16.3 Policies, Legal Compliance, and Ethical Principles

16.3 Policies, Legal Compliance, and Ethical Principles

Quick Answer: Task A.8 is develop policies and procedures for information and systems management. Task A.9 is comply with legal and regulatory standards. Task A.10 is understand and comply with the organization’s ethical business principles—conflicts of interest, vendor gifts, and dual loyalty. A steak does not recuse you.

These three tasks are how Domain 4 keeps power from becoming improvisation. Chapter 3 covered HIPAA, HITECH, interoperability policy, and accreditation as environment. Chapter 14 turned privacy and security into access and safeguards (Domain 3 E tasks). Here the management verbs are write the local rule, obey the external rule, and stay unbought. Management and Leadership remains 25% of the 100-scored-item, two-hour form.

CPHIMS practice questionsPractice questions with detailed explanations

Recertification context you should not invent: the cycle is three years, 45 CE hours, including 2 hours of ethics or conflict-of-interest content. HIMSS does not publish a CPHIMS pass rate and does not publish a CPHIMS-official gift-dollar schedule. Use the organization’s COI and gift policy plus applicable law.

A.8 Policy versus procedure, and why both exist

A.8 is information and systems management: access and joiner-mover-leaver, change control, backup and restore, data retention and legal hold, acceptable use, vendor and cloud use, AI or decision-support content control, downtime, and who may grant elevated privilege. Privacy-and-security policy work in chapter 14 still applies; do not pretend A.8 is only passwords. Do not pretend it is only privacy either. A change-control policy with no procedure is a sermon. A restore runbook with no policy is an unauthorized habit.

Lifecycle the exam will reward:

1. Trigger: law, accreditation, incident, audit, new system, or a gap you can show.
2. Draft with operations, privacy, security, compliance, and the people who will do the steps.
3. Approve through the governed body—not a hallway “looks good.”
4. Version, owner, effective date, review date.
5. Communicate and train the people in scope. A PDF on a share is not implementation.
6. Audit for actual use. Retire or revise when the system or the law moved.

If staff must break the procedure to finish a shift, the procedure is wrong or the staffing is wrong. Do not “fix” that with a silent exception list only three analysts know.

A.9 Comply—do not freelance the statute

A.9 is a compliance task, not a legislative drafting task. You are not asked to recite penalty tables (those move). You are asked to stop, redesign, or escalate when a plan would violate a standard that applies:

• Privacy and security of PHI (HIPAA/HITECH and organizational policy)
• Interoperability and information-blocking rules (chapter 3)
• Retention, legal hold, and discoverability
• Conditions of participation, payer contracts, and accreditation patient-rights or environment-of-care requirements that touch systems
• Fraud-and-abuse risk when vendor funds, physician arrangements, or referral data are in the design
• FDA or other device rules when software functions as a medical device—know when to call the specialist, not when to guess a classification on a stem

Compliance behaviors that survive stems:

• Name the applicable rule. A state privacy law, a 42 CFR Part 2 constraint, or a research IRB is not optional because the EHR “can” do the extract.
• Do not innovate around a prohibition. “The board wants the portal dark until we are ready” is still an information-blocking problem if the rule applies.
• BAA before PHI, as chapter 11 already taught. An NDA is not compliance.
• Escalate early. A.9 is failed when the CPHIMS professional waits until after go-live to mention the legal issue.

A.8 writes the local operationalization. A.9 is why you cannot waive it for a favorite project.

A.10 Ethical business principles: conflicts, gifts, dual loyalty

The handbook language is understand and comply with the organization’s ethical business principles. Typical content—and the examples the plan expects you to handle—includes:

Conflicts of interest. You (or a household member) have a financial, employment, equity, or decision interest that a reasonable person would think could bias a systems decision. Owning vendor stock while scoring that vendor’s RFP is a conflict. Moonlighting for the implementer you are overseeing is a conflict. The remedy is disclose to the governed channel and recuse from the decision, not a private promise to “be objective.”

Vendor gifts and entertainment. Meals, tickets, conference travel, devices, “advisory” honoraria, and family junkets are influence unless the organization’s policy and law clearly allow a narrow courtesy and you document it. “Everyone in HIT does dinners” is not a principle. If the gift would look ugly on the evening news beside an award decision, do not take it. When in doubt, decline or route through compliance—do not self-clear because the steak was “educational.”

Dual loyalty. You owe the employer, patients, and the public a duty, and someone else is paying for a slice of your judgment. Classic HIT forms:

• Sitting on a vendor customer board while writing the RFP those products will answer
• Employed by the health system and incentivized (bonus, equity, future job) by a supplier
• Clinician-informaticist promoting a tool they invented or licensed to the same organization without a managed conflict process
• Consultant retained by both the buyer and the seller on the same selection

Dual loyalty is not solved by working longer hours. It is solved by transparency, recusal, and sometimes by refusing the second hat.

Ethics is also how you treat data and people: do not spy in the EHR “because I can,” do not trade patient stories for a demo, do not bury an adverse finding to save a vendor relationship. Those are A.10 failures even when no gift changed hands.

Distinctions the exam will punish

• Policy versus procedure versus a slide.
• A.8 write local rules versus A.9 comply with external standards versus chapter 14 implement privacy/security controls.
• Disclose and recuse versus “I can be fair.”
• Organizational COI/gift policy versus a made-up HIMSS dollar cap.
• Relationship management (chapter 18 vendors) versus bought influence.

Scenarios and exam traps

Scenario. Operations wants a “flexible” downtime practice “until we write policy later.” A.8 says write the policy and the procedure before the next outage trains you in public. A checklist on one analyst’s laptop is not an information-systems policy. Approve it, train the house supervisor, and audit the next event.

Scenario. A product owner asks to keep electronic discharge summaries from leaving the organization until the portal “looks better,” even though the records are complete and a request is on the table. That is an A.9 problem (information-blocking / access rules from chapter 3), not a branding preference. Redesign the portal later; do not withhold the designated record set to spare embarrassment.

Scenario. A vendor offers two conference flights, a dinner, and a “customer advisory” stipend the week your committee scores its RFP. Disclose to compliance, recuse from scoring, and decline anything the gift policy does not clearly allow. Staying on the committee because you “know the product best” is the conflict. Dual loyalty is the stipend plus the score.

Scenario. You hold equity in a documentation vendor. Your spouse just joined that firm. You are the internal chair for an ambient-scribe selection. File the COI and get off the chair. Objectivity speeches are not a control. If the organization still wants your technical facts, give them as a recused witness, not as a voter.

Scenario. Recertification paperwork is due. You have plenty of informatics CE and zero ethics hours. The requirement is 45 hours in three years including 2 ethics/COI hours. Technical conferences do not silently satisfy A.10’s professional duty or the renewal rule.

Watch these traps:

1. Calling a slide deck or a vendor SOP “the policy.”
2. Treating A.8 as only privacy, or treating A.9 as a reason to memorize stale civil-money-penalty tables.
3. Waiving a legal standard because the project is late or the board is excited.
4. Self-clearing gifts, meals, or honoraria as education.
5. Keeping a second hat (vendor board, equity, family employment) off the COI process while you award work.
6. Inventing a HIMSS-official CPHIMS gift-dollar limit or a published exam pass rate.

/practice/cphimsPractice questions with detailed explanations