15.3 HIPAA Privacy/Security, Cybersecurity & Internal Coding Audits

AHIMA Certified Coding Specialist CCS

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: ICD-10-CM Diagnosis Coding Fundamentals & UHDDS Guidelines

1.1 ICD-10-CM Structure, Formats, and Core Conventions 1.2 UHDDS Principal Diagnosis Selection Rules 1.3 Secondary Diagnoses Reporting & Present on Admission (POA) Indicators

2 Chapter 2: Circulatory, Cardiac & Vascular Inpatient Coding

2.1 Hypertension, Hypertensive Heart & Chronic Kidney Disease, and CAD 2.2 Acute Myocardial Infarction (AMI) Types & Sequencing 2.3 Heart Failure Types, Acuity & Cardiomyopathy 2.4 Cerebrovascular Disease, Acute Stroke, and Late Effects

3 Chapter 3: Respiratory, Sepsis & Infectious Conditions Coding

3.1 Sepsis, Severe Sepsis, and Septic Shock Guidelines 3.2 Pneumonias, Aspiration Pneumonia, and Influenza 3.3 COPD, Asthma, and Acute Respiratory Failure

4 Chapter 4: Renal, Endocrine, Gastrointestinal & Nutritional Disorders

4.1 Acute Kidney Injury (AKI) & Chronic Kidney Disease (CKD) 4.2 Diabetes Mellitus Types, Manifestations & Complications 4.3 Protein-Calorie Malnutrition & Endocrine Emergencies 4.4 Gastrointestinal Bleeding, Ulcers, and Acute Abdominal Pathologies

5 Chapter 5: Neoplasms, Obstetrics, Perinatal, Injury & Trauma Coding

5.1 Neoplasm Table, Primary, Secondary & Encounters for Therapy 5.2 Obstetrics, Normal/Complicated Deliveries & Puerperium 5.3 Perinatal Conditions & Congenital Malformations 5.4 Traumatic Injuries, Fractures & 7th Character Extensions

6 Chapter 6: ICD-10-PCS Architecture, Conventions & Approaches

6.1 ICD-10-PCS 7-Character System Architecture & Conventions 6.2 ICD-10-PCS The Seven Surgical Approaches 6.3 General PCS Guidelines & Multiple Procedure Rules

7 Chapter 7: ICD-10-PCS Root Operations: Cutting Out, Taking Out & Altering Body Parts

7.1 Excision vs Resection vs Destruction 7.2 Extraction, Drainage, and Extirpation 7.3 Detachment & Amputation Coding 7.4 Release vs Division

8 Chapter 8: ICD-10-PCS Root Operations: Putting In, Putting Back & Moving Body Parts

8.1 Replacement vs Supplement vs Insertion 8.2 Reposition, Transfer, and Reattachment 8.3 Bypass, Dilation, Occlusion, and Restriction

9 Chapter 9: High-Volume Inpatient Surgical & Medical Procedures in ICD-10-PCS

9.1 Coronary Artery Bypass Grafting (CABG) & Percutaneous Coronary Interventions 9.2 Total Joint Arthroplasties & Spinal Fusion 9.3 Mechanical Ventilation & Extracorporeal Therapies

10 Chapter 10: Outpatient CPT & HCPCS Level II Coding & Modifiers

10.1 CPT Evaluation and Management (E/M) Guidelines 10.2 CPT Surgical, Radiology, Pathology & HCPCS Level II Coding 10.3 CPT Modifiers in Hospital Outpatient & Professional Coding

11 Chapter 11: Inpatient Record Review, Clinical Validation & Documentation Integrity

11.1 Inpatient Health Record Analysis & UHDDS Documentation Hierarchy 11.2 Clinical Validation of Diagnoses vs Coding Compliance 11.3 Identifying Reportable Secondary Conditions & Complications

12 Chapter 12: Compliant Provider Queries & AHIMA/ACDIS Standards

12.1 AHIMA/ACDIS Compliant Query Standards & Ethical Principles 12.2 Compliant Query Formats: Open-Ended, Multiple-Choice & Yes/No 12.3 High-Impact Clinical Query Scenarios & Provider Workflow

13 Chapter 13: Inpatient Prospective Payment System (IPPS) & MS-DRG Mechanics

13.1 IPPS Reimbursement Structure & MS-DRG Grouping Logic 13.2 Complications and Comorbidities (CC) & Major CC (MCC) Impact 13.3 All-Patient Refined DRG (APR-DRG) System 13.4 Inpatient Transfer Policies, Cost Outliers & Short-Stay Rules

14 Chapter 14: Outpatient Reimbursement, Coding Edits & Fraud/Abuse Compliance

14.1 Hospital Outpatient Prospective Payment System (OPPS) & APCs 14.2 National Correct Coding Initiative (NCCI) Edits & MUEs 14.3 Hospital-Acquired Conditions (HAC) Reduction & Quality Programs 14.4 Healthcare Fraud, Abuse Laws, Audits & AHIMA Ethical Standards

15 Chapter 15: Health Information Technology, CAC, Encoders & Data Security

15.1 Electronic Health Records (EHR) & Computer-Assisted Coding (CAC) 15.2 Logic-Based Encoders, Groupers & Health Data Systems 15.3 HIPAA Privacy/Security, Cybersecurity & Internal Coding Audits

15.3 HIPAA Privacy/Security, Cybersecurity & Internal Coding Audits

Key Takeaways Explain This Topic AI

HIPAA Safe Harbor de-identification requires removal of 18 identifier categories; those categories are not the definition of PHI. Coding and billing may occur as payment or healthcare operations without individual authorization, subject to applicable minimum-necessary rules and exceptions.

A covered entity needs a Business Associate Agreement with a vendor or contractor that performs a business-associate function involving PHI, unless another HIPAA status or exception applies; remote location alone does not determine business-associate status.

The HIPAA Security Rule requires risk-based administrative, physical, and technical safeguards; specific controls such as encryption, MFA, VDI, privacy screens, and tamper-evident logs are selected and documented through the organization’s risk analysis.

Internal coding audit programs use prospective and retrospective review with risk-based sampling and organization-defined accuracy targets, followed by proportionate education and re-audit.

Last updated: August 2026

HIPAA Privacy/Security, Cybersecurity & Internal Coding Audits

AHIMA CCS Exam Focus: Ensuring data security, patient privacy, and rigorous coding quality is a central mandate for certified coding professionals. On the Certified Coding Specialist (CCS) exam, candidates are evaluated on HIPAA Privacy Rule provisions (including the 18 HIPAA Safe Harbor identifier categories, the Minimum Necessary standard, and TPO exceptions), HIPAA Security Rule safeguard pillars (administrative, physical, and technical controls), cybersecurity protocols for remote/offshore coding, the design of prospective versus retrospective audit programs, risk-based sampling methodologies, and mathematical formulas for calculating DRG and code-level accuracy against an organization-defined accuracy target.

1. HIPAA Privacy Rule & Protected Health Information (PHI) in HIM

The Health Insurance Portability and Accountability Act (HIPAA) establishes federal privacy and security requirements for protected health information. The HITECH Act strengthened this framework through breach-notification requirements, direct accountability for business associates and subcontractors, expanded enforcement and penalties, and incentives supporting adoption and meaningful use of certified electronic health record technology. HIPAA Safe Harbor: 18 Identifier Categories

┌─────────────────────────────────────────┬─────────────────────────────────────────┐
│ 1. Names of patients and relatives │ 10. Account numbers │
│ 2. Geography smaller than a state* │ 11. Certificate / license numbers │
│ 3. Date elements except year* │ 12. Vehicle identifiers / serial numbers│
│ 4. Telephone numbers │ 13. Device identifiers & serial numbers │
│ 5. Fax numbers │ 14. Web Universal Resource Locators(URLs│
│ 6. Electronic mail addresses │ 15. Internet Protocol (IP) addresses │
│ 7. Social Security numbers │ 16. Biometric identifiers (fingerprints)│
│ 8. Medical Record Numbers (MRNs) │ 17. Full-face photographic images │
│ 9. Health plan beneficiary numbers │ 18. Other unique number/trait/code │
└─────────────────────────────────────────┴─────────────────────────────────────────┘

*Safe Harbor has detailed exceptions for certain three-digit ZIP codes and for ages over 89. These categories are a de-identification test, not an exhaustive definition of when information is PHI.

The "Minimum Necessary" Standard in Coding Operations

Under 45 CFR § 164.502(b), covered entities must make reasonable efforts to limit the use, disclosure, or request of PHI to the "minimum necessary to accomplish the intended purpose of the use, disclosure, or request." The standard has defined exceptions, including disclosures to or requests by a healthcare provider for treatment; payment and healthcare-operations work generally remains subject to minimum-necessary policies.

Application to Inpatient/Outpatient Coders: Medical coders need role-appropriate access to the portions of the encounter record reasonably necessary for accurate coding, which may include physician progress notes, consultation reports, operative summaries, pathology results, discharge summaries, nursing flowsheets, and medication administration records. However, coders must not access unrelated past encounters, records of family members, or charts of high-profile patients without an active, assigned clinical coding or auditing business need.

Role-Based Access Control (RBAC): HIM leadership must configure EHR security profiles so that coding staff receive access tailored to their specific job function, preventing unrestricted browsing of non-relevant health system databases.

Treatment, Payment, and Health Care Operations (TPO) Exceptions

HIPAA permits covered entities to use and disclose PHI without obtaining individual patient authorization under the statutory Treatment, Payment, and Health Care Operations (TPO) exceptions:

Payment: Activities undertaken by healthcare providers to obtain reimbursement for health services. Medical coding, Clinical Documentation Improvement (CDI), billing claim generation ( 837I / 837P ), electronic claims transmission, and payer utilization review fall squarely under the Payment exception.

Health Care Operations: Activities related to covered entity operations, including internal coding quality audits, peer review, professional credentialing, compliance training, and accreditation surveys. Internal coding audits are legally conducted under Operations without patient authorization.

Business Associate Agreements (BAAs)

A Business Associate (BA) is any external individual or organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity for a function regulated by HIPAA. Common HIM Business Associates include third-party coding staffing agencies, offshore coding vendors, independent coding audit firms, cloud-based encoder software hosts, and transcription vendors.

Mandatory BAA Provisions: Under the HIPAA Omnibus Final Rule, Business Associates are directly liable for compliance with the HIPAA Security Rule. A compliant Business Associate Agreement (BAA) must explicitly establish:

The permitted and required uses and disclosures of PHI.

The requirement to implement administrative, physical, and technical safeguards.

Mandatory reporting of security incidents and breaches of unsecured PHI to the covered entity without unreasonable delay (and no later than 60 days under federal law).

Binding downstream subcontractors to the exact same privacy and security obligations.

Authorization for the covered entity to terminate the contract if the BA violates a material term.

Return or secure destruction of PHI at termination when feasible; when infeasible, continued protections and limits on further use or disclosure.

2. HIPAA Security Rule & Remote Coding Cybersecurity

While the Privacy Rule focuses on who can access PHI across all mediums (paper, verbal, electronic), the HIPAA Security Rule (45 CFR Part 160 and Part 164, Subparts A and C) establishes federal standards specifically safeguarding Electronic Protected Health Information (ePHI) across three structural safeguard pillars: HIPAA Security Rule: Three Pillars

│
┌─────────────────────────────┼─────────────────────────────┐
▼ ▼ ▼
Administrative Safeguards Physical Safeguards Technical Safeguards
Formal risk analysis • Facility access controls • Unique user identification
Security management process • Workstation use policies • Emergency 'break-glass' access
Workforce security & training• Device & media controls • Automatic session logoff
Contingency / DR planning • Visual privacy controls • Transmission security
Sanction policies for breach • Secure physical disposal • Audit controls/activity review
Technical Safeguards in Modern HIM

The Security Rule is risk-based and technology-neutral. It requires access-control, audit-control, integrity, authentication, and transmission-security capabilities, while many implementation specifications—including encryption—are addressable , meaning the entity must assess reasonableness and appropriateness, implement the safeguard when reasonable, or document an equivalent measure or why it is not reasonable.

Access control: Assign unique user identification and authorize access according to role and minimum necessary use. Automatic logoff, emergency access, and multi-factor authentication can be appropriate controls based on risk; HIPAA does not prescribe one universal MFA configuration.

Audit and integrity controls: Record and examine activity in systems containing ePHI and protect information from improper alteration or destruction. Tamper-evident logging and SIEM monitoring are useful implementations, not named universal technologies in the regulation.

Transmission and storage protection: Encryption, secure VPNs, and contemporary TLS/AES configurations can reduce risk, but HIPAA does not mandate TLS 1.3 or AES-256 by name. Select and document safeguards through the entity's risk analysis and security-management process.

Remote and Offshore Coding Security Protocols

For home-based or offshore coding, an organization should select remote-work safeguards from its risk analysis and document them in policy. Common controls include:

Virtual Desktop Infrastructure (VDI): Coders connect to a virtualized hospital desktop session hosted in the secure hospital data center. No patient data or medical records are ever stored, downloaded, or cached on the remote computer's local hard drive.

Data Loss Prevention (DLP) Policies: VDI environments disable local clipboard copying, local file saving, external USB storage drive connectivity, and local document printing.

Physical Home Workstation Security: Remote coding agreements mandate a dedicated, private home office space with closed doors, clean-desk standards (no written notes with patient identifiers), and reasonable visual-privacy controls to prevent unauthorized viewing. Privacy screens may be appropriate based on the workspace risk assessment but are not universally mandated by HIPAA.

3. Internal Coding Audit Programs: Design, Methodology & Sampling

A comprehensive Internal Coding Audit Program is an indispensable component of hospital compliance and revenue cycle integrity. Audits serve to prevent allegations of healthcare fraud under the False Claims Act, ensure adherence to official coding guidelines, identify physician documentation deficiencies, prevent payer claim denials, and guide targeted coder education. Coding Audit Program Architecture

│
┌───────────────────────────────┴───────────────────────────────┐
▼ ▼
Prospective (Pre-Bill) Audits Retrospective (Post-Bill) Audits
Audited AFTER coding, BEFORE claim drop • Audited AFTER claim drop & payment
Prevents submission of incorrect/false claims • Allows unhurried, large statistical sampling
Catches overcoding and undercoding immediately • Measures actual billing accuracy
Disadvantage: Increases DNFB & delays A/R cash flow • Disadvantage: Requires formal rebilling/refunds
Prospective vs. Retrospective Audits

Audit Dimension Prospective (Pre-Bill) Audit Retrospective (Post-Bill) Audit

Timing Completed after code assignment but prior to claim transmission ( 837I / 837P ) Completed after claim submission and final payer adjudication/remittance ( 835 )

Primary Goal Prevent billing errors, fraudulent claims, and immediate claim denials Measure ongoing compliance baseline, evaluate longitudinal trends, sample large volumes

Cash Flow Impact Temporarily holds claims, increasing Discharged Not Final Billed (DNFB) and A/R days Zero impact on initial billing turnaround and hospital cash flow

Error Remediation Codes corrected directly on the claim prior to billing; zero payer notification needed Requires applicable claim adjustments, rebilling, and overpayment review or repayment under the controlling payer rules and deadlines

Best Application High-risk DRGs, newly hired coders, new regulatory updates, vendor onboarding Routine quarterly compliance benchmarking, annual physician documentation profiling

Sampling Strategies: Random vs. Focused Risk-Based Sampling

To optimize audit resources, HIM departments deploy a hybrid sampling methodology:

Statistically Valid Random Sampling: A randomized selection of inpatient and outpatient records across all service lines to calculate an unbiased, baseline departmental coding accuracy rate.

Focused (Risk-Based) Sampling: Targeted selection of records with high regulatory, financial, or clinical vulnerability. High-yield focused audit targets include:

High-Weight / High-Dollar MS-DRGs: Major surgical procedures, organ transplants, ECMO, mechanical ventilation greater than 96 consecutive hours ( 5A1955Z ), tracheostomy, and extensive burn cases.

Single CC/MCC Inpatient Cases: Records where an MS-DRG is elevated to a higher payment tier by a single secondary diagnosis (e.g., Sepsis, Acute Kidney Injury, Encephalopathy, Severe Protein-Calorie Malnutrition). These cases represent prime targets for payer clinical validation denials.

Hospital-Acquired Conditions (HACs) & Present on Admission (POA) Inconsistencies: Cases with hospital-acquired catheter-associated UTIs, surgical site infections, or stage 3/4 pressure injuries with POA = N (No) or POA = U (Undetermined).

Post-Acute Care Transfer (PACT) Cases: Inpatient discharges assigned MS-DRGs subject to transfer penalty rules where the patient was transferred to home health, skilled nursing, or hospice.

Unlisted Surgical Codes: CPT or ICD-10-PCS claims utilizing unlisted/unspecified procedure codes ( 0YZ... , 47999 , etc.).

Provider Query Compliance: Reviewing query forms to identify non-compliant, leading questions or financial prompts.

4. Industry Accuracy Benchmarks, Formulas & Closing the Audit Loop

Organizations should define and document their own coding-accuracy targets, sampling rules, error weights, and corrective-action thresholds. A 95% target is common in some departments and contracts, but it is not a universal AHIMA-mandated national threshold. Coding Accuracy Formulas

┌─────────────────────────────────────────────────────────────────────────────────┐
│ 1. Code-Level Accuracy Rate (%) │
│ (Total Correct Codes Assigned / Total Codes Evaluated) x 100 │
├─────────────────────────────────────────────────────────────────────────────────┤
│ 2. DRG / Narrative Accuracy Rate (%) │
│ (Total Correct DRGs Assigned / Total Inpatient Cases Audited) x 100 │
├─────────────────────────────────────────────────────────────────────────────────┤
│ 3. Financial Variance & Net Reimbursement Impact │
│ Gross Overpayments - Gross Underpayments = Net Financial Reimbursement Delta│
└─────────────────────────────────────────────────────────────────────────────────┘
Calculating Coding Accuracy

Auditors compute accuracy at two distinct operational tiers:

Code-Level Accuracy Rate (%):

Evaluates the precision of every individual diagnosis and procedure code assigned.

Formula: Code-Level Accuracy Rate (%) = Total Correct Codes Assigned Total Codes Evaluated × 100 \text{Code-Level Accuracy Rate (\%)} = \frac{\text{Total Correct Codes Assigned}}{\text{Total Codes Evaluated}} \times 100 Code-Level Accuracy Rate (%) = Total Codes Evaluated Total Correct Codes Assigned × 100

Where Total Codes Evaluated = Correct Codes + Incorrect/Changed Codes + Missed/Omitted Codes (False Negatives) \text{Total Codes Evaluated} = \text{Correct Codes} + \text{Incorrect/Changed Codes} + \text{Missed/Omitted Codes (False Negatives)} Total Codes Evaluated = Correct Codes + Incorrect/Changed Codes + Missed/Omitted Codes (False Negatives) .

DRG Accuracy Rate (%):

Evaluates whether the assigned codes resulted in the correct final MS-DRG or APR-DRG assignment.

Formula: DRG Accuracy Rate (%) = Total Correct DRGs Assigned Total Inpatient Records Audited × 100 \text{DRG Accuracy Rate (\%)} = \frac{\text{Total Correct DRGs Assigned}}{\text{Total Inpatient Records Audited}} \times 100 DRG Accuracy Rate (%) = Total Inpatient Records Audited Total Correct DRGs Assigned × 100

Note: A case may have a minor secondary diagnosis code error that does not alter the final MS-DRG (e.g., if multiple other valid MCCs exist), resulting in an incorrect code-level score but a 100% correct DRG score.

Step-by-Step Mathematical Example

An auditor reviews 50 inpatient charts. Across these 50 charts, the coder assigned 300 total diagnosis and procedure codes. The audit reveals:

270 codes were completely correct.

15 codes were incorrect (wrong code selected).

15 valid codes were missed and omitted by the coder.

46 of the 50 charts had the correct final MS-DRG assigned; 4 charts had an incorrect MS-DRG resulting from missed or incorrect principal diagnoses/MCCs. Total Codes Evaluated = 270 (Correct) + 15 (Incorrect) + 15 (Missed) = 300 \text{Total Codes Evaluated} = 270 \text{ (Correct)} + 15 \text{ (Incorrect)} + 15 \text{ (Missed)} = 300 Total Codes Evaluated = 270 (Correct) + 15 (Incorrect) + 15 (Missed) = 300 Code-Level Accuracy Rate = 270 300 × 100 = 90.0 % ( below an illustrative organizational 95% target ) \text{Code-Level Accuracy Rate} = \frac{270}{300} \times 100 = 90.0\% \quad (\text{below an illustrative organizational 95\% target}) Code-Level Accuracy Rate = 300 270 × 100 = 90.0% ( below an illustrative organizational 95% target ) DRG Accuracy Rate = 46 50 × 100 = 92.0 % ( below an illustrative organizational 95% target ) \text{DRG Accuracy Rate} = \frac{46}{50} \times 100 = 92.0\% \quad (\text{below an illustrative organizational 95\% target}) DRG Accuracy Rate = 50 46 × 100 = 92.0% ( below an illustrative organizational 95% target )

Closing the Audit Feedback Loop: RCA & Corrective Action Plans

An audit program fails if results are merely archived without actionable remediation. Closing the loop requires a systematic four-phase process:

Loading diagram...

Root Cause Analysis (RCA): Categorize each identified error by underlying etiology: (a) Coding guideline misunderstanding , (b) Encoder logic trap or software misdirection , (c) Incomplete provider documentation requiring a query , or (d) Clerical / typographical oversight .

Individual & Departmental Education: Deliver one-on-one coder mentoring and formal inservice training targeting identified vulnerability trends (e.g., sepsis sequencing, acute myocardial infarction timing rules, root operation differentiation in PCS).

Corrective Action Plan (CAP) & Intensive Pre-Bill Monitoring: When performance falls below the organization's documented threshold, a proportionate corrective action plan may include targeted education, focused pre-bill review, and re-audit. The review percentage, duration, and release criteria should follow local policy rather than an assumed universal rule.

Continuous Quality Improvement (CQI): Trend aggregate audit metrics quarterly to identify systemic documentation opportunities, guiding Clinical Documentation Improvement (CDI) specialist focus areas and physician educational programs.