task.

Kotter's eight steps: urgency, coalition, vision, communication, empowerment, short-term wins, consolidation, and anchoring.

ADKAR sequence is awareness, desire, knowledge, ability, and reinforcement; a change initiative fails if any element is missing.

Risk score equals probability multiplied by impact; risks above the agreed threshold enter the risk register with an owner and mitigation plan.

ITIL distinction: an incident restores service quickly, while a problem investigates the underlying root cause of recurring incidents.

Waterfall uses sequential phases with formal sign-off; agile uses time-boxed sprints with iterative delivery, and validated regulated systems often blend both.