Your FREE RHIA Flashcards 2026 – 300+ Cards

An organization-wide framework of accountability, policies, and decision rights for managing information as a strategic asset across its lifecycle.

A subset of information governance focused specifically on the management, quality, and integrity of the organization's data.

The accuracy, completeness, consistency, and reliability of data throughout its lifecycle — data is unchanged from source and fit for its purpose.

A documented set of standard definitions for every data element — name, format, allowable values, and meaning — that enforces consistency across systems.

Applying uniform definitions, formats, and value sets (a data dictionary) so the same element means the same thing everywhere it is collected or reported.

The permanent database that links every medical record number a patient has across an organization to one unique enterprise identifier.

An MPI that links a patient's identifiers across multiple facilities or systems within a health system or HIE.

AHIMA's maturity model describing how an organization advances information governance across competency areas over staged levels.

The stages information passes through — creation/capture, use, storage/maintenance, archival, and destruction — each governed by IG policy.

AHIMA's data-quality model: data should be accurate, complete, consistent, timely, relevant, and accessible (among other characteristics).

A person accountable for the quality, definition, and appropriate use of a specific set of data elements under the IG framework.

Data captured in discrete, defined fields (e.g., coded values, lab results) that can be queried and analyzed directly.

Free-text or narrative data (e.g., dictated notes) that is not in defined fields and is harder to query without processing.

Data about data — descriptive details (author, date, source, format) that give context and support retrieval, audit, and governance.

The clinical and administrative documentation an organization must capture and maintain, governed by regulatory, accreditation, and organizational policy.

The formally defined subset of records an organization will disclose as its official business record in response to a legal request.

Under HIPAA, the records a covered entity uses to make decisions about an individual — what a patient has a right to access and amend.

Linking data elements from one system or code set to another (e.g., a crosswalk) so information moves accurately between systems.

A cross-functional body that sets data policies, resolves data-definition conflicts, and oversees data quality enterprise-wide.

Required clinical data elements abstracted and submitted for quality programs and to facility committees and payers.

Mapping local terms and values to a common standard or terminology so data from different sources can be aggregated and compared.

The principle that one authoritative, governed copy of a data element exists, so reports and decisions rely on consistent data.

Records management handles documents/retention; IG is the broader strategic framework governing all information, including data and analytics.

An organizational policy requiring all systems to use approved element definitions and value sets to prevent inconsistent or duplicate data.

The discipline of acquiring, analyzing, protecting, and governing digital and traditional health information to support quality care and operations.

A governed master file of billable items, codes, and prices; its integrity is an information-governance and revenue concern.

Data that stakeholders can rely on for decisions because its quality and integrity are governed, documented, and auditable.

A documented organizational rule (policy) and the step-by-step method to carry it out (procedure) — the backbone of IG and compliance.

Using governed, quality data to produce insights that guide operational and strategic management decisions.

Governing the design and approval of documentation forms and EHR templates so captured data is complete, consistent, and compliant.

Any body of information (a database, record set, report) the organization manages and protects for its value.

The documented, agreed meaning and allowable values of a data element, recorded in the data dictionary.

Documentation must identify who created each entry; governance ensures every entry is attributable and signed.

An amendment adds new information; a correction fixes an error — both must preserve the original entry (no deletion).

Tracking changes to documents, forms, and policies so the current authoritative version is always identifiable.

Ownership is organizational accountability for data; stewardship is the operational responsibility to maintain its quality.

The function that coordinates IG strategy, policies, and metrics across departments.

Ensuring every required documentation element is present and authenticated before a record is considered complete.

Reviewing records to identify missing or unauthenticated documentation (e.g., unsigned reports) for provider completion.

A governance body that approves the design and data elements of paper forms and EHR templates.

Categorizing data by sensitivity (e.g., public, internal, confidential, PHI) to apply appropriate controls.

Documentation of where data originated and how it moved/transformed across systems — supports trust and audit.

Measures (data-quality rates, duplicate rates, policy adoption) that show IG program maturity and value.

The Health Insurance Portability and Accountability Act — federal law setting national standards to protect health information (Privacy, Security, and Breach Notification Rules).

Individually identifiable health information held or transmitted by a covered entity or business associate, in any form.

Sets national standards for how PHI may be used and disclosed and gives patients rights over their information.

Requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Requires covered entities to notify affected individuals, HHS, and sometimes the media when unsecured PHI is breached.

The HIPAA principle of using, disclosing, or requesting only the least PHI needed to accomplish the intended purpose.

Under HIPAA, a health plan, health-care clearinghouse, or provider that transmits health information electronically.

A person or entity that performs functions involving PHI on behalf of a covered entity; bound by a business associate agreement (BAA).

The three purposes for which a covered entity may use or disclose PHI without patient authorization.

A patient's HIPAA right to inspect and obtain a copy of their PHI in a designated record set, generally within 30 days.

A patient's HIPAA right to request correction of inaccurate or incomplete PHI in their designated record set.

A patient's HIPAA right to receive a list of certain disclosures of their PHI made by the covered entity.

A patient's signed permission required to use or disclose PHI for purposes other than treatment, payment, or operations.

The HIM process of validating, fulfilling, and tracking requests for copies of a patient's health information.

A HIPAA authorization must specify the information, who may disclose and receive it, the purpose, an expiration, and the patient's signature/date.

The document a covered entity must give patients describing how their PHI may be used and disclosed and their rights.

The period an organization must keep records, set by the strictest of state law, federal rule, accreditation, and policy.

Disposing of records past retention using a method that renders PHI unreadable/unrecoverable, with a destruction log.

A policy specifying how long each record type is kept and how it is destroyed when retention ends.

An impermissible use or disclosure of unsecured PHI that compromises its security or privacy, unless a risk assessment shows low probability of compromise.

The breach analysis of: nature/extent of PHI, who received it, whether PHI was actually acquired/viewed, and the extent of risk mitigation.

Individuals must be notified without unreasonable delay and no later than 60 days from discovery of a breach.

A court order compels disclosure of PHI; a subpoena generally requires additional assurances (e.g., notice or a qualified protective order) before disclosure.

Separately kept notes that receive heightened HIPAA protection and generally require specific authorization to disclose.

Federal rule giving stricter confidentiality protection to substance-use disorder treatment records than HIPAA alone.

Where state privacy law is more stringent than HIPAA, the state law controls (HIPAA is a federal floor, not a ceiling).

The individual a covered entity must designate to develop and implement privacy policies and handle complaints.

The individual responsible for developing and implementing the organization's ePHI security policies under the Security Rule.

Security Rule policies and procedures — risk analysis, workforce training, access management — that manage ePHI protection.

Security Rule controls protecting facilities and devices — facility access, workstation use, and device/media controls.

Security Rule technology controls — access control, audit controls, integrity, and transmission security for ePHI.

Granting ePHI access by role and need-to-know via unique user IDs, authentication, and authorization.

Assigning system permissions based on a user's job role so each user sees only the PHI their role requires.

Hardware, software, and procedures that record and examine activity in systems containing ePHI.

The required, ongoing assessment of risks and vulnerabilities to ePHI confidentiality, integrity, and availability.

Converting ePHI into unreadable form; encrypted data that is breached is 'secured' and may not trigger breach notification.

The law that strengthened HIPAA enforcement, added breach notification, increased penalties, and extended rules to business associates.

Ongoing auditing of PHI access and ROI workflows to ensure the organization complies with privacy policies and law.

Helping patients and families understand and exercise their rights to obtain their health information appropriately.

Removing identifiers from PHI (Safe Harbor's 18 identifiers or expert determination) so it is no longer protected under HIPAA.

Consent is general permission to use PHI for TPO; authorization is specific written permission for other uses/disclosures.

Joint Commission and similar bodies impose documentation and confidentiality standards beyond regulation that HIM must monitor.

The three security objectives the Security Rule protects for ePHI.

Administrative safeguards ensuring access is appropriate at hire and revoked promptly at termination.

Required data backup, disaster recovery, and emergency-mode operation plans to keep ePHI available.

A required policy applying consequences to workforce members who violate security policies.

Policies that authorize access to ePHI based on role and need, a required administrative safeguard.

Technical safeguards (e.g., encryption) protecting ePHI as it travels over a network.

Measures ensuring ePHI is not improperly altered or destroyed.

Verifying identity with two independent factors (something you know/have/are) to strengthen access control.

Routinely examining system access logs to detect inappropriate PHI access (snooping).

Accessing PHI without a legitimate business need — a privacy violation even if no data leaves the organization.

Steps a covered entity takes to lessen harm after an impermissible use or disclosure of PHI.

Public/media breach notice used when a breach affects 500+ residents of a state or contact information is insufficient.

The agency that enforces the HIPAA Privacy, Security, and Breach Notification Rules and investigates complaints.

Tiered fines for HIPAA violations based on culpability, up to an annual maximum per provision.

The contract that binds a business associate to safeguard PHI and comply with applicable HIPAA rules.

Uses generally requiring specific authorization, with HITECH restrictions on remuneration for PHI.

A permitted secondary disclosure that cannot reasonably be prevented when reasonable safeguards are in place.

HIPAA requires verifying the identity and authority of a person requesting PHI before disclosure.

A patient's right to request limits on uses/disclosures; must be honored for out-of-pocket-paid services to a health plan.

PHI may be disclosed as expressly authorized by a court order without patient authorization.

The interdisciplinary use of information technology and data to acquire, store, analyze, and present health data for better care and decisions.

Quantitative measures (census, rates, length of stay) computed from health data to describe and monitor organizational performance.

The number of days between a patient's admission and discharge; average LOS (ALOS) is total discharge days divided by discharges.

The number of inpatients present in a facility at a point in time, used to compute occupancy and staffing measures.

Total inpatient service days for a period divided by the number of days in the period.

The percentage of available beds occupied — inpatient service days divided by available bed days, times 100.

The proportion of inpatient deaths to discharges (including deaths) in a period, often expressed as a percentage.

The rate or incidence of disease within a defined population.

The number of NEW cases of a condition in a population over a period.

The number of EXISTING cases (new and old) of a condition in a population at a point in time.

Measures of central tendency: mean is the average, median is the middle value, mode is the most frequent value.

Using database and statistical techniques to discover patterns, trends, and relationships in large data sets.

Maintaining one accurate enterprise identifier per patient by preventing and resolving duplicates, overlays, and overlaps.

Two or more records/identifiers created for the SAME patient — must be merged to preserve a single record.

One patient's information recorded under ANOTHER patient's identifier — a serious patient-safety error to resolve immediately.

The same patient has different enterprise identifiers across facilities in a system — reconciled in an EMPI.

Presenting data graphically (charts, dashboards) so trends and outliers are clear for decision-making.

A visual display of key performance indicators and metrics, updated for managers to monitor performance at a glance.

A graph using bars to compare values across discrete categories.

A graph showing how a value changes over time — ideal for trends.

A graph showing the frequency distribution of a continuous variable using adjacent bars.

A circular graph showing parts of a whole as proportional slices.

A graph plotting two variables as points to reveal correlation or relationship.

A quantifiable measure used to evaluate success against an objective (e.g., coding accuracy, DNFB days).

Software (e.g., relational) for creating, querying, and maintaining structured data.

Data organized into tables (relations) of rows and columns, linked by keys, and queried with SQL.

A field (or set) that uniquely identifies each row in a database table.

A field in one table that references the primary key of another, linking related data.

The standard language for querying and manipulating data in a relational database.

A longitudinal digital record of a patient's health information shared across providers and settings.

Helping clinicians and staff use EHR applications correctly — training, troubleshooting, and optimization.

The electronic sharing of health information among organizations to improve coordination of care.

The ability of different information systems and devices to exchange and use data — often via HL7 or FHIR standards.

Health Level Seven — a family of standards for exchanging clinical and administrative health data between systems.

Fast Healthcare Interoperability Resources — a modern HL7 standard using web technologies for exchanging health data.

EHR tools (alerts, reminders, order sets) that give clinicians knowledge and patient-specific information at the point of care.

Using a targeted tool/checklist to review documentation for CDI, quality, or safety against criteria.

A report measuring staff or department output (e.g., charts coded per hour) used to manage performance.

Examining data over time to identify direction and patterns that inform summary reports for leadership.

A central repository of integrated data from multiple sources, optimized for reporting and analysis.

Verifying that computed statistics are accurate and correctly defined before reporting them to stakeholders.

Analyzing data across groups of patients to improve outcomes and manage cost for a defined population.

An organized system that collects standardized data on a defined population (e.g., a cancer or trauma registry).

Identifying and recording the specific data elements required for a report, registry, or quality measure from the record.

The number of times each bed changes occupants in a period — discharges divided by available beds.

The proportion of deaths that are autopsied; the gross rate uses all inpatient deaths as the denominator.

The rate of hospital-acquired infections among patients in a period.

A measure of how spread out values are around the mean.

A measure of how often an event occurs relative to a population at risk, usually times a constant (e.g., per 1,000).

A ratio compares two quantities (a:b); a proportion is a ratio where the numerator is part of the denominator.

Data combined across individuals to describe a group, with no patient identified.

Data that can be traced to a specific patient — protected and access-controlled.

The health record itself — data collected during direct patient care.

Data derived from the record for other uses — registries, indexes, and databases.

A secondary record listing diseases (by code) treated in a facility, used for studies and reporting.

A secondary record listing procedures performed, organized by code.

Accuracy is closeness to the true value; precision is consistency/reproducibility of the measurement.

Technology converting scanned text images into machine-readable data for the EHR.

AI that interprets free-text clinical narrative to extract or suggest structured data and codes.

Stages of deploying an information system — planning, analysis, design, implementation, and maintenance.

Concentrated end-user assistance during and immediately after a new system's launch.

Checking data against rules (range, format, consistency) at entry to prevent errors.

Comparing performance metrics against internal targets or external best-in-class organizations.

A line graph of a metric over time used to detect shifts and trends in process improvement.

A run chart with statistical control limits used to distinguish normal variation from special-cause variation.

Confirming a dashboard's underlying data and calculations are correct before stakeholders rely on it.

All clinical and administrative functions that capture, manage, and collect patient-service revenue — from scheduling to final payment.

Overseeing the revenue cycle to maximize appropriate, compliant reimbursement and minimize denials and lost revenue.

Patient-access functions before/at the encounter — scheduling, registration, insurance verification, and prior authorization.

Functions during care — charge capture, coding, CDI, and documentation — that translate services into billable data.

Functions after care — claims submission, payment posting, denials management, and collections.

A program that improves the accuracy and completeness of clinical documentation so it supports correct codes and reflects severity.

A compliant, non-leading question to a provider to clarify ambiguous, incomplete, or conflicting documentation before coding.

Auditing assigned codes against documentation and official guidelines to confirm they are correct and complete.

An inpatient classification that pays a fixed amount per admission based on diagnoses and procedures (MS-DRG under Medicare).

The outpatient hospital payment unit under Medicare's Outpatient Prospective Payment System.

The average DRG relative weight for a facility's patients — a measure of clinical complexity that drives reimbursement.

A method paying a predetermined amount per case/service (e.g., IPPS, OPPS) rather than per actual cost.

Reimbursement that pays separately for each service provided, rewarding volume.

Reimbursement tied to quality and outcomes rather than volume, shifting financial risk toward providers.

A CMS program adjusting hospital payment up or down based on quality and outcome measures.

A single payment covering all services for an episode of care, encouraging coordination and efficiency.

A group of providers jointly accountable for the cost and quality of care for a population, sharing savings or risk.

The billing record submitted to a payer (e.g., UB-04 for facilities, CMS-1500 for professionals) requesting reimbursement.

Verifying, submitting, tracking, and reconciling claims to ensure timely, accurate payment.

Analyzing, appealing, and preventing payer denials to recover and protect revenue.

A claim with no errors that can be processed and paid without additional information.

Recording all billable services and supplies provided so they appear on the claim.

The master file of all billable items, their codes, descriptions, and prices used to generate charges.

Ensuring charges and coding are accurate, compliant, and complete so reimbursement is correct and defensible.

Accounts discharged but not yet billed — a key revenue-cycle metric where high values signal bottlenecks (often coding).

The average number of days to collect payment after billing — a core revenue-cycle performance metric.

Knowingly submitting false claims or misrepresenting services to obtain payment — illegal under the False Claims Act.

Practices inconsistent with sound fiscal or medical practice causing unnecessary cost — improper but not necessarily intentional.

Assigning codes for more severe or expensive conditions/services than documented — a fraud and compliance risk.

Billing components of a service separately to obtain higher payment when a single combined code applies.

Federal law imposing liability for knowingly submitting false or fraudulent claims to the government.

CMS edits that prevent improper code pairs and unbundling to promote correct coding.

A CMS contractor that audits claims to identify and recover improper Medicare payments.

The requirement that a service be reasonable and necessary; diagnosis codes must support the procedure billed.

Medicare policies defining what is covered and when, used to demonstrate medical necessity.

A risk-adjustment model grouping diagnoses to predict cost and set capitated/value-based payment.

Hard-coding assigns charges automatically via the CDM; soft-coding is HIM coders assigning codes from documentation.

The payer's explanation of how a claim was adjudicated — paid, adjusted, or denied — used to post payments.

The statement sent to the patient describing what the payer covered and what the patient owes.

A review of revenue-cycle data and processes to find compliance gaps, errors, and improvement opportunities.

Front-end functions (scheduling, registration, eligibility) that set up accurate billing and reduce denials.

Payer approval obtained before a service to confirm coverage and prevent denial.

Confirming a patient's insurance coverage and benefits before service.

Rules determining which payer is primary when a patient has more than one insurance.

The standard institutional/facility claim form.

The standard professional/physician claim form.

A value reported with each inpatient diagnosis showing whether it was present at admission; drives HAC payment.

A reasonably preventable condition not present on admission that can reduce Medicare payment.

Medicare Severity DRG — the inpatient payment group reflecting diagnoses, procedures, and severity (CC/MCC).

Secondary conditions that raise the DRG tier; an MCC raises it more than a CC.

Comparing services documented to charges posted to ensure all billable activity is captured.

A charge posted after the claim has dropped, which can require rebilling and delay payment.

A reduction of the billed amount (contractual or bad debt) recorded on the account.

The difference between the charge and the payer's contracted (allowed) amount, written off.

A revenue-cycle metric of average time to collect; lower is better cash flow.

The percentage of claims paid on first submission without rework — a clean-claim efficiency measure.

The percentage of claims denied by payers; a key RCM performance and compliance metric.

A formal request to a payer to reconsider a denied or underpaid claim, supported by documentation.

A scheduled review verifying coding meets official guidelines and payer rules to prevent fraud/abuse.

The HHS Office of Inspector General's annual list of audit and enforcement priorities organizations monitor.

Federal law prohibiting paying for referrals of services reimbursed by federal health programs.

Federal law restricting physician self-referral for certain designated health services.

A dashboard of metrics (DNFB, A/R days, denial rate, CMI) used to manage revenue-cycle performance.

Medicare edits applied to outpatient claims to check coding and coverage before payment.

Defining an organization's long-term direction and allocating resources to achieve its mission, vision, and goals.

A concise statement of an organization's core purpose and what it does.

A statement describing what an organization aspires to become in the future.

A planning tool assessing internal Strengths and Weaknesses and external Opportunities and Threats.

A goal is a broad desired outcome; an objective is a specific, measurable, time-bound step toward it.

Strategic planning sets long-term direction; operational planning manages day-to-day execution to support it.

A structured approach to transitioning people and the organization from a current to a desired future state.

Recruiting, developing, evaluating, and retaining staff and managing personnel issues within legal requirements.

A document defining a position's duties, responsibilities, required qualifications, and reporting relationships.

The qualifications, skills, and experience a person needs to perform a particular job.

The process of attracting and identifying qualified candidates to fill positions.

Integrating and training new employees so they become productive and understand policy and culture.

A periodic, structured evaluation of an employee's job performance against expectations.

A graduated approach to addressing performance/conduct problems — verbal warning, written warning, suspension, termination.

A defined expected level of output (e.g., charts coded per hour) used to set and measure performance.

Determining the number and mix of staff needed to meet workload while controlling labor cost.

The number of subordinates a manager directly supervises.

A diagram of an organization's structure, reporting relationships, and chain of command.

Systematically analyzing and redesigning workflows to increase quality, efficiency, or value.

Ongoing measurement and improvement of organizational processes and outcomes (e.g., PDSA cycles).

Plan-Do-Study-Act — an iterative method for testing and implementing a process change on a small scale first.

A methodology that improves processes by eliminating waste and maximizing value to the customer.

A data-driven methodology (DMAIC) that reduces process variation and defects.

Six Sigma's improvement steps: Define, Measure, Analyze, Improve, Control.

Arranging tasks, people, and tools so work flows efficiently and accurately.

Planning, executing, and closing a defined effort within scope, time, and budget constraints.

A bar chart that schedules project tasks against time to track progress and dependencies.

A financial plan estimating revenue and expenses for a period; HIM managers help prepare and monitor it.

A budget for day-to-day revenue and expenses (salaries, supplies) over a fiscal year.

A budget for major, long-term asset purchases (e.g., a new EHR module or scanners).

Comparing budgeted to actual amounts and explaining the differences to control finances.

A measure of a project's financial benefit relative to its cost.

Comparing the expected costs and benefits of an option to support a decision.

A unit expressing staffing as the hours of one full-time employee (e.g., two half-time staff = 1.0 FTE).

Voluntary review by an external body (e.g., The Joint Commission) confirming an organization meets quality standards.

A major accrediting body whose standards address documentation, safety, and information management.

Government permission required for a facility or individual to operate or practice.

Recognition by a body that a person or program meets defined standards (e.g., CMS Conditions of Participation).

An organized system of policies, training, auditing, and reporting to prevent and detect violations of law and policy.

Negotiating, monitoring, and renewing agreements with vendors and outsourced services (e.g., ROI, coding).

Managing third-party performance, service levels, and PHI safeguards (via a BAA) for outsourced functions.

Building staff skills and competencies through structured education to improve performance and support change.

Leadership sets vision and motivates change; management plans, organizes, and controls day-to-day operations.

Techniques for addressing and resolving interpersonal or interdepartmental disputes constructively.

A strategic tool measuring performance across financial, customer, internal-process, and learning perspectives.

A category of outcomes critical to organizational success, tracked with objectives and KPIs.

Assigning authority and responsibility for a task to a subordinate while retaining accountability.

Frameworks (e.g., Maslow, Herzberg) explaining what drives employee performance and engagement.

Activities and leadership that develop a cohesive, high-performing work group.

Measuring output against standards to manage staffing and identify training needs.

Managing the authorized number and type of positions and FTEs within budget.

Verifying staff have the knowledge and skills required for their role, often at hire and periodically.

Identifying and developing employees to fill key roles in the future.

Policies governing remote HIM work, including PHI safeguards and productivity standards.

Salaries and benefits — typically the largest HIM operating expense to plan and control.

A department to which costs are assigned for budgeting and accountability.

Fixed costs stay constant with volume (rent); variable costs change with volume (supplies).

Managing output standards without sacrificing accuracy/quality (e.g., coding error rate).

A structured method to identify the underlying cause of a problem or adverse event.

A proactive method identifying potential process failures and their effects before they occur.

Reengineering how work is done to remove non-value steps and improve efficiency and accuracy.

The defined boundaries of a project — what is and is not included — guarding against scope creep.

A significant checkpoint or deliverable date in a project schedule.

Any person or group with an interest in or affected by a project or decision.

CMS requirements a facility must meet to participate in Medicare/Medicaid.

Creating organizational rules that align operations with law, accreditation, and strategic goals.

A documented routine method for performing a recurring task consistently.

A business case (cost-benefit, ROI) supporting a major asset purchase in the capital budget.