Health Information and Technology
Core concepts
Candidates must be fluent in the practice's technology stack: the electronic health record, the practice management system, the claims clearinghouse, and the interfaces that connect them. Understand code sets (ICD-10-CM for diagnoses, CPT and HCPCS for procedures and supplies), how charge capture flows from documentation to claim, and how clearinghouse edits and denial management protect cash flow. Interoperability terms appear often - HL7, FHIR, and consolidated clinical document exchange. Under the HIPAA Security Rule, safeguards are administrative, physical, and technical; encryption, role-based access, unique user IDs, audit trails, and backup and downtime procedures all matter. A business associate agreement is required with vendors who touch protected health information on the practice's behalf. The Privacy Rule's minimum-necessary standard governs disclosures, and the patient's right of access requires producing records in the form and format requested (if readily producible) within 30 days, with a single 30-day extension and only a reasonable, cost-based fee.
Traps
- Denying records over unpaid balances. Payment cannot be conditioned on record release.
- Charging a search or review fee for a patient's own records; only labor, supplies, and postage are recoverable.
- Assuming every vendor needs a BAA - only those handling PHI on the practice's behalf.
- Confusing psychotherapy notes with general mental health documentation; they carry separate rules.
- Treating a backup as an archive, or skipping a tested downtime procedure.
Rule of thumb
When a record request arrives, apply three tests: minimum necessary, correct authorization or legal basis, and timely response within the 30-day clock.