Health Information Management — EHR & HIM Study Guide
HEALTH INFORMATION MANAGEMENT: EHR DOCUMENTATION & HIM
CONCEPTS STUDY GUIDE QUESTIONS WITH ANSWERS & RATIONALES (EHR
NAVIGATION, HIPAA/ROI, CODING, DATA INTEGRITY)
Section I — HIM & EHR Concept Review
1. Health Record Content & Structure
• The legal health record (LHR) is the documentation created by or for a
healthcare organization that is admissible as official evidence in legal
proceedings; it differs from the designated record set (DRS), which is
broader and includes any record used to make decisions about a patient.
• Core components of a complete health record include the history and
physical (H&P), physician orders, progress notes, medication
administration record (MAR), nursing notes, consent forms,
diagnostic/lab results, and discharge summary.
• The problem list is a running, updated summary of a patient's significant
diagnoses, conditions, and issues — it should be reconciled at every
encounter, not simply appended to.
• Structured data (coded fields, drop-downs, checkboxes) supports
analytics and clinical decision support; unstructured data (free-text
notes) supports narrative detail but is harder to query.
• Amendments to a record must be dated, timed, and signed, and must
never delete or obscure the original entry — the original stays visible
with the correction appended (late entry, addendum, or correction).
2. Release of Information (ROI) & HIPAA
• The Minimum Necessary Standard requires that only the minimum
amount of PHI needed to accomplish the intended purpose be used or
disclosed — it does not apply to disclosures to the patient or disclosures
required for treatment.
Page 1 of 29
, Health Information Management — EHR & HIM Study Guide
• A valid HIPAA authorization must include: description of the
information, who may disclose, who may receive, purpose, expiration
date/event, and signature — verbal consent alone is not sufficient for
most non-TPO (treatment, payment, operations) disclosures.
• Treatment, Payment, and Operations (TPO) disclosures generally do not
require patient authorization.
• Specially protected information (behavioral health, substance use
treatment under 42 CFR Part 2, HIV status, genetic information) often
requires a separate, more specific authorization than general PHI.
• An accounting of disclosures tracks certain releases of PHI (not including
TPO) for up to six years and must be provided to the patient upon
request.
• The Minimum Necessary Standard and 'need to know' access controls
are the basis for role-based access in an EHR.
3. EHR Functionality & Modules
• Computerized Provider Order Entry (CPOE) allows providers to enter
orders directly, reducing transcription errors and enabling built-in
clinical decision support (drug interaction alerts, allergy checks).
• Clinical Decision Support (CDS) tools include drug-drug and drug-allergy
interaction checks, dosage range checking, and reminders/alerts for
preventive care.
• e-Prescribing (eRx) transmits prescriptions electronically to the
pharmacy and can check for formulary compliance and interactions
before submission.
• Interoperability levels: foundational (basic data exchange), structural
(uniform format/syntax, e.g., HL7), and semantic (shared meaning of
data, enabling clinical use across systems).
• Health Information Exchange (HIE) enables sharing of patient data
across organizations; a Master Patient Index (MPI) is used to uniquely
identify patients across systems and prevent duplicate or overlaid
records.
4. Data Integrity & Quality
Page 2 of 29
, Health Information Management — EHR & HIM Study Guide
• Data integrity means data is accurate, complete, consistent, and
trustworthy across its lifecycle — threats include duplicate records,
overlays, upcoding/downcoding, and copy-forward errors.
• A duplicate record occurs when one patient has two or more separate
medical record numbers; an overlay occurs when one patient's data is
incorrectly merged into another patient's record — overlays are more
dangerous because they mix two people's clinical data.
• Copy-and-paste (copy-forward) documentation risks propagating
outdated or inaccurate information forward into new notes if not
reviewed and updated.
• Data quality characteristics commonly tested: accuracy, accessibility,
comprehensiveness, consistency, currency, definition, granularity,
precision, relevancy, and timeliness (AHIMA's data quality management
model).
• Audit trails record who accessed a record, when, and what action was
taken — essential for both data integrity monitoring and HIPAA security
compliance.
5. Coding, Reimbursement & Compliance Basics
• ICD-10-CM is used for diagnosis coding; ICD-10-PCS is used for inpatient
procedure coding; CPT/HCPCS are used for outpatient procedure and
service coding.
• Upcoding (billing for a higher level of service than performed) and
unbundling (billing separately for services that should be billed
together) are forms of fraudulent or abusive billing.
• Present on Admission (POA) indicators identify whether a diagnosis was
present at the time of inpatient admission — used for quality reporting
and reimbursement adjustment.
• The National Correct Coding Initiative (NCCI) edits prevent improper
payment for code pairs that should not be billed together.
• Compliance programs rely on the seven elements outlined by the OIG:
written policies, compliance oversight, training, effective communication,
auditing/monitoring, enforcement of standards, and prompt response to
detected offenses.
6. Patient Registration & Admission Workflows
Page 3 of 29
HEALTH INFORMATION MANAGEMENT: EHR DOCUMENTATION & HIM
CONCEPTS STUDY GUIDE QUESTIONS WITH ANSWERS & RATIONALES (EHR
NAVIGATION, HIPAA/ROI, CODING, DATA INTEGRITY)
Section I — HIM & EHR Concept Review
1. Health Record Content & Structure
• The legal health record (LHR) is the documentation created by or for a
healthcare organization that is admissible as official evidence in legal
proceedings; it differs from the designated record set (DRS), which is
broader and includes any record used to make decisions about a patient.
• Core components of a complete health record include the history and
physical (H&P), physician orders, progress notes, medication
administration record (MAR), nursing notes, consent forms,
diagnostic/lab results, and discharge summary.
• The problem list is a running, updated summary of a patient's significant
diagnoses, conditions, and issues — it should be reconciled at every
encounter, not simply appended to.
• Structured data (coded fields, drop-downs, checkboxes) supports
analytics and clinical decision support; unstructured data (free-text
notes) supports narrative detail but is harder to query.
• Amendments to a record must be dated, timed, and signed, and must
never delete or obscure the original entry — the original stays visible
with the correction appended (late entry, addendum, or correction).
2. Release of Information (ROI) & HIPAA
• The Minimum Necessary Standard requires that only the minimum
amount of PHI needed to accomplish the intended purpose be used or
disclosed — it does not apply to disclosures to the patient or disclosures
required for treatment.
Page 1 of 29
, Health Information Management — EHR & HIM Study Guide
• A valid HIPAA authorization must include: description of the
information, who may disclose, who may receive, purpose, expiration
date/event, and signature — verbal consent alone is not sufficient for
most non-TPO (treatment, payment, operations) disclosures.
• Treatment, Payment, and Operations (TPO) disclosures generally do not
require patient authorization.
• Specially protected information (behavioral health, substance use
treatment under 42 CFR Part 2, HIV status, genetic information) often
requires a separate, more specific authorization than general PHI.
• An accounting of disclosures tracks certain releases of PHI (not including
TPO) for up to six years and must be provided to the patient upon
request.
• The Minimum Necessary Standard and 'need to know' access controls
are the basis for role-based access in an EHR.
3. EHR Functionality & Modules
• Computerized Provider Order Entry (CPOE) allows providers to enter
orders directly, reducing transcription errors and enabling built-in
clinical decision support (drug interaction alerts, allergy checks).
• Clinical Decision Support (CDS) tools include drug-drug and drug-allergy
interaction checks, dosage range checking, and reminders/alerts for
preventive care.
• e-Prescribing (eRx) transmits prescriptions electronically to the
pharmacy and can check for formulary compliance and interactions
before submission.
• Interoperability levels: foundational (basic data exchange), structural
(uniform format/syntax, e.g., HL7), and semantic (shared meaning of
data, enabling clinical use across systems).
• Health Information Exchange (HIE) enables sharing of patient data
across organizations; a Master Patient Index (MPI) is used to uniquely
identify patients across systems and prevent duplicate or overlaid
records.
4. Data Integrity & Quality
Page 2 of 29
, Health Information Management — EHR & HIM Study Guide
• Data integrity means data is accurate, complete, consistent, and
trustworthy across its lifecycle — threats include duplicate records,
overlays, upcoding/downcoding, and copy-forward errors.
• A duplicate record occurs when one patient has two or more separate
medical record numbers; an overlay occurs when one patient's data is
incorrectly merged into another patient's record — overlays are more
dangerous because they mix two people's clinical data.
• Copy-and-paste (copy-forward) documentation risks propagating
outdated or inaccurate information forward into new notes if not
reviewed and updated.
• Data quality characteristics commonly tested: accuracy, accessibility,
comprehensiveness, consistency, currency, definition, granularity,
precision, relevancy, and timeliness (AHIMA's data quality management
model).
• Audit trails record who accessed a record, when, and what action was
taken — essential for both data integrity monitoring and HIPAA security
compliance.
5. Coding, Reimbursement & Compliance Basics
• ICD-10-CM is used for diagnosis coding; ICD-10-PCS is used for inpatient
procedure coding; CPT/HCPCS are used for outpatient procedure and
service coding.
• Upcoding (billing for a higher level of service than performed) and
unbundling (billing separately for services that should be billed
together) are forms of fraudulent or abusive billing.
• Present on Admission (POA) indicators identify whether a diagnosis was
present at the time of inpatient admission — used for quality reporting
and reimbursement adjustment.
• The National Correct Coding Initiative (NCCI) edits prevent improper
payment for code pairs that should not be billed together.
• Compliance programs rely on the seven elements outlined by the OIG:
written policies, compliance oversight, training, effective communication,
auditing/monitoring, enforcement of standards, and prompt response to
detected offenses.
6. Patient Registration & Admission Workflows
Page 3 of 29
