Sharing external audit results with leadership involves ensuring compliance with privacy regulations, particularly the Health Insurance Portability and Accountability Act (HIPAA), which protects patient health information (PHI).

Option A (Acquire authorization from external auditors to share): Auditors may have confidentiality agreements, but sharing results internally with leadership typically does not require their authorization, as leadership is part of the covered entity.

Option B (Remove patient identifiers): This is the correct answer. The NAHQ CPHQ study guide states, “To share medical record audit results internally, patient identifiers must be removed to comply with HIPAA and protect PHI” (Domain 1). De-identification ensures privacy while allowing leadership to review aggregate findings.

Option C (Classify sections with protected health information as confidential): Classifying PHI as confidential is standard, but it does not address sharing results, which requires de-identification for broader dissemination.

Option D (Obtain specific patient consent): Consent is not required for internal quality improvement activities, as they fall under HIPAA’s healthcare operations exemption, provided PHI is protected.

CPHQ Objective Reference: Domain 1: Patient Safety, Objective 1.8, “Ensure compliance with privacy regulations in quality activities,” emphasizes de-identification for sharing audit results. The NAHQ study guide notes, “Removing patient identifiers allows safe sharing of audit data for quality improvement” (Domain 1).

Rationale: De-identifying audit results ensures HIPAA compliance, enabling safe sharing with leadership, aligning with CPHQ’s patient safety and privacy principles.