The shorthand of the records world — HIM, ROI, TAT, and the rest of the vocabulary that shows up in statutes, invoices, and request forms. Plain definitions for every term we use, so nothing on this site needs a decoder.
Book a demo
Trusted across the network
490K+ record requests fulfilled annually
4.9
rating across 1,707 reviews on Google
Core terms
HIM
Health information management — the department responsible for medical records, their accuracy, their retention, and their release.
ROI
Release of information — the process of disclosing medical records to an authorized requester. Not return on investment, though both appear on this site.
TAT
Turnaround time — how long a request takes from receipt to delivery. The primary performance measure for a records department.
PHI
Protected health information — individually identifiable health information covered by HIPAA.
Right of access
The federal right of an individual to obtain a copy of their own medical records, generally within 30 days and at a limited, cost-based fee.
Minimum necessary
The HIPAA principle that a disclosure should include only the information needed for its stated purpose, rather than the entire chart by default.
Information blocking
Practices that unreasonably interfere with access to or exchange of electronic health information, prohibited under the 21st Century Cures Act.
Authorization
The signed permission that allows a provider to release records to a specific party for a specific purpose and scope.
Custodian of records
The person or organization legally responsible for maintaining a set of records and attesting to their completeness.
Certification
A signed attestation that records produced are a true and complete copy of the record as kept, usually required for court.
MRA
Medicare Risk Adjustment — the process by which plan payments are adjusted for member health status, requiring chart review to substantiate diagnoses.
HEDIS
Healthcare Effectiveness Data and Information Set — a standardized set of quality measures, many of which require abstraction from medical records.
RADV
Risk Adjustment Data Validation — an audit verifying that diagnoses submitted for risk adjustment are supported by the medical record.
Disclosure accounting
The record a covered entity must keep of certain disclosures of PHI, which a patient can request.
BAA
Business associate agreement — the contract governing a vendor that handles PHI on behalf of a covered entity.
SOC 2
An independent audit report on a service organization’s controls for security, availability, confidentiality, processing integrity, and privacy.
Audit log
A time-stamped record of every event on a release of information request — who did what, and when. Also called an audit trail.
Care coordination
Sharing information about a patient’s care among everyone on their care team, including making sure referrals are handled on time.
Covered entity
A healthcare provider, health plan, or healthcare clearinghouse that sends health information electronically in transactions governed by Department of Health and Human Services standards.
EHR
Electronic health record — a view of a patient’s health drawn from every provider involved in their care, open to the clinicians the patient authorizes.
EMR
Electronic medical record — the digital version of a patient’s chart, kept by one provider to care for that patient.
ePHI
Electronic protected health information — PHI created, stored, sent, or received in electronic form by covered entities and their business associates.
HIE
Health information exchange — providers accessing and sharing a patient’s health information electronically, so care isn’t held up waiting on records.
HIPAA
Health Insurance Portability and Accountability Act — the federal law that sets standards for protecting PHI and gives patients access to their own records.
HITECH Act
Health Information Technology for Economic and Clinical Health Act — the law that promoted EHR adoption and, in Subtitle D, strengthened civil and criminal enforcement of HIPAA.
Medical record
The chronological history of a patient’s health issues, diagnoses, and test results, with every procedure performed and treatment prescribed.
Quality assurance
Checking every release for quality, privacy, and security — that the authorization is complete and valid, and that everything released is correct.
Referral management
Running the handoff when a patient is referred to another provider, usually a specialist, with visibility into which specialists are in the area or network.
Requester
The patient or party asking for records. When the requester isn’t the patient, the patient must authorize the release first.
State statute pricing
The copy charge state law allows for medical records, as a flat fee or a capped per-page rate. Where that charge isn’t supported by the real cost of copying, HIPAA’s cost-based limit on patient access prevails.
The terms in context
Guides that put these terms to work
Each one takes a handful of the definitions above and shows what they mean for a real request.
