Information Governance: Framework, Records, and Retention
Definition and scope
Information governance (IG) is the enterprise-wide accountability framework for how information is created, captured, accessed, used, shared, retained, and destroyed. On the RHIA exam, IG is never just an IT project or a synonym for HIM operations: it is led by a multidisciplinary steering committee with an executive sponsor, a charter, policies, and defined metrics. AHIMA's IG principles - accountability, transparency, integrity, protection, compliance, availability, retention, and disposition - are common answer choices, so know what each means.
Core artifacts
Candidates must distinguish the legal health record (the subset of information disclosed on request), the designated record set (medical, billing, and other records used to make decisions about the individual), and the complete record (everything, including provider notes and shadow files). The master patient index (MPI) is the identity backbone; duplicate rates and overlay errors are data-integrity failures. A data dictionary defines each element, its source, and allowable values; metadata describes data about data.
Retention and destruction
HIPAA does not set a universal medical-record retention period; it requires six years for policies and documentation. Retention is driven by state statutes, payer contracts, accreditation standards, and the statute of limitations. When periods conflict, keep the longest. A legal hold (e-discovery) suspends routine destruction. Destruction must be documented with a certificate and must render data unreadable.
Trap and rule of thumb
A frequent trap is a scenario where IT "owns" IG, or where a facility destroys records on a HIPAA-based six-year schedule while state law requires ten. Rule of thumb: know your longest applicable retention period and never destroy under legal hold.
Worked example: a state requires adult records be kept 10 years and a payer contract requires 7 - the schedule is 10 years.