HIPAA Terms in Plain English, Linked to the Actual Regulation
Welcome to our Comprehensive HIPAA Compliance Glossary, designed specifically for healthcare professionals navigating the complexities of HIPAA regulations. This essential resource provides clear definitions and explanations of key terms, ensuring you stay informed and compliant.
Search our A-Z list of HIPAA compliance terms, including definitions for concepts like ‘Protected Health Information (PHI)’, ‘Business Associates (BA)’, and ‘Notice of Privacy Practices’. If you can’t find the term you’re looking for, try searching with different keywords or clear the filter to browse our extensive list of HIPAA-related terms.
For further insights, check out our articles on HIPAA compliance best practices and recent updates to regulations.
All 1,300 terms, 91 pages, free. Just your name and email.
The technical standard requiring policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs granted access rights under § 164.308(a)(4). Its specifications are unique user identification, emergency access procedure, automatic logoff, and encryption and decryption.
The individual's right to an accounting of disclosures of PHI made in the six years before the request, excluding disclosures for treatment, payment, and operations, to the individual, under authorization, for the facility directory, for national security, to correctional institutions, and certain others. Respond within 60 days with one 30-day extension; the first accounting in any 12-month period is free.
For an addressable specification, the entity must assess whether it is a reasonable and appropriate safeguard in its environment. If it is, implement it. If not, document why and implement an equivalent alternative measure if reasonable and appropriate. Addressable does not mean optional; every addressable specification requires a documented decision.
The Privacy Rule's administrative requirements: designate a privacy official and complaint contact, train the workforce, maintain safeguards, provide a complaint process, apply and document sanctions, mitigate harm, refrain from intimidation and retaliation, not require waiver of rights, maintain written policies and procedures, and retain documentation for six years.
Administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information, and to manage the conduct of the workforce in relation to protecting that information.
Legally separate covered entities under common ownership or control may designate themselves a single affiliated covered entity for Privacy, Security, and Breach Notification Rule compliance. The designation must be documented and retained.
The required standard to identify the security official responsible for developing and implementing the entity's Security Rule policies and procedures.
The required technical standard to implement hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
The activity record produced by audit controls: who accessed what, when, and what they did. The rule requires mechanisms that record and examine information system activity; the resulting logs are typically the first evidence OCR requests.
The individual's written permission for uses and disclosures not otherwise permitted or required by the Privacy Rule. Must contain the core elements and required statements of § 164.508(c). Psychotherapy notes, marketing, and sale of PHI each require authorization with specific conditions.
The addressable specification to implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.
The property that data or information is accessible and usable upon demand by an authorized person.
The required information access management standard: implement policies and procedures for authorizing access to ePHI consistent with the applicable requirements of the Privacy Rule.
The HIPAA statutory requirements for transactions, code sets, identifiers, privacy, security, and enforcement. An administrative simplification provision is defined at § 160.103, and 45 CFR Parts 160, 162, and 164 implement them.
PHI may be disclosed to a person subject to FDA jurisdiction with respect to an FDA-regulated product or activity, including to collect or report adverse events, track products, enable recalls, repairs, or replacement, and conduct post-marketing surveillance.
A covered entity or business associate is liable for a civil money penalty for the acts or omissions of its agent, including a workforce member or business associate acting as agent, determined under the federal common law of agency and acting within the scope of the agency.
The accommodation mechanism for confidential communications: a different phone number, address, or channel; providers may not demand a reason, and plans may require an endangerment statement.
The regulation's term is de-identification, achieved by expert determination or safe harbor; information de-identified under either method falls outside HIPAA.
A maintained list of systems, devices, applications, and media that create, receive, maintain, or transmit ePHI. A risk analysis is incomplete if the organization does not know where ePHI exists.
A patient's authorization allowing a provider to receive payment directly from a health plan. It is a payment workflow concept and should not be confused with a HIPAA authorization for non-TPO use of PHI.
The corroboration that a person is the one claimed.
An individual may revoke an authorization at any time, in writing, except to the extent the entity has already taken action in reliance on it or the authorization was obtained as a condition of insurance coverage during a contestability period.
A formal review confirming that user access remains appropriate for job duties. Certifications help detect excessive permissions, stale accounts, and role drift.
Permitted grounds: the record was not created by the entity (unless the originator is no longer available), is not part of the designated record set, would not be available for inspection under § 164.524, or is accurate and complete. Denial triggers a written notice with the right to a statement of disagreement that travels with future disclosures.
A control that allows only approved software to run. Whitelisting can reduce malware risk on workstations and servers that access ePHI.
An administrative safeguard concept involving Administrative Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Administrative Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Administrative Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Administrative Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Administrative Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Administrative PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Administrative Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Administrative Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Administrative Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Administrative Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Administrative User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Administrative Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Administrative Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Administrative Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Administrative Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Administrative Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Administrative Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Administrative Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The acquisition, access, use, or disclosure of protected health information in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI. Three exclusions apply: unintentional, good faith acquisition by a workforce member acting within their authority; inadvertent disclosure between persons authorized to access PHI at the same entity or arrangement; and disclosures where the unauthorized recipient would not reasonably have been able to retain the information. An impermissible use or disclosure is presumed to be a breach unless the entity demonstrates a low probability that the PHI has been compromised.
Requires notification following a breach of unsecured PHI: to individuals under § 164.404, to the media for breaches involving more than 500 residents of a state or jurisdiction under § 164.406, to the Secretary under § 164.408, and by business associates to covered entities under § 164.410.
The four-factor assessment that can rebut the presumption of breach: the nature and extent of the PHI involved, including identifiers and likelihood of re-identification; the unauthorized person who used or received it; whether the PHI was actually acquired or viewed; and the extent to which the risk has been mitigated.
A person who, on behalf of a covered entity but not as a member of its workforce, creates, receives, maintains, or transmits PHI for functions such as claims processing, data analysis, utilization review, quality assurance, patient safety activities, billing, or practice management; or who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services involving PHI. The definition expressly includes health information organizations, e-prescribing gateways, personal health record vendors acting for a covered entity, and subcontractors that handle PHI for another business associate.
The written contract required before a business associate may create, receive, maintain, or transmit PHI for a covered entity. Required provisions: permitted uses and disclosures, no further use, appropriate safeguards including Security Rule compliance for ePHI, breach and security incident reporting, subcontractor flow-down, support for access, amendment, and accounting rights, HHS access, return or destruction of PHI at termination, and authorization to terminate for violation.
Health information related to mental health or substance use treatment. It is generally PHI when held by a covered entity, while psychotherapy notes and certain substance use disorder records may receive heightened protections.
Billing on a provider's behalf is a named business associate activity, and a billing service converting data between standard and nonstandard formats also appears in the health care clearinghouse definition.
A safe harbor identifier category: biometric identifiers, including finger and voice prints, must be removed for de-identification.
A policy allowing workforce members to use personal devices for work. If those devices access ePHI, the organization must address authentication, encryption, remote wipe, screen lock, and termination procedures.
HIPAA addresses business continuity through the contingency plan standard: data backup, disaster recovery, emergency mode operation, testing and revision, and application and data criticality analysis.
The satisfactory assurances requirement is the regulatory hook: the covered entity must have a documented basis (the BAA, and in practice vetting behind it) that the BA will appropriately safeguard PHI.
A current list of vendors and partners that create, receive, maintain, or transmit PHI for the organization. The inventory helps confirm every business associate has a signed BAA and an owner.
A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate, and the BA must obtain the same satisfactory assurances from it that the covered entity obtained from the BA.
The No Surprises Act rules prohibit balance billing for out-of-network emergency services, for nonemergency services by nonparticipating providers at participating facilities absent notice and consent, and for air ambulance services by nonparticipating providers.
Claims submitted together electronically remain the health care claims transaction and must use the adopted X12N 837 standard.
A workforce device model where personal phones or laptops are used for work. BYOD needs access controls, encryption, remote wipe expectations, and clear PHI handling rules.
The contingency plan standard is HIPAA's business continuity requirement: backup, disaster recovery, emergency mode operation, testing, and criticality analysis for systems holding ePHI.
The rule requires retrievable exact copies of ePHI; how long backups are kept is a risk-based decision, not a stated timeframe.
A safe harbor identifier category: health plan beneficiary numbers must be removed for de-identification.
Conducting or arranging auditing functions is a named health care operation, and claims review appears in the payment definition.
Enrollment and disenrollment in a health plan is a named HIPAA transaction with the X12N 834 as its adopted standard.
Auditing functions, including fraud and abuse detection and compliance programs, are health care operations by definition.
Authenticating by fingerprint or face implements the person or entity authentication standard: verifying that the one seeking access to ePHI is the one claimed.
A storage model used by servers and cloud systems. When block volumes contain ePHI, encryption, snapshots, access, and disposal need documented safeguards.
Regular reporting to leadership on compliance risks, incidents, vendor status, and remediation. Board-level visibility helps show governance and accountability.
A vendor and business associate oversight concept involving Business Associate Access Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Audit Evidence. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Policy Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Risk Finding. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Training Record. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Incident Log. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate PHI Handling. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Security Control. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Privacy Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Retention Check. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Business Associate Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Business Associate User Provisioning. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Encryption Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Backup Test. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Contingency Task. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Compliance Calendar. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Evidence Packet. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate System Inventory. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Business Associate Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Business Associate Claims Transaction. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Eligibility Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Business Associate Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Business Associate Workforce Attestation. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Exception Register. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
There is no official government-issued HIPAA certification for organizations. No agency certifies that a covered entity is "HIPAA compliant." OCR has explicitly stated that compliance is an ongoing obligation, not a certification status. Individuals can earn credentials such as Certified HIPAA Professional (CHP), but these are professional designations, not government certifications.
The monetary penalty the Secretary may impose for violations of the administrative simplification provisions, in the amount determined under § 160.404.
The use of remote servers to store, manage, and process ePHI. Cloud service providers that store or process ePHI are business associates and must sign a BAA. The covered entity remains responsible for ensuring the provider implements appropriate safeguards. Simply storing encrypted data in the cloud does not eliminate the need for a BAA.
Two tracks: the covered entity's internal complaint process, and complaints to the Secretary. Any person may file with OCR, in writing, within 180 days of when they knew or should have known of the act, and OCR may investigate.
The overall system of policies, procedures, training, documentation, and oversight that an organization uses to meet HIPAA requirements. Includes a risk analysis, written policies, workforce training, sanctions policy, breach response plan, and BAAs. Having one is the primary factor OCR considers when determining enforcement severity.
An authorization generally may not be combined with any other document to create a compound authorization, with narrow exceptions for research study authorizations and combining psychotherapy notes authorizations with each other.
An exception to the business associate definition for entities that transport PHI but do not routinely access it. The US Postal Service, UPS, and ISPs are conduits and do not need a BAA. However, a cloud company storing PHI is not a conduit. The line between conduit and business associate is narrow.
Providers must permit and accommodate reasonable requests to receive PHI communications by alternative means or at alternative locations; health plans must accommodate when the individual states that disclosure could endanger them.
The property that data or information is not made available or disclosed to unauthorized persons or processes.
A covered entity may obtain the individual's consent to use or disclose PHI for treatment, payment, or health care operations. Consent is optional under the Privacy Rule and never substitutes for an authorization where one is required.
The required standard to establish policies and procedures for responding to an emergency or other occurrence, such as fire, vandalism, system failure, or natural disaster, that damages systems containing ePHI.
A formal agreement between OCR and an entity requiring specific steps to resolve HIPAA violations. CAPs typically run one to three years and include monitoring, reporting, and remediation. Once a CAP is in place, you are on the government's timeline.
A health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction for which HHS has adopted a standard.
Those functions of a covered entity the performance of which makes the entity a health plan, health care provider, or health care clearinghouse.
Penalties imposed by the Department of Justice for knowing HIPAA violations. Three tiers: up to $50,000 and one year in prison for knowing violations, up to $100,000 and five years for false pretenses, up to $250,000 and ten years for intent to sell or use PHI for personal gain. Criminal enforcement targets individuals.
A documented process for evaluating and approving changes to systems, workflows, or vendors that affect ePHI. Major changes should trigger security evaluation and risk analysis updates.
Attachment information is defined as documentation of health care or characteristics of health care provided; health claims attachments are a named HIPAA transaction, but no attachment standard has been adopted to date.
The health care claim status transaction, conducted with the adopted X12N 276 request and 277 response standards.
Short for health care clearinghouse: an entity that converts health information between nonstandard and standard formats for other entities, including billing services, repricing companies, and value-added networks performing those functions.
A measurement of healthcare quality using clinical data. If the measure uses identifiable patient information, HIPAA rules for use, disclosure, minimum necessary, and data sharing still apply.
Any set of codes used to encode data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes, including both the codes and their descriptors.
HIPAA's version of a compensating control: when an addressable specification is not reasonable and appropriate, the entity implements an equivalent alternative measure that accomplishes the same protective purpose, and documents the decision.
The adopted standards for the coordination of benefits information transaction: the ASC X12N 837 implementations, with NCPDP for retail pharmacy.
Reviewing the competence or qualifications of health care professionals and conducting credentialing activities are named health care operations.
Movement of PHI or ePHI outside the United States or to a vendor with offshore operations. HIPAA does not ban offshore handling, but covered entities must manage BAAs, safeguards, and applicable state or contractual limits.
The person or role responsible for maintaining and producing records in response to valid requests. In healthcare, this can include medical record access requests, subpoenas, audits, and retention obligations.
A web application vulnerability that can let attackers run malicious scripts in a user's browser. In healthcare portals, XSS can expose sessions, messages, or other ePHI.
An administrative safeguard concept involving Covered Entity Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Covered Entity Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Covered Entity Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Covered Entity Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Covered Entity Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Covered Entity PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Covered Entity Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Covered Entity Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Covered Entity Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Covered Entity Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Covered Entity User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Covered Entity Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Covered Entity Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Covered Entity Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Covered Entity Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Covered Entity Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Covered Entity Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
With respect to PHI created or received by a business associate in its capacity as the business associate of a covered entity, the combining of that PHI with PHI received as business associate of another covered entity, to permit data analyses relating to the health care operations of the respective covered entities.
The required specification to establish and implement procedures to create and maintain retrievable exact copies of ePHI.
The agreement required before disclosing a limited data set: it establishes the permitted uses and disclosures, identifies who may use or receive the data, and binds the recipient to safeguards, non-re-identification, no contacting of individuals, and flow-down to agents.
A covered entity must protect a deceased individual's PHI for 50 years following death; after that, the information is no longer PHI.
Health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify, is not individually identifiable. The rule provides two methods: expert determination and safe harbor. Properly de-identified information is no longer PHI.
A group of records maintained by or for a covered entity that is: the medical and billing records about individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or records used, in whole or in part, to make decisions about individuals. A record is any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity.
The required standard for policies and procedures governing the receipt and removal of hardware and electronic media containing ePHI into and out of a facility, and their movement within it.
A treatment relationship between an individual and a health care provider that is not an indirect treatment relationship; the provider delivers care, services, or results directly to the individual rather than through another provider.
The required specification to establish, and implement as needed, procedures to restore any loss of data.
The release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.
Maintain Security Rule policies and procedures in written form (which may be electronic), and maintain a written record of any action, activity, or assessment the Rule requires to be documented.
The practice of labeling information by sensitivity and handling requirements. PHI and ePHI should be classified so workforce members know when stronger access, storage, transmission, and disposal controls apply.
Technology and procedures designed to detect or block improper transmission of sensitive data. DLP can help prevent PHI from leaving through email, web uploads, removable media, or unmanaged cloud tools.
Documenting where PHI is collected, stored, used, transmitted, disclosed, and destroyed. Data mapping supports risk analysis, minimum necessary review, breach response, and vendor management.
HIPAA's data minimization principle is the minimum necessary standard: limit uses, disclosures, and requests of PHI to what the purpose actually requires.
Access granted to a person acting on behalf of another user, patient, or organization. Delegated access should be documented, limited by role, and traceable in audit logs.
The narrow facility directory categories: name, facility location, general condition, and religious affiliation, shareable under the informed no-objection rules; not a license for broader disclosure.
The required specification for policies and procedures addressing the final disposition of ePHI and the hardware or electronic media on which it is stored.
Documented manual operations during system unavailability implement the emergency mode operation specification: continuing critical business processes while protecting ePHI.
Working denied claims falls inside the definition of payment: billing, claims management, collection activities, and related health care data processing.
A model where certain users can manage accounts, roles, or settings for a defined area. Delegated admin rights should be limited, logged, and reviewed.
Configuring devices to reduce security risk before use. Hardening can include disabling services, enforcing encryption, patching, and applying baseline settings.
The regulation defines electronic signature for transactions: an electronic sound, symbol, or process attached to or logically associated with attachment information and executed by a person with the intent to sign it.
A covered entity must document and retain every signed authorization, as required by § 164.530(j).
The paper capture tool used during system downtime, part of emergency mode operation procedures for continuing critical processes while protecting ePHI.
An administrative safeguard concept involving Designated Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Designated Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Designated Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Designated Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Designated Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Designated PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Designated Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Designated Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Designated Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Designated Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Designated User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Designated Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Designated Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Designated Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Designated Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Designated Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Designated Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Designated Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Electronic storage material on which data is or may be recorded electronically (hard drives, removable or transportable digital memory such as magnetic tape or disk, optical disk, or digital memory card), and transmission media used to exchange information already in electronic storage media (internet, extranet or intranet, leased lines, dial-up lines, private networks, and physical movement of removable storage media). Paper-to-paper faxes and voice telephone calls are not electronic media transmissions if the information did not exist in electronic form immediately before the transmission.
Protected health information that is transmitted by electronic media or maintained in electronic media (paragraphs (1)(i) and (1)(ii) of the definition of protected health information).
The required specification to establish and implement procedures for obtaining necessary ePHI during an emergency.
The required specification for procedures to enable continuation of critical business processes for protection of the security of ePHI while operating in emergency mode.
The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.
The compliance and investigation procedures, civil money penalty provisions, and hearing procedures for the administrative simplification rules: complaints, investigations, penalty amounts and factors, affirmative defenses, and appeals.
The required standard to perform periodic technical and nontechnical evaluation, based initially on the Security Rule standards and thereafter in response to environmental or operational changes, establishing the extent to which policies and procedures meet the Rule's requirements.
A person with appropriate knowledge and experience with generally accepted statistical and scientific principles determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify an individual, and documents the methods and results.
The addressable specification to implement a mechanism to encrypt and decrypt ePHI. Data encrypted consistent with HHS guidance is also secured, taking its loss outside breach notification.
The addressable specification to implement a mechanism to encrypt ePHI whenever deemed appropriate during transmission.
Security tooling that monitors computers and servers for suspicious activity and helps contain malware or unauthorized access. EDR supports HIPAA's expectation that organizations detect and respond to security incidents.
An organization-wide approach for identifying and managing operational, compliance, financial, and security risks. HIPAA risk analysis should connect to this broader governance process when one exists.
The enrollment and disenrollment transaction, conducted with the adopted ASC X12N 834 standard.
A request to deviate from a standard, policy, or control for a documented reason. Security exceptions should be time-limited, risk-reviewed, approved, and tracked through remediation.
An assessment performed by an outside party to evaluate compliance, controls, or financial processes. External audits do not create official HIPAA certification, but they can identify gaps and support remediation.
The health care EFT and remittance advice transaction: transmission of payment and payment processing information from a health plan to a provider's financial institution, with adopted standards at § 162.1602 and CAQH CORE operating rules at § 162.1603.
The 835 remittance advice adopted as the standard for explaining health plan payment of claims.
A covered entity may disclose to a family member, relative, close personal friend, or person identified by the individual the PHI directly relevant to that person's involvement in the individual's care or payment, and may notify such persons of the individual's location, general condition, or death.
Security tooling that monitors endpoints for suspicious activity, malware, and compromise. EDR supports detection and response for systems that access or store ePHI.
HIPAA's documentation requirements define the evidence: written policies and procedures, written records of required actions and assessments, and six-year retention.
The eligibility for a health plan transaction, conducted with the adopted X12N 270 inquiry and 271 response standards.
A gateway that encrypts outbound email carrying ePHI implements the addressable transmission encryption specification.
Employment records held by a covered entity in its role as employer are excluded from the definition of PHI. The same lab result can be PHI in the patient chart and a non-PHI employment record in the HR file.
A list of laptops, desktops, phones, tablets, servers, and other endpoints. Inventory supports patching, encryption tracking, access review, and incident response.
A maintained list of approved deviations from policy or standard controls. Each exception should include owner, reason, compensating controls, and expiration.
An administrative safeguard concept involving Electronic Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Electronic Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Electronic Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Electronic Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Electronic Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Electronic PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Electronic Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Electronic Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Electronic Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Electronic Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Electronic User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Electronic Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Electronic Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Electronic Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Electronic Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Electronic Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Electronic Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Electronic Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The required standard to implement policies and procedures to limit physical access to electronic information systems and the facilities housing them, while ensuring that properly authorized access is allowed.
A covered health care facility may maintain a directory holding the individual's name, location in the facility, general condition, and religious affiliation, and disclose it to clergy or to persons who ask for the individual by name, if the individual was informed and given the chance to object. Religious affiliation goes only to clergy.
The addressable specification for policies and procedures to safeguard the facility and its equipment from unauthorized physical access, tampering, and theft.
Education records covered by FERPA, and the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), are excluded from the definition of protected health information. Student health records at FERPA-covered schools generally follow FERPA, not HIPAA.
A criminal HIPAA culpability concept involving obtaining or disclosing PHI under deceptive circumstances. It carries higher potential criminal penalties than a knowing violation without false pretenses.
Under the electronic media definition, a paper-to-paper fax is not an electronic media transmission when the information did not exist in electronic form immediately before transmission; the faxed PHI remains PHI and misdirected faxes remain disclosures.
Access fees may include only reasonable, cost-based labor for copying, supplies for the copy, postage, and preparation of an agreed summary. Retrieval fees are not permitted.
A network security control that filters traffic between networks or systems. Firewalls help reduce exposure of systems containing ePHI and should be configured, monitored, and reviewed.
Technical investigation of a security incident to determine what happened, which systems were affected, and whether ePHI was accessed or exfiltrated. Findings often inform breach risk assessment.
A covered entity may use limited categories of PHI for its own fundraising, must provide a clear and conspicuous opportunity to opt out with each communication, may not condition treatment or payment on the choice, and must honor elections.
The addressable specification to document repairs and modifications to the physical components of a facility related to security, for example hardware, walls, doors, and locks.
An identity model where a trusted provider authenticates users for multiple applications. It can simplify access management but still needs MFA, logging, and timely deprovisioning.
A periodic check of network access rules to remove unnecessary exposure. Reviews help show reasonable protection against anticipated threats to ePHI systems.
PHI may be disclosed as authorized by, and to the extent necessary to comply with, workers' compensation laws and similar no-fault programs for work-related injuries or illness. First report of injury is also a named HIPAA transaction in the § 160.103 transaction definition, though no standard has been adopted for it.
For essential health benefits, a plan must cover prescription drugs per USP category and class counts, use a pharmacy and therapeutics committee, and publish an up-to-date, accurate, and complete drug list. HIPAA-side, formulary communications appear in the marketing definition's refill reminder carve-out at § 164.501.
Fraud and abuse detection and compliance programs are named health care operations; related payment-side review activities appear in the payment definition.
Implements the encryption specification; a lost laptop whose disk was encrypted consistent with the HHS guidance referenced in § 164.402 does not hold unsecured PHI, so its loss is not a reportable breach.
An electronic response confirming receipt or syntax status of a transaction file. Acknowledgments help troubleshoot HIPAA transaction exchange failures.
Switching to standby systems during an outage implements the disaster recovery and emergency mode operation specifications for systems containing ePHI.
Implements the addressable mechanism to authenticate ePHI: electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.
A cover page used when sending records by fax. It should limit PHI, identify the intended recipient, and include misdirected-fax instructions.
A login method where one identity provider authenticates users across multiple systems. It can improve control if MFA, logging, and deprovisioning are enforced.
Encrypting specific database fields implements the addressable mechanism to encrypt and decrypt ePHI.
A protocol used to move files between systems. PHI transfers should use secure variants and approved workflows, not plain unencrypted FTP.
The health oversight provision: PHI may be disclosed to a health oversight agency for audits, civil, administrative, or criminal investigations, inspections, licensure actions, and proceedings overseeing the health care system and government benefit programs.
An administrative safeguard concept involving Facility Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Facility Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Facility Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Facility Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Facility Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Facility PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Facility Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Facility Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Facility Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Facility Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Facility User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Facility Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Facility Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Facility Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Facility Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Facility Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Facility Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Facility Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An evaluation comparing your current HIPAA posture against regulatory requirements to identify deficiencies. Typically follows a risk assessment and produces a list of areas where policies, procedures, or technical controls are missing. The output feeds directly into a remediation plan.
With respect to an individual: information about the individual's genetic tests, the genetic tests of family members, the manifestation of a disease or disorder in family members, and any request for or receipt of genetic services or participation in clinical research including genetic services by the individual or a family member. Includes genetic information of a fetus carried by the individual or a family member and of any embryo legally held through assisted reproductive technology. Excludes information about the sex or age of any individual.
An employee welfare benefit plan (as defined in section 3(1) of ERISA), including insured and self-insured plans, to the extent the plan provides medical care to employees or their dependents directly or through insurance, reimbursement, or otherwise, that has 50 or more participants or is administered by an entity other than the employer that established and maintains the plan.
A contractual term that restricts legally required or permitted disclosure. In healthcare compliance, agreements should not prevent required reporting, patient rights fulfillment, or cooperation with regulators.
The business associate definition expressly includes health information organizations, e-prescribing gateways, and other persons providing data transmission services with routine access to PHI.
A broad role or ownership assignment used in policies, such as designating privacy, security, records, or incident response responsibility. HIPAA programs work better when these designations are named and documented.
A compliance posture showing an organization attempted to follow HIPAA through reasonable policies, training, documentation, and response. Good faith does not erase violations, but it can affect enforcement outcomes.
A group responsible for privacy, security, risk, and compliance oversight. In larger organizations, a committee helps ensure HIPAA decisions are tracked, assigned, and reviewed.
Access permissions divided by role, location, patient relationship, function, or data type. Granular access helps support minimum necessary use and reduces broad exposure of ePHI.
A practical policy that defines boundaries for risky workflows such as texting, cloud storage, remote work, or AI tools. Guardrails help workforce members make compliant choices without memorizing regulations.
Genetic information (an individual's genetic tests, family members' tests, family disease manifestation, and genetic services participation) is health information by definition and is PHI when individually identifiable and held by a covered entity or business associate.
Privacy and security risk created when location-based tools collect or target people around healthcare facilities. Patient location data can create sensitive inferences.
Covered entities must provide a process for individuals to complain about the entity's privacy policies and its compliance, designate a contact person or office, and document all complaints received and their disposition.
A healthcare provider organization where multiple clinicians furnish services. HIPAA duties apply to the covered entity and should be implemented across shared systems and workforce roles.
A separate network for patients and visitors. It should be isolated from systems that create, receive, maintain, or transmit ePHI.
A prioritized workflow that turns risk analysis findings into assigned actions, due dates, evidence, and closure notes. Remediation tracking is what makes risk analysis operational.
A broad release is HIPAA-valid only if it contains the authorization core elements and required statements; missing elements or vague descriptions make it defective, and a defective authorization permits nothing.
A document defining a compliance committee's scope, members, meeting cadence, authority, and recordkeeping expectations.
Filtering for low-value bulk email that can hide important notices or security alerts. Healthcare organizations should avoid filtering that buries breach or vendor notices.
A centralized Windows configuration rule. GPOs can enforce password, lockout, logging, encryption, and workstation controls for ePHI environments.
A narrow access permission tied to a specific task, record type, or function. Granular permissions support least privilege and better audit review.
A parent, guardian, or person acting in loco parentis is generally the unemancipated minor's personal representative, except when the minor lawfully consented to the care, may lawfully obtain it without parental consent, or a parent has agreed to confidentiality between the minor and the provider.
A practical document explaining how to follow a policy in daily work. Guidelines should stay consistent with approved HIPAA policies and training.
A temporary or limited account used by visitors, contractors, or support personnel. Guest accounts should expire automatically and avoid unnecessary PHI access.
A regulated-system validation concept often seen in life sciences. It is not a HIPAA requirement, but validation evidence may matter where health data systems overlap.
An administrative safeguard concept involving Governance Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Governance Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Governance Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Governance Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Governance Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Governance PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Governance Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Governance User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Governance Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Governance Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Governance Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Governance Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Governance Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Governance Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Governance Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Care, services, or supplies related to the health of an individual, including preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition or functional status of an individual or affecting the structure or function of the body; and the sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
A public or private entity, including a billing service, repricing company, community health management information system, and value-added networks and switches, that either processes health information received from another entity from a nonstandard format into standard data elements or a standard transaction, or receives a standard transaction and converts it into nonstandard format or content for a receiving entity.
A component or combination of components of a hybrid entity designated as performing covered functions, in accordance with § 164.105(a)(2)(iii)(D).
Activities of the covered entity, to the extent related to its covered functions, including: quality assessment and improvement; population-based activities to improve health or reduce costs; case management and care coordination; reviewing competence and qualifications of professionals, evaluating performance, credentialing, training, accreditation, certification, and licensing; conducting or arranging medical review, legal services, and auditing functions, including fraud and abuse detection and compliance; business planning and development; and business management and general administrative activities, including customer service, internal grievance resolution, sale or transfer of assets, and creating de-identified information or limited data sets.
A provider of services as defined in section 1861(u) of the Social Security Act, a provider of medical or health services as defined in section 1861(s), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
Any information, including genetic information, whether oral or recorded in any form or medium, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for health care.
Defined for information blocking: an individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of technology or services for access, exchange, or use of electronic health information among more than two unaffiliated individuals or entities.
An individual or group plan that provides, or pays the cost of, medical care. The definition enumerates 17 categories, including group health plans, health insurance issuers, HMOs, Medicare Parts A and B, Medicaid, Medicare supplement issuers, long-term care policy issuers (excluding certain nursing home fixed indemnity policies), multi-employer welfare plans, and listed government programs. Excepted-benefit policies and government programs whose principal purpose is not providing or paying for health care are excluded.
The Department of Health and Human Services. In Parts 160 through 164, Secretary means the Secretary of HHS or any officer or employee to whom the authority has been delegated.
The Health Insurance Portability and Accountability Act of 1996. Established national standards for protecting individually identifiable health information. Key provisions include the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule. Despite its name, the law's privacy and security impact far exceeds its original insurance portability focus.
The Health Information Technology for Economic and Clinical Health Act of 2009. Made business associates directly liable for HIPAA violations, established the Breach Notification Rule, increased penalties, required periodic audits, and created the public breach portal. Most enforcement mechanisms that give HIPAA its teeth come from HITECH.
A single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates health care components in accordance with the rules.
The pre-2013 interim standard asking whether an incident posed significant risk of harm to the individual. The Omnibus Rule replaced it with the presumption of breach plus the four-factor low probability of compromise assessment.
The ONC certification criterion for a standardized API for patient and population services: certified health IT must support FHIR-based API access, the technical foundation for patient-facing apps and data exchange.
When acting as a business associate, a clearinghouse may receive a standard transaction on a covered entity's behalf and translate it into nonstandard format for the entity, and receive nonstandard transactions and translate them into standard ones.
A planned unique identifier for health plans that was never fully implemented as a required standard. Current HIPAA identifier requirements focus on NPIs for providers and EINs for employers in transactions.
An EHR vendor hosting a provider's records maintains ePHI on the provider's behalf and is a business associate by definition; the BAA and Security Rule obligations attach.
Manual evaluation by a qualified person before making a compliance-sensitive decision, such as breach determination, disclosure approval, or denial of access. Human review helps avoid automated policy errors.
Information collected by consumer health apps. It may fall outside HIPAA unless handled by a covered entity or business associate, but it can still be sensitive and regulated elsewhere.
HCPCS is defined at § 162.103 and adopted at § 162.1002 as a standard code set for physician services, other health care services, and medical supplies, orthotics, and durable medical equipment.
A unique label assigned to a device. Asset tags help track laptops, drives, and equipment that may access or store ePHI.
A fixed-length value generated from data to help detect changes. Hashes can support integrity checks for files, logs, and evidence packets.
The verification standard: before disclosure, verify the identity of a person requesting PHI and their authority to have access, if not already known, and obtain any required documentation, statements, or representations.
A database operated in a cloud or vendor environment. If it stores ePHI, the hosting arrangement needs safeguards, access controls, and usually a BAA.
The PHI definition draws the line: records a covered entity holds in its role as employer (sick notes, FMLA paperwork, drug test results in HR files) are excluded from PHI, while identical clinical information in the patient record is PHI.
An administrative safeguard concept involving HIPAA Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving HIPAA Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving HIPAA Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving HIPAA Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving HIPAA Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving HIPAA PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving HIPAA Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving HIPAA Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving HIPAA Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving HIPAA Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving HIPAA User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving HIPAA Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving HIPAA Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving HIPAA Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving HIPAA Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving HIPAA Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving HIPAA Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving HIPAA Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Specific requirements or instructions for implementing a standard.
A use or disclosure incident to an otherwise permitted use or disclosure is itself permitted, provided the entity applied reasonable safeguards and the minimum necessary standard. Overheard hallway conversations despite precautions are the classic example.
A subset of health information, including demographic information collected from an individual, that is created or received by a health care provider, health plan, employer, or health care clearinghouse; relates to a person's physical or mental health, health care, or payment for health care; and identifies the individual or provides a reasonable basis to believe it could be used to identify the individual.
The required specification to implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
The property that data or information have not been altered or destroyed in an unauthorized manner.
The addressable specification under transmission security: implement measures to ensure that electronically transmitted ePHI is not improperly modified without detection until disposed of.
The process of verifying a person's identity before granting portal access, releasing records, or enrolling them in a system. Weak identity proofing can lead to improper disclosure of PHI.
The Privacy Rule's baseline standard: a covered entity or business associate may not use or disclose PHI except as the rule permits or requires. Every breach starts as an impermissible use or disclosure.
The required security incident procedures standard: identify and respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and their outcomes.
A relationship in which the provider delivers health care based on the orders of another provider, and typically furnishes services, products, or reports of diagnosis or results directly to that other provider rather than to the individual. Labs and pathologists are the classic examples.
A practice by an actor (health care provider, health IT developer of certified health IT, or health information network or exchange) that is likely to interfere with access, exchange, or use of electronic health information, except as required by law or covered by a regulatory exception. For developers and networks the standard is knows or should know; for providers, knows the practice is unreasonable and likely to interfere.
A self-directed review of policies, procedures, training, access, vendors, or safeguards. Internal audits help catch compliance gaps before a complaint, breach, or regulator review.
The people, process, and technology used to manage users, authentication, roles, access reviews, and termination. IAM is central to ePHI access control.
A backup that cannot be altered or deleted for a defined period. Immutable backups can improve ransomware resilience and support contingency planning.
The person assigned to coordinate incident response activities. The role should manage escalation, communications, evidence preservation, and decision tracking.
A rating that indicates the impact and urgency of a privacy or security event. Severity levels help determine response timelines, notification review, and leadership involvement.
The workforce definition turns on direct control, not payroll: a contractor working under the entity's direct control is workforce; one operating independently with PHI is analyzed as a business associate.
Determination of eligibility or coverage is named inside the Privacy Rule's definition of payment, making verification a permitted payment activity under § 164.506; the electronic version is the 270/271 eligibility transaction at § 162.1202.
A maintained list of applications, databases, devices, integrations, and repositories that store or transmit ePHI. It is a practical foundation for risk analysis.
A collected set of logs, screenshots, notices, timelines, and decisions used to evaluate a privacy or security incident. It supports consistent breach assessment and later investigation response.
A repository for clinical images, scanned documents, or diagnostic files. Archives containing patient identifiers require access control, retention, and backup safeguards.
A workflow where received faxes wait for review and routing. Queues can contain PHI and should have restricted access and timely cleanup.
A contract term allocating responsibility for certain losses. Vendor agreements involving PHI should review indemnity alongside BAAs, insurance, and liability limits.
The risk that seemingly limited data can reveal sensitive facts when combined with other information. Inference risk matters for analytics, location, and small populations.
A service account used by one system to connect to another. Integration accounts should be unique, scoped, rotated, and monitored.
A patient-rights concept involving Individual Access Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Audit Evidence. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Policy Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Risk Finding. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Training Record. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Incident Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Vendor Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual PHI Handling. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Security Control. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Privacy Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Retention Check. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual User Provisioning. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Encryption Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Backup Test. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Contingency Task. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Compliance Calendar. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Evidence Packet. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual System Inventory. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Claims Transaction. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Eligibility Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Workforce Attestation. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Exception Register. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
Covered entities participating in an organized health care arrangement may produce a single joint notice meeting stated conditions; provision of the joint notice by any one participating entity satisfies the requirement for the others at that service delivery site.
A business arrangement between two or more parties. When a healthcare joint venture involves PHI, the parties must analyze covered entity status, business associate roles, BAAs, and permitted uses.
In judicial or administrative proceedings, PHI may be disclosed in response to a court or tribunal order (limited to what the order expressly authorizes), or to a subpoena or discovery request accompanied by satisfactory assurances of notice to the individual or a qualified protective order.
The legal authority of a regulator, court, or state over an entity or matter. HIPAA obligations may intersect with state privacy, breach, medical record, and consumer protection laws.
Temporary access granted only when needed for a specific task, incident, or patient care purpose. It reduces standing privileges and can support minimum necessary access.
A short operational reference that helps workforce members follow privacy or security procedures. Job aids should match the approved policy and avoid creating conflicting instructions.
A process that maps workforce duties to system permissions. It supports role-based access and helps justify why each role needs specific ePHI access.
An accreditation review that may examine privacy, documentation, safety, and operational controls. It is not a HIPAA audit but can surface related compliance gaps.
A state, federal, or local legal requirement that applies in addition to HIPAA. More stringent privacy laws may need to be followed alongside HIPAA.
An accountability model that distinguishes human error, risky behavior, and reckless conduct. It can help sanctions policies stay consistent and fair.
A health record for a minor. Parent access, minor consent, abuse concerns, and state law can change who may access or authorize disclosure.
A short record explaining why a safeguard, disclosure, or addressable specification decision was made. It helps preserve compliance reasoning for later review.
The litigation pathway: court order, or subpoena and discovery requests with satisfactory assurances (notice to the individual or a qualified protective order); the disclosure is limited to the PHI expressly authorized.
Controls that reduce improper or unsolicited faxing of patient information. Fax workflows should verify recipient numbers and minimize PHI on cover sheets.
Correctional institution is defined at § 164.501; a covered entity may disclose an inmate's PHI to the institution or law enforcement custodian when necessary for the individual's health care, safety and security of the institution, officers, employees, transport, or law enforcement on the premises.
Temporary access for trainees or observers. Access should be supervised, limited, and documented when PHI may be visible.
A shared review between a covered entity and vendor covering safeguards, incidents, access, and open remediation items.
A record of manual financial or billing adjustments. If entries reference patients or claims, they should be protected and retained appropriately.
A large data export from an EHR, billing system, or analytics tool. Bulk exports raise minimum necessary, access, encryption, and retention concerns.
A preservation requirement driven by a regulator, court, or state law. It may override routine destruction schedules for PHI or compliance evidence.
Care delivered inside a correctional institution operates under the correctional provisions: disclosures to the institution are permitted for treatment, institutional safety, and custody purposes, and inmates lack certain rights such as notice acknowledgment while in custody.
Small timing variation in logs, alerts, or network signals. Analysts should account for jitter when reconstructing incidents involving ePHI systems.
A check that PHI access is tied to the user's actual job function. It supports minimum necessary and role-based access decisions.
An investigation involving multiple parties, such as a covered entity, business associate, insurer, or regulator. Roles, evidence, and communications should be coordinated.
A disclosure supported by a permitted purpose, authorization, legal requirement, or patient right. The reason and scope should be documented when not routine.
An administrative safeguard concept involving Joint Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Joint Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Joint Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Joint Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Joint Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Joint PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Joint Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Joint Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Joint Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Joint Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Joint User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Joint Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Joint Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Joint Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Joint Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Joint Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Joint Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Joint Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Procedures for generating, distributing, storing, rotating, and destroying encryption keys. HIPAA does not specify key management by name, but effective encryption requires it. Poorly managed keys (stored alongside encrypted data, shared, or never rotated) undermine encryption entirely.
A process for securely storing encryption keys so authorized recovery is possible if primary access is lost. Key escrow must be tightly controlled because misuse can expose encrypted ePHI.
A metric used to monitor compliance program performance, such as training completion, BAA coverage, unresolved risks, access review completion, or incident closure time.
An authentication factor based on something the user knows, such as a password or PIN. Strong systems combine it with possession or biometric factors for multi-factor authentication.
A measurable signal used to manage compliance operations, such as training completion, unresolved risks, overdue BAAs, or incident closure time.
The planned replacement of encryption keys. Rotation limits exposure if a key is compromised and supports disciplined encryption management.
A metric that warns of increased privacy or security risk, such as terminated users with active accounts or overdue patching on ePHI systems.
A message authentication method using a secret key to verify integrity. It can help detect unauthorized changes in sensitive data workflows.
A launch checklist used when onboarding a new system, vendor, or location. It should cover PHI flows, access roles, BAAs, training, and safeguards.
An internal support article explaining approved procedures. Articles that mention PHI workflows should be reviewed so they do not conflict with HIPAA policies.
A software flaw listed as actively exploited by attackers. Systems handling ePHI should prioritize remediation of known exploited vulnerabilities.
A backup verified to restore correctly and free of corruption or malware. Backup testing matters because untested backups may fail during an incident.
A list of active workforce and service accounts. It supports access reviews, deprovisioning, and detection of orphaned accounts.
A dashboard tracking compliance and security metrics. It should summarize evidence status without exposing unnecessary PHI.
A network authentication protocol used in many enterprise environments. When used for ePHI systems, ticket lifetimes, account hygiene, and logging matter.
Patient intake through a shared kiosk or tablet. It needs screen privacy, session reset, authentication, and sanitation of cached PHI.
An encryption key managed by a key management service. KMS keys protecting ePHI should have restricted administration, rotation, and audit logs.
The handoff of operational knowledge during staff changes or vendor transitions. For HIPAA programs, transfer should preserve policy ownership, evidence, and risk context.
A process for confirming that a message or file came from an expected source. It helps reduce phishing and misdirected PHI workflows.
A person or role responsible for protecting, issuing, rotating, or recovering encryption keys. Key custodian duties should be separated from ordinary user access where practical.
A protected copy of an encryption key used for recovery. Key backups need stronger controls than ordinary files because they can unlock sensitive data.
Workstation habits and screen placement that reduce shoulder-surfing and accidental viewing. It is a practical physical safeguard in reception and shared spaces.
A model describing stages of an attack, from reconnaissance through actions on objectives. It helps security teams map defenses around ePHI systems.
Access granted to analysts, billing staff, compliance staff, or managers who need records for operations rather than direct care.
A container-platform object used to store credentials or keys. Secrets tied to ePHI applications should be encrypted, scoped, and rotated.
A technical safeguard or security operations concept involving Key Access Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A compliance oversight concept involving Key Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A technical safeguard or security operations concept involving Key Policy Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Risk Finding. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Training Record. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Key Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A technical safeguard or security operations concept involving Key PHI Handling. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Security Control. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Privacy Workflow. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Retention Check. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Key Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Key User Provisioning. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Contingency Task. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Compliance Calendar. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Evidence Packet. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key System Inventory. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Key Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Key Claims Transaction. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Eligibility Workflow. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Key Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Key Workforce Attestation. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Exception Register. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Permitted disclosures to law enforcement officials: as required by law or legal process; limited identification and location information about suspects, fugitives, witnesses, or missing persons; about victims in stated circumstances; about decedents; crime on the premises; and crime emergencies.
PHI that excludes 16 listed direct identifiers of the individual and of relatives, employers, and household members. It may retain dates and some geography, and may be used or disclosed only for research, public health, or health care operations, and only under a data use agreement.
The addressable specification for procedures to monitor log-in attempts and report discrepancies.
The official business record of patient care maintained by a provider. It often overlaps with the designated record set, but the two concepts are not always identical.
A process preserving records when litigation, investigation, audit, or enforcement action is reasonably anticipated. A legal hold can override normal destruction schedules.
A user account managed on a single device or application rather than through a central identity provider. Local accounts should be inventoried, secured, and removed when no longer needed.
A lost or stolen device holding ePHI is a security incident to respond to, mitigate, and document; if the data was unencrypted, breach notification analysis follows because the PHI was unsecured.
A directory service used to manage users and groups. When tied to ePHI system access, directory accuracy affects authentication, authorization, and termination controls.
An older application or device that may lack modern security features. Legacy systems containing ePHI need compensating safeguards and documented risk decisions.
A security principle that limits systems to necessary services, ports, and features. It reduces attack surface for systems handling ePHI.
A contract limit on damages. For vendors handling PHI, liability caps should be reviewed against breach, indemnity, and regulatory risk.
Licensing and credentialing activities appear in the definition of health care operations, permitting the PHI uses they entail.
Managing systems, vendors, policies, and accounts from creation through retirement. Lifecycle discipline prevents stale access, outdated policies, and unsupported ePHI repositories.
Protection of location information that may reveal care, diagnosis, or visit patterns. Location data tied to healthcare can create sensitive PHI inferences.
The period audit and security logs are kept. Retention should align with investigation needs, policy requirements, and the six-year HIPAA documentation rule where applicable.
Access granted through software permissions rather than physical entry. Logical access controls include authentication, authorization, session management, and logging.
Rules for marking documents, exports, tickets, or files by sensitivity. Labels help workforce members recognize PHI and apply the right handling steps.
The official health record maintained for legal and business purposes. It supports patient access, amendment, disclosure, and retention processes.
Documentation maintained by skilled nursing, assisted living, or long-term care providers. It is PHI when held by a covered provider.
The documented response path for a missing device, implementing the security incident procedures standard and feeding the breach risk assessment when unsecured ePHI is involved.
The single highest-value safeguard for portable devices: it implements the encryption specification and keeps a lost laptop outside the breach rules because the PHI is not unsecured.
A record entry made after the original event. Late entries should be clearly marked and preserve integrity of the original documentation timeline.
A written statement from management, counsel, or a vendor about facts relevant to compliance. It should be supported by evidence where possible.
A record of a chat interaction. If patients discuss care, billing, or identifiers, transcripts become PHI and need retention and access controls.
An account with elevated privileges on a device or application. Local admin rights should be limited because they can bypass normal safeguards.
An administrative safeguard concept involving Limited Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Limited Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Limited Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Limited Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Limited Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Limited PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Limited Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Limited Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Limited Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Limited Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Limited User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Limited Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Limited Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Limited Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Limited Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Limited Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Limited Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Limited Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Software, for example a virus, designed to damage or disrupt a system.
A communication about a product or service that encourages recipients to purchase or use it. Marketing does not include refill reminders (if any payment received is reasonably related to the cost of making the communication) or communications for treatment, care coordination, or to describe the entity's own health-related products and services, EXCEPT that those become marketing when the covered entity receives financial remuneration from a third party whose product is being promoted. Marketing communications require prior written authorization that discloses the remuneration.
The required specification for procedures to remove ePHI from electronic media before the media are made available for re-use.
When using, disclosing, or requesting PHI, make reasonable efforts to limit it to the minimum necessary to accomplish the intended purpose. Does not apply to disclosures to or requests by a provider for treatment, disclosures to the individual, uses or disclosures under an authorization, disclosures to the Secretary, and uses or disclosures required by law.
Access control requiring two or more verification factors before granting access to ePHI. While HIPAA does not explicitly name MFA, the 2025 Security Rule NPRM proposes making it a required specification. Many practices already use MFA for EHR access.
Combines the awareness specification (procedures for guarding against, detecting, and reporting malicious software) with the security incident procedures standard (identify, respond, mitigate, document).
An IT provider that creates, receives, maintains, or transmits ePHI for a covered entity is a business associate; maintaining or hosting ePHI alone triggers the definition, even without viewing it.
A business associate violation significant enough to trigger the covered entity's duty to take reasonable steps to cure or end it, and failing that, to terminate the contract if feasible.
A safe harbor identifier category: medical record numbers must be removed for de-identification. Operationally, the MRN is the patient's unique identifier within a provider's systems.
The implementation specifications: for routine and recurring disclosures, standard protocols limiting PHI to the minimum necessary; for all other disclosures, criteria and individual review of each request.
Technology used to enforce security settings on phones, tablets, and laptops. MDM can require encryption, passcodes, remote wipe, app controls, and separation of work data.
A system that links patient identities across records and facilities. MPI accuracy affects patient matching, privacy, and safe information exchange.
Review of health care services for medical necessity, coverage, or justification of charges is named within the Privacy Rule's definition of payment.
A reporting rule that suppresses small counts to reduce re-identification risk. It is often used in analytics, quality reporting, and public health datasets.
Software used to enforce settings on phones, tablets, and laptops. MDM can require encryption, passcodes, remote wipe, and application controls for devices accessing ePHI.
A template policy adapted to an organization's actual workflows. Model policies are useful only when customized, approved, trained, and followed.
A cloud environment where multiple customers share provider infrastructure. HIPAA use requires proper logical separation, safeguards, and a BAA when the provider handles ePHI.
An outsourced IT provider handling systems that hold ePHI is a business associate under the definition's create, receive, maintain, or transmit language; a BAA is required.
The unique number identifying a patient within a provider's records; a listed safe harbor identifier that must be removed for de-identification.
A cryptographic value used to verify message integrity and authenticity. It can support trustworthy transmission of sensitive health data.
Rules for receiving, sorting, scanning, and sending mail that may include PHI. Procedures reduce misrouting and unattended-document exposure.
A backup service operated by an internal IT team or vendor. If the service stores or can access ePHI backups, BAA and safeguard requirements apply.
A temporary process used when normal systems are unavailable or not ready. Workarounds involving PHI should be approved, documented, and retired.
The record showing media were disposed of and tracked: disposal procedures are required, and the addressable accountability specification calls for maintaining a record of the movements of hardware and electronic media and any person responsible.
Disclosure of information in file names, headers, logs, or document properties. Metadata can reveal patient identity, diagnosis, location, or workflow details.
A privacy-rule concept involving Minimum Necessary Access Review. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A compliance oversight concept involving Minimum Necessary Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Minimum Necessary Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Minimum Necessary Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Minimum Necessary Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Minimum Necessary Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Minimum Necessary Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Minimum Necessary PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving Minimum Necessary Security Control. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving Minimum Necessary Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Minimum Necessary Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Minimum Necessary Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Minimum Necessary User Provisioning. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A technical safeguard or security operations concept involving Minimum Necessary Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Minimum Necessary Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Minimum Necessary Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Minimum Necessary Compliance Calendar. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving Minimum Necessary Evidence Packet. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Minimum Necessary System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Minimum Necessary Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Minimum Necessary Claims Transaction. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving Minimum Necessary Eligibility Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A patient-rights concept involving Minimum Necessary Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Minimum Necessary Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Minimum Necessary Exception Register. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
The standard unique health identifier for health care providers: a 10-position all-numeric identifier with a check digit and no embedded intelligence. Covered providers must obtain an NPI, disclose it on request, use it in standard transactions, and report changes within 30 days.
The National Institute of Standards and Technology. Develops cybersecurity standards referenced by OCR. Key documents: NIST SP 800-66 (HIPAA Security Rule implementation), the Cybersecurity Framework, and NIST SP 800-53 (security controls). HHS has cited NIST guidance in multiple enforcement actions.
Individuals have a right to adequate written notice of the entity's uses and disclosures of PHI, the individual's rights, and the entity's legal duties, with a required header, content elements, effective date, distribution rules, posting requirements, and website availability.
Dividing a network into zones to limit movement between systems. Segmentation can reduce the blast radius of malware and protect systems containing ePHI from unnecessary exposure.
For disclosures not made on a routine and recurring basis, develop criteria designed to limit PHI to the minimum necessary and review each request individually against those criteria.
Individual breach notice must describe, to the extent possible, what happened and when, the types of information involved, steps individuals should take, what the entity is doing to investigate and mitigate, and contact procedures. Written notice goes by first-class mail, or email if the individual agreed, without unreasonable delay and no later than 60 days after discovery.
A provider with a direct treatment relationship must make a good faith effort to obtain the individual's written acknowledgment of receipt of the notice at first service delivery, and if not obtained, document the effort and why it failed.
The adopted standard medical data code set for drugs and biologics in retail pharmacy transactions: National Drug Codes as maintained and distributed by HHS in collaboration with drug manufacturers.
The workforce minimum necessary specification: identify the persons or classes of persons who need access to PHI to carry out their duties, the categories of PHI needed, and appropriate conditions on that access.
A confidentiality contract. An NDA may protect business information, but it does not replace a BAA when a vendor handles PHI for a covered entity.
Assurance that a person cannot reasonably deny a transaction or action. Digital signatures, audit logs, and strong authentication support non-repudiation.
A record of breach or incident notices sent to patients, HHS, media, business associates, or partners. It supports evidence of timely notification.
Clinical and administrative documentation maintained by a nursing facility. These records are PHI when held by a covered provider or related business associate.
An event that could have caused a privacy or security incident but was caught before harm occurred. Tracking near misses improves training and controls.
Technology that decides whether devices may connect to a network. NAC can enforce posture checks before access to networks with ePHI systems.
Shared storage connected to a network. NAS devices containing PHI need access controls, encryption where appropriate, backups, and patching.
A map of systems, segments, connections, and data flows. Current diagrams make risk analysis and incident response more accurate.
The format in which records are provided to a requester. Patient access workflows should honor requested electronic form when readily producible.
Breach notice methods: written notice by first-class mail to the last known address (or email if the individual agreed), substitute notice when contact information is insufficient, and urgent notice by telephone in addition to written notice when there is possible imminent misuse.
A safeguard that limits or monitors outbound traffic from systems and networks. Egress controls can reduce unauthorized PHI exports and improve breach detection.
A proposed identifier for health plans that has not been implemented as a required standard. Organizations should avoid assuming an adopted plan identifier exists.
A record of network traffic metadata between systems. Flow logs help investigate unusual transfers, lateral movement, and possible PHI exfiltration.
Documentation generated under the surprise billing rules (notice and consent records, good faith estimates, required disclosures) lives under 45 CFR Part 149.
A test, staging, or development environment. Live PHI should be avoided there unless safeguards, approvals, and masking controls are in place.
The National Provider System assigns a single, unique NPI to each provider (with subpart enumeration rules), collects and maintains provider information, deactivates NPIs when appropriate, reactivates on request, and never reassigns a deactivated NPI to another provider.
A patient-rights concept involving Notice Access Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Audit Evidence. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Policy Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Risk Finding. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Training Record. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Incident Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Vendor Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice PHI Handling. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Security Control. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Privacy Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Retention Check. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice User Provisioning. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Encryption Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Backup Test. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Contingency Task. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Compliance Calendar. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Evidence Packet. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice System Inventory. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Claims Transaction. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Eligibility Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Workforce Attestation. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Exception Register. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
The HHS division that enforces HIPAA. Investigates complaints, conducts compliance reviews, provides technical assistance, and imposes penalties. Most investigations begin with patient complaints or breach reports, not random audits.
The 2013 final rule implementing HITECH Act provisions into HIPAA. Extended requirements directly to business associates, strengthened the breach notification standard (from "harm" to "probability of compromise"), and expanded patient rights. The reason BAs are directly subject to enforcement today.
A clinically integrated care setting in which individuals typically receive health care from more than one provider; an organized system of health care in which participating covered entities hold themselves out to the public as joint participants and engage in joint utilization review, quality assessment, or shared financial risk; or specified arrangements between group health plans and health insurance issuers or HMOs. OHCA members may share PHI for the arrangement's operations and may use a joint notice of privacy practices.
A technical approach that applies access controls, labels, or encryption directly to files, records, or data objects. It can help protect PHI even when data moves across systems.
A vendor that stores, processes, supports, or accesses PHI from outside the United States. Offshore arrangements require careful BAA terms, security review, and awareness of payer or state restrictions.
A day-to-day control that turns written policy into actual practice, such as access reviews, ticket approvals, log checks, badge procedures, or breach drills.
The mandatory restriction: when the individual or someone on their behalf (other than the plan) has paid for the item or service in full, the entity must honor a request not to disclose it to the health plan for payment or operations, unless disclosure is required by law.
Coding vendors receive PHI to assign billing codes on the provider's behalf, a business associate function requiring a BAA.
The Exchange enrollment provision: the initial open enrollment period and the annual open enrollment period during which qualified individuals may enroll in or change qualified health plans.
The common name for clinical note sharing driven by the information blocking rules: withholding electronic health information such as clinical notes can be information blocking under § 171.103 unless a regulatory exception applies.
An organization's ability to continue critical services during disruption. For healthcare, resilience connects contingency planning, backups, downtime procedures, and vendor readiness.
An affirmative permission model where a person actively agrees to a use or disclosure. HIPAA uses authorization for many non-TPO uses, while state law may impose opt-in rules.
A patient's choice to decline certain communications or directory listings when permitted. Preferences should be documented and honored across relevant workflows.
A system used to enter medications, labs, imaging, or service orders. Because it creates and transmits PHI, access, integrity, and audit controls matter.
Steps for operating through a system outage, implementing the emergency mode operation specification for protection of ePHI during the event.
A third party billing for a provider handles PHI for a covered function and is a business associate; billing is named in the definition.
Confirming identity or request details through a separate communication channel. It reduces risk for password resets, portal invites, and sensitive disclosures.
A control or process for checking messages before they leave the organization. It can catch misaddressed emails or attachments containing PHI.
A record of when a user bypasses a normal restriction or alert. Override logs should be reviewed for appropriateness and potential privacy concerns.
Technology that converts scanned images into searchable text. OCR output can create new PHI repositories when medical records, IDs, or billing documents are indexed.
Cloud storage for files and unstructured data. Object buckets containing PHI need access policies, encryption, logging, and lifecycle controls.
A process for securing records, devices, mail, voicemail, and systems during temporary or permanent closure. It supports continuity and privacy protection.
Temporary or after-hours access needed for care, support, or incident response. On-call access should be role-limited and logged.
A web form used to collect patient or billing information. Forms collecting PHI need secure transport, storage, access controls, and vendor review.
A risk, audit, or incident action that missed its due date. Tracking overdue items helps leadership prioritize unresolved HIPAA exposure.
An administrative safeguard concept involving OCR Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving OCR Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving OCR Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving OCR Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving OCR Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving OCR PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving OCR Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving OCR Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving OCR Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving OCR Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving OCR User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving OCR Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving OCR Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving OCR Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving OCR Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving OCR Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving OCR Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving OCR Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Identifying, testing, and applying software updates to fix known vulnerabilities. The Security Rule's requirement to protect against reasonably anticipated threats encompasses keeping systems updated. Unpatched software is a leading entry point for ransomware in healthcare. OCR has cited failure to patch in multiple enforcement actions.
Activities of a health plan to obtain premiums or determine or fulfill its coverage and benefit responsibilities, and activities of a provider or plan to obtain or provide reimbursement for health care. Includes eligibility and coverage determinations, adjudication or subrogation of claims, risk adjusting, billing, claims management, collection activities, medical necessity and justification-of-charges review, utilization review (precertification, preauthorization, concurrent and retrospective review), and limited disclosures to consumer reporting agencies.
The required standard to implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.
A person with authority under applicable law to act on behalf of an individual in making health care decisions, or for a decedent's estate, must be treated as the individual for Privacy Rule purposes, subject to the abuse, neglect, and endangerment exception at § 164.502(g)(5).
Physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.
Defined as at section 3(16)(B) of ERISA: the employer, for a plan established by a single employer; the employee organization, for a plan maintained by one; or the association, committee, joint board of trustees, or similar group, for a multi-employer plan.
Both rules require implementing reasonable and appropriate written policies and procedures to comply with their standards, maintained in accordance with the documentation requirements and changed as needed.
HIPAA standards preempt contrary state law, with exceptions: Secretary-granted exception determinations, state laws more stringent than the federal standard, public health reporting laws, and certain health plan reporting and audit laws. More stringent state privacy protections survive.
A covered entity must designate, and document, a privacy official responsible for developing and implementing its privacy policies and procedures, plus a contact person or office for complaints and further information.
The privacy standards for individually identifiable health information: permitted and required uses and disclosures, authorization requirements, individual rights (notice, access, amendment, accounting, restrictions), and administrative requirements.
Individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by FERPA, the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), employment records held by a covered entity in its role as employer, and records of a person who has been deceased for more than 50 years.
Notes recorded in any medium by a mental health professional documenting or analyzing the contents of conversation during a private, group, joint, or family counseling session, that are separated from the rest of the individual's medical record. Excludes medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
Permitted disclosures without authorization to public health authorities for preventing or controlling disease, injury, or disability, including reporting disease, births and deaths, child abuse or neglect, FDA-regulated product safety, communicable disease exposure, and workplace medical surveillance in stated circumstances.
A secure online system that lets patients view records, send messages, request appointments, or pay bills. Portal access requires identity proofing, authentication, audit logging, and appropriate privacy controls.
The named HIPAA transaction pairing payment (EFT) with the explanation of payment (X12N 835 remittance advice).
Not required by HIPAA. Testing results serve as evidence for the required risk analysis and the periodic technical evaluation standard.
Not named in the regulation. Phishing defenses fall under the security awareness and training standard, including the specification for guarding against, detecting, and reporting malicious software.
An authentication factor based on something the user has, such as a hardware key, authenticator app, smart card, or security token. It is commonly paired with a password for MFA.
The health plan premium payments transaction, conducted with the adopted ASC X12N 820 standard.
A tool commonly used to satisfy the addressable password management specification: procedures for creating, changing, and safeguarding passwords.
Patient app access to records rides on the standardized API for patient and population services certification criterion; CMS program rules (Title 42) require payers to expose Patient Access APIs built on the same standards.
The good faith estimate requirement: providers and facilities must give uninsured or self-pay individuals an estimate of expected charges for scheduled items and services, within the section's timeframes and content requirements.
The process of linking records to the correct individual. Matching errors can cause wrong-record access, disclosure, or clinical safety problems.
A message inviting a patient to create portal access. It should verify destination details and avoid exposing more PHI than necessary.
Procedures are reported with the adopted code sets: CPT-4 and HCPCS for physician and other health care services, ICD-10-PCS for inpatient hospital procedures, and CDT for dental services.
A privacy-rule concept involving PHI Access Review. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A compliance oversight concept involving PHI Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving PHI Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving PHI Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving PHI Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving PHI Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving PHI Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
Protected health information: individually identifiable health information transmitted or maintained in any form or medium (electronic, paper, or oral) by a covered entity or business associate, excluding FERPA education records, certain student treatment records, employment records held by an employer, and records of persons deceased more than 50 years.
A privacy-rule concept involving PHI Security Control. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving PHI Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving PHI Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving PHI Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving PHI User Provisioning. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A technical safeguard or security operations concept involving PHI Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving PHI Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving PHI Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving PHI Compliance Calendar. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving PHI Evidence Packet. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving PHI System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving PHI Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving PHI Claims Transaction. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving PHI Eligibility Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A patient-rights concept involving PHI Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving PHI Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving PHI Exception Register. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A court or tribunal order, or a stipulation, that prohibits the parties from using or disclosing the PHI for any purpose other than the litigation and requires return or destruction of the PHI, including copies, at the end of the proceeding.
Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, are the first-listed health care operations.
Quality assessment activities are health care operations by definition, permitting use of PHI without authorization under § 164.506.
A search or lookup of patient information in an EHR, HIE, or other system. Queries should be tied to a permitted purpose and captured in audit logs.
The workflow for routing access requests, amendment requests, incidents, claims, or privacy tasks to the right owner. Good queue management helps meet HIPAA deadlines and documentation expectations.
Part 2's analog to a business associate agreement: the agreement by which a service organization receiving Part 2 records acknowledges it is bound by the Part 2 rules and will resist unauthorized efforts to obtain the records.
A metric used to assess care, outcomes, safety, or performance. Measures may rely on PHI and should follow minimum necessary and reporting rules.
A health information exchange model where one system searches another for patient records. Access should be tied to identity, purpose, consent rules, and audit logs.
An electronic transaction waiting to be processed or transmitted. Queues containing PHI need access controls, retention rules, monitoring, and error handling.
A short incident procedure for urgent privacy or security events. It should identify first actions, escalation contacts, evidence preservation, and breach review triggers.
A controlled location where suspicious files, messages, or records are isolated for review. If PHI is present, access and retention still need safeguards.
A scheduled review of user permissions. It helps detect excessive access, stale accounts, role drift, and termination failures before they create incidents.
A recurring review of training, incidents, risks, policies, BAAs, and evidence. It keeps HIPAA work from becoming a once-a-year scramble.
A recurring patch process for lower-risk updates. Critical vulnerabilities affecting ePHI systems may need faster handling outside the routine cycle.
A recurring review of business associates and key vendors. It checks BAA status, incidents, security evidence, subcontractors, and service changes.
A disclosure that must be reviewed because its authority, recipient, or minimum necessary scope is unclear. It should be paused or escalated before release when possible.
The minimum attendance needed for governance decisions to be valid. Defining quorum helps document oversight and accountability for privacy and security decisions.
Controls that limit storage, message, or export volume. Quotas can reduce accidental bulk exposure of PHI and support monitoring for abnormal activity.
A limited record sample used to test process accuracy. Samples containing PHI should be minimized, protected, and destroyed when no longer needed.
A person with appropriate role, authority, or expertise for a specific compliance task. Documentation should show why the individual was assigned.
A health plan that has in effect a certification that it meets the standards of Part 156 Subpart C, issued or recognized by each Exchange through which the plan is offered.
Submitting care quality or performance data to a payer, registry, or government program. Reports should use minimum necessary data and appropriate agreements.
A completed form from a patient, workforce member, or vendor. Responses may contain PHI, compliance evidence, or security information requiring protection.
Reviewing work queues for stuck claims, referrals, faxes, portal messages, or incidents. Queues containing PHI need timely handling and access limits.
A professional role used in some security assessment programs. It is not a HIPAA-defined certification, but assessor evidence may support broader vendor or control review.
An administrative safeguard concept involving Qualified Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Qualified Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Qualified Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Qualified Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Qualified Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Qualified PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Qualified Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Qualified Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Qualified Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Qualified Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Qualified User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Qualified Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Qualified Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Qualified Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Qualified Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Qualified Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Qualified Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Qualified Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the entity did not act with willful neglect.
The business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.
A 2021 HITECH amendment requiring OCR to consider whether an entity had recognized security practices in place for the prior 12 months when determining fines. Includes NIST Cybersecurity Framework compliance and Section 405(d) of the Cybersecurity Act of 2015. Provides tangible incentive to adopt industry-standard security frameworks.
Required documentation must be retained for six years from the date of its creation or the date when it last was in effect, whichever is later. This is a documentation retention rule; HIPAA does not set medical record retention periods, which are state law.
The documented plan for reducing identified risks; it implements the required risk management specification, which calls for measures sufficient to bring risk to a reasonable and appropriate level.
A mandate contained in law that compels a use or disclosure of PHI and is enforceable in a court of law. Includes court orders and court-ordered warrants; subpoenas or summonses issued by a court, grand jury, inspector general, or authorized administrative body; civil or authorized investigative demands; Medicare conditions of participation; and statutes or regulations requiring production of information, including when payment is sought under a government benefit program.
A specification the regulation marks as required must be implemented as written. No assessment, alternative measure, or documentation substitute applies.
A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
A formal settlement between OCR and an entity resolving a compliance investigation. Typically includes a monetary payment and a corrective action plan. Published on the HHS website as enforcement precedent.
The individual's right to inspect and obtain a copy of PHI in a designated record set, excluding psychotherapy notes and litigation-prepared information; in the form and format requested if readily producible; within 30 days with one 30-day extension; for a reasonable, cost-based fee. The entity must also transmit copies to a third party the individual clearly designates in a signed writing.
The individual's right to have a covered entity amend PHI in a designated record set. The entity acts within 60 days (one 30-day extension) and either makes the amendment and notifies relevant parties, or issues a written denial explaining the basis and the individual's rights.
Individuals may request restrictions on uses and disclosures for treatment, payment, operations, and to persons involved in care. The entity need not agree, except it MUST agree when the disclosure would go to a health plan for payment or operations and the item or service was paid out of pocket in full.
The required specification to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the entity.
The required specification to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).
A ransomware encryption of ePHI is a security incident by definition (unauthorized access and interference with system operations), and under OCR guidance it is presumptively a breach of unsecured PHI unless the four-factor assessment demonstrates a low probability of compromise.
Matching an EFT payment to its corresponding 835 remittance advice by trace number, governed by the Phase III CORE 370 Reassociation Rule adopted as an operating rule.
The referral certification and authorization transaction, conducted with the adopted ASC X12N 278 standard.
Access to systems from outside the organization's controlled network. Remote access to ePHI should use MFA, encryption, device controls, logging, and clear workforce rules.
The individual's ask to limit how PHI is used or shared. Optional for the entity to grant, except the mandatory self-pay restriction; once agreed, a restriction binds the entity except in emergencies.
No intimidation, threats, coercion, discrimination, or other retaliatory action against individuals for exercising Privacy Rule rights, filing a complaint, participating in an investigation or hearing, or opposing an unlawful act or practice in good faith.
A common method of satisfying information access management: access rights granted by job role, consistent with documented policies for authorizing access to ePHI.
A documented decision that a residual risk is at a reasonable and appropriate level, made using the flexibility factors: size, complexity, and capabilities; technical infrastructure; costs; and probability and criticality of the risks.
The working inventory of identified risks and their treatment. Not named in the rule, but the standard way entities document that risk management decisions were made and tracked.
A control that deletes managed data from a lost, stolen, or retired device. Remote wipe supports mobile and BYOD protection for ePHI.
Reviewing and modifying a user's right of access when duties change implements the addressable access establishment and modification specification.
An administrative safeguard concept involving Risk Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Risk Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Risk Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Not separately defined in the regulation. The Security Rule operationalizes risk through the required risk analysis and risk management specifications: assess threats and vulnerabilities to ePHI, then reduce them to a reasonable and appropriate level.
An administrative safeguard concept involving Risk Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Risk Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Risk Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Risk PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Risk Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Risk User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Risk Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Risk Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Risk Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Risk Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Risk Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Risk Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Risk Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Remove 18 categories of identifiers of the individual and of the individual's relatives, employers, and household members, and have no actual knowledge that the remaining information could be used alone or in combination to identify the individual.
The Privacy Rule requires appropriate administrative, technical, and physical safeguards to protect PHI from impermissible use or disclosure; the Security Rule's general rules require protecting the confidentiality, integrity, and availability of all ePHI against reasonably anticipated threats and impermissible uses.
A covered entity or business associate may not receive direct or indirect remuneration in exchange for PHI, except under an authorization stating that remuneration will result, or within listed exceptions including public health, research (cost-based), treatment and payment, sale of the business, business associate services, individual access fees, and disclosures required by law.
Both rules require appropriate sanctions against workforce members who fail to comply with the entity's security or privacy policies and procedures.
The required standard to implement a security awareness and training program for all members of the workforce, including management. Its addressable specifications cover security reminders, protection from malicious software, log-in monitoring, and password management.
The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations, in an information system.
The required standard to implement policies and procedures to prevent, detect, contain, and correct security violations. Its four implementation specifications are risk analysis, risk management, sanction policy, and information system activity review.
The security official every covered entity and business associate must identify as responsible for developing and implementing security policies and procedures. In small practices this is often the same person as the Privacy Officer.
The security standards for the protection of electronic protected health information: general rules, administrative safeguards, physical safeguards, technical safeguards, organizational requirements, and documentation requirements, applying to covered entities and business associates.
HIPAA does not specifically address social media, but the rules apply regardless of platform. Posting patient photos, sharing treatment details, or discussing identifiable patients on social media is a PHI disclosure requiring authorization. Even well-intentioned posts can violate HIPAA.
A rule, condition, or requirement describing products, systems, services, or practices: classification of components, specification of materials, performance, or operations, or delineation of procedures; or, with respect to the privacy of health information, a rule, condition, or requirement of Subpart E.
A transaction that complies with an adopted HIPAA standard. A covered entity conducting a covered transaction with another covered entity using electronic media must conduct it as a standard transaction.
Under the HITECH Act, state AGs can bring civil actions in federal court on behalf of residents affected by HIPAA violations. Provides an independent enforcement mechanism beyond OCR. Several state AGs have brought actions after large breaches.
A person to whom a business associate delegates a function, activity, or service, other than as a member of the business associate's workforce. A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate.
Records of federally assisted substance use disorder treatment programs carry protections beyond HIPAA: patient consent requirements for disclosure, limits on redisclosure, and restrictions on use in proceedings against the patient. Within Title 45, such records held by covered entities remain PHI as well.
Sanctions applied to workforce members must be documented, and the documentation retained under § 164.530(j).
Encrypted messaging platforms implement the transmission security standard when ePHI moves between parties over a network.
A vendor or customer questionnaire used to evaluate safeguards, policies, incident response, and compliance posture. It supports due diligence but should be validated against evidence where possible.
A contract provision defining performance expectations such as uptime, response time, backup recovery, or incident notice. SLAs for PHI vendors should align with contingency and breach response needs.
A model dividing security and compliance duties between an organization and its vendor, especially in cloud services. The customer remains responsible for its own configuration, access decisions, and policies.
An independent report on a service organization's controls. SOC 2 can support vendor due diligence, but it is not a HIPAA certification and does not replace a BAA.
Encrypted file transfer implements the transmission security standard: guarding against unauthorized access to ePHI moving over an electronic communications network.
An approved deviation from a security requirement. Exceptions should be time-limited, risk-rated, and tied to compensating safeguards.
A control that separates responsibilities so one person cannot perform conflicting high-risk actions unchecked. It can reduce fraud, misuse, and admin abuse.
A diagnosis that may carry additional stigma or legal protection. Access and disclosure should account for minimum necessary and any stricter state or federal rules.
An administrative safeguard concept involving Security Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Security Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Security Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Security Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Security Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Security PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
Security or security measures encompass all of the administrative, physical, and technical safeguards in an information system.
A privacy-rule concept involving Security Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Security Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Security Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Security User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Security Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Security Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Security Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Security Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Security Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Security Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Security Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The Secretary may provide technical assistance to covered entities and business associates to help them comply voluntarily with the administrative simplification provisions.
The technology and the policy and procedures for its use that protect electronic protected health information and control access to it.
Delivering healthcare services through electronic communications. HIPAA applies the same way as in-person care. ePHI must be protected during transmission and storage. Telehealth platforms must be HIPAA-compliant and covered by a BAA.
A covered entity that knows of a pattern of activity or practice of its business associate in material breach must take reasonable steps to cure or end the violation, and if unsuccessful, terminate the contract if feasible. The BAA itself must authorize termination for violation of a material term.
A covered entity may use or disclose PHI for its own treatment, payment, or health care operations without individual authorization, and for another entity's in stated circumstances. The three terms are defined at § 164.501.
The transmission of information between two parties to carry out financial or administrative activities related to health care, including health care claims or equivalent encounter information, payment and remittance advice, coordination of benefits, claim status, enrollment and disenrollment, eligibility, premium payments, referral certification and authorization, first report of injury, health claims attachments, EFT and remittance advice, and other transactions the Secretary may prescribe.
The required standard to implement technical security measures to guard against unauthorized access to ePHI being transmitted over an electronic communications network.
The provision, coordination, or management of health care and related services by one or more health care providers, including coordination or management with a third party, consultation between providers relating to a patient, and referral of a patient from one provider to another.
A discussion-based walkthrough used to satisfy the addressable testing and revision specification: periodic testing and revision of contingency plans.
Identifying reasonably anticipated threats is a component of the required risk analysis of risks and vulnerabilities to ePHI.
Replacing sensitive values with tokens that have no useful meaning outside a controlled system. Tokenization may reduce exposure but does not automatically remove HIPAA obligations if re-identification remains possible.
The documentation that required training was provided, retained in written or electronic form under § 164.530(j).
The adopted format specification for each named transaction; covered entities conducting those transactions electronically must use the adopted standard.
Software used to provide remote care. If it creates, receives, maintains, or transmits PHI for a covered provider, HIPAA safeguards and often a BAA are required.
A TPA processing or administering claims for a health plan is a business associate; claims processing or administration is the first activity listed in the business associate definition.
A support system used to track requests and incidents. If tickets include PHI, the system needs access controls, retention rules, and user guidance.
The Privacy Rule distinguishes direct treatment relationships, where the provider delivers care and results to the individual, from indirect ones, where care is based on another provider's orders and results flow through that provider.
A person the individual identifies for involvement in care or notification; disclosures to them are limited to PHI directly relevant to that involvement, with the individual given the opportunity to agree or object when practicable.
TLS is a standard technology used to meet the transmission security standard and its encryption specification for ePHI in transit.
The operational artifact implementing the addressable termination procedures specification: terminating access to ePHI when employment or another workforce arrangement ends.
A controlled store that maps tokens back to sensitive values. A token vault protecting PHI-derived values needs strong access control and monitoring.
The adopted CAQH CORE operating rules include the Phase III CORE 370 EFT and ERA Reassociation Rule, which uses the trace number to let providers match the EFT payment to its 835 remittance advice.
A documented reason a workforce member missed, delayed, or received alternate training. Exceptions should be tracked until resolved.
A record of messages or files sent between systems. Logs help prove when PHI was sent, where it went, and whether delivery failed.
The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment.
An administrative safeguard concept involving Training Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Training Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Training Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The Privacy Rule requires training the workforce on privacy policies as necessary for their functions and documenting it; the Security Rule requires a security awareness and training program for the entire workforce including management.
A technical safeguard or security operations concept involving Training Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Training Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Training PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Training Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Training User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Training Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Training Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Training Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Training Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Training Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Training Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Training Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The required specification to assign a unique name or number for identifying and tracking user identity.
Protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through a technology or methodology specified by the Secretary in guidance. Under that guidance, PHI is secured only by encryption meeting the guidance or by destruction; anything else that is lost or impermissibly disclosed triggers breach analysis.
With respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of the information WITHIN the entity that maintains it. Movement outside the entity is a disclosure.
Within the definition of security incident: the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.
The adopted HIPAA identifiers: the NPI for health care providers and the EIN for employers. No standard unique patient identifier has ever been adopted.
Information that does not live in a neatly defined database field, such as PDFs, scanned records, emails, images, notes, and attachments. Unstructured PHI is often missed in risk analysis.
Billing for a higher-level service than was actually provided. It is primarily a fraud and billing compliance issue, but related records and investigations may involve PHI.
Granting and documenting access implements the addressable access authorization and access establishment and modification specifications: policies for granting access to ePHI and for establishing, documenting, reviewing, and modifying a user's right of access.
Named within the definition of payment: utilization review activities, including precertification and preauthorization of services, and concurrent and retrospective review.
A disruption that prevents access to ePHI or critical systems. It should trigger downtime procedures, contingency plan review, and possible incident documentation.
A device holding ePHI not encrypted per the HHS guidance holds unsecured PHI; its loss or theft is presumptively a breach unless the four-factor assessment shows a low probability of compromise.
A centralized log source that combines events across systems. It helps investigations by connecting identity, device, application, and data-access activity.
A check that each workforce member has an individual account instead of shared credentials. Unique IDs support accountability and audit controls.
A folder, shared drive, inbox, or archive containing PHI outside core clinical systems. These repositories are often missed in access reviews and retention plans.
Software no longer receiving security updates. Unsupported systems that handle ePHI create risk and usually require upgrade, isolation, or documented compensating controls.
Documentation created during urgent care visits. It is PHI when held by a covered provider and should flow into access, amendment, billing, and retention workflows.
Testing performed before a system goes live. For ePHI systems, testing should avoid live PHI unless safeguards and approvals are in place.
Security monitoring that detects unusual access patterns. It can help identify snooping, compromised accounts, or abnormal ePHI exports.
A risk created when confusing workflows cause privacy or security mistakes. Poorly designed systems can lead to wrong-patient disclosure, misrouting, or improper access.
Device identifiers and serial numbers are a listed safe harbor category to remove. (UDI is also an FDA labeling term; the HIPAA hook is the identifier list.)
Software used without review or approval. If it stores or transmits PHI, it can create shadow IT risk and missing BAA exposure.
When contact information is insufficient or out of date: for fewer than 10 unreachable individuals, an alternative written, phone, or other means; for 10 or more, a conspicuous 90-day website posting or major print or broadcast media notice, plus a toll-free number active for at least 90 days.
A platform for managing laptops, phones, tablets, and other endpoints. UEM can enforce encryption, patches, passcodes, and remote wipe.
A recipient whose identity or authority has not been verified. PHI should not be disclosed until the recipient and purpose are confirmed.
Removing access for departing or role-changed users; the addressable specification requires procedures for terminating access to ePHI when the employment or other arrangement ends.
An administrative safeguard concept involving Unique Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Unique Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Unique Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Unique Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Unique Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Unique PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Unique Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Unique Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Unique Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Unique Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Unique User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Unique Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Unique Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Unique Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Unique Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Unique Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Unique Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Unique Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The regulatory core of vendor management: a covered entity may disclose PHI to a business associate only with satisfactory assurances, documented in a BAA, that the vendor will appropriately safeguard the information.
The Secretary will, to the extent practicable and consistent with the enforcement provisions, seek the cooperation of covered entities and business associates in obtaining compliance.
Core elements: a specific and meaningful description of the information; the persons authorized to make the disclosure; the recipients; the purpose; an expiration date or event; and the individual's signature and date. Required statements cover the right to revoke, treatment or payment conditioning rules, and redisclosure risk. It must be in plain language, and the individual gets a copy.
A review of a vendor's access to PHI, security controls, subcontractors, breach history, and contractual obligations. It helps determine whether a BAA and additional safeguards are required.
A process for managing changes to policies, procedures, forms, and technical configurations. Version control helps prove which document was in effect at a given time.
A VPN tunnel is a common technical measure satisfying the transmission security standard for ePHI crossing open networks.
Not named in the rule; automated scanning is a standard input to the required risk analysis, which must identify technical vulnerabilities affecting ePHI.
An account still active after its owner has left, a direct failure of the termination procedures specification calling for ePHI access to end when the workforce arrangement ends.
A rule that checks transaction, form, or data quality before processing. Validation reduces rejected claims, data errors, and misrouted PHI.
Payment and delivery models that reward quality, outcomes, or efficiency. Data sharing for these programs often involves PHI and healthcare operations.
A report documenting an exception from expected policy, process, or security behavior. Variance tracking supports investigation and corrective action.
A password, key, token, or certificate stored in a controlled secrets vault. Vaulting reduces exposure of credentials that protect ePHI systems.
A review of third-party accounts, portals, integrations, and support access. It helps confirm vendors still need access and that access matches the BAA and contract.
A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days from discovery, identifying to the extent possible each individual affected and providing information the covered entity needs for its own notices.
A plan for ending a vendor relationship while protecting PHI. It should cover data return, deletion, transition support, access shutdown, and evidence.
Health information is defined to include information that is oral, not just recorded. Speaking PHI to an unauthorized listener is a disclosure exactly as handing over a document would be.
A telehealth or scheduling feature that queues patients before a visit. It should limit exposure of names, visit reasons, and other PHI to unauthorized users.
Rules for leaving messages that may include patient information. Policies should define what can be said, when authorization is needed, and how preferences are honored.
Vetting behind the required satisfactory assurances that a vendor receiving PHI will appropriately safeguard it; the assurances themselves must be documented in the BAA.
The program wrapper around the BAA requirements: identify vendors handling PHI, obtain satisfactory assurances in a compliant BAA, and act on known violations.
A covered entity may disclose proof of immunization to a school required by law to have it, with the agreement of a parent, guardian, or other person in loco parentis, or of the individual if an adult or emancipated minor. The agreement may be oral but must be documented.
A maintained list of vendor security, privacy, legal, and support contacts. Current contacts matter during incidents and BAA reviews.
A set of documents supporting vendor security and compliance review, such as policies, reports, diagrams, attestations, and incident history.
A recording of a telehealth encounter. If retained, it is PHI and needs consent review, access controls, retention rules, and secure storage.
A remotely delivered desktop environment. Virtual desktops accessing ePHI still need authentication, logging, clipboard controls, and endpoint safeguards.
A vendor and business associate oversight concept involving Vendor Audit Evidence. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Policy Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Risk Finding. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Training Record. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Incident Log. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
HIPAA has no vendor category. A vendor that creates, receives, maintains, or transmits PHI for a covered entity is a business associate; one that never touches PHI is outside the rule.
A vendor and business associate oversight concept involving Vendor PHI Handling. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Security Control. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Privacy Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Retention Check. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Vendor Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Vendor User Provisioning. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Encryption Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Backup Test. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Contingency Task. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Compliance Calendar. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Evidence Packet. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor System Inventory. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Vendor Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Vendor Claims Transaction. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Eligibility Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Vendor Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Vendor Workforce Attestation. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Exception Register. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Monitoring Rule. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
Breaches affecting 500 or more individuals must be reported to the Secretary contemporaneously with individual notice, and HITECH requires HHS to post them publicly. Breaches under 500 are logged and reported within 60 days after the end of the calendar year.
Conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated. Willful neglect triggers the highest penalty tiers and mandatory investigation.
Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the entity's direct control, whether or not they are paid by it.
Train all workforce members on privacy policies and procedures as necessary and appropriate for their functions: each new member within a reasonable period, and retraining after material changes. The Security Rule separately requires a security awareness and training program. Training must be documented.
The required standard to implement physical safeguards for all workstations that access ePHI, restricting access to authorized users.
The required standard for policies and procedures specifying the proper functions to be performed, the manner of performance, and the physical attributes of the surroundings of workstations that access ePHI.
The addressable specification to implement procedures to determine that a workforce member's access to ePHI is appropriate.
Any person within the workforce definition: employees, volunteers, trainees, and others under the entity's direct control in the performance of work, paid or unpaid.
The signed receipt of the Notice of Privacy Practices a direct treatment provider must make a good faith effort to obtain at first service delivery, or document the attempt.
An online system where patients, staff, or partners access information. Portals handling PHI need authentication, session controls, encryption, logging, and support procedures.
An automated message sent from one system to another when an event occurs. Webhooks carrying PHI require secure transport, authentication, logging, and recipient controls.
A recurring confirmation that backups completed and failures were resolved. Backup checks support contingency planning and reduce recovery surprises.
A covered entity is not in violation when a workforce member or business associate, in good faith believing the entity engaged in unlawful conduct or care that endangers patients, discloses PHI to a health oversight agency, public health authority, accreditation organization, or an attorney retained to evaluate the whistleblower's options.
A guided implementation process for a practice, vendor, or client. For HIPAA, onboarding should include PHI flow mapping, access roles, BAAs, training, and evidence setup.
A list of desktops, laptops, tablets, and shared terminals that access ePHI. Inventory supports patching, encryption, location tracking, and disposal controls.
The written policy implementing the workstation use standard: what workstations that access ePHI may be used for, how, and in what physical surroundings.
A documentation, access, or disclosure error involving the wrong individual. It can create patient safety risk and may require privacy incident review.
Information from watches, sensors, or trackers. It may become PHI when collected or maintained by a covered entity or business associate for care or payment.
The record proving who was trained and when; the rule requires documenting that training has been provided.
Sending PHI to the wrong person is an impermissible disclosure, presumed to be a breach unless the four-factor assessment demonstrates a low probability that the PHI has been compromised.
A small tracking technology embedded in a webpage. On healthcare sites, pixels can create privacy risk if they transmit visit or patient-context data.
A domain approved for communication, integration, or file exchange. Whitelisting should be paired with verification and ongoing vendor review.
Monitoring that detects unauthorized or suspicious wireless activity. It can help protect networks supporting ePHI systems.
A review of how information moves through a business process. Workflow audits can reveal unnecessary PHI exposure, missing safeguards, and inefficient handoffs.
Access granted to a shared group rather than an individual. Workgroup permissions should be reviewed so membership changes do not silently expand PHI access.
An administrative safeguard concept involving Workforce Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Workforce Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Workforce Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Workforce Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Workforce Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Workforce PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Workforce Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Workforce User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Workforce Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Workforce Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Workforce Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Workforce Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Workforce Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Workforce Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Workforce Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Monitoring Rule. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The ASC X12 standards and Technical Reports Type 3 adopted for HIPAA transactions are incorporated by reference at § 162.920, which lists each adopted X12 implementation specification.
The insurance subcommittee of ASC X12 whose Technical Reports Type 3 (TR3s) define most adopted HIPAA transaction standards, incorporated by reference at § 162.920.
A digital certificate used to support identity verification and encrypted communication. Certificates can help secure APIs, portals, VPNs, and other systems that transmit ePHI.
Structured data encoded in XML for exchange between systems. XML payloads containing PHI require the same access, transmission, logging, and retention safeguards as other ePHI.
Security technology that correlates alerts across endpoints, networks, email, cloud, and identity systems. XDR can improve detection and response for threats to ePHI.
A health information exchange profile for moving clinical documents using physical or electronic media. When documents identify patients, HIPAA safeguards still apply.
A health information exchange profile for sharing clinical documents across organizations. Access controls, audit trails, and permitted-purpose rules remain important when PHI is exchanged.
The adopted standard for the eligibility for a health plan inquiry: ASC X12N 270, with NCPDP standards for retail pharmacy.
The adopted standard for the eligibility for a health plan response: ASC X12N 271.
The adopted standard for the health care claim status request: ASC X12N 276.
The adopted standard for the health care claim status response: ASC X12N 277.
The adopted standard for the referral certification and authorization transaction: ASC X12N 278, with NCPDP standards for retail pharmacy.
The adopted standard for the health plan premium payments transaction: ASC X12N 820.
The adopted standard for enrollment and disenrollment in a health plan: ASC X12N 834.
The adopted standard for the health care payment and remittance advice transaction: ASC X12N 835.
The adopted standard for the health care claims or equivalent encounter information transaction: the ASC X12N 837 professional, institutional, and dental implementations, plus the NCPDP standards for retail pharmacy drug claims.
An access-control policy language used to express authorization rules. It can support fine-grained decisions for systems that manage sensitive health data.
The process of reviewing correlated security alerts from an XDR platform. Triage should determine scope, affected systems, PHI exposure, and escalation needs.
A web-compatible document format sometimes used in clinical exchange contexts. If it identifies a patient, it should be treated as PHI.
A standard for encrypting XML content. It can protect structured healthcare payloads, but key management and transport security remain necessary.
A standard acknowledgment used to report whether a transaction file was received and syntactically accepted. It supports transaction troubleshooting.
Companion guides operate under trading partner agreements, which may not change a data element or segment definition, condition, or use, add elements or segments, use unadopted codes, or change the meaning or intent of the adopted implementation specification.
A party exchanging standard transactions under a trading partner agreement (defined at § 160.103 as an agreement related to the exchange of information in electronic transactions); § 162.915 limits what such agreements may modify.
A documented response workflow for alerts from extended detection and response tools. Playbooks should include PHI exposure checks and escalation criteria.
Checking an XML payload against an expected schema. Validation helps reject malformed healthcare data before it disrupts workflows or exposes information.
A healthcare transaction standard term related to X12 Access Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Audit Evidence. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Policy Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Risk Finding. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Training Record. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Incident Log. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Vendor Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 PHI Handling. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Security Control. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Privacy Workflow. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Retention Check. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Disclosure Log. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 User Provisioning. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Encryption Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Backup Test. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Contingency Task. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Compliance Calendar. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Evidence Packet. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 System Inventory. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Authorization Workflow. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Claims Transaction. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Eligibility Workflow. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Patient Request. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Workforce Attestation. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Exception Register. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A scheduled review of risk analysis results, unresolved remediation items, incidents, vendor changes, and policy updates before the next compliance cycle.
Access temporarily delegated or transferred to another authorized person, such as coverage during leave. It should be documented and removed when the need ends.
A hardware security key commonly used as a possession factor for MFA. Hardware keys can reduce phishing risk for systems that access ePHI.
Health records involving minors. HIPAA usually treats a parent or guardian as the personal representative, but exceptions can apply for minor consent, abuse, or state law.
The amount of deductible a member has accumulated during the plan year. It appears in eligibility and benefits workflows and is PHI when tied to a person.
A scheduled review of business associate agreements and vendor relationships. It helps catch missing contracts, outdated contacts, and changed PHI workflows.
The rule sets no annual cycle; it requires security measures to be reviewed and modified as needed to continue reasonable and appropriate protection, and periodic evaluation against the standards.
The risk analysis requirement itself states no frequency; HHS guidance treats it as an ongoing process, and annual refresh is common practice rather than regulatory text.
An internal status for elevated concern that does not yet meet incident severity. Defined alert levels help workforce members escalate privacy or security issues consistently.
Operational management of appointment capacity. Scheduling data can reveal care relationships and should be handled as PHI when linked to patients.
When state or other law lets a minor consent to their own care, the parent is not automatically the personal representative for that care; state law controls parental access, and where state law is silent, the provider has documented discretion.
Patient portal access for minors and guardians. It needs careful configuration because adolescent consent, proxy access, and state law can conflict.
Parental access can be limited when the minor lawfully consented to the care, when confidentiality was agreed, or when the provider reasonably believes the personal representative situation involves abuse, neglect, or endangerment.
A structured configuration format often used for infrastructure and applications. YAML files should not store PHI or secrets unless protected by strong controls.
A malware detection rule used by security teams. YARA can support detection of threats targeting systems that process or store ePHI.
A scheduled removal of stale users, excessive roles, and abandoned groups. Cleanup supports least privilege before the next compliance cycle.
A documented request for key vendors to confirm controls, incidents, subcontractors, and contact details. It supports ongoing business associate oversight.
Mental or behavioral health documentation involving a minor. Access and disclosure may be affected by minor consent, state law, and safety concerns.
Proof of immunization may go to a school legally required to have it with a documented agreement from a parent, guardian, person acting in loco parentis, or the emancipated or adult individual.
Portal proxy access for parents tracks personal representative status: full access while the parent is the minor's personal representative, restricted for minor-consented services where state law limits parental access.
A schedule for required and role-specific privacy or security training. It should account for new hires, annual refreshers, and policy changes.
A limit on access to a minor's records based on consent rules, safety concerns, or law. Restrictions should be configured consistently across portals and workflows.
A visit where a minor may have confidentiality rights under state law. Records and portal access should reflect the applicable privacy rule.
Separating sensitive minor records or data elements so access can be managed correctly. Segmentation helps avoid inappropriate proxy disclosure.
An authorization involving a minor's records. Validity depends on who may sign under HIPAA, state law, and the service involved.
An administrative safeguard concept involving Year-End Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Year-End Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
An administrative safeguard concept involving Year-End Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Year-End Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Year-End Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A privacy-rule concept involving Year-End PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Year-End Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Year-End Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Year-End Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Year-End Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Year-End User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Year-End Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Year-End Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Year-End Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Year-End Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Year-End Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Year-End Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Year-End Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A security model that continuously verifies users, devices, access, and context rather than assuming internal network traffic is trusted. It can support least privilege and stronger ePHI protection.
A software flaw unknown to the vendor or without an available patch. Organizations should use layered safeguards, monitoring, and incident response to reduce exposure.
A forgotten active account belonging to a departed user; evidence the termination procedures specification is not operating.
Securely erasing keys or sensitive data from memory or storage. Zeroization supports disposal, media reuse, and incident containment.
Safe harbor requires removing all geographic subdivisions smaller than a state, except the initial three digits of a ZIP code when the three-digit area contains more than 20,000 people; for areas of 20,000 or fewer, the three digits become 000.
A firewall design that applies rules between network zones. It can isolate ePHI systems from guest, administrative, or vendor networks.
A privileged access model where elevated rights are not continuously assigned. Users request time-limited privilege when needed, reducing account compromise risk.
Zero Trust Network Access, a model that grants application access based on identity, device posture, and context. It can replace broad VPN access for ePHI systems.
Backup storage separated by trust level, geography, or function. Zoning can protect clean backups from ransomware and administrative mistakes.
Rules for creating, sending, receiving, scanning, and extracting compressed files. ZIP archives containing PHI need encryption, recipient verification, and malware controls.
Automated device setup that applies security settings before first use. It can help enforce encryption, passcodes, and managed apps on devices accessing ePHI.
A DNS operation that can expose domain records if misconfigured. Attackers can use exposed records to map healthcare systems and target services.
A vendor account that outlived the vendor relationship. Termination procedures and the BAA obligation to return or destroy PHI at contract termination both point at closing it.
A statistical signal that a value is unusual compared with a population. In healthcare analytics, small or unusual groups may increase re-identification risk.
A plan for responding when a critical vulnerability has no patch. It should define monitoring, isolation, compensating controls, vendor contact, and leadership escalation.
A segmentation approach that limits access between users, workloads, and applications based on identity and context. It reduces lateral movement toward ePHI systems.
Separating systems into controlled zones so a compromise in one area does not automatically expose ePHI elsewhere.
A malicious compressed file that expands massively when opened. Email and upload workflows should scan archives before they reach systems handling PHI.
Restoring systems by network, application, or business zone after an incident. Zonal recovery can prioritize critical care and ePHI access functions.
A starting access model where users receive no permissions until a role-based need is approved. It supports least privilege for ePHI systems.
A component that evaluates identity, device, context, and policy before granting access. It supports finer control than broad network trust.
A notice about a newly discovered vulnerability without a complete fix. Advisories should trigger risk review for affected ePHI systems.
A compressed package of records produced for transfer or release. Exports containing PHI should be encrypted, verified, and tracked.
Access that changes based on network, device, location, or trust zone. It can reduce exposure when users connect from unmanaged environments.
Containing an incident within a defined network or application zone. It helps preserve critical clinical functions and limit ePHI exposure.
A security operations term for Zero Trust Access Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Audit Evidence. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Policy Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Risk Finding. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Training Record. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Incident Log. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Vendor Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust PHI Handling. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Security Control. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Privacy Workflow. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Retention Check. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Disclosure Log. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust User Provisioning. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Encryption Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Backup Test. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Contingency Task. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Compliance Calendar. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Evidence Packet. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust System Inventory. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Authorization Workflow. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Claims Transaction. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Eligibility Workflow. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Patient Request. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Workforce Attestation. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Exception Register. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
One Guy Consulting helps small practices and business associates put these terms into practice: risk assessments, written policies, training, and BAAs.
All 1,300 terms in plain English, 91 pages. Add your name and email and the download starts right away.
