6.1 Medical Records, HIPAA/HITRUST, Charting & Physician Referral

ACSM Certified Clinical Exercise Physiologist ACSM-CEP

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 The ACSM-CEP Role, Job Definition & Scope of Practice 1.2 Exam Format, Domain Weights & Scoring 1.3 Eligibility, Study Planning & Test-Day Strategy

2 Applied Exercise Physiology & Metabolic Calculations

Bioenergetics & Energy Systems (ATP-PC, glycolytic, oxidative) Acute Cardiorespiratory & Metabolic Responses to Aerobic Exercise Responses to Resistance Exercise & Chronic Training Adaptations ACSM Metabolic Equations, METs & Interpreting VO₂ / RER / Ventilatory Threshold

3 Pathophysiology of Clinical Populations

3.1 Coronary Artery Disease, Myocardial Infarction & Revascularization (PCI/CABG) 3.2 Heart Failure, Valvular Disease & Cardiac Rhythm Disorders 3.3 Hypertension, Dyslipidemia & Peripheral Artery Disease 3.4 Pulmonary Disease: COPD, Asthma & Restrictive/Interstitial Disorders 3.5 Diabetes, Metabolic Syndrome & Obesity 3.6 Renal Disease & Musculoskeletal/Orthopedic Conditions 3.7 Neuromuscular, Neurological & Cognitive Conditions (stroke, MS, Parkinson's, SCI) 3.8 Neoplastic, Immunologic & Hematologic Disorders (cancer, HIV/AIDS, anemia)

4 Clinical ECG Interpretation

4.1 ECG Leads, Waveforms, Rate & Rhythm Determination 4.2 Arrhythmias & Conduction Blocks 4.3 Ischemia, Injury & Infarction (ST changes, exercise-induced) 4.4 Drug & Electrolyte ECG Effects; Resting/Exercise Monitoring Setup & Lead Placement

5 Pharmacology for the Clinical Exercise Physiologist

5.1 Beta-Blockers, Calcium-Channel Blockers & Nitrates 5.2 RAAS Agents, Diuretics, Antiarrhythmics, Lipid-Lowering & Antithrombotic Drugs 5.3 Bronchodilators, Corticosteroids, Insulin & Oral Antidiabetic Agents 5.4 Medication Effects on HR/BP & Exercise Response; Dose/Meal/Dialysis Timing

6 Patient Assessment (Domain I, 18%)

6.1 Medical Records, HIPAA/HITRUST, Charting & Physician Referral 6.2 Patient Interview, Medical History & Medication Reconciliation 6.3 Resting Vital Signs, Body Composition & Resting ECG 6.4 Preparticipation Health Screening & Level of Monitoring (PAR-Q+, ACSM algorithm, ACC/AHA · GOLD · ADA · AACVPR) 6.5 Assessing Patient Goals, Readiness & Psychosocial Status

7 Clinical Exercise Testing (Domain II, 18%)

Submaximal Aerobic Tests (treadmill, cycle, step, 6-minute walk) Musculoskeletal Fitness, Mobility & Balance Testing Maximal Symptom-Limited GXT: Protocols, Contraindications & ECG Prep Test Termination: Relative & Absolute Indications Interpreting & Reporting Results (ECG response, RPP, claudication, Duke Treadmill Score, VO₂/RER/AT)

8 Exercise Prescription for Clinical Populations (Domain III, 22%)

FITT-VP Principles, Progression & Prescription Foundations Ex Rx for Cardiovascular Disease (CAD, HF, HTN, PAD, post-revascularization) Ex Rx for Pulmonary Disease (COPD, asthma; breathing techniques, supplemental O2) Ex Rx for Diabetes, Metabolic Syndrome & Obesity Ex Rx for Musculoskeletal, Neuromuscular, Neoplastic & Other Conditions Communicating Intensity (THR, RPE, talk test), Monitoring & Modifying the Prescription

9 Exercise Training & Leadership (Domain IV, 24%)

9.1 Discussing the Training Plan, Clinician & Patient Expectations/Goals 9.2 Instructing & Modifying Exercise Modes (cardiorespiratory, strength/endurance, flexibility, coordination, agility) 9.3 Patient Monitoring & Supervision During Exercise (telemetry, oximetry, glucometry, ECG) 9.4 Contraindications to Training & Modifying Recommendations 9.5 Documenting Clinical Status, Reporting Adverse Events & Interdisciplinary Coordination

10 Education & Behavior Change (Domain V, 13%)

10.1 Behavioral-Health Screening & Recognizing Distress (PHQ-9, Beck, SF-36; referral) 10.2 Patient Education, Health Literacy & Disease Self-Management 10.3 Motivational Interviewing & Behavior-Change Theories (Transtheoretical, HBM, Social Cognitive, Five-A's) 10.4 Promoting Adherence, Self-Efficacy, Relapse Prevention & Social Support

11 Legal, Professional & Emergency Management (Domain VI, 5%)

11.1 Emergency Equipment, Crash Cart Inspection & Emergency Procedures 11.2 CPR/AED/BLS/ACLS, Universal Precautions & EMS Activation 11.3 Scope of Practice, Legal/Ethical Standards, Liability/Negligence, Informed Consent & Professional Organizations (ACSM/AACVPR/AHA)

6.1 Medical Records, HIPAA/HITRUST, Charting & Physician Referral

Key Takeaways Explain This Topic AI

HIPAA's Privacy Rule governs use and disclosure of PHI in any form; the Security Rule specifically governs administrative, physical, and technical safeguards for electronic PHI (ePHI).

HITRUST CSF is a certifiable control framework, not a law itself, that maps HIPAA requirements into an auditable set of controls for healthcare organizations and vendors.

A complete chart review before the first encounter covers the referral reason, past medical/surgical history, medications and allergies, recent labs/diagnostics, and prior exercise-test or rehab records.

A valid physician referral specifies diagnosis, functional limitations, relevant medications, and specific orders; ambiguous orders must be clarified with the referring provider, not assumed.

SOAP-format documentation (Subjective, Objective, Assessment, Plan) creates a timely, specific, legally defensible record used by the entire care team.

Last updated: July 2026

Medical Records, HIPAA/HITRUST, Charting & Physician Referral

Quick Answer: Before a Clinical Exercise Physiologist (CEP) puts a patient on a treadmill or teaches a single exercise, the medical record must be reviewed, the physician referral must be understood, and every step must be documented in a way that satisfies HIPAA. The Privacy Rule controls who may see and share protected health information (PHI); the Security Rule controls how electronic PHI (ePHI) is technically safeguarded; HITRUST CSF is a certifiable control framework many healthcare organizations use to operationalize HIPAA compliance across systems and vendors.

Why Chart Review Comes Before the Patient Encounter

A CEP practices inside a medical setting, which means every assessment, test, and exercise session happens within a legal and clinical record system, not a standalone fitness log. Reviewing the chart first accomplishes three things: it confirms the patient has a valid referral for the service being delivered, it surfaces conditions or medications that change how testing and exercise should be conducted, and it protects the patient (and the CEP) by grounding decisions in documented history rather than self-report alone, which is frequently incomplete or inaccurate.

HIPAA: The Rules a CEP Must Know Cold

HIPAA is not one rule — for exam purposes, know the difference between the rules most relevant to daily CEP practice:

Rule What It Governs CEP-Relevant Example

Privacy Rule Use and disclosure of PHI in any form — paper, verbal, electronic Discussing a patient's cardiac history only with staff who need it for that patient's care

Security Rule Administrative, physical, and technical safeguards for ePHI specifically Password-protected EMR login, encrypted messaging, audit logs, automatic screen lock

Breach Notification Rule Reporting obligations when PHI is exposed Reporting a lost, unencrypted device containing patient records within required timelines

A useful shorthand: the Privacy Rule answers "who is allowed to see or share this information," while the Security Rule answers "how do we technically keep electronic records safe." Both apply whether the CEP is working from an EMR, a paper referral, or a shared telemetry monitoring station.

HITRUST CSF: Operationalizing HIPAA

HITRUST CSF (Health Information Trust Alliance Common Security Framework) is not itself a law — it is a certifiable control framework that maps HIPAA (and other regulatory) requirements into a concrete, auditable set of controls that hospitals, clinics, and health-tech vendors can be certified against. A CEP does not need to personally manage HITRUST certification, but should understand that an employer's HITRUST-certified systems (EMR platforms, telemetry vendors, scheduling software) exist specifically to keep day-to-day documentation practices compliant by design.

The Physician Referral (Exercise Order)

A valid referral is the legal basis for the CEP's scope of action with that patient. A complete referral should specify:

Diagnosis / reason for referral (e.g., post-MI, COPD, type 2 diabetes)
Functional limitations or precautions (e.g., sternal precautions, non-weight-bearing status, angina threshold)
Relevant medications that affect the exercise response (e.g., beta-blockers blunting heart rate)
Specific test or program orders (e.g., "symptom-limited GXT with 12-lead ECG" or "cardiac rehab, telemetry")
Provider signature and date

If an order is ambiguous or incomplete — for example, a restriction with no stated end date — the CEP's responsibility is to contact the referring provider for clarification before proceeding , not to guess or default to a generic protocol. Practicing outside a referral's stated scope is both a clinical-safety issue and a scope-of-practice violation, expanded further in Chapter 11.

Conducting a Thorough Chart Review

Before the first encounter, a complete chart review should cover:

Reason for referral / primary diagnosis
Past medical and surgical history
Current medication list and documented allergies

Recent labs and diagnostic tests — echocardiogram, cardiac catheterization report, pulmonary function tests, A1C, lipid panel

Prior exercise test results or cardiac/pulmonary rehabilitation records
Relevant social history — tobacco use, occupation, living situation, prior activity level
Documentation Standard: The SOAP Note

Most clinical exercise settings document encounters using the SOAP format:

S — Subjective: What the patient reports (symptoms, perceived exertion, adherence)
O — Objective: Measured data (vital signs, ECG findings, workload, distance)
A — Assessment: The CEP's interpretation of the session relative to the plan of care
P — Plan: Next steps, modifications, or provider notifications

Documentation must be timely, legible (or properly entered if electronic), and specific — it becomes part of the permanent medical record, is used by the entire care team, is legally discoverable, and supports medical necessity for reimbursement. Vague notes ("patient did fine") create both clinical and legal risk; objective, specific notes ("Completed 20 min at stage 3, HR 118/145 age-predicted max, RPE 13, no symptoms") do not.