Glossary of hospital risk, claims and AI terms

By Ahmed Jemaa, Co-Founder and CEO of Medrecords AI. Updated 2026-11-14.

Limits: We read each vendor's own web pages and the cited studies on 2026-11-14 and did not upload records to any tool, ours included. Nothing here is legal, actuarial or clinical advice; privilege and reserving rules vary by state and by program.

Risk management and patient safety terms

Sentinel event

The Joint Commission's term for a patient safety event, not primarily caused by the patient's illness, that reaches the patient and results in death, permanent harm or severe harm. Accredited organizations that self-report submit the analysis and action plan within 45 business days of becoming aware of the event.

Serious safety event

A term many hospitals use internally for a deviation from expected practice that reaches the patient and causes moderate to severe harm or death. Definitions vary by program; use your own policy's wording.

Root cause analysis (RCA)

A structured review of a serious event that looks for system causes and contributing factors, not individual blame, and ends in an action plan. The Joint Commission's sentinel event policy describes the same analysis under its own name.

Patient safety organization (PSO)

An entity listed by AHRQ under the Patient Safety Act that receives and analyzes safety data from providers. Reporting to a PSO is what makes patient safety work product protection available.

Patient safety work product (PSWP)

Under 42 CFR 3.20, data, reports and analyses (such as root cause analyses) assembled for reporting to a PSO, or the deliberations of a patient safety evaluation system. It excludes the medical record, billing and discharge information, and information kept separately from that system. 42 CFR 3.204 makes it privileged, with exceptions.

Peer review privilege

State-law protection for the records and deliberations of medical staff peer review committees. Scope differs a lot between states; most don't protect facts available from original sources such as the chart.

Communication and resolution program (CRP)

A hospital program that responds to patient harm with open communication, event review, an apology and, where care was unreasonable, an offer of compensation. A 2026 AHRQ-funded rapid review found low-strength evidence that the most developed programs reduce claim rates and defense costs.

CANDOR

Communication and Optimal Resolution: AHRQ's process and toolkit for responding to unexpected patient harm in a timely, thorough and just way, built around early disclosure instead of deny and defend.

EHR audit trail

The system log of who viewed, created, changed or signed each entry in the electronic health record, and when. Often requested in malpractice discovery to test the timing of notes.

Late entry

A chart entry written after the time of the care it describes. Common and often legitimate, but it carries 2 times: the care time and the entry time. Federal hospital rules (42 CFR 482.24(c)) require entries to be dated, timed and authenticated.

Claims and reserving terms

Early case assessment (ECA)

The first structured review of a claim after notice: what the chart shows, what records are missing, the reviewer's view of care and causation, likely damages, and the recommended path. See the ECA checklist.

Case reserve

The estimate, set by a claims professional with authority, of what 1 known claim will cost to resolve, usually split into indemnity and expense, and updated as facts change.

IBNR

Incurred but not reported: the actuary's estimate for claims from events that have already happened but haven't been reported yet. Part of aggregate reserves, not case reserves.

Captive

An insurance company owned by the organizations it insures. Many health systems insure their malpractice risk through a captive, which affects who sets reserves and approves settlements.

Litigation hold

An instruction to preserve records and data that may be relevant to a claim, including EHR audit logs, device data and email, issued when a claim is reasonably anticipated.

Work product

Material prepared by or for a party in anticipation of litigation, which court rules protect from discovery with limits. Work done at counsel's direction is easier to fit within it.

National Practitioner Data Bank (NPDB)

The federal data bank that receives reports of malpractice payments made for the benefit of a practitioner. Under 45 CFR 60.5, a payment is reported within 30 days.

RMIS

Risk management information system: the software that holds incidents, claims, financials and often insurance and compliance data. RLDatix, Origami Risk and Riskonnect are examples.

AI and record review terms

Page citation

A reference from a line of AI output to the page of the source file it came from. It lets a person check each line in seconds and is the minimum to ask of any tool.

Deduplication

Finding and removing repeated pages, for example your own chart produced back to you by plaintiff counsel. It cuts reading time, and on tools that bill unique pages, cost.

Hallucination

An AI output that states something the source doesn't support: a wrong date, an invented finding, or a negative turned positive. Page citations are how you catch it.

Business Associate Agreement (BAA)

The HIPAA contract required before a vendor creates, receives or keeps protected health information for a covered entity. Consumer chatbot accounts don't come with one.

Protected health information (PHI)

Individually identifiable health information held or sent by a covered entity or its business associates. Every chart and claim file on this site's topics contains it.

Questions about these terms