8.3 Policies for Electronic, Paper, and Verbal Query Communications

Preserve the same query standard across communication channels

A query can reach a provider through an EHR workflow, a paper form, or a conversation. The medium changes how the organization routes, authenticates, retains, and retrieves it. It does not change the need for relevant sourced indicators, neutral wording, appropriate answer options, and independent provider judgment.

Begin by asking what the communication does. Under the 2026 ACDIS/AHIMA query brief, a patient-specific prompt presenting a diagnosis or documentation option can be a query even if a vendor calls it an alert or nudge. Passive reference material that does not direct a response for a specific patient is different. General documentation education is also distinct from a request to clarify a particular encounter.

Design the electronic workflow around a usable question

Use approved channels with appropriate access and encounter identification. The responsible provider should be able to locate the relevant indicators, understand the issue, and enter a response that can be authenticated and retained. Indicators can be included directly or made accessible through direct links as described in the brief. A link should lead to the relevant source information rather than leave the recipient to search an unrelated record.

Define who can create and revise template structure, who can customize patient information, and how versions are approved and retired. Templates require editable or customizable fields for encounter-specific content. A policy that locks every word against any customization can prevent the reviewer from presenting the actual record. Control permissions and review the final content instead of treating free text as inherently noncompliant.

Check the provider-visible title and answer presentation. Do not preselect a diagnosis, emphasize a preferred response, or make the provider agree to a condition to complete the workflow. Provide the alternatives appropriate to the format and situation, using the detailed drafting examples in Sections 15.2–15.3. Software can enforce required fields without predetermining the clinical answer.

Apply security and authentication requirements within their scope

45 CFR 164.312 addresses electronic PHI access controls, audit controls, integrity, authentication, and transmission security. 42 CFR 482.24 addresses hospital record integrity and authentication. Apply the relevant requirements through the organization's security, HIM, and clinical documentation processes.

Neither provision creates a universal query-product specification requiring a particular inbox folder, read receipt, or cryptographic signature on every query. Likewise, 21 CFR 11.1 defines the scope of FDA electronic-record requirements; it is not a blanket authentication rule for every routine hospital CDI workflow. Determine which rules actually apply rather than borrow a requirement from an unrelated regulatory setting.

Useful tracking information may include the encounter, author, issued content, recipient, dates, status, response, authentication, and subsequent corrections. The organization should be able to reconstruct what occurred and protect information from improper alteration or destruction. A read receipt shows a system event, not that the provider supplied a clinically supported answer. An authenticated answer also does not make an otherwise leading question compliant.

Govern automated output as actual queries

Vendor-supplied or AI-generated queries are not compliant by default. Evaluate their source selection, titles, wording, options, routing, and handling of prior answers. A tool that repeatedly offers a diagnosis after the provider has rejected it can create pressure just as a manual process can. Do not send another request solely to override an unwanted response.

The 2026 brief permits human review before delivery or ongoing structured auditing of generated output. For automated delivery without pre-delivery review, it calls for regular structured auditing. It does not mandate a human signature before every automated query, and it does not transfer accountability to the vendor. Define the organizational owner, staff training, audit process, defect reporting, and correction procedure. Detailed technology-risk assessment is developed later in the guide.

Keep paper workflows traceable

Paper forms need clear patient and encounter identification, a secure route to the appropriate provider, an approved response location, and a way to track and retrieve the actual communication. Colored stock or a particular binder position may help a local process, but neither is a national query requirement. A well-controlled paper register can be appropriate; the brief does not require every paper workflow to have a simultaneous electronic ledger.

Assign responsibility for checking that issued forms and responses are accounted for during transfers and discharge processing. Preserve legibility, relevant sources, the provider's answer, and authentication. When scanning is used, confirm completeness, correct indexing, readability, and authorized access. Follow the chosen record arrangement from section 8.2; not every retained paper query must be placed in one universally named electronic LHR folder.

Corrections must preserve an honest account of the original and the change through the approved HIM process. Do not erase, backdate, or silently replace an answered query. The form and record system may require different correction procedures; there is no single handwritten strike-through method that applies to every electronic and paper situation.

Document a verbal query and obtain a record response

The 2026 brief permits verbal clarification, including peer-to-peer discussions, under the same substantive standards. Retain the following elements of the actual discussion:

• Date and time
• Individuals involved
• Clinical indicators and their record sources
• The neutral question explaining the encounter-specific clarification need
• Answer options, when used
• The provider's actual response

Organizational policy defines where this record is maintained and how it is tracked and accessed. Preserve the question and discussion, not merely a notation that the provider “agreed.”

The provider's response must also be documented in the permanent health record to support coding. If that has not occurred, work with the provider to obtain an appropriate entry or addendum, or use a written query channel. A CDI tracking note alone cannot substitute for that provider documentation. Follow local escalation if the provider has not documented the response.

Illustrative workflow: An operative report's header and narrative give different sides for the same procedure. The CDI professional contacts the surgeon who performed it, cites the two entries, and asks neutrally which side is correct. The conversation record preserves the question, sources, participants, time, and answer. The surgeon supplies the appropriate authenticated record clarification through the organization's process. Coding then uses the resolved record and applicable procedure rules. An undocumented instruction to “use the right side” would leave the discrepancy unresolved in the source record.

The example illustrates handling of conflicting entries; it is not a complete query template or a rule to infer laterality from whichever note appears more detailed. A real request needs the actual encounter information and source citations.

Secure messaging does not remove retention duties

A telephone call, bedside discussion, or secure chat may all contain a patient-specific query. Follow the applicable approved documentation process rather than assume that the platform's message history is a sufficient permanent record. If messages expire automatically, arrange retention of the actual query and required response evidence through an approved method. Do not place PHI in an unapproved communication channel or rely on a private recollection of the exchange.

Conversely, a discussion of a de-identified case for education is not automatically a query requiring a fabricated patient record entry. Apply the definition to the actual communication. A defect should lead to review and correction under the organization's policy; it is not, by itself, proof of a False Claims Act violation or a nationally mandated employee sanction.

Test the end-to-end process

Before implementing a new channel, walk through an issued query, an appropriate negative response, a covering-provider change, a correction, a system outage, and later retrieval. Confirm that the system preserves what the provider actually saw, that the answer can be located and authenticated, and that paper or verbal steps are not lost between systems.

Audit real uses after implementation. A technically secure platform can still deliver a leading query, while a compliant question can fail operationally if it is routed incorrectly or never retained. Evaluate content, workflow, record integrity, and provider burden together. The objective is a reliable clarification process with a retrievable account of what happened.