CCI cheat sheet

Informatics equation (Friedman): people + information + technology + processes, with the goal of improved health outcomes; informaticians translate among clinical, technical, and business stakeholders.

Data-information-knowledge-wisdom (DIKW) hierarchy: raw data are discrete facts, information is data with context, knowledge is synthesized relationships, wisdom is applied judgment in novel cases.

Core competencies per the informatics education frameworks: clinical domain knowledge, information science, computer science, cognitive science, and management/leadership.

Health IT ecosystem layers: infrastructure (network, servers, identity), applications (EHR, LIS, RIS, pharmacy, imaging), interfaces (HL7 v2, FHIR), and governance.

EHR adoption incentives in the US stem from the HITECH Act of 2009, which established meaningful use; the 21st Century Cures Act (2016) added information blocking and interoperability provisions.

Clinical informatician roles: CMIO/CNIO (executive), clinical analyst (build), informatics nurse (workflow), data scientist/analyst (reporting), HIM professional (coding, release of information).

Human factors concepts: cognitive load, interruptions, alarm fatigue, and automation bias (over-reliance on system suggestions) are primary sources of health IT-induced error.

Usability heuristics: visibility of system status, match to clinical workflow, error prevention, consistency, and user control; usability is measured by efficiency, error rate, learnability, and satisfaction.

Workflow mapping methods: direct observation, contextual inquiry, shadowing, time-motion studies, and swimlane process maps; capture who does what, in what order, with which information.

Current-state vs future-state mapping: document the as-is workflow before design, then define the to-be workflow and the gap list that drives build requirements.

Process improvement frameworks: Lean (remove waste: waiting, rework, handoffs), Six Sigma (reduce variation, DMAIC), and PDSA (Plan-Do-Study-Act) for iterative change.

Bottleneck and constraint identification: the constraint limits throughput; improving non-constraint steps does not increase overall flow (Theory of Constraints).

Handoffs are high-risk transitions; standardized handoff tools (SBAR: Situation, Background, Assessment, Recommendation) reduce information loss.

Workarounds signal a workflow-design mismatch; they are data about system fit, not user noncompliance, and should be logged and analyzed rather than punished.

Interruption and multitasking research: each interruption increases task completion time and error; design should batch, defer, or offload non-urgent alerts and messages.

Role-based workflow: define tasks by licensure and competency (RN vs LPN vs MA vs provider) so system permissions and order sets match scope of practice.

EHR vs EMR: an EMR is a single-organization record; an EHR is a longitudinal, cross-organization record designed for sharing.

Core EHR modules: registration/ADT (admit-discharge-transfer), CPOE, pharmacy, eMAR (electronic medication administration record), results review, documentation, and billing.

BCMA (bar-code medication administration) matches patient wristband, drug, dose, and time; it prevents wrong-patient and wrong-drug errors at the point of administration.

CPOE with clinical decision support reduces medication errors; without decision support, CPOE alone yields smaller benefit.

System architecture: client-server vs cloud-hosted; interfaces via HL7 v2 (ADT, ORM/ORU), FHIR (RESTful resources), and CDA (clinical document architecture) for documents.

Downtime planning: define planned vs unplanned downtime procedures, read-only access, paper fallback forms, and reconciliation steps after restoration.

Master patient index (MPI) and enterprise registration prevent duplicate records; duplicate rate is a key data integrity metric.

Health IT testing phases: unit, integration, interface, regression, usability, and user acceptance testing (UAT) occur before go-live; parallel testing compares old and new systems.

Interoperability levels: syntactic (structure, e.g., HL7 v2 message format), semantic (shared meaning, e.g., LOINC, SNOMED CT), and organizational (policy and governance).

Key terminology standards: SNOMED CT (clinical findings, procedures), LOINC (laboratory and observations), ICD-10-CM/PCS (diagnoses and inpatient procedures, billing), RxNorm (medications), CPT (procedures, billing).

HL7 v2 uses pipe-delimited segments (MSH, PID, PV1, OBX); HL7 FHIR uses RESTful resources (Patient, Observation, MedicationRequest) with JSON/XML payloads.

Data quality dimensions: completeness, accuracy, timeliness, consistency, validity, and uniqueness; each requires an explicit measure and threshold.

Data governance defines ownership, stewardship, definitions, access, and lifecycle; a data dictionary and metadata repository are core artifacts.

Structured vs unstructured data: coded fields enable querying and decision support; free text requires NLP and is more prone to ambiguity.

De-identification per HIPAA: removal of 18 identifiers under the Safe Harbor method, or an expert determination that re-identification risk is very small.

Aggregate vs discrete data: aggregate data (counts, rates) cannot be drilled to the patient level; discrete data support clinical decision support and quality measurement.

CDS five rights (Osheroff): the right information, to the right person, in the right format, through the right channel, at the right point in workflow.

CDS intervention types: order sets, alerts, templates, reference information, documentation forms, relevant data display, and workflow guidance.

Alert fatigue: high override rates reduce effectiveness; tactics include tiering by severity, reducing firing frequency, and requiring rationale for high-severity overrides.

Knowledge management lifecycle: acquire, validate, represent, deploy, and maintain; content requires named owners and scheduled review dates.

Rule representation: if-then logic, Arden Syntax (medical logic modules), and CQL (Clinical Quality Language) for computable quality measures.

Drug-drug interaction and allergy checking are foundational medication CDS; specificity (severity levels) matters more than alert volume.

Predictive analytics and AI-based CDS require validation, bias assessment, and transparency; local validation is required before clinical deployment.

Measure and rule versioning: changes in guidelines or code sets (e.g., annual ICD-10 updates) require re-validation of dependent CDS logic.

HIPAA Privacy Rule governs use and disclosure of protected health information (PHI); the Security Rule covers electronic PHI (ePHI) via administrative, physical, and technical safeguards.

HIPAA identifiers: 18 categories including names, geographic subdivisions smaller than a state, dates (except year), phone/fax, email, SSN, MRN, and full-face photos.

Minimum necessary standard: use or disclose only the minimum PHI needed for the purpose; treatment disclosures are exempt from the minimum necessary requirement.

Breach notification: notify affected individuals without unreasonable delay and no later than 60 days after discovery; HHS notification thresholds depend on breach size.

Security triad (CIA): confidentiality, integrity, availability; controls include access control, audit logs, encryption, and business associate agreements (BAAs).

Authentication factors: something you know, have, or are; multi-factor authentication is required for remote access to ePHI under common risk frameworks.

Information blocking: the 21st Century Cures Act prohibits practices that interfere with access, exchange, or use of electronic health information, with defined exceptions.

Consent and authorization: authorization is required for uses not covered by treatment, payment, or operations; psychotherapy notes require specific authorization.

Donabedian model: structure (resources), process (what is done), and outcome (result); measures should be classified by these categories.

IOM/NAM six aims: safe, effective, patient-centered, timely, efficient, equitable; each aim implies distinct measures.

Quality measure types: structure, process, outcome, balancing, and patient experience; measures require numerator, denominator, exclusions, and a specified data source.

PDSA cycle: Plan (hypothesis and measure), Do (small test), Study (compare to prediction), Act (adopt, adapt, or abandon).

Root cause analysis (RCA) is retrospective for sentinel events; failure mode and effects analysis (FMEA) is prospective, scoring severity x occurrence x detectability.

Safety event taxonomy: near miss, no-harm event, harmful event, and sentinel event; voluntary reporting systems undercount events due to fear of blame.

Just culture distinguishes human error (console), at-risk behavior (coach), and reckless behavior (sanction); it supports reporting without removing accountability.

Common quality metrics: medication error rate, falls with injury per 1,000 patient days, CLABSI/CAUTI standardized infection ratios, and readmission rates.

Kotter's 8 steps: urgency, guiding coalition, vision, communicate, empower action, short-term wins, consolidate gains, anchor in culture.

Lewin change model: unfreeze, change, refreeze; ADKAR focuses on individual change (Awareness, Desire, Knowledge, Ability, Reinforcement).

Stakeholder analysis: map influence vs interest; high-influence/high-interest stakeholders require active engagement and decision roles.

Project management: scope, schedule, budget (triple constraint); a charter defines goals, sponsor, scope, and success measures before build begins.

Governance structure: executive steering committee (prioritization, funding), clinical informatics committee (content approval), and operational workgroups (build and testing).

Go-live strategies: big bang (all at once) vs phased (unit, module, or site); at-the-elbow support and command centers reduce disruption.

Change readiness and adoption: measure training completion, super-user coverage, and post-go-live usage metrics; adoption is a leading indicator of benefit realization.

Benefits realization: define baseline and target metrics before implementation; post-implementation audits compare actual use and outcomes to the business case.