8 governance policies that constrain entity operations, workflow execution, and business rules across the healthcare ontology. Each policy is defined in enterprise-knowledge/policies/ as a Markdown file.
Access to PHI restricted to minimum necessary for job function; role definitions reviewed semi-annually by Privacy Officer
Role-Based PHI Access
PHI access granted by role assignment; cross-department access requires supervisor approval; VIP/restricted patient records require explicit authorization
Break-the-Glass Audit
Break-the-glass override triggers immediate audit log entry; >3 uses by same user in 30 days triggers formal investigation by Privacy Officer
Access Anomaly Detection
Automated detection of unusual access patterns (after-hours, volume spikes, accessing records outside care team); anomalies flagged for review within 24 hours
Breach Notification
Breach notification within 60 days for incidents affecting >500 individuals; immediate notification to HHS and affected individuals per HIPAA Breach Notification Rule
PHI Log Retention
PHI access log retention: 6 years minimum; logs must be tamper-evident and available for audit within 48 hours of request
De-Identification
De-identification per Safe Harbor (18 identifiers removed) or Expert Determination method; re-identification risk assessment required for limited datasets
Consent Management
Consent management for research data sharing and HIE participation; patient opt-in/opt-out tracked; consent expiration and renewal enforced
Clean claim rate target >95%; claims failing front-end edits returned to coding within 24 hours; root cause analysis for rates below 90%
Denial Rework SLA
High-value denials (>$5K): rework within 48 hours; standard denials: rework within 5 business days; aging denials >30 days escalated to Revenue Cycle Director
Timely Filing
100% compliance with payer-specific filing deadlines; automated alerts at 75% and 90% of deadline elapsed; missed deadlines tracked as revenue leakage
Coding Accuracy
Coding accuracy target >97%; quarterly audit of random sample (minimum 5% of encounters); discrepancies >3% trigger coder re-education
Charge Capture
Charge capture reconciliation within 3 business days of service date; missing charges identified by comparing scheduled procedures to posted charges
Underpayment Follow-Up
Underpayment follow-up initiated for variance >5% from contracted rate; appeals filed within payer-specific appeal window; trends reported monthly to CFO
Prior Authorization
Prior authorization submission within 24 hours of scheduling; status tracked through determination; expired auths flagged before service date
ED boarding maximum 4 hours; escalation to house supervisor at 2 hours; >4 hours triggers capacity alert to COO and activates surge discharge protocol
Bed Occupancy
Optimal bed occupancy range 82-88%; below 80%: review elective scheduling capacity; above 90%: activate pre-surge planning
Surge Protocol
Surge protocol activation at >95% predicted occupancy; includes discharge acceleration, elective case review, and regional transfer coordination
OR Utilization
OR utilization target >80% of allocated block time; unused block released at T-72 hours; chronic underutilization (<70% for 3 months) triggers block reallocation
Discharge Timing
Discharge before noon target >40%; barriers-to-discharge huddle daily at 10 AM; pending discharges visible on real-time capacity dashboard
Staffing Ratios
Staffing ratios per state mandate with acuity-based adjustment; understaffing triggers float pool activation then agency escalation
Agency Nurse Cap
Agency nurse hours capped at <5% of total nursing hours; exceeding cap for >2 consecutive pay periods triggers workforce planning review
Fall risk assessment: every shift and on transfer; pressure injury risk assessment: every shift for high-risk patients; reassessment on clinical status change
Generic substitution mandatory unless clinical exception documented by prescriber; brand-only exceptions reviewed quarterly by P&T committee
Controlled Substance Waste
Controlled substance waste requires dual-witness documentation; discrepancies investigated within 24 hours; patterns reported to Pharmacy Director and compliance
Dispense Anomaly Detection
Nurse dispense volume >3σ above unit average triggers automated investigation flag; patterns reviewed weekly by Chief Pharmacy Officer
Expiry Waste
Expiry waste target <1% of total inventory value; FEFO (first expiry, first out) dispensing enforced; monthly expiry report reviewed by Pharmacy Director
Critical Med Stockout
Stockout of critical medications: emergency procurement within 4 hours; therapeutic substitution protocol activated; clinical notification to affected units
Formulary Changes
All formulary additions, deletions, and restrictions require P&T committee approval; clinical evidence review and cost-effectiveness analysis mandatory
ID: POL-REG-001 | Regulatory: CMS / State / TJC | Systems: All
Rule Area
Key Rules
CMS Quality Reports
CMS quality reports filed before deadline (100% on-time target); draft completion required 10 business days before due date for review
Accreditation Readiness
Accreditation readiness score maintained >95% at all times; mock survey conducted semi-annually; deficiencies remediated within 30 days
Policy Review Cycle
All policies reviewed annually at minimum; policies impacted by regulatory changes reviewed within 30 days of effective date
Staff Training
Regulatory and compliance training completion >98%; new hire training within 30 days of start; annual refresher tracked per employee
Regulatory Change Assessment
Regulatory change impact assessment completed within 14 days of publication; affected policies, workflows, and systems identified and remediation planned
Consent Management
Research consent renewal tracked with expiration alerts; re-consent required for protocol amendments; IRB approval status linked to consent records
Audit Trail
All reporting data must have complete audit trail from source system to reported number; lineage documentation required for all regulatory submissions