Canadian Health Information Management Association Practice Exam

Which business use of a health record generally does NOT require patient authorization?

1. Investigation of a patient complaint by department manager

2. Review of documentation by the facility's insurer

3. Review of the record by the patient's attorney

4. A and B

The correct answer is: A and B

The investigation of a patient complaint by a department manager and the review of documentation by the facility's insurer are instances that typically do not require patient authorization due to their role in ensuring quality of care and risk management. These activities are considered part of the healthcare organization's operational functions. When a patient complaint is investigated, it is essential for the healthcare organization to have the ability to review relevant health records in order to address the concerns effectively and ensure that appropriate standards of care are being met. Similarly, insurers need access to patient records to assess claims, perform audits, and ensure that the services provided were necessary and appropriate. These activities are often deemed necessary for organizational risk management and quality assurance, thus falling under exceptions to the general rule requiring patient consent for access to their health information. However, accessing a patient’s health record by their attorney does require authorization since it typically pertains to legal matters or litigation, where the patient's privacy rights are more pronounced. Therefore, the correct choice reflects the understanding that certain internal review processes are essential for operational integrity and can proceed without explicit patient consent.