Clinical decision support glossary

Clinical decision support (CDS)

Clinical decision support is health software that produces patient-specific guidance by evaluating data about an individual patient against clinical logic or evidence, and delivers it into the workflow at the moment a decision is being made. It differs from a clinical reference tool in one specific way: a reference tool returns the same content to everyone who asks the same question, whereas CDS reasons over this patient’s data and would produce different output for a different patient. The distinction is inferential, not editorial — a reference product can have excellent content and still not be CDS.

Chart-aware clinical decision support

Chart-aware clinical decision support reads data already in the patient record — problems, medications, allergies, labs, imaging, prior procedures — and conditions its output on that data, instead of asking the clinician to re-enter it. Chart-awareness is what lets a recommendation account for what has already been done, so a study performed two days ago is not recommended again. Decision support that fires on a diagnosis code alone cannot do this.

Differential diagnosis generator

A differential diagnosis generator takes a clinical presentation and returns a ranked list of candidate diagnoses. It answers the question "what could this be." That is a different job from returning a workup — the specific labs, imaging, routing and escalation thresholds that follow — and products in this space vary in whether they do one, the other, or both.

Ambient clinical documentation (AI scribe)

Ambient clinical documentation software listens to a clinical encounter and drafts the note from what was said. The category is built on capture rather than recommendation: even where such a product surfaces order suggestions, it is generally recognising intent the clinician has already spoken aloud. It is complementary to decision support rather than a substitute for it.

Alert fatigue

Alert fatigue is the desensitisation that occurs when clinicians receive so many decision-support warnings — many of them irrelevant to the patient in front of them — that they begin dismissing alerts reflexively, including the ones that matter. It is the central design constraint in clinical decision support: a system that fires more often is not safer, and specificity is worth more than sensitivity once dismissal becomes habitual.

LOINC

LOINC (Logical Observation Identifiers Names and Codes) provides universal identifiers for health observations and measurements, most prominently laboratory tests. It is stewarded by the Regenstrief Institute together with the LOINC Committee, and is available under an open license that is free for both commercial and non-commercial use. Coded labs matter because a local test name such as "Creat" or "CREATININE-S" is meaningless outside the originating lab, whereas a LOINC code identifies the analyte, specimen and units unambiguously. Note that "free" does not mean unlicensed: LOINC use is governed by a licence, it simply carries no fee.

Source: LOINC licence

RadLex

RadLex is a controlled terminology for radiology covering anatomy, imaging observations, procedures, modalities and devices. It is produced and maintained by the Radiological Society of North America (RSNA), which also co-maintains the LOINC/RSNA Radiology Playbook for standardised imaging procedure names. RadLex describes imaging content and procedures — it is not a billing code set and does not substitute for CPT or ICD-10-CM.

Source: RSNA RadLex

ICD-10-CM

ICD-10-CM is the diagnosis code set used for morbidity coding in all US healthcare settings, maintained by the National Center for Health Statistics at the CDC with annual updates coordinated with CMS. As a work of the United States Government it is not subject to US copyright, and is published for free download — no licence, fee or royalty is required to use, embed or redistribute the codes and descriptions in the United States. The common error is assuming every medical code set carries the same terms; unlike CPT, ICD-10-CM imposes no licensing cost on software vendors.

Source: NCHS ICD-10-CM

CPT

CPT (Current Procedural Terminology) is the code set used in the United States to report medical, surgical and diagnostic services. CPT is owned and published by the American Medical Association and maintained by the AMA-convened CPT Editorial Panel. Unlike ICD-10-CM it is a privately authored work protected by copyright, and organisations that reproduce, distribute or embed CPT codes and descriptors in software must obtain an AMA licence. The practical consequence for clinical software: a product can ship ICD-10-CM codes freely but needs an executed licence before displaying CPT descriptors.

Source: AMA CPT licensing

SNOMED CT

SNOMED CT is a comprehensive clinical terminology of more than 360,000 active concepts with formally defined logical relationships, used to encode findings, disorders, procedures and body structures. It is owned by SNOMED International, a not-for-profit governed by its Member countries. Licensing is territorial and free within Member countries; in the United States, a Member country, the National Library of Medicine distributes the US Edition at no cost. SNOMED CT is a clinical meaning terminology rather than a billing code set — it complements ICD-10-CM, and mapping between the two is lossy.

Source: SNOMED International

RxNorm

RxNorm provides normalised names for clinical drugs and links them to the drug vocabularies used in pharmacy and interaction-checking software. It is produced by the National Library of Medicine and released monthly at no cost. Its value is letting a system recognise that two differently named medication records refer to the same ingredient, strength and dose form — the foundation for interaction checking and medication reconciliation. RxNorm normalises drug identity; it is not itself a drug knowledge base and supplies no interaction or dosing content.

Source: NLM RxNorm

FHIR, FHIR R4 and US Core

FHIR (Fast Healthcare Interoperability Resources) is a health data exchange standard published by HL7 International that models clinical information as modular resources — Patient, Observation, Condition, MedicationRequest — exchanged over a RESTful API. FHIR R4 remains the version anchored in US regulation and in most production EHR APIs. US Core is the HL7 US Realm implementation guide defining the minimum constraints, required elements and value sets on those resources. A frequent misconception is that "supports FHIR" implies interoperability: without conformance to a profile set such as US Core, two FHIR servers can be mutually unintelligible.

Source: HL7 US Core

SMART on FHIR

SMART on FHIR is a specification describing OAuth 2.0-based patterns for applications to authorise, authenticate and integrate with FHIR-based systems. Published by HL7 International with Boston Children’s Hospital, it defines the App Launch and Backend Services patterns, FHIR-derived access scopes, and launch context such as the currently selected patient. It is what allows a third-party clinical app to launch inside an EHR with the right user identity and patient context without holding EHR credentials. SMART is an authorisation and launch standard, not a data model.

Source: HL7 SMART App Launch

CDS Hooks

CDS Hooks defines a hook-based pattern for invoking decision support from inside a clinician’s workflow: the EHR fires a named hook at a defined moment — opening a chart, signing an order — calls an external CDS service, and renders the returned cards in the interface. It is maintained by HL7 International with Boston Children’s Hospital. The problem it solves is CDS historically being trapped inside the EHR vendor’s own rules engine; CDS Hooks lets independently developed decision support reach the point of care through a vendor-neutral interface. It is complementary to SMART on FHIR: CDS Hooks decides when decision support fires, SMART decides how an app is launched and authorised.

Source: HL7 CDS Hooks

HL7 Infobutton

The HL7 Infobutton standard defines a URL-based mechanism by which a clinical system requests relevant reference knowledge from an external resource, passing context such as the patient’s problem or medication, the user’s role, and the clinical task. It is why clicking a small icon next to a diagnosis in an EHR lands on context-appropriate reference content rather than a generic search. Infobutton retrieves knowledge — it does not evaluate patient data to generate a recommendation, so it is a context-aware reference mechanism rather than inferential decision support.

Source: HL7 Infobutton

HIPAA Business Associate Agreement (BAA)

A Business Associate Agreement is the written contract required by the HIPAA Privacy and Security Rules before protected health information may be created, received, maintained or transmitted on a covered entity’s behalf. It must define permitted uses, require safeguards and breach reporting, flow the same restrictions down to subcontractors, and permit termination for material breach. The common and consequential error is calling a product "HIPAA compliant": HIPAA imposes obligations on organisations, not on software, and HHS does not recognise private "certifications" of Security Rule compliance. Compliance is a property of a specific deployment, which is why the accurate vendor claim is "we will sign a BAA and support a compliant deployment" rather than "our product is HIPAA compliant."

Source: 45 CFR 164.504

Protected Health Information (PHI)

Protected Health Information is individually identifiable health information — relating to health status, care, or payment for care — created, received, maintained or transmitted by a HIPAA covered entity or business associate, in any form. Any clinical software that ingests chart data is almost certainly handling PHI. Two misconceptions are worth correcting: PHI is not limited to a checklist of identifiers, since free-text narrative and combinations of quasi-identifiers are equally PHI when they identify a person; and data does not become PHI merely by being health-related, since the same data held outside HIPAA’s scope is not PHI under HIPAA.

Source: 45 CFR 160.103

De-identification: Safe Harbor and Expert Determination

HIPAA recognises exactly two methods for rendering PHI not individually identifiable. Safe Harbor requires removing all eighteen enumerated identifier categories and additionally requires that the entity have no actual knowledge that the remaining information could identify someone. Expert Determination requires a qualified person to determine, and document, that re-identification risk is very small. A regular-expression scrub of free text is neither: it is an implementation technique that may contribute to Safe Harbor, but on its own it produces no documented risk analysis, silently misses identifiers embedded in narrative, and does nothing about the actual-knowledge condition. Data that has merely been regex-scrubbed remains PHI.

Source: 45 CFR 164.514

ACR Appropriateness Criteria

The ACR Appropriateness Criteria are evidence-based guidelines published by the American College of Radiology to assist in selecting the most appropriate imaging or treatment for a specific clinical condition. They are ACR intellectual property. They are made available for personal, research and informational use, but commercial reuse — including embedding the rating tables in software — is licensed case by case through the ACR rather than under a published rate card. This is a segment-wide constraint on imaging decision support products, not a limitation specific to any one vendor.

Source: ACR

Appropriate Use Criteria (AUC) program and qualified CDSM

The Medicare Appropriate Use Criteria program, created by section 218(b) of the Protecting Access to Medicare Act of 2014, would have required ordering clinicians to consult a CMS-qualified Clinical Decision Support Mechanism before ordering advanced imaging, and to report that consultation on the claim. It never took effect. CMS paused the program for reevaluation and rescinded the implementing regulations at 42 CFR 414.94 effective 1 January 2024, stopped qualifying CDSMs, and terminated the associated billing codes. The statute itself was not repealed.

Full status and sources →