Study guide
18.2 HIPAA, Minimum Necessary, and Record Confidentiality
Certified Clinical Documentation Specialist CCDS
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Eligibility Pathways and the 2,000-Hour Year 1.3 Allowed Resources and Test-Day Rules 1.4 Recertification, Fees, and How This Guide Maps the Eight Domains
2 IPPS Foundations
2.1 How IPPS Works and How CMS Updates It 2.2 MS-DRG Assignment, Relative Weights, and Grouping 2.3 Provider and Clinical Staff Documentation Duties under IPPS
3 Severity, CMI, Medical Necessity, and Oversight
3.1 CC versus MCC Recognition and CC Exclusion Lists 3.2 Case Mix Index and Why CDI Tracks It 3.3 Two-Midnight Rule, Medical Necessity of Setting, and Principal Diagnosis 3.4 MAC, RAC, CERT, OIG, and Denial-Vulnerable Practices
4 Nervous and Respiratory System CDI
4.1 Nervous System Conditions for CDI 4.2 Acute and Chronic Respiratory Failure, ABGs, and Ventilation Support 4.3 Pneumonia, COPD, PE, Pleural Effusion, and Respiratory Infections
5 Circulatory, Digestive, Hepatobiliary, Musculoskeletal, and Skin CDI
5.1 Circulatory Disorders 5.2 Digestive and Hepatobiliary Disorders 5.3 Musculoskeletal and Skin
6 Endocrine, Nutrition, Kidney, and Hematologic CDI
6.1 Diabetes, Dehydration, and Obesity 6.2 Malnutrition Criteria, Severity, and Audit Risk 6.3 AKI, CKD Staging, UTI, and Urinary Stones 6.4 Anemia, Coagulation, Sickle Cell, Lymphoma, and Leukemia
7 Infectious Disease, Other MDCs, and Clinical Indicator Tools
7.1 Sepsis, Severe Sepsis, Postoperative and Other Infections 7.2 Mental, Substance Use, Injuries/Toxicology, and HIV-Related Conditions 7.3 Medications, Diagnostic Tests, and Abbreviations as Clinical Indicators
8 Health Record Elements and Query Triggers
8.1 Which Record Elements Support Diagnosis and Procedure Codes 8.2 Attending versus Radiologist, Pathologist, and Other Providers 8.3 When a Physician Query Is Warranted 8.4 When Queries Are Not Appropriate
9 Query Timing, Verbal Queries, Formats, and Clinical Indicators
9.1 Concurrent, Retrospective, Pre-Bill, and Prospective Timing 9.2 Verbal Queries and Required Documentation 9.3 Open-Ended, Multiple-Choice, and Yes/No 9.4 Clinical Indicators and How to Source Them
10 Compliant Query Practice and Clinical Validation
10.1 Compliant versus Leading and Other Noncompliant Queries 10.2 ACDIS/AHIMA 2026 Guidelines for Achieving a Compliant Query Practice 10.3 Clinical Validation and Diagnoses without Clinical Support
11 CDI Program Metrics
11.1 Productivity, Query Volume, and Provider Response Rates 11.2 CMI, CC/MCC Capture, and High-Frequency DRGs 11.3 SOI/ROM as CDI Program Performance Metrics
12 Physician Metrics, PEPPER, Forecasting, and Public Data
12.1 Measuring Physician Documentation Performance 12.2 PEPPER, Forecasting, Hospital Financial Data, and Public Reporting
13 CDI Roles, Coder Collaboration, and Physician Education
13.1 Roles and Responsibilities of the CDI Specialist 13.2 Coder Roles Working with a CDI Department 13.3 Physician Education Tools, Forms, and Presentations
14 Provider Communication and DRG Reconciliation
14.1 Non-Confrontational Communication and When Verbal Beats Written 14.2 Working DRG versus Final DRG Reconciliation
15 Official Guidelines, Principal Diagnosis, and Secondary Diagnosis
15.1 Official Guidelines, Cooperating Parties, Updates, and AHA Coding Clinic 15.2 Principal Diagnosis Selection 15.3 Secondary Diagnosis Reporting Criteria
16 Sequencing, Coding Conventions, and POA Indicators
16.1 Sequencing When Two Diagnoses Equally Meet PD; Working DRG with Multiple Diagnoses 16.2 Integral Signs/Symptoms, the With Convention, and Uncertain Diagnoses 16.3 Present-on-Admission Indicator Assignment and Payment Impact
17 Hospital-Acquired Conditions, Disposition, and ICD-10-PCS Essentials
17.1 CMS Hospital-Acquired Condition Payment Provision 17.2 Discharge Disposition, Transfer Payment, Principal Procedure, and ICD-10-PCS Essentials
18 Ethics, Privacy, and Leading Queries as Compliance Failures
18.1 ACDIS Code of Ethics and CDI Goals beyond Reimbursement 18.2 HIPAA, Minimum Necessary, and Record Confidentiality 18.3 Leading Queries as a Compliance Failure
19 DRG Creep, OIG Oversight, PEPPER, and the False Claims Act
19.1 DRG Compliance, DRG Creep, and the OIG Work Plan 19.2 PEPPER Compliance Risks and the False Claims Act
20 Mortality Index, Observed-to-Expected Ratios, and Quality Data Sources
20.1 Documentation Impact on Mortality Index (SOI/ROM) 20.2 Mortality Reviews and Observed-to-Expected Ratios 20.3 Abstracted versus Claims-Based Quality Data
21 CMS Quality Programs, PSIs, and Infection versus Complication Codes
21.1 HVBP, HAC Reduction Program, HRRP, 30-Day Mortality, and Hospital IQR 21.2 PSI 90 Components and PSIs beyond the Composite 21.3 Healthcare-Associated Infections versus Complication Codes
18.2 HIPAA, Minimum Necessary, and Record Confidentiality
Key Takeaways Explain This Topic AI
HIPAA's minimum necessary standard (45 CFR 164.502(b) and 164.514(d)) applies to inpatient CDI because documentation review is a health care operations use of PHI, not a treatment exception.
CDI access is legitimate only for patients assigned to the specialist's job function; curiosity, family, coworker, or VIP look-ups are unauthorized.
Keep protected health information off personal phones, cameras, SMS, and personal email; use only organization-approved EHR and messaging systems.
Verbal hallway talk, printers, and social-media case posts can disclose PHI even without a name if the facts identify the patient.
The May 2024 CCDS handbook tests maintaining confidentiality of the medical record and other information relevant to CDI practice.
Last updated: September 2026
18.2 HIPAA, Minimum Necessary, and Record Confidentiality
Quick Answer: A CDI specialist may open an inpatient record only because the job function requires it, and may use only the minimum necessary protected health information to do that job. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule's minimum necessary standard lives at 45 CFR 164.502(b) and 164.514(d) . Personal phones, personal email, and curiosity clicks are outside that job function.
This independent ExamFinch section teaches confidentiality as Domain VII tests it for inpatient CCDS candidates. The May 2024 handbook lists maintaining confidentiality of the medical record and other information relevant to CDI practice. The July 2024 ACDIS Code of Ethics adds a matching duty: preserve, protect, and secure personal health information in every form or medium, follow HIPAA, follow organizational policy, and keep records unavailable to people who are not authorized. ExamFinch is not interpreting enforcement for the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) ; it is teaching the rules specialists actually work under.
PHI, covered entities, and where CDI sits
Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate, in any form. Names, medical record numbers, dates of admission, room numbers plus a rare diagnosis, photographs of a monitor, and a query screenshot are all in scope when they can identify the patient. A hospital operating as a covered entity must apply the Privacy Rule and the Security Rule to its workforce. Inpatient CDI specialists — employed or contracted — are workforce for this purpose when they use the hospital's records to do hospital work.
HIPAA defines health care operations to include quality assessment, outcomes evaluation, reviewing competence of health care professionals, case management, and related administrative functions (see 45 CFR 164.501 ). Concurrent or retrospective CDI review of assigned inpatients is operations work. That classification matters because the minimum necessary standard applies to operations uses. It does not apply to several other pathways listed by OCR, including:
- Disclosures to, or requests by, a health care provider for treatment
- Disclosures to the individual who is the subject of the information
- Uses or disclosures made under a valid authorization
- Uses or disclosures required for HIPAA Administrative Simplification compliance
- Disclosures to HHS for compliance investigations
- Uses or disclosures required by law
CDI is not treatment. The specialist is not the attending, not the consultant, and not the bedside nurse. Opening the entire longitudinal record because it is interesting, or because a friend was admitted, cannot be defended as treatment. Opening the current encounter, and the limited prior documentation needed to clarify this stay, is the operations pattern hospitals encode in role-based access.
Minimum necessary in a CDI workflow
OCR's minimum necessary guidance tells covered entities to identify who needs access, what categories of PHI they need, and under what conditions. Hospitals may allow treating clinicians access to the full record as needed; they must say so in policy when the entire record is necessary. CDI policy is usually narrower: assigned units or service lines, assigned census, assigned review queues. Case-by-case review of every click is not required if the role design already limits the queue. Non-routine access — a VIP, a coworker, a family member, a record on another campus — is supposed to be reviewed against criteria, and the default answer is no.
Practically, minimum necessary for inpatient CDI looks like this:
Task Usually minimum necessary Not minimum necessary
Concurrent review of an assigned medical-unit admission Current encounter, relevant prior records needed to clarify this stay, labs and imaging cited in a query Opening an unassigned psychiatry admission two floors away
Writing a query to the attending Sourced indicators for the question being asked Pasting the entire problem list, social history, and genetic testing report into the query body
Verbal huddle with the attending on the unit The clinical conflict that needs clarification, spoken out of public earshot Discussing the case in an elevator or cafeteria line
Coding collaboration The documentation issue that affects code assignment Forwarding a full discharge summary to a personal email to finish later
Education De-identified examples under hospital policy A social-media post with admission date plus a rare disease
The Security Rule backs the same idea with access controls. 45 CFR 164.308(a)(3) (workforce security) and 164.308(a)(4) (information access management) require procedures so only authorized workforce reach electronic PHI, and so access is removed when the job changes. 45 CFR 164.312(a) requires unique user identification and access control. CDI specialists get individual EHR logins for a reason. Shared passwords, shoulder-surfing a colleague's session, and remaining in a record after the assignment ends are Security Rule problems as well as Privacy Rule problems. Audit logs will show who opened the chart. Curiosity access is still access.
Job-function access, not professional courtesy
Legitimate CDI access is assignment-based . If the work queue, unit assignment, or retrospective batch does not include that patient, do not open the chart. Titles do not expand the right. A CCDS credential is not a master key. A former bedside role on that unit does not revive treatment access. A rumor that documentation is poor on another service is a reason to talk to a manager about assignment, not a reason to self-assign through the EHR.
Sensitive categories need extra care. The ACDIS ethics materials note that genetic, adoption, substance-use, sexual, and behavioral information is easy to misuse. Inpatient CDI specialists will still see those data when they are part of an assigned record. They will not search for them, mention them in a hallway teaching moment, or carry them home on paper. If a query does not need the substance-use history to clarify acute kidney injury staging, leave the substance-use history out of the query text.
Incidental disclosure is not a free pass. HIPAA recognizes that some overheard speech happens in a hospital. It does not authorize a specialist to choose the cafeteria as the place to recap overnight queries. Close the workstation, lower the voice, use a private room or approved secure message, and do not leave query worksheets on a shared printer.
Personal devices are not a second medical record
Hospital policy almost always forbids storing PHI on personal phones, tablets, laptops, USB drives, and consumer cloud accounts. That rule is stricter than a one-line HIPAA prohibition, and CCDS candidates should follow the stricter operational rule. The Security Rule still requires workstation security ( 45 CFR 164.310 ) and transmission security ( 45 CFR 164.312(e) ). Photographing a monitor, a query letter, a census with MRNs, or a white-board list and texting it to yourself is creating electronic PHI on an unmanaged device. So is forwarding an EHR secure message to a personal Gmail address, syncing screenshots to a personal photo stream, or finishing queries in a notes app that backs up to a consumer cloud.
If the hospital has a managed bring-your-own-device program, that program still requires encryption, mobile-device management, and a prohibition on mixing PHI into personal message threads. Absent that program, the exam-safe and job-safe answer is: no PHI on personal devices . Use the virtual desktop, the approved EHR app, and the approved pager or secure chat. If the system is down, wait or use the downtime procedure; do not invent a phone-camera workaround.
Printed PHI is still PHI. Query packets, working-DRG lists, and sticky notes with names plus diagnoses belong in locked shred bins, not in a backpack for the commute. Remote retrospective review belongs on a hospital-managed connection, not on a cafe laptop with an unlocked screen.
Candidate scenario: the former coworker
Priya is assigned to surgical intensive care. The admission board shows a former coworker on the inpatient psychiatry unit. Priya wants to know whether the person is all right and clicks into that record. That click is unauthorized. She is not assigned to psychiatry. She is not treating the patient. Minimum necessary does not stretch to kindness or curiosity. If she is worried as a person, she can follow whatever family or friend communication the patient has authorized; she cannot audit the chart. If she already opened it, she should close it, report the incident through the hospital's privacy process, and expect an audit-log review. Pretending it was an accidental misclick after the fact is worse.
Loading diagram... Decide whether a CDI specialist may open or share inpatient PHI
Exam traps for 18.2
Treatment exception is not a CDI exception. Nurses and physicians may need the full record to treat. CDI specialists need the record to clarify documentation for assigned patients. Do not answer that minimum necessary never applies inside a hospital.
De-identified is a technical standard, not a vibe. Removing the name but leaving admission date, facility, and a rare diagnosis can still identify the patient. Public Facebook or Discord case discussions are a confidentiality failure even when the poster meant to teach.
After-hours convenience is not a safeguard. A passcode on a personal phone does not turn that phone into a covered-entity system. Deleting a photo later does not undo the creation of PHI on an unapproved device.
Query worksheets are PHI. They contain identifiers and clinical facts. They are not exempt because they live in a CDI software module rather than the designated record set label a hospital uses for the legal medical record.
Report, do not hide. Privacy incidents follow organizational incident-response policy. The Code of Ethics tells specialists to seek guidance and report vulnerabilities. Domain VII will not reward covering a click.
Official pages to recheck:
- OCR minimum necessary requirement
- OCR minimum necessary PDF
- ACDIS Code of Ethics PDF (confidentiality principle)