Enterprise Content and Record Management for Healthcare

It is estimated that more than 90 percent of all information created and used in organizations today is electronic.1 While the current rate of electronic health record (EHR) adoption may lower this figure in some healthcare organizations, the trend is clearly toward an increase in electronic information. The requirement to better manage electronic health information and the dearth of management strategies to help the healthcare industry meet demands such as e-discovery and compliance has highlighted the need for an overarching strategy to aggressively manage records and content.

To avoid fragmented, chaotic information processes, healthcare organizations must adopt an integrated set of strategies, standards, best practices, and technologies for managing patient-centric and organizational information. This practice brief explores the emerging requirements for enterprise records and content management in healthcare organizations.

A Broadening Role for HIM Professionals

Traditionally, HIM professionals have managed the health record, whether it is paper-based, hybrid, or electronic. However, an increasing number of HIM professionals are expanding their role to manage all types of clinical content, including PACS images, voice, text, and speech files, e-mail, and software versions, regardless of whether it is officially part of the health record.

A broader role for HIM professionals is now emerging in the form of the enterprise records manager. The position oversees all of a healthcare organization’s records and content, including financial, administrative, and clinical data.

Depending on job description and expertise, HIM professionals may be responsible for record and content management on a number of different levels (see “Levels of Content and Records HIM May Manage,” at right). However, this role involves enterprise content and records management (ECRM).

ECRM combines two concepts: electronic records management and enterprise content management. At the foundational level, the two main components are defined as follows:

Electronic records management is the electronic management of digital and analog records contained in IT systems using computer equipment and software according to accepted principles and practices of records management. Records management is the field of management “responsible for the efficient and systematic control of the creation, receipt, maintenance, use, and disposition of analog and digital records, including processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records.”2

Enterprise content management includes the technologies, tools, and methods used to capture, manage, store, preserve, and deliver content across an enterprise.3

Briefly described, content is generally considered the intellectual substance of a document. A record is defined as information created or received in the transaction of business and maintained as evidence in pursuance of legal obligations. Appendix A , “ECRM Concepts, Terms, and Definitions,” offers key concepts and definitions of the various aspects of ECRM. All appendixes are included in the online version of this brief, available in the FORE Library: HIM Body of Knowledge at www.ahima.org.

ECRM principles outlined here can and should be applied to all types and levels of information from the health record to all the organization’s business records.

Levels of Content and Records HIM May Manage

Depending on job description and expertise, HIM professionals may be responsible for content and record management of varying scope, from traditional management of health records to a wide range of clinical content and organizational records.

The Case for ECRM

Many healthcare organizations are learning the unique challenges associated with managing electronic health information. According to Gartner, “Organizations need to recognize information as a business asset and manage it effectively in order to increase value, reduce risk, and improve operational efficiency.”4 ECRM strategies applied to health records, health information, and organizational information provide value to the entire enterprise by facilitating the location and use of information and effectively managing it throughout its lifecycle.

Business drivers for ECRM in healthcare organizations include the following functions.

User efficiency. The facilitation of patient care and associated processes is a common driver for ECRM in healthcare. Clinicians are frequently concerned with the vast amounts of information they must sift through in order to render patient care.

ECRM initiatives respond to the need to organize this vast amount of information so that it can be accessed easily during the patient care process. In this way, ECRM supports patient safety and quality of care. However, its application is not limited to direct patient health information. It may also be applied to policies and procedures, workflow processes, and business documents such as contracts and directories that support patient care and the organization’s business needs.

Ideally included in an organization’s overall information governance and management plan, ECRM initiatives provide fast, efficient access for multiple purposes, including patient care.

Legal and regulatory compliance. Healthcare organizations must ensure compliance with a plethora of legal and regulatory mandates, including those related to billing, state licensures and certifications, and federal and state privacy and security regulations. They must also be able to appropriately locate and access information in order to compile a complete legal health record.

Due to the prospect of e-discovery, the massive growth of unstructured content and potential for its loss if not properly managed contribute to risk and legal exposure. The appropriate application of ECRM strategies and tools is critical in mitigating these risks.

Any information that could be relevant evidence in a lawsuit is discoverable. In the absence of ECRM, an organization’s ability to collect, review, and preserve electronically stored information can be onerous and costly.5

Effective record control policies and procedures regarding retention and disposal requirements can reduce costs associated with e-discovery by decreasing the amount of information that needs to be retrieved if records are appropriately destroyed at the termination of their required retention period. These policies and procedures can also reduce the cost associated with restoration of content maintained on media that is difficult to reproduce or that has become obsolete.

An organization’s failure to produce relevant requested electronically stored data can potentially result in significant fines or sanctions.

Accreditation and regulatory standards. When components of an EHR are housed in various systems, viewing a patient’s complete health record can be difficult, and an inability to present complete and current information can pose a patient safety issue. Accreditation and regulatory bodies may have standards that address this issue. For example, the Joint Commission’s accreditation standards require timely and easy access to complete information throughout the healthcare organization, whether paper-based systems, electronic systems, or hybrid systems.6

Accredited organizations must have processes in place to effectively manage information, including its capture, reporting, processing, storing, retrieving, disseminating, and display of clinical/service and nonclinical data and information. In addition, the healthcare organization is required to have a complete and accurate health record for each patient assessed, cared for, treated, or served. ECRM is an important strategy for complying with information management and health record standards and regulations.

Business continuity. ECRM involves identifying the organization’s mission-critical records and content and planning for management during manmade or natural disasters, making it a critical part of business continuity planning.

Lifecycle Records Management

Content and records, regardless of how they are created and maintained, must be managed throughout their lifecycle, from creation through final disposition. This illustration identifies the major phases in the records management lifecycle.

Source: Sprehe, J. Timothy. “Enterprise Records Management: Strategies and Solutions.” White paper. September 2002. Available online at www.hummingbird.com/alt_content/binary/pdf/collateral/wp/rmstrategies.pdf.

Records Management Lifecycle

The record lifecycle is the foundation of ECRM principles. “Lifecycle Records Management,” opposite, illustrates the record lifecycle from creation through final disposition. The cycle applies to all types of enterprise records, including health records.

The following stages of a record’s lifecycle explore the elements of the records management lifecycle and address common components of records management and expand the descriptions for each phase of the lifecycle.

Record creation, capture, or receipt. This phase includes creating, editing, and reviewing work in process as well as capture of content (e.g., through document imaging technology) or receipt of content (e.g., through a health information exchange).

Every organization must establish business rules for determining when content or documents become records. For example, a clinical document must be authenticated or signed in order to be considered a record, or diagnostic results designated as “preliminary” are not considered to be a record until they are designated as “final.”

Examples of content that are not considered to be records may include items such as the initial versions of a document, preliminary results, drafts, working documents, and informal communications. The organization decides whether and when this content may be disposed of.

Record maintenance and use. Once records are created they must be maintained in such a way that they are accessible and retrievable. Components of this phase include functions, rules, and protocols for indexing, searching, retrieving, processing, routing, and distributing.

Record classification and metadata. Classification is a critical component of records management. Though not a unique point in the lifecycle, it does support the other phases. Record classification creates categories or groups of records necessary for access, search, retrieval, retention, and disposition of records.

Metadata are generated at various points in the records management lifecycle, providing underlying data to describe the document, specify access controls and rights, provide retention and disposition instructions, and maintain the record history and audit trail.

Record audit and data controls. Controls and audits support a variety of phases in the record lifecycle. Functions and processes in this component of records management may include edit checks at the data level, decision support tools, identification of classes of records that require auditing, and checks for record completeness.

Record preservation and retention. Preservation is synonymous with storage. Issues associated with preservation include: technology and media obsolescence, media degradation, media in an archival system, conversion over time, and conversion of standards over time.

Closely associated with preservation is retention or the identification of periods of times after which records and content will no longer be kept and are subject to destruction. Planning for preservation and retention should also include strategies to identify and prevent modification or destruction of records that are needed for legal purposes or so-called legal hold.

Record disposal encompasses the destruction process for data and records including the various media type and documentation of destruction.

ECRM Tools and Technologies

Enterprise content and record management is accomplished through a combination of organizational policies, tools, and technologies. The healthcare industry, like other vertical market industries (e.g., finance, energy, insurance, and transportation), has developed a plethora of information systems to meet its own specific business needs, such as EHR systems, patient financial systems, and picture archive and communications systems. However, as in other industries, the technology is focused on the unique transactional and database needs to support healthcare processes and does not usually include functionality to help manage records and content.

The IT industry has developed a multitude of systems to improve the content, documentation, and record management processes common to all industries. These information systems collectively are referred to as enterprise content management (ECM) information systems. ECM system component tools and technology help organizations manage content stored in documents and records to achieve business goals.

Common ECM system tools and technologies include, but are not limited to:

Automatic identification and character recognition technologies, including bar coding, intelligent character recognition, optical character recognition, and optical mark recognition, allow large amounts of analog data to be converted into digital data without manual data input.

Categorization or classification tools automate the placement of content into categories or classes for future retrieval based on the taxonomy.

Computer output to laser disk and enterprise report management technology stores and indexes computer output (primarily computer reports with report-formatted data) on magnetic disks, optical disks, and magnetic tape. Once stored, the reports can be retrieved, viewed, printed, faxed, or distributed to the Internet.

Collaboration technologies enable individual employees or business partners to easily create and maintain project teams regardless of geographic location. As such, they facilitate team-based content creation and decision making.

Document management technology controls and organizes documents. Electronic features and functions specific to document management technology include:

  • Document assembly, whereby health record documents can be automatically retrieved in the correct order, based on predefined, user-specific rules and table.
  • Document version (or revision) control, whereby health record documents can be automatically assigned version numbers. For example, daily laboratory test result reports (version 1) versus cumulative summary laboratory test result reports (version 2); preliminary radiology procedure result reports (version 1) versus final radiology procedure result reports (version 2); and transcribed operative reports (versions 1, 2) versus signed transcribed operative reports (version 3) versus amended transcribed operative reports (version 4). Typically, only the most recent or last document version is accessible for view purposes.
  • Document check-in and check-out services, whereby users can collaboratively view, review, and edit shared documents without concern about who might be simultaneously updating the document. Clinical teams that author progress notes are an example of document sharing using check-in/check-out capabilities.
  • Document security consists of all the technical document tools to protect, control, and monitor document access (e.g., unique user identification or authentication, audit trails, automatic log-offs, and biometric identifiers) and to prevent unauthorized access to documents transmitted over a network.

Electronic document imaging technology captures data via scanning, faxing, or automatic identification. It also stores and retrieves documents regardless of original format.

E-mail management technology classifies, stores, and destroys e-mail messages consistent with organization standards, just like any other document or record.

Forms processing technology accepts scanned forms and extracts data from boxes and lines on forms to populate databases.

Records management technology electronically identifies records and retains them in a secured repository. It also provides controlled access to records and destroys records in accordance with predetermined retention schedules based on either outside regulations or internal business practices.

Electronic features and functions specific to records management technology include:

  • Record capture, where a predefined set of metadata are established supporting accurate representation of the record with disciplined disposition and retention actions
  • Record preservation format, where a format, such as eXtensible mark-up language (XML) or portable document format (PDF), is established for retrieval and cross-departmental interchange
  • Record retention calculation, where “triggers” automatically save electronic documents or Web content as records according to pre-established business rules
  • Record disposition control, where rules provide electronic notifications to managers that certain records or documents have met their retention dates and require manual confirmation to delete, save, or destroy
  • Record deletion and destruction and suspension of record deletion and destruction to support litigation

Search/Retrieval technologies allow users to get out of the system what users put into the system.

Taxonomy tools provide a formal structure for information based on an organization’s individual needs.

Web content management technology addresses Web-based content creation, review, approval, and publishing processes.

Workflow automation and business process management technology automates business processes, in whole or in part, where documents, information, or tasks are passed from one participant to another for action according to a set of rules. A business process is a logically related set of workflows, work steps, and tasks that provide a product or service to customers.

Desired Functionality

As discussed, some EHR and health IT systems contain few ECM component tools and technologies. Healthcare organizations typically acquire and implement separate ECM systems that complement the acquired and implemented EHR and related systems.

In addition, few ECM information systems contain all the above-mentioned component tools and technologies, and many are provided as toolkits, allowing an organization to develop the required information system based on its unique needs.

The following identifies the most desired functionality to help manage health records and other types of content in a healthcare environment:

  • Declaration of records: As mentioned, not all content and documents become records (see definition of “record” in appendix A). Software can assist with the process of proclaiming documents and content as official records and support organizational policies related to the official legal health record and designated record set.
  • Taxonomy management provides a shared vocabulary that an enterprise can use to organize and find information.
  • Version/revision control facilitates the management of multiple revisions of the same unit of information. Changes are usually identified by incrementing an associated number or letter code, termed the revision number, revision level, or simply revision, and associated historically with the person making the change. Revision control allows organizations to revert to a previous revision, which is critical for allowing legitimate users to correct mistakes and to allow groups of editors to track each other’s edits. Each version is associated with its own set of metadata.
  • Workflow automation/business process management products allow a company to create a workflow model and components, such as online forms, and then use this product to manage and enforce the consistent handling of work.
  • Audit logs and trails are used to monitor individual use of computer systems, security, reconstruction of problem events, problem monitoring, and intrusion detection.
  • Search engines are retrieval systems that quickly locate information stored on computers. Users enter specific criteria about an item and the engine locates matching items in a short amount of time. An electronic master patient index uses a search engine to locate specific patients within its data repository.
  • Preservation and legal hold: The 2006 changes to the Federal Rules of Civil Procedure identify the need to preserve and place litigation holds on electronically stored information. Once litigation is reasonably anticipated, the organization has the obligation to suspend routine record destruction activities and place litigation holds on data and information until the legal matter is resolved. Health Level Seven’s Record Management and Evidentiary Support Profile addresses EHR requirements that pertain to preservation, retention, litigation hold, and destruction of electronically stored health information.

System Selection and Governance

An organization’s system selection process should follow standards. These standards should include a process that identifies the needs and a plan to meet the specific business objectives as well as a comprehensive method for system selection. Appendix B, “ECRM System Selection Techniques and Tools,” provides recommended techniques and tools for system selection. It is available in the online version of this brief.

Healthcare organizations frequently select “best of breed” health information systems and use varying implementation strategies to manage the transition to these systems while ensuring that users have the features and functions necessary to perform specialized tasks. This almost always affects HIM functions and requires process changes in the HIM department.

HIM-specific scenarios that incorporate ECRM concepts and technologies are outlined in appendix C, also available in the online version. The scenarios provide HIM challenges that demonstrate common uses for the ECRM technologies for records completion, release of information, and health records management and retention.

Implementing an enterprise record and content management program requires significant organization, process, and changes to job responsibilities. The organization must determine how ECRM will be integrated throughout all departments. It must implement a governance plan that identifies policies and procedures, enabling technologies, assignments of accountability, and ownership of various program aspects.7

To effectively address, manage, and communicate the myriad policies, the organization must establish an oversight committee to bring decision-makers and data stewards to the table. For example, an enterprise records committee should provide monitoring and oversight of ECRM strategies and be the approval authority for the designated subcommittees. Appendix D, available in the online version, provides a suggested staffing model for this committee, a subcommittee structure, and committee responsibilities.

Appendixes Available Online

Definitions, selection tools, and sample staffing models are available in five appendixes included in the online version of this practice brief. It is available in the FORE Library: HIM Body of Knowledge at www.ahima.org and through www.ahima.org/infocenter/briefs.asp.

  • Appendix A: “ECRM Concepts, Terms, and Definitions”
  • Appendix B: “ECRM System Selection Techniques and Tools”
  • Appendix C: “Health Information Records and Content Management Scenarios”
  • Appendix D: “Enterprise Records Committee: Suggested Staffing Model, Subcommittee Structure, and Responsibilities”
  • Appendix E: “ECRM Sample Job Description

ECRM Roles

Achieving a fully implemented enterprise-wide content and record management program may take several years. Starting the process with business units that already recognize the importance of data and compliance with regulatory standards (e.g., HIM, finance, human resources, and internal audit) may help expedite the early phases of the project. Additionally, integrating roles and responsibilities into existing departments, functions, and committee structures with related responsibilities (e.g., information security or litigation response team) may be beneficial.

Records and content management applies to everyone and every business unit within the organization that creates, maintains, or uses electronic or paper-based records.8 Therefore, various roles and responsibilities need to be clarified. The following section expounds on these various roles for units and individuals.

Business Unit and Department Roles

Records are created as a result of an organization’s business needs and processes; however, they are typically created at the business unit level. Roles and responsibilities at the business unit (or department) level need to be identified for the frontline staff and knowledge workers, the record custodian, and the business unit manager.

It is the frontline staff and knowledge workers that often create, retrieve, and use content. This group should be aware of the rationale for the records management program and their responsibilities within it. The group must be proficient in distinguishing records from nonrecords, using appropriate security measures, and classifying documents.

Subject matter expertise about record content and maintenance requirements tends to be domain-specific. For example, human resource staff is most familiar with the requirements for managing human resource records. For this reason, many ECRM programs use a model in which a record custodian is identified as a subject matter expert for a given domain for each business unit.

The record custodian is responsible for records maintenance procedures including indexing electronic and paper records, purging records for storage and destruction, using ECRM technologies, and outlining documentation destruction and related procedures.

Managers of business units or departments are responsible for ensuring that staff create and maintain records according to established policies and procedures. Business unit managers are also responsible for maintaining record integrity. They do so by identifying record classification methods and retention schedules for various record types, ensuring compliance with retention schedules, and placing a hold on record destruction for specific cases. Overall, the business unit manager is seen as the data steward for content and records created and used by the unit.

Finally, business unit managers’ awareness and commitment is essential to the success of any ECRM program.9,10

HIM Department Roles

The HIM business unit manager serves a dual ECRM role. As the organization’s subject matter expert in health record content and management, the first role of the HIM manager is custodian for the organization’s legal health record.

Healthcare organizations should identify the components of their legal health records and how they will ensure that the integrity of the legal health record and its various components are assembled and maintained.11 Because sections of a health record often originate in different business units within a facility (e.g., radiology department creates an MRI report and nurse creates a pressure ulcer assessment), consideration needs to be given to both the operational needs of the various business units as well as requirements for ensuring a sound legal document.

This requires that the business unit managers, the data stewards, and the HIM managers (the legal health record custodians) collaborate to ensure that the record meets all organizational needs.

The second role of the HIM manager is that of steward for records created and used by HIM staff that are not part of the health record. This role is similar to the role of other business unit managers.

HIM managers also often serve on committees with responsibility for ECRM oversight.

Organizational Oversight for ECRM

Oversight for the ECRM program is established by assigning executive responsibility with operations managed through an enterprise records and content manager in collaboration with the information technology manager (see appendix E in the online version for sample job descriptions).

Organizations may designate executive responsibility and oversight for the enterprise records and content management program. A top-level executive officer is the principal decision maker with the responsibility of ensuring that the organization leverages information for maximum effectiveness enterprise-wide.

The officer also ensures that staff protect information from a variety of threats, monitor the use of information to ensure consistency in information practices, quantify the value of information, and forecast information that will be needed in order to make business units successful. The executive may be the chief information officer, chief operating officer, compliance officer, general counsel, or chief records officer.

The enterprise content and records manager is responsible for the organization’s records and information management program and personnel. This role manages, controls, and directs active records systems and centers, records organization and evaluation, and inactive records systems. This manager also controls correspondence, reports and directives, and record retention.

The enterprise manager ensures that processes fully support and implement the organization’s records and content management policies. He or she may also be responsible for the organization’s film- or computer-based imaging operations and personnel.

The information technology manager is responsible for managing all organization technologies and provides technology support and training. The manager’s primary duties include analyzing systems and processes; maintaining workstations and networks; and designing, developing, and maintaining Web-based applications.

Healthcare organizations must recognize the importance of their information assets and implement a coordinated process to manage their records and content. It will require new thinking, a new approach, and effective use of technology. HIM professionals have a unique skill set in managing health records—paper, hybrid, and electronic—that provides new roles and opportunities.

HIM professionals must actively step up to manage EHRs and clinical content. HIM professionals who wish to push beyond the boundaries of the HIM department have an opportunity to move into an enterprise role to oversee the overarching processes and challenges associated with managing the organization’s documents, content, records, and business processes.


  1. Sedona Conference. The Sedona Principles Addressing Electronic Document Production. 2nd edition. June 2007. Available online at www.sedonaconference.org.
  2. Sprehe, J. Timothy. “Enterprise Records Management: Strategies and Solutions.” White paper. September 2002. Available online at www.hummingbird.com/alt_content/binary/pdf/collateral/wp/rmstrategies.pdf.
  3. AIIM International and ARMA International. Revised Framework for Integration of EDMS & ERMS Systems (ANSI/AIIM ARMA TR48-2006). AIIM International and ARMA International, 2006.
  4. Gartner. “Organizing for Information Management.” White paper. 2008.
  5. Strong, Karen. “Enterprise Content and Records Management.” Journal of AHIMA 79, no. 2 (Feb. 2008): 38–42.
  6. The Joint Commission. The Comprehensive Accreditation Manual for Hospitals: The Official Handbook. Oakbrook Terrace, IL: Joint Commission, 2007.
  7. National Institute of Standards and Technology. An Introduction to Computer Security: The NIST Handbook. Available online at http://csrc.nist.gov/publications/nistpubs/800-12/handbook.pdf
  8. Gartner. “Organizing for Enterprise Information Management.”
  9. Daum, P. “From Ad-Hoc to Adherence.” The Information Management Journal (May/June 2007): 43–49.
  10. The International Organization for Standardization. “Information and Documentation—Records Management: Part 2. Guidelines.” 2001. Available online at www.iso.org/iso/catalogue_detail?csnumber=35845.
  11. Dougherty, Michelle. “How Legal Is Your EHR? Identifying Key Functions That Support a Legal Record.” Journal of AHIMA 79, no. 2 (Feb. 2008): 24–30.


Pearce-Moses, Richard. A Glossary of Archival and Records Terminology. Chicago, IL: The Society of American Archivists, 2005

VA Northern California Health Care System. Policy Statement 00-11 Appendix 30. September 21, 2004.


Definitions, selection tools, and sample staffing models are available in five appendixes included in the online version of this practice brief. It is available in the FORE Library: HIM Body of Knowledge at www.ahima.org.

Appendix A: “ECRM Concepts, Terms, and Definitions”

Appendix B: “ECRM System Selection Techniques and Tools”

Appendix C: “Health Information Records and Content Management Scenarios”

Appendix D: “Enterprise Records Committee: Suggested Staffing Model, Subcommittee Structure, and Responsibilities”

Appendix E: “ECRM Sample Job Descriptions”

Prepared by

Carol Coots, CPC, CPC-H

Kevin Joerling, CRM

Michelle Dougherty, MA, RHIA, CPS

Wannetta Edwards, MS, RHIA

Margaret M. Foley, PhD, RHIA, CCS


Alison Nicklas, RHIA

Jesseca Olsen, RHIA

Amy Richardson, RHIA

Jennifer Teal, RHIA, CPC

Lydia Washington, MS, RHIA, CPHIMS


Dawn Criswell, MS, RHIA

Laura Debs, RHIT, CCS-P

Chris Meyers, RHIA

D’Arcy Myjer, PhD, RHIA, FAHIMA

David Sweet, MLS

Lilly Timon, RHIA

Carl Weise, CCRM, ERM

This work was supported by a grant to FORE from Meta Health Technology.

The information contained in this practice brief reflects the consensus opinion of the the professionals who developed it. It has not been validated through scientific research.

Article citation:
AHIMA. "Enterprise Content and Record Management for Healthcare" Journal of AHIMA 79, no.10 (October 2008): 91-98.