Which of the following is a facility business use of the health record generally not requiring patient authorization?

In the context of health records, there are certain business uses that are considered part of the operational needs of a healthcare facility and typically do not require patient authorization.

The investigation of a patient complaint by the department manager is an example of a facility's internal process aimed at ensuring quality of care and addressing patient concerns effectively. This type of investigation is essential for a facility’s improvement and accountability and thus does not necessitate patient authorization since it is part of the operational responsibilities of the facility.

Similarly, the review of documentation by the facility's professional liability insurer is another instance where authorization is not required. Insurers need access to the records to assess the facility's liability in the event of a claim. This is also viewed as part of the facility's business operations and is crucial for the financial and operational integrity of the institution.

By considering both scenarios, it is evident that these uses align with standard practices in healthcare operations and compliance, allowing them to bypass the need for patient consent.

Consequently, combining both uses—investigation of a complaint and review by the professional liability insurer—results in the correct choice.