Healthcare Industry
Domain 1 tests the business and clinical context of healthcare: who touches PHI, how care and payment flow, and the vocabulary you need to reason about risk. The exam assumes you can look at a workflow and name the covered entity, the data, and the system.
The players
- Providers - hospitals, physician groups, long-term care, home health, labs, imaging centers, pharmacies.
- Payers - commercial insurers, Medicare/Medicare Advantage, Medicaid, pharmacy benefit managers.
- Clearinghouses - translate claims between providers and payers; a covered entity in their own right when they process non-standard transactions.
- Others - life sciences, device manufacturers, health information exchanges, and vendors who are business associates.
How data and money move
Fee-for-service pays per service; capitation pays per member per month; value-based models pay for outcomes. Every model still generates the same core flow: registration, clinical documentation, orders and results, coding, claim, remittance.
Code sets to recognize
ICD-10-CM (diagnoses) and ICD-10-PCS (inpatient procedures); CPT and HCPCS (outpatient procedures, supplies); NDC (drugs); LOINC (lab observations); SNOMED CT (clinical findings); RxNorm (medications).
Worked example
A patient presents to an emergency department with chest pain. Registration captures demographics and insurance in the ADT feed; the EHR places orders; the lab returns results over an HL7 ORU message mapped to LOINC; radiology stores images in a PACS using DICOM; the coder assigns ICD-10-CM and CPT; a payer receives an X12 837 claim and returns an 835 remittance. Reasoning: each arrow is a disclosure and each destination has its own owner, retention rule, and breach exposure - claims data is PHI even though it looks financial.
Traps
- Assuming only hospitals are covered entities; a solo practitioner who bills electronically is one.
- Mixing up CPT and ICD-10-PCS.
- Treating payment data as outside HIPAA.
- Assuming insurers fall outside the rules.