Clinic software glossary: terms vendors use

Vendors and payers use shorthand that is easy to nod along to. These definitions are general, written for practice managers, and they are not legal advice. For the HIPAA terms, HHS is the source. The EHR vendor question list shows many of these terms in use.

Audit log

A record of who opened, changed, printed or exported what, and when. It is how a practice finds out who touched a record after a problem.

Business associate

A person or company that handles patient information on behalf of a covered entity as part of a service, such as billing, hosting or transcription. Your EHR vendor is usually one.

Business associate agreement

The written contract HIPAA expects between a covered entity and each business associate. It sets out how the associate may use patient information and what safeguards it must keep. Often shortened to BAA.

Certified health IT

Software that has been tested against criteria set by the federal government’s health IT certification program. Listings are public. Certification says the tested functions work. It does not say the product fits your practice.

Charge capture

Recording the services given during a visit so that each one reaches the claim. Missed charge capture is revenue that never gets billed.

Claim scrubbing

Automatic checks that catch errors such as missing fields or mismatched codes before a claim goes to the payer.

Clearinghouse

An intermediary that formats claims, passes them to payers and returns the payers’ responses to the practice.

Clinical decision support

Prompts and alerts inside the EHR that help a clinician at the point of care, such as a warning about a drug interaction.

Covered entity

Under HIPAA, a health plan, a health care clearinghouse, or a health care provider that sends certain transactions electronically. Most clinics are covered entities.

CPT code

A numeric code, published by the American Medical Association, that describes a procedure or service for billing.

Data migration

Moving records from one system to another. It includes mapping fields, a trial run and checking the result against the original.

Denial

A payer’s refusal to pay a claim, in whole or in part. Many denials can be corrected and resubmitted or appealed.

Downtime procedures

The written steps a practice follows when its systems are unavailable, including how to see patients, record what happens and enter it afterward.

EHR and EMR

An EMR is a practice’s digital chart. An EHR is meant to follow the patient across organizations. Vendors and clinics often use the two terms for the same thing.

Eligibility check

Confirming a patient’s coverage with the payer before the visit, so the practice knows what is covered.

Encryption

Scrambling data so that it cannot be read without a key. It can apply to data in transit, such as a message, and to data at rest, such as a stored file or backup.

ePrescribing

Sending a prescription from the EHR to a pharmacy electronically instead of on paper or by phone.

FHIR

Fast Healthcare Interoperability Resources, a standard from HL7 for exchanging health data through web-based interfaces. It is increasingly how apps and portals pull data from an EHR.

HL7

A standards organization for health data exchange. People also use the name for its older message formats, which many lab and imaging connections still use.

ICD-10

The code set used to record diagnoses on a claim. ICD-10-CM covers diagnoses and is separate from the procedure codes.

Interface

A connection that passes data between two systems, such as an EHR and a lab. Interfaces often carry setup fees and have to be maintained.

Interoperability

The ability of different systems to exchange data and use what they receive. In a clinic it is the difference between data that flows between tools and data someone retypes.

Minimum necessary

A HIPAA standard that asks a practice to limit the patient information used or shared to what is needed for the purpose. There are exceptions, including disclosures for treatment.

Multi-factor authentication

Signing in with more than a password, for example a password plus a code from a phone. It makes a stolen password less useful.

Patient portal

A secure website or app where patients can see parts of their record, message the practice, fill in forms and book visits, depending on what the practice turns on.

Practice management system

Software for the business side of a practice: scheduling, registration, billing and reporting. It may be part of an EHR or a separate product.

Prior authorization

Approval a payer requires before it will cover a service or drug. The practice usually has to submit clinical information to get it.

Protected health information

Individually identifiable health information that a covered entity or business associate holds or sends. Often shortened to PHI.

Remittance advice

The payer’s explanation of how it handled a claim: what it paid, what it adjusted and why. The electronic version is often paired with an electronic payment.

Revenue cycle management

The whole path from scheduling and registration through coding, claims, payment posting and follow-up on unpaid balances.

Risk analysis

A documented review of where electronic patient information is held and what could threaten it. The HIPAA Security Rule expects one, and it should be repeated as systems change.

Role-based access

Giving each user only the access their job needs, by assigning them a role such as front desk, nurse or biller.

Superbill

An itemized form listing the services a patient received along with the codes for them. It feeds the claim, and patients sometimes use it to file with an insurer themselves.

Unique user identification

A HIPAA Security Rule requirement to give each user their own login so that activity can be traced to one person. Shared logins defeat it.