HIPAA Terms in Plain English, Linked to the Actual Regulation
Welcome to our Comprehensive HIPAA Compliance Glossary, designed specifically for healthcare professionals navigating the complexities of HIPAA regulations. This essential resource provides clear definitions and explanations of key terms, ensuring you stay informed and compliant.
Search our A-Z list of HIPAA compliance terms, including definitions for concepts like ‘Protected Health Information (PHI)’, ‘Business Associates (BA)’, and ‘Notice of Privacy Practices’. If you can’t find the term you’re looking for, try searching with different keywords or clear the filter to browse our extensive list of HIPAA-related terms.
For further insights, check out our articles on HIPAA compliance best practices and recent updates to regulations.
All 1,941 terms, 143 pages, free. Just your name and email.
Includes related healthcare, research, privacy, and cybersecurity terminology. Related technologies and frameworks are not automatically HIPAA requirements.
Sorting out HIPAA? A free 30-minute review maps your gaps.
Book your free 30-minute intro callA federal law addressing multiple health-policy issues, including interoperability and information blocking. Its health-information access provisions operate alongside HIPAA privacy protections. See Information Blocking.
A backup approach using three copies of data, two types of storage media, and one copy off-site. Additional isolation or immutability may be needed.
A formal review confirming that user access remains appropriate for job duties. Certifications help detect excessive permissions, stale accounts, and role drift.
The technical standard requiring policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs granted access rights under § 164.308(a)(4). Its specifications are unique user identification, emergency access procedure, automatic logoff, and encryption and decryption.
Also known as: Information Access Management
The required information access management standard: implement policies and procedures for authorizing access to ePHI consistent with the applicable requirements of the Privacy Rule.
A credential presented to a service to obtain authorized access to resources. Its audience, scope, and lifetime constrain permitted use.
Temporarily or persistently blocking authentication after specified failures or suspicious activity. Poorly designed lockout policies can also enable denial-of-service attacks.
An attacker gaining control of a legitimate user's account. The account's normal permissions can then expose records or support further attacks.
The individual's right to an accounting of disclosures of PHI made in the six years before the request, excluding disclosures for treatment, payment, and operations, to the individual, under authorization, for the facility directory, for national security, to correctional institutions, and certain others. Respond within 60 days with one 30-day extension; the first accounting in any 12-month period is free.
An arrangement in which multiple systems or sites concurrently provide service. Coordination and consistency controls are important during failures.
An arrangement in which a primary system serves normal workloads while a standby is available to take over. Failover readiness requires testing.
For an addressable specification, the entity must assess whether it is a reasonable and appropriate safeguard in its environment. If it is, implement it. If not, document why and implement an equivalent alternative measure if reasonable and appropriate. Addressable does not mean optional; every addressable specification requires a documented decision.
A code identifying the general category or responsibility for a claim-payment adjustment. It works with more specific reason codes.
An administrative safeguard concept involving Administrative Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Administrative Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Administrative Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Administrative Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Administrative Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Administrative Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Administrative Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Administrative Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Administrative Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Administrative Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An official who conducts administrative hearings, including contested HIPAA civil monetary penalty cases. The hearing process differs from an OCR complaint investigation.
A patient-rights concept involving Administrative Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Administrative PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Administrative Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Administrative Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
The Privacy Rule's administrative requirements: designate a privacy official and complaint contact, train the workforce, maintain safeguards, provide a complaint process, apply and document sanctions, mitigate harm, refrain from intimidation and retaliation, not require waiver of rights, maintain written policies and procedures, and retain documentation for six years.
An administrative safeguard concept involving Administrative Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information, and to manage the conduct of the workforce in relation to protecting that information.
An administrative safeguard concept involving Administrative Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The HIPAA statutory requirements for transactions, code sets, identifiers, privacy, security, and enforcement. An administrative simplification provision is defined at § 160.103, and 45 CFR Parts 160, 162, and 164 implement them.
An administrative safeguard concept involving Administrative System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Administrative Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A body that decides disputes under an administrative process. Requests for PHI in its proceedings must meet applicable disclosure conditions.
An administrative safeguard concept involving Administrative User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Administrative Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Administrative Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Clinical events and commonly associated messages describing patient admissions, discharges, transfers, and related registration changes.
Instructions or a designation concerning future health care decisions, often used when a person cannot decide or communicate. Its effect depends on applicable law.
An input deliberately modified to cause a model to produce an incorrect or unintended result. Small changes may be difficult for people to notice.
Authorized testing that reproduces selected behaviors of a real or representative adversary to evaluate defenses.
PHI may be disclosed to a person subject to FDA jurisdiction with respect to an FDA-regulated product or activity, including to collect or report adverse events, track products, enable recalls, repairs, or replacement, and conduct post-marketing surveillance.
Legally separate covered entities under common ownership or control may designate themselves a single affiliated covered entity for Privacy, Security, and Breach Notification Rule compliance. The designation must be documented and retained.
A structured review of an incident or exercise to identify what worked, what failed, and what should change. Findings should lead to assigned improvements.
A covered entity or business associate is liable for a civil money penalty for the acts or omissions of its agent, including a workforce member or business associate acting as agent, determined under the federal common law of agency and acting within the scope of the agency.
AI systems that can plan or carry out multi-step actions using tools or external services. Permissions and oversight should reflect the actions they can perform.
Authorized adversarial testing of an AI system to identify failures, misuse routes, or vulnerabilities. Tests should reflect the system's actual capabilities and deployment context.
NIST's voluntary framework for managing risks associated with AI systems through governance and lifecycle activities. It is not a HIPAA certification.
A backup separated from connected production networks or systems. Effective isolation depends on how access, transfers, and administration are controlled.
Reduced attention or response effectiveness caused by excessive, repetitive, or low-value alerts. Tuning and prioritization can improve handling.
An assessment of an automated system's potential effects on people, including privacy, fairness, safety, and accountability concerns.
A secondary location or environment where critical operations can resume after a disruption. Its capacity and readiness determine what it can support.
The accommodation mechanism for confidential communications: a different phone number, address, or channel; providers may not demand a reason, and plans may require an endangerment statement.
Tools that capture clinical conversations and help generate documentation. Audio, transcripts, and draft notes can contain PHI and need appropriate controls.
A Medicare classification grouping certain outpatient services for payment under the hospital outpatient prospective payment system.
Permitted grounds: the record was not created by the entity (unless the originator is no longer available), is not part of the designated record set, would not be available for inspection under § 164.524, or is accurate and complete. Denial triggers a written notice with the right to a statement of disagreement that travels with future disclosures.
A covered entity's written response to an individual's statement disagreeing with an amendment denial. The entity must provide the individual with a copy.
The regulation's term is de-identification, achieved by expert determination or safe harbor; information de-identified under either method falls outside HIPAA.
A federal criminal law prohibiting knowing and willful remuneration to induce or reward referrals or business involving federal health care programs. It is a separate healthcare compliance obligation; PHI used in related operations or investigations still requires lawful handling.
An access-control feature restricting reuse of a credential when entry and exit records do not match the expected sequence.
Also known as: Antivirus; Anti-Malware
Software that detects, blocks, or removes malicious software using methods such as signatures and behavior analysis. It needs appropriate configuration and updating, and cannot prevent every attack. See Malware Response.
A named permission limiting what an API client may access or do. Narrow scopes can reduce unnecessary access to patient records.
Restricting API request frequency or volume to reduce abuse and resource exhaustion. Limits should account for legitimate clinical workflows.
Operational information collected about API activity, such as errors, timings, requests, or responses. Telemetry can expose sensitive data if collection is too broad.
Permitting only approved applications or executable content to run. Maintaining the list and handling exceptions are essential to effective use.
Running an application within a restricted environment that limits its access to the surrounding system. Isolation strength depends on the implementation.
A control that allows only approved software to run. Whitelisting can reduce malware risk on workstations and servers that access ePHI.
Affirmative agreement by someone, often a child, who cannot provide legally effective consent for the activity. Mere failure to object is not assent.
A maintained list of systems, devices, applications, and media that create, receive, maintain, or transmit ePHI. A risk analysis is incomplete if the organization does not know where ePHI exists.
The required standard to identify the security official responsible for developing and implementing the entity's Security Rule policies and procedures.
A patient's authorization allowing a provider to receive payment directly from a health plan. It is a payment workflow concept and should not be confused with a HIPAA authorization for non-TPO use of PHI.
Reducing paths through which an attacker can affect a system, such as unnecessary services, risky features, and exposed permissions.
A structured diagram breaking an attacker's objective into possible steps or alternative paths. It helps identify where controls can interrupt an attack.
Revealing a sensitive characteristic about an individual, potentially without identifying the person's exact record. Group patterns can create this risk.
The required technical standard to implement hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
The activity record produced by audit controls: who accessed what, when, and what they did. The rule requires mechanisms that record and examine information system activity; the resulting logs are typically the first evidence OCR requests.
Encryption that protects confidentiality and detects unauthorized modification of the protected content. Correct nonce and key handling are essential.
A scan performed with authorized credentials to examine settings and software that external probing may miss. Scan accounts themselves need protection.
The corroboration that a person is the one claimed.
A NIST level describing the strength of an authentication process, including authenticator requirements and protections against attack.
Evidence about an authenticator's origin or properties, typically supplied through a signed statement. Attestation is different from proof of the user's identity.
Associating an authenticator with a subscriber's account. Secure enrollment and replacement procedures help prevent an attacker from binding their own authenticator.
The individual's written permission for uses and disclosures not otherwise permitted or required by the Privacy Rule. Must contain the core elements and required statements of § 164.508(c). Psychotherapy notes, marketing, and sale of PHI each require authorization with specific conditions.
An OAuth flow in which a client exchanges an authorization code for tokens. PKCE protects the exchange against certain interception attacks.
An individual may revoke an authorization at any time, in writing, except to the extent the entity has already taken action in reliance on it or the authorization was obtained as a condition of insurance coverage during a contestability period.
The addressable specification to implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.
The property that data or information is accessible and usable upon demand by an authorized person.
HIPAA permits specified disclosures, consistent with applicable law and professional ethics, to prevent or lessen a serious and imminent threat. Information may be shared with someone reasonably able to help, subject to the rule's conditions.
Screening used to assess suitability for a role or access. HIPAA's Workforce Clearance Procedure calls for assessing appropriate ePHI access but does not specifically mandate a universal criminal-background-check process.
Reducing backup storage by storing repeated data only once and referencing it where needed. Shared dependencies must remain intact for restoration.
The rule requires retrievable exact copies of ePHI; how long backups are kept is a risk-based decision, not a stated timeframe.
The No Surprises Act rules prohibit balance billing for out-of-network emergency services, for nonemergency services by nonparticipating providers at participating facilities absent notice and consent, and for air ambulance services by nonparticipating providers.
A deliberately hardened system used as a controlled access point to a restricted environment. Concentrated access makes monitoring especially important.
Claims submitted together electronically remain the health care claims transaction and must use the adopted X12N 837 standard.
Health information related to mental health or substance use treatment. It is generally PHI when held by a covered entity, while psychotherapy notes and certain substance use disorder records may receive heightened protections.
A safe harbor identifier category: health plan beneficiary numbers must be removed for de-identification.
Removing an individual from health-plan coverage through an enrollment-related workflow. Effective dates and beneficiary identification must be accurate.
Enrollment and disenrollment in a health plan is a named HIPAA transaction with the X12N 834 as its adopted standard.
Conducting or arranging auditing functions is a named health care operation, and claims review appears in the payment definition.
Auditing functions, including fraud and abuse detection and compliance programs, are health care operations by definition.
Billing on a provider's behalf is a named business associate activity, and a billing service converting data between standard and nonstandard formats also appears in the health care clearinghouse definition.
An organized collection of biological specimens and associated information maintained for research or other authorized uses. Specimens and linked records require appropriate governance.
A safe harbor identifier category: biometric identifiers, including finger and voice prints, must be removed for de-identification.
Authenticating by fingerprint or face implements the person or entity authentication standard: verifying that the one seeking access to ePHI is the one claimed.
A storage model used by servers and cloud systems. When block volumes contain ePHI, encryption, snapshots, access, and disposal need documented safeguards.
The people responsible for defending systems, monitoring threats, and responding to attacks. Responsibilities vary by organization.
Regular reporting to leadership on compliance risks, incidents, vendor status, and remediation. Board-level visibility helps show governance and accountability.
A group of compromised devices controlled together by an attacker. Botnets can support spam, fraud, denial of service, or other attacks.
Replacing values below a threshold with a floor value or category. It reduces exposure of unusual low values while limiting detail.
The acquisition, access, use, or disclosure of protected health information in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI. Three exclusions apply: unintentional, good faith acquisition by a workforce member acting within their authority; inadvertent disclosure between persons authorized to access PHI at the same entity or arrangement; and disclosures where the unauthorized recipient would not reasonably have been able to retain the information. An impermissible use or disclosure is presumed to be a breach unless the entity demonstrates a low probability that the PHI has been compromised.
Requires notification following a breach of unsecured PHI: to individuals under § 164.404, to the media for breaches involving more than 500 residents of a state or jurisdiction under § 164.406, to the Secretary under § 164.408, and by business associates to covered entities under § 164.410.
The four-factor assessment that can rebut the presumption of breach: the nature and extent of the PHI involved, including identifiers and likelihood of re-identification; the unauthorized person who used or received it; whether the PHI was actually acquired or viewed; and the extent to which the risk has been mitigated.
A service organization's statement about relevant changes after an assurance report's coverage period. It does not extend the auditor's opinion or replace another audit.
Also known as: Bring Your Own Device
A policy allowing workforce members to use personal devices for work. If those devices access ePHI, the organization must address authentication, encryption, remote wipe, screen lock, and termination procedures.
Consent under the Common Rule for specified storage, maintenance, and secondary research use of identifiable information or biospecimens. It is distinct from HIPAA authorization.
An authorization failure allowing users to invoke functions outside their permitted role, such as administrative operations.
An API authorization failure allowing access to another user's or tenant's object by changing identifiers. Authentication alone does not prevent it.
Systematically trying many possibilities to discover a password, key, or other secret. Feasibility depends on entropy and practical limits on attempts.
Writing beyond a memory buffer's intended boundary. It can corrupt memory, crash software, or enable unauthorized code execution.
A program offering rewards for qualifying vulnerability reports. Authorized scope and rules define what testing and findings are eligible.
An approach for exporting large sets of FHIR data through standardized bulk-data workflows. Export permissions and storage protections are especially important.
A person who, on behalf of a covered entity but not as a member of its workforce, creates, receives, maintains, or transmits PHI for functions such as claims processing, data analysis, utilization review, quality assurance, patient safety activities, billing, or practice management; or who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services involving PHI. The definition expressly includes health information organizations, e-prescribing gateways, personal health record vendors acting for a covered entity, and subcontractors that handle PHI for another business associate.
A vendor and business associate oversight concept involving Business Associate Access Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
The written contract required before a business associate may create, receive, maintain, or transmit PHI for a covered entity. Required provisions: permitted uses and disclosures, no further use, appropriate safeguards including Security Rule compliance for ePHI, breach and security incident reporting, subcontractor flow-down, support for access, amendment, and accounting rights, HHS access, return or destruction of PHI at termination, and authorization to terminate for violation.
A vendor and business associate oversight concept involving Business Associate Audit Evidence. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Business Associate Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Business Associate Backup Test. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Claims Transaction. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Compliance Calendar. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Contingency Task. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Business Associate Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
The satisfactory assurances requirement is the regulatory hook: the covered entity must have a documented basis (the BAA, and in practice vetting behind it) that the BA will appropriately safeguard PHI.
A vendor and business associate oversight concept involving Business Associate Eligibility Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Encryption Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Evidence Packet. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Exception Register. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Incident Log. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A current list of vendors and partners that create, receive, maintain, or transmit PHI for the organization. The inventory helps confirm every business associate has a signed BAA and an owner.
A patient-rights concept involving Business Associate Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Business Associate PHI Handling. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Policy Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Privacy Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Retention Check. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Risk Finding. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Security Control. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate, and the BA must obtain the same satisfactory assurances from it that the covered entity obtained from the BA.
A vendor and business associate oversight concept involving Business Associate System Inventory. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Training Record. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate User Provisioning. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Business Associate Workforce Attestation. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
HIPAA addresses business continuity through the contingency plan standard: data backup, disaster recovery, emergency mode operation, testing and revision, and application and data criticality analysis.
A planned activity testing how an organization maintains or restores critical operations during disruption. Exercises should produce concrete improvement actions.
The contingency plan standard is HIPAA's business continuity requirement: backup, disaster recovery, emergency mode operation, testing, and criticality analysis for systems holding ePHI.
A fraud scheme using compromised or impersonated business email accounts to redirect payments, request sensitive data, or trigger unauthorized actions.
An analysis of how disrupted activities affect an organization. It identifies critical services, dependencies, recovery priorities, and time sensitivities.
A physical restraint attaching equipment to a fixed object. Its value depends on the lock, attachment points, and surrounding controls.
A person assisting someone with care or daily needs. Caregiving does not automatically establish legal authority over decisions or unrestricted record access. See Personal Representative and Health Care Power of Attorney.
An assurance-report approach excluding a subservice organization's controls from the auditor's direct testing while identifying relevant assumptions and dependencies.
Withholding a value in a statistical table, often because a small count could reveal information about individuals.
An entity issuing digital certificates that bind public keys to identities or other attributes. Trust depends on its validation and operating practices.
A federal protection restricting disclosure of identifiable, sensitive research information in specified circumstances. Its protection does not eliminate all permissible disclosures or HIPAA duties.
A supplier's record describing destruction of specified records or media. It provides evidence but should be supported by an appropriate destruction process.
Restricting acceptable certificates or public keys to expected values. Pinning can strengthen trust checks but complicate certificate rotation and recovery.
A signed list identifying certificates revoked before their normal expiration. Clients need sufficiently current revocation information.
There is no official government-issued HIPAA certification for organizations. No agency certifies that a covered entity is "HIPAA compliant." OCR has explicitly stated that compliance is an ongoing obligation, not a certification status. Individuals can earn credentials such as Certified HIPAA Professional (CHP), but these are professional designations, not government certifications.
A documented history of evidence collection, handling, transfers, and storage. It helps establish integrity and accountability during an investigation.
A documented process for evaluating and approving changes to systems, workflows, or vendors that affect ePHI. Major changes should trigger security evaluation and risk analysis updates.
The monetary penalty the Secretary may impose for violations of the administrative simplification provisions, in the amount determined under § 160.404.
A code explaining why a payment or claim amount differs from the amount billed. It appears in claim-payment and remittance workflows.
Attachment information is defined as documentation of health care or characteristics of health care provided; health claims attachments are a named HIPAA transaction, but no attachment standard has been adopted to date.
A payer's decision not to pay a claim or service after review. Reasons and available correction or appeal routes depend on the issue.
The health care claim status transaction, conducted with the adopted X12N 276 request and 277 response standards.
A claim containing the information needed for processing without specified defects or additional investigation. The applicable definition depends on the payer or governing program.
Rules for securing sensitive papers, removable media, and other materials when a workspace is unattended. It reduces accidental viewing, loss, and theft.
Deceiving a user into interacting with a hidden or disguised interface, often through framing or overlays. Frame restrictions help reduce the risk.
An OAuth grant allowing a client to obtain access based on its own credentials, rather than a user's interactive authorization.
A FIDO protocol for communication between a client and an external authenticator, such as a hardware security key.
A structured collection of clinical information about a population, condition, or treatment. Its privacy requirements depend on its purposes, participants, and identifiability.
A repository integrating clinical data from multiple systems for reporting and analysis. Secondary uses still require appropriate permissions and safeguards.
Information or tools that help clinicians and patients make healthcare decisions. Examples include alerts, reminders, recommendations, and relevant reference information.
An HL7 specification enabling clinical systems to call decision-support services at defined workflow points. Shared patient context needs appropriate access controls.
An HL7 standard for structured clinical documents combining machine-readable content with human-readable narrative.
An HL7 language for expressing clinical logic, including logic used in quality measures and decision support.
A measurement of healthcare quality using clinical data. If the measure uses identifiable patient information, HIPAA rules for use, disclosure, minimum necessary, and data sharing still apply.
A database of information about clinical studies, such as objectives, enrollment, interventions, and results. Registration does not authorize disclosure of participant-level PHI.
A control point helping organizations monitor and apply security policies to cloud-service use. Capabilities depend on integration and visibility.
The use of remote servers to store, manage, and process ePHI. Cloud service providers that store or process ePHI are business associates and must sign a BAA. The covered entity remains responsible for ensuring the provider implements appropriate safeguards. Simply storing encrypted data in the cloud does not eliminate the need for a BAA.
Cloud settings diverging from their approved configuration over time. Drift can expose data or weaken access and logging controls.
Tools analyzing cloud identities and permissions to identify excessive or risky access. Effective permissions may span several policies and roles.
Tools that evaluate cloud configurations for security weaknesses and policy violations. Findings require validation and remediation.
Tools protecting workloads such as virtual machines, containers, and serverless functions. Coverage differs across platforms and deployment models.
An integrated category of tools combining security capabilities for cloud-native applications across development and operation.
A standard paper claim form used for professional healthcare services. Its electronic counterpart is associated with the X12 837P implementation.
A right under federal law for certain qualified beneficiaries to continue group health coverage temporarily after qualifying events. COBRA is separate from HIPAA, while the covered group health plan's PHI remains subject to HIPAA privacy rules.
Any set of codes used to encode data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes, including both the codes and their descriptors.
An alternate facility with basic infrastructure but limited ready-to-run computing resources. Restoration generally requires additional equipment and setup.
Restricting collection of personal information to what is appropriate for a stated purpose. It is a general privacy principle with different legal implementations.
Infrastructure and communications used by attackers to direct compromised systems. C2 traffic may carry instructions, status reports, or stolen data.
The contractual agreement establishing requirements for participating QHINs under TEFCA. Its obligations flow through participating exchange relationships.
The federal human-subject research protections in 45 CFR Part 46, Subpart A, adopted by multiple agencies. Research consent and HIPAA authorization serve different legal functions.
A system of identifiers and records for publicly disclosed cybersecurity vulnerabilities. A CVE identifier names a vulnerability rather than measuring its severity.
A framework for describing vulnerability characteristics and calculating severity scores. A score is one input to prioritization, not a complete risk assessment.
A catalog of types of software and hardware weaknesses. A CWE describes a weakness class rather than a specific disclosed vulnerability.
HIPAA's version of a compensating control: when an addressable specification is not reasonable and appropriate, the entity implements an equivalent alternative measure that accomplishes the same protective purpose, and documents the decision.
Two tracks: the covered entity's internal complaint process, and complaints to the Secretary. Any person may file with OCR, in writing, within 180 days of when they knew or should have known of the act, and OCR may investigate.
Controls assumed to be implemented by a service organization's downstream service providers as part of achieving the stated objectives or criteria.
Withholding additional table values so a protected value cannot be reconstructed from totals or related cells.
Controls the service organization assumes its customers implement for the stated control objectives or criteria to be achieved.
The overall system of policies, procedures, training, documentation, and oversight that an organization uses to meet HIPAA requirements. Includes a risk analysis, written policies, workforce training, sanctions policy, breach response plan, and BAAs. Having one is the primary factor OCR considers when determining enforcement severity.
A result describing how privacy guarantees combine across multiple differential privacy operations. Repeated releases must be assessed together.
An authorization generally may not be combined with any other document to create a compound authorization, with narrow exceptions for research study authorizations and combining psychotherapy notes authorizations with each other.
A clinical system for entering and transmitting orders, such as medications, tests, or procedures. Orders and associated patient information require appropriate access controls.
Exposure created by relying heavily on one provider, platform, region, or dependency. A single disruption may affect many critical services.
Access decisions based on signals such as identity, device status, location, and session risk. Policies may permit, block, or require stronger authentication.
A research authorization required as a condition of receiving research-related treatment where HIPAA permits that condition. Combined authorizations must distinguish conditioned from unconditioned research.
An exception to the business associate definition for entities that transport PHI but do not routinely access it. The US Postal Service, UPS, and ISPs are conduits and do not need a BAA. However, a cloud company storing PHI is not a conduit. The line between conduit and business associate is narrow.
Providers must permit and accommodate reasonable requests to receive PHI communications by alternative means or at alternative locations; health plans must accommodate when the individual states that disclosure could endanger them.
The property that data or information is not made available or disclosed to unauthorized persons or processes.
Controlling and documenting system settings and changes throughout their lifecycle. It helps prevent insecure drift and supports reliable recovery.
A covered entity may obtain the individual's consent to use or disclose PHI for treatment, payment, or health care operations. Consent is optional under the Privacy Rule and never substitutes for an authorization where one is required.
A structured expression of an individual's permissions or restrictions concerning information use or disclosure. Its effect depends on applicable law and the implementation.
Software that records and applies consent preferences for data collection or sharing. A preference setting is not automatically a valid HIPAA authorization.
A structured representation of consent information, such as a FHIR Consent resource. Recording consent does not by itself enforce it.
A court-established arrangement for managing specified personal or financial affairs. Financial authority alone does not necessarily confer authority over health care decisions.
A set of implementation templates using CDA to standardize common clinical documents, such as care summaries and discharge information.
Exchange in which individuals obtain, manage, or direct sharing of their health information. Different services may have different legal roles.
Attaching a verifiable signature to a container image or its metadata. Consumers must validate signatures and trusted identities before relying on them.
Protection of container images, runtimes, orchestration, and workloads. Shared infrastructure and configuration create risks beyond the application itself.
A browser policy limiting allowed content sources and selected behaviors for a web page. It can reduce the impact of some injection attacks.
A privacy theory evaluating information flows against expectations about the setting, participants, information, and transmission conditions.
The required standard to establish policies and procedures for responding to an emergency or other occurrence, such as fire, vandalism, system failure, or natural disaster, that damages systems containing ePHI.
A HIPAA violation that persists over time. Each day it continues can constitute a separate violation for civil monetary penalty calculations.
Ongoing assessment of identity or session trust after initial login. The method and its privacy effects depend on the signals collected.
Capturing data changes continuously or near-continuously to support recovery to multiple points in time. Recovery capability depends on retained history and implementation.
Relying on a control implemented by another system, provider, or organizational function. The inherited control's scope and effectiveness must fit the use case.
Relating controls to requirements, frameworks, or other controls. A mapping shows correspondence rather than proving implementation or compliance.
Evaluating whether a safeguard is designed appropriately and operates as intended. Testing should use relevant evidence and defined criteria.
A process for sharing vulnerability information with affected parties and coordinating remediation and public disclosure.
The adopted standards for the coordination of benefits information transaction: the ASC X12N 837 implementations, with NCPDP for retail pharmacy.
A formal agreement between OCR and an entity requiring specific steps to resolve HIPAA violations. CAPs typically run one to three years and include monitoring, reporting, and remediation. Once a CAP is in place, you are on the government's timeline.
A safeguard intended to reduce harm or restore acceptable conditions after a problem, such as patching, account repair, or recovery procedures.
A health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction for which HHS has adopted a standard.
An administrative safeguard concept involving Covered Entity Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Covered Entity Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Covered Entity Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Covered Entity Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Covered Entity Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Covered Entity Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Covered Entity Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Covered Entity Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Covered Entity Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Covered Entity Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Covered Entity Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Covered Entity PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Covered Entity Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Covered Entity Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Covered Entity Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Covered Entity User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Covered Entity Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
Those functions of a covered entity the performance of which makes the entity a health plan, health care provider, or health care clearinghouse.
The stages of issuing, using, updating, suspending, and revoking a credential. Recovery and replacement are part of the lifecycle.
Replacing a credential or secret with a new one and retiring the old value. Rotation must account for dependent services and active access.
Trying stolen username-and-password pairs against other services to exploit password reuse. Rate limits and stronger authentication reduce the risk.
A protected system for storing and controlling access to sensitive credentials. Vault access and recovery procedures need strong safeguards.
Reviewing the competence or qualifications of health care professionals and conducting credentialing activities are named health care operations.
Penalties imposed by the Department of Justice for knowing HIPAA violations. Three tiers: up to $50,000 and one year in prison for knowing violations, up to $100,000 and five years for false pretenses, up to $250,000 and ten years for intent to sell or use PHI for personal gain. Criminal enforcement targets individuals.
Coordinating leadership decisions, communications, and priorities during a major disruption. It connects operational response with wider organizational responsibilities.
Movement of PHI or ePHI outside the United States or to a vendor with offshore operations. HIPAA does not ban offshore handling, but covered entities must manage BAAs, safeguards, and applicable state or contractual limits.
An IHE profile supporting querying and retrieving clinical documents across healthcare communities.
An IHE profile supporting identification of matching patients across healthcare communities. It supports subsequent discovery of patient information.
A browser mechanism governing cross-origin access to responses. CORS policy is not a substitute for server-side authorization.
An attack causing a user's browser to send an unintended authenticated request. Appropriate request verification and cookie controls help prevent it.
A web application vulnerability that can let attackers run malicious scripts in a user's browser. In healthcare portals, XSS can expose sessions, messages, or other ePHI.
The ability to replace cryptographic algorithms, protocols, or keys without rebuilding the entire system. It supports response to emerging weaknesses.
The person or role responsible for maintaining and producing records in response to valid requests. In healthcare, this can include medical record access requests, subpoenas, audits, and retention obligations.
An encryption key whose management is controlled by the customer rather than entirely by the service provider. Access, rotation, availability, and recovery remain important.
With respect to PHI created or received by a business associate in its capacity as the business associate of a covered entity, the combining of that PHI with PHI received as business associate of another covered entity, to permit data analyses relating to the health care operations of the respective covered entities.
The required specification to establish and implement procedures to create and maintain retrievable exact copies of ePHI.
The practice of labeling information by sensitivity and handling requirements. PHI and ePHI should be classified so workforce members know when stronger access, storage, transmission, and disposal controls apply.
A controlled environment for joint data analysis with restrictions on access and outputs. The label alone does not establish de-identification or lawful use.
An entity determining the purposes and means of personal-data processing under frameworks such as the GDPR. It is not a synonym for HIPAA covered entity.
Unauthorized transfer of data out of an organization or controlled environment. Theft may occur through network connections, accounts, removable media, or cloud services.
The recorded path of data through sources, transformations, and destinations. Lineage helps trace how an output was produced.
Connecting records from different datasets believed to describe the same person or event. Linkage can improve analysis while increasing identification and disclosure risks.
Technology and procedures designed to detect or block improper transmission of sensitive data. DLP can help prevent PHI from leaving through email, web uploads, removable media, or unmanaged cloud tools.
Documenting where PHI is collected, stored, used, transmitted, disclosed, and destroyed. Data mapping supports risk analysis, minimum necessary review, breach response, and vendor management.
Concealing or replacing selected data values for display, testing, or sharing. Masking does not necessarily remove PHI or prevent recovery of the underlying data.
HIPAA's data minimization principle is the minimum necessary standard: limit uses, disclosures, and requests of PHI to what the purpose actually requires.
Manipulating data used for training or processing to influence a system's behavior or reduce its reliability.
The ability to obtain and move data into another usable environment or service. Export formats and contractual access rights influence practical portability.
A contract describing responsibilities for processing personal data. A DPA is not automatically a substitute for a HIPAA business associate agreement.
An entity processing personal data on a controller's behalf under frameworks such as the GDPR. Its status is distinct from HIPAA business associate status.
Information about where data came from, who created or changed it, and how it was produced. Provenance supports trust and traceability.
The geographic location where data is stored or processed. Residency does not by itself establish HIPAA compliance or adequate protection.
Tools discovering sensitive data and evaluating its access, exposure, and protection across systems or services.
Standards and approaches for marking and handling health information with specific privacy restrictions. Segmentation can support more granular sharing controls.
Assigned responsibility for data quality, appropriate use, access, and lifecycle management. Stewardship connects governance rules to operational decisions.
The individual to whom personal data relates under frameworks such as the GDPR. HIPAA usually uses the term individual.
Exchanging selected values between records to obscure their original associations. Poor design may distort analysis or leave disclosure risks.
The agreement required before disclosing a limited data set: it establishes the permitted uses and disclosures, identifies who may use or receive the data, and binds the recipient to safeguards, non-re-identification, no contacting of individuals, and flow-down to agents.
A structured document describing a dataset's collection, contents, uses, and limitations. It helps users assess suitability and risks.
Changing dates by controlled offsets while preserving selected intervals or patterns. It does not by itself establish HIPAA de-identification.
Health information that does not identify an individual, and for which there is no reasonable basis to believe it can be used to identify, is not individually identifiable. The rule provides two methods: expert determination and safe harbor. Properly de-identified information is no longer PHI.
A covered entity must protect a deceased individual's PHI for 50 years following death; after that, the information is no longer PHI.
Security tools that create misleading targets or information to attract attackers and reveal malicious activity.
Using multiple complementary safeguards so one failure does not remove all protection. Layers can include people, processes, applications, devices, and networks.
Using a strong magnetic field to disrupt data on magnetic media. It is not an effective sanitization method for nonmagnetic storage such as flash memory.
Access granted to a person acting on behalf of another user, patient, or organization. Delegated access should be documented, limited by role, and traceable in audit logs.
A model where certain users can manage accounts, roles, or settings for a defined area. Delegated admin rights should be limited, logged, and reviewed.
Qualifying deliberations or analysis within a patient safety evaluation system. These may be patient safety work product, subject to the statute's definitions and exclusions.
A network segment separating externally reachable services from more trusted internal systems. Allowed connections between zones should be restricted.
An OAuth mechanism binding tokens to a client-held key and requiring signed proofs. It limits some misuse of stolen bearer tokens.
Working denied claims falls inside the definition of payment: billing, claims management, collection activities, and related health care data processing.
An attack or condition preventing legitimate users from accessing a system or service. It can involve resource exhaustion, software flaws, or disrupted connections. See Distributed Denial of Service (DDoS).
Documenting relationships among systems, services, people, and resources. It helps identify cascading failures and recovery priorities.
An administrative safeguard concept involving Designated Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Designated Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Designated Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Designated Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Designated Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Designated Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Designated Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Designated Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Designated Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Designated Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Designated Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Designated PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Designated Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Designated Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A group of records maintained by or for a covered entity that is: the medical and billing records about individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or records used, in whole or in part, to make decisions about individuals. A record is any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity.
An administrative safeguard concept involving Designated Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Also known as: Designated Standards Maintenance Organization (DSMO)
An organization designated to receive and coordinate requests to change HIPAA transaction standards or their implementation specifications.
An administrative safeguard concept involving Designated System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Designated User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Designated Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Designated Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An audit conducted primarily by reviewing submitted documentation rather than visiting the organization. OCR has used desk audits to examine selected HIPAA requirements; policies should be supported by evidence of actual practice.
The extent to which security monitoring can identify relevant attack behaviors or conditions. Coverage depends on available data and tested detection logic.
Designing, testing, tuning, and maintaining security detections. It includes data requirements, logic, validation, and operational handling.
A safeguard intended to identify an unwanted event or condition, such as monitoring, alerts, or access reviews.
Matching records using defined rules about exact or specified field agreements. Errors or missing values can affect the resulting matches.
The required standard for policies and procedures governing the receipt and removal of hardware and electronic media containing ePHI into and out of a facility, and their movement within it.
An OAuth flow for devices with limited input or browsing capability. A user completes authorization through a separate browser-capable device.
Configuring devices to reduce security risk before use. Hardening can include disabling services, enforcing encryption, patching, and applying baseline settings.
A classification grouping inpatient hospital cases by clinical and resource characteristics for payment or analysis. Different programs use different DRG systems.
A set of DICOM web services for searching, retrieving, and storing medical imaging information through web-based interfaces.
A mathematical privacy framework that bounds how much one person's data can change a computation's output distribution. The guarantee depends on the mechanism and privacy parameters.
The combined practice of examining digital evidence and managing security incidents. Preservation, containment, and recovery must be coordinated.
A standard for medical imaging data and communication. Identifying information can appear in metadata and in the image itself.
The regulation defines electronic signature for transactions: an electronic sound, symbol, or process attached to or logically associated with attachment information and executed by a person with the intent to sign it.
Standards-based secure exchange of health information using Direct protocols and trust relationships. Sender and recipient identity and destination accuracy remain important.
A treatment relationship between an individual and a health care provider that is not an indirect treatment relationship; the provider delivers care, services, or results directly to the individual rather than through another provider.
Sending health information to a known recipient for a defined purpose, such as a referral. Destination verification and secure transport remain important.
The narrow facility directory categories: name, facility location, general condition, and religious affiliation, shareable under the informed no-objection rules; not a license for broader disclosure.
The required specification to establish, and implement as needed, procedures to restore any loss of data.
The release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.
A covered entity must document and retain every signed authorization, as required by § 164.530(j).
The required specification for policies and procedures addressing the final disposition of ePHI and the hardware or electronic media on which it is stored.
A denial-of-service attack launched through many sources to overwhelm a service or its supporting infrastructure. Availability of clinical systems can be affected.
Applying policies to domain-name requests, such as blocking known malicious domains. Filtering does not address every route to malicious content.
Transporting DNS queries through HTTPS to protect the connection. It can also change how an organization observes or filters DNS traffic.
Transporting DNS queries through TLS to protect the connection between the client and resolver.
Manipulating DNS responses so a browser reaches a different destination under the same host name, potentially accessing restricted services.
A controlled destination used in place of an unwanted domain's normal response, often to disrupt or observe malicious connections.
Maintain Security Rule policies and procedures in written form (which may be electronic), and maintain a written record of any action, activity, or assessment the Rule requires to be documented.
Impersonating a trusted domain through forged presentation or a misleading domain name. Technical verification and careful destination checking help reduce deception.
A ransomware scheme combining disruption or encryption with threats to release stolen data. Restoring backups does not resolve the disclosure risk.
The paper capture tool used during system downtime, part of emergency mode operation procedures for continuing critical processes while protecting ePHI.
Documented manual operations during system unavailability implement the emergency mode operation specification: continuing critical business processes while protecting ePHI.
Unwanted software downloading or executing when a user visits compromised or malicious content, sometimes through a software vulnerability.
Requiring two authorized people to participate in a sensitive operation so one person cannot complete it alone.
Multiple records or identifiers incorrectly representing one patient in a system. Duplicates can fragment care information and complicate disclosure requests.
A duty under applicable law or professional rules to take protective action concerning certain threats. Required actions and permissible disclosures vary by jurisdiction and circumstances.
A duty under applicable law or professional rules to warn about certain threats. HIPAA's serious-threat permission does not create a universal duty to warn.
The period an attacker remains present before detection, removal, or another defined endpoint. Investigations may only estimate the initial entry time.
Testing a running application through its exposed interfaces for security weaknesses. Coverage depends on the reachable behavior and test setup.
An approach allowing individuals to manage and update consent choices over time. Changes must be applied consistently across relevant systems and uses.
Controlling traffic leaving a network or system. Restrictions can limit exfiltration and communications with attacker infrastructure.
An administrative safeguard concept involving Electronic Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Electronic Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Electronic Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Electronic Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Automated exchange of case information from clinical systems to public health authorities. Reporting must follow applicable authority and data requirements.
An administrative safeguard concept involving Electronic Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A quality measure computed using electronically represented clinical data and specified logic. Reliable measurement depends on accurate data and implementation.
An administrative safeguard concept involving Electronic Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Computer-to-computer exchange of structured business information using agreed formats. HIPAA administrative transactions are a major healthcare use of EDI.
A patient-rights concept involving Electronic Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Electronic Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Electronic Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Electronic Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The health care EFT and remittance advice transaction: transmission of payment and payment processing information from a health plan to a provider's financial institution, with adopted standards at § 162.1602 and CAQH CORE operating rules at § 162.1603.
A technical safeguard or security operations concept involving Electronic Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Electronic transmission of laboratory results to public health or other authorized recipients using specified standards and reporting rules.
Electronic storage material on which data is or may be recorded electronically (hard drives, removable or transportable digital memory such as magnetic tape or disk, optical disk, or digital memory card), and transmission media used to exchange information already in electronic storage media (internet, extranet or intranet, leased lines, dial-up lines, private networks, and physical movement of removable storage media). Paper-to-paper faxes and voice telephone calls are not electronic media transmissions if the information did not exist in electronic form immediately before the transmission.
A digital clinical record system commonly associated with one practice or organization. EMR and EHR terminology varies by vendor and context; the HIPAA obligations depend on the information and activities, not the label. See Hosted EHR.
An electronic record of medication administration, including timing, dose, and responsible staff. Accurate access and audit records support patient safety.
A patient-rights concept involving Electronic Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Electronic PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Electronic Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Creating and transmitting prescription information electronically. Prescription data and associated patient identifiers must be handled with appropriate privacy and security safeguards.
Electronic exchange supporting requests and decisions for authorization of care or medication. Applicable transaction standards depend on the workflow.
A privacy-rule concept involving Electronic Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
Protected health information that is transmitted by electronic media or maintained in electronic media (paragraphs (1)(i) and (1)(ii) of the definition of protected health information).
The 835 remittance advice adopted as the standard for explaining health plan payment of claims.
An administrative safeguard concept involving Electronic Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Electronic User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Electronic Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An electronic process verifying specified information about covered service visits, such as the recipient, provider, location, and time.
An administrative safeguard concept involving Electronic Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The eligibility for a health plan transaction, conducted with the adopted X12N 270 inquiry and 271 response standards.
A gateway that encrypts outbound email carrying ePHI implements the addressable transmission encryption specification.
A numerical representation of information used for tasks such as similarity search. An embedding is not automatically anonymous or safe to share.
The required specification to establish and implement procedures for obtaining necessary ePHI during an emergency.
A covered entity may disclose to a family member, relative, close personal friend, or person identified by the individual the PHI directly relevant to that person's involvement in the individual's care or payment, and may notify such persons of the individual's location, general condition, or death.
The required specification for procedures to enable continuation of critical business processes for protection of the security of ePHI while operating in emergency mode.
A system for distributing urgent alerts to designated people or groups. Contact accuracy and alternate delivery routes influence reliability.
A physical or virtual coordination location for managing emergency information, decisions, and resources.
Employment records held by a covered entity in its role as employer are excluded from the definition of PHI. The same lab result can be PHI in the patient chart and a non-PHI employment record in the HR file.
The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.
The addressable specification to implement a mechanism to encrypt and decrypt ePHI. Data encrypted consistent with HHS guidance is also secured, taking its loss outside breach notification.
The addressable specification to implement a mechanism to encrypt ePHI whenever deemed appropriate during transmission.
Also known as: Endpoint Detection and Response
Security tooling that monitors computers and servers for suspicious activity and helps contain malware or unauthorized access. EDR supports HIPAA's expectation that organizations detect and respond to security incidents.
A list of laptops, desktops, phones, tablets, servers, and other endpoints. Inventory supports patching, encryption tracking, access review, and incident response.
Restricting an endpoint's communications to contain suspected compromise. Some management or investigation connections may remain available.
The compliance and investigation procedures, civil money penalty provisions, and hearing procedures for the administrative simplification rules: complaints, investigations, penalty amounts and factors, affirmative defenses, and appeals.
The enrollment and disenrollment transaction, conducted with the adopted ASC X12N 834 standard.
An index linking patient identifiers across systems within an enterprise or exchange environment. Incorrect links can expose or contaminate records.
An organization-wide approach for identifying and managing operational, compliance, financial, and security risks. HIPAA risk analysis should connect to this broader governance process when one exists.
Managing access rights and memberships throughout their lifecycle. Approval, review, and expiration help keep permissions appropriate.
Observing conditions such as temperature, humidity, smoke, or water intrusion. It helps detect threats to systems and stored records.
A group of records sharing the same values for selected attributes. Privacy models such as k-anonymity evaluate these groups.
Procedures for moving people safely from a threatened area. Plans should account for patients, accessibility, accountability, and continuity needs.
The required standard to perform periodic technical and nontechnical evaluation, based initially on the Security Rule standards and thereafter in response to environmental or operational changes, establishing the extent to which policies and procedures meet the Rule's requirements.
HIPAA's documentation requirements define the evidence: written policies and procedures, written records of required actions and assessments, and six-year retention.
Reviewing a selected subset of records or events to assess a larger population. Sampling design affects what conclusions can be supported.
Loss, destruction, or alteration of evidence that should have been preserved. Legal obligations depend on the circumstances and applicable law.
A legal protection limiting compelled disclosure or use of specified information in proceedings. HIPAA privacy protection does not itself create a general evidentiary privilege.
A maintained list of approved deviations from policy or standard controls. Each exception should include owner, reason, compensating controls, and expiration.
A request to deviate from a standard, policy, or control for a documented reason. Security exceptions should be time-limited, risk-reviewed, approved, and tracked through remediation.
A recognized reason for requesting or disclosing information in an exchange framework. A stated purpose does not authorize uses outside applicable law.
Research meeting a specified exemption from certain Common Rule requirements. An exemption does not automatically remove HIPAA obligations for PHI.
Research review performed through an authorized streamlined process when applicable eligibility criteria are met. Expedited does not mean exempt from review or privacy safeguards.
A person with appropriate knowledge and experience with generally accepted statistical and scientific principles determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, to identify an individual, and documents the methods and results.
A collection of tools or automated components for exploiting vulnerabilities, often used to deliver malware.
A model estimating the likelihood that a published vulnerability will be exploited in the wild within a defined period. It complements severity scoring.
How readily a weakness can be used to produce an unauthorized effect. Access requirements, available attack code, and environmental conditions influence it.
An assessment performed by an outside party to evaluate compliance, controls, or financial processes. External audits do not create official HIPAA certification, but they can identify gaps and support remediation.
Sorting out HIPAA? A free 30-minute review maps your gaps.
Book your free 30-minute intro callA face-to-face marketing communication by a covered entity to an individual that does not require the marketing authorization otherwise required by HIPAA.
The required standard to implement policies and procedures to limit physical access to electronic information systems and the facilities housing them, while ensuring that properly authorized access is allowed.
An administrative safeguard concept involving Facility Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Facility Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Facility Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Facility Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Facility Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A covered health care facility may maintain a directory holding the individual's name, location in the facility, general condition, and religious affiliation, and disclose it to clergy or to persons who ask for the individual by name, if the individual was informed and given the chance to object. Religious affiliation goes only to clergy.
A patient-rights concept involving Facility Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Facility Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Facility Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Facility Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Facility Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Also known as: Maintenance Records
The addressable specification to document repairs and modifications to the physical components of a facility related to security, for example hardware, walls, doors, and locks.
A patient-rights concept involving Facility Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Facility PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Facility Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Facility Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Facility Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The addressable specification for policies and procedures to safeguard the facility and its equipment from unauthorized physical access, tampering, and theft.
An administrative safeguard concept involving Facility System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Facility User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Facility Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Facility Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Restoring a device to its original or default configuration. A factory reset does not necessarily remove all recoverable data.
Returning a service from a temporary recovery environment to its normal environment. Data consistency and controlled cutover are important.
Switching to standby systems during an outage implements the disaster recovery and emergency mode operation specifications for systems containing ePHI.
A federal law imposing civil liability for specified knowing false or fraudulent claims involving government payment. Healthcare billing records may be relevant to an investigation, but disclosure of those records must still follow applicable HIPAA permissions.
A result incorrectly indicating that a condition is absent. Missed malicious activity can continue without intervention.
An alert or result incorrectly indicating that a condition is present. Excess false positives can consume investigation capacity.
A criminal HIPAA culpability concept involving obtaining or disclosing PHI under deceptive circumstances. It carries higher potential criminal penalties than a knowing violation without false pretenses.
An HL7 standard representing health information as structured resources and supporting exchange through APIs and other methods. FHIR alone does not provide all security safeguards.
A cover page used when sending records by fax. It should limit PHI, identify the intended recipient, and include misdirected-fax instructions.
Under the electronic media definition, a paper-to-paper fax is not an electronic media transmission when the information did not exist in electronic form immediately before transmission; the faxed PHI remains PHI and misdirected faxes remain disclosures.
The federal government's daily publication of agency rules, proposed rules, and notices. It records HIPAA rulemaking and effective-date announcements; the Code of Federal Regulations organizes the resulting regulations by subject.
A program receiving federal assistance as defined by Part 2, which can include specified funding, licensing, certification, or tax-related support. Assistance is not limited to direct grants.
An identity model where a trusted provider authenticates users for multiple applications. It can simplify access management but still needs MFA, logging, and timely deprovisioning.
Training a model across multiple locations while keeping raw training data locally. Model updates can still leak information and need protection.
A login method where one identity provider authenticates users across multiple systems. It can improve control if MFA, logging, and deprovisioning are enforced.
A NIST level describing protections for exchanging and relying on identity assertions between an identity provider and a relying party.
Access fees may include only reasonable, cost-based labor for copying, supplies for the copy, postage, and preparation of an agreed summary. Retrieval fees are not permitted.
Education records covered by FERPA, and the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), are excluded from the definition of protected health information. Student health records at FERPA-covered schools generally follow FERPA, not HIPAA.
A FHIR resource describing an event relevant to security auditing, including actors, affected entities, and event details.
A FHIR resource containing a collection of resources, such as search results, a document, or a set of transaction requests.
A FHIR resource describing a system's supported capabilities, such as resources, operations, formats, and interactions.
A FHIR resource representing consent-related rules or choices. Implementers must separately determine legal validity and enforce applicable restrictions.
A FHIR resource carrying details about errors, warnings, or processing results. Diagnostic information should avoid unnecessary sensitive disclosure.
A set of constraints and extensions adapting a FHIR resource or other definition to a particular use case.
A FHIR resource describing activities and agents involved in producing or changing information. It helps trace origin and responsibility.
A defined unit of structured information in FHIR, such as Patient, Observation, or Consent. Resources contain elements and may reference other resources.
A mechanism for requesting notifications when specified events or data changes occur. Notification content and endpoints need appropriate protection.
A family of standards supporting public-key authentication through WebAuthn and CTAP. It enables authenticators such as security keys and platform passkeys.
Encrypting specific database fields implements the addressable mechanism to encrypt and decrypt ePHI.
Also known as: Mechanism to Authenticate ePHI
Implements the addressable mechanism to authenticate ePHI: electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.
A protocol used to move files between systems. PHI transfers should use secure variants and approved workflows, not plain unencrypted FTP.
Malicious activity operating largely through memory, scripts, or legitimate tools rather than a conventional installed executable. Some artifacts may still be written to disk.
Systems or measures intended to control or extinguish fires. Selection should account for occupied spaces and sensitive equipment.
A network security control that filters traffic between networks or systems. Firewalls help reduce exposure of systems containing ePHI and should be configured, monitored, and reviewed.
A periodic check of network access rules to remove unnecessary exposure. Reviews help show reasonable protection against anticipated threats to ePHI systems.
PHI may be disclosed as authorized by, and to the extent necessary to comply with, workers' compensation laws and similar no-fault programs for work-related injuries or illness. First report of injury is also a named HIPAA transaction in the § 160.103 transaction definition, though no standard has been adopted for it.
Technical investigation of a security incident to determine what happened, which systems were affected, and whether ePHI was accessed or exfiltrated. Findings often inform breach risk assessment.
A captured representation of digital storage or other evidence used for investigation. Its integrity should be documented with appropriate acquisition methods and hashes.
A sequence of events reconstructed from digital evidence. Timestamp interpretation and source reliability affect its accuracy.
For essential health benefits, a plan must cover prescription drugs per USP category and class counts, use a pharmacy and therapeutics committee, and publish an up-to-date, accurate, and complete drug list. HIPAA-side, formulary communications appear in the marketing definition's refill reminder carve-out at § 164.501.
A property protecting past session keys if a long-term secret is later compromised. Correct protocol choices and implementation are required.
Requiring a second person's review or approval for a consequential action. Independent review helps catch mistakes and misuse.
Risk arising from suppliers used by an organization's direct vendors. These downstream relationships may affect access, availability, and data protection.
The health oversight provision: PHI may be disclosed to a health oversight agency for audits, civil, administrative, or criminal investigations, inspections, licensure actions, and proceedings overseeing the health care system and government benefit programs.
Fraud and abuse detection and compliance programs are named health care operations; related payment-side review activities appear in the payment definition.
A claim being rejected before adjudication because submission or validation requirements were not met. It differs from an adjudicated claim denial.
A federal rule requiring certain vendors of personal health records and related entities outside HIPAA's covered-entity framework to report qualifying breaches. It complements HIPAA breach notification in the broader health-data ecosystem.
Research review by a convened IRB with the required quorum and participation. It is commonly used when a study does not qualify for an alternative review pathway.
Implements the encryption specification; a lost laptop whose disk was encrypted consistent with the HHS guidance referenced in § 164.402 does not hold unsecured PHI, so its loss is not a reportable breach.
Using a system or data for purposes beyond those originally intended. New uses can create additional privacy risks and permission requirements.
An electronic response confirming receipt or syntax status of a transaction file. Acknowledgments help troubleshoot HIPAA transaction exchange failures.
An EDI envelope grouping transaction sets of a related type. It sits between the interchange envelope and individual transaction sets.
A covered entity may use limited categories of PHI for its own fundraising, must provide a clear and conspicuous opportunity to opt out with each communication, may not condition treatment or payment on the choice, and must honor elections.
A HIPAA authorization describing future research sufficiently for an individual reasonably to expect the proposed uses or disclosures. It need not identify every future study by name.
Testing software with varied, malformed, or unexpected inputs to reveal failures and security weaknesses.
A contractual term that restricts legally required or permitted disclosure. In healthcare compliance, agreements should not prevent required reporting, patient rights fulfillment, or cooperation with regulators.
An evaluation comparing your current HIPAA posture against regulatory requirements to identify deficiencies. Typically follows a risk assessment and produces a list of areas where policies, procedures, or technical controls are missing. The output feeds directly into a remediation plan.
The business associate definition expressly includes health information organizations, e-prescribing gateways, and other persons providing data transmission services with routine access to PHI.
A differential privacy mechanism adding calibrated Gaussian noise. Its privacy guarantee depends on sensitivity, noise scale, and specified privacy parameters.
A broad role or ownership assignment used in policies, such as designating privacy, security, records, or incident response responsibility. HIPAA programs work better when these designations are named and documented.
A broad release is HIPAA-valid only if it contains the authorization core elements and required statements; missing elements or vague descriptions make it defective, and a defective authorization permits nothing.
Replacing precise values with broader categories, such as age ranges or larger geographic areas. The goal is to reduce identifying detail.
AI that produces content such as text, images, audio, or code from learned patterns. Handling PHI through such tools requires appropriate permissions and safeguards.
With respect to an individual: information about the individual's genetic tests, the genetic tests of family members, the manifestation of a disease or disorder in family members, and any request for or receipt of genetic services or participation in clinical research including genetic services by the individual or a family member. Includes genetic information of a fetus carried by the individual or a family member and of any embryo legally held through assisted reproductive technology. Excludes information about the sex or age of any individual.
A federal law restricting certain uses of genetic information in health coverage and employment. HIPAA also treats genetic information as health information and restricts health-plan underwriting uses.
Genetic information (an individual's genetic tests, family members' tests, family disease manifestation, and genetic services participation) is health information by definition and is PHI when individually identifiable and held by a covered entity or business associate.
Maintaining resources or copies in geographically separated locations to reduce exposure to a single regional event.
Privacy and security risk created when location-based tools collect or target people around healthcare facilities. Patient location data can create sensitive inferences.
An FDA database containing identifying information about devices with unique device identifiers. It does not contain individual patient treatment records.
Forging Kerberos ticket-granting tickets using compromised domain signing material. The attack can enable broad and persistent impersonation.
A compliance posture showing an organization attempted to follow HIPAA through reasonable policies, training, documentation, and response. Good faith does not erase violations, but it can affect enforcement outcomes.
An administrative safeguard concept involving Governance Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Governance Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Governance Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Governance Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A document defining a compliance committee's scope, members, meeting cadence, authority, and recordkeeping expectations.
An administrative safeguard concept involving Governance Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A group responsible for privacy, security, risk, and compliance oversight. In larger organizations, a committee helps ensure HIPAA decisions are tracked, assigned, and reviewed.
An administrative safeguard concept involving Governance Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Governance Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Governance Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Governance Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Governance Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Governance Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Governance Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Governance PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Governance User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Governance Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Governance Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Access permissions divided by role, location, patient relationship, function, or data type. Granular access helps support minimum necessary use and reduces broad exposure of ePHI.
Consent that distinguishes particular data, recipients, purposes, or periods rather than granting a single broad permission.
A narrow access permission tied to a specific task, record type, or function. Granular permissions support least privilege and better audit review.
Filtering for low-value bulk email that can hide important notices or security alerts. Healthcare organizations should avoid filtering that buries breach or vendor notices.
Covered entities must provide a process for individuals to complain about the entity's privacy policies and its compliance, designate a contact person or office, and document all complaints received and their disposition.
An employee welfare benefit plan (as defined in section 3(1) of ERISA), including insured and self-insured plans, to the extent the plan provides medical care to employees or their dependents directly or through insurance, reimbursement, or otherwise, that has 50 or more participants or is administered by an entity other than the employer that established and maintains the plan.
A centralized Windows configuration rule. GPOs can enforce password, lockout, logging, encryption, and workstation controls for ePHI environments.
A healthcare provider organization where multiple clinicians furnish services. HIPAA duties apply to the covered entity and should be implemented across shared systems and workforce roles.
A parent, guardian, or person acting in loco parentis is generally the unemancipated minor's personal representative, except when the minor lawfully consented to the care, may lawfully obtain it without parental consent, or a parent has agreed to confidentiality between the minor and the provider.
A legal arrangement assigning specified decision-making responsibilities to a guardian. HIPAA personal representative status depends on the authority actually granted.
A practical policy that defines boundaries for risky workflows such as texting, cloud storage, remote work, or AI tools. Guardrails help workforce members make compliant choices without memorizing regulations.
A temporary or limited account used by visitors, contractors, or support personnel. Guest accounts should expire automatically and avoid unnecessary PHI access.
A separate network for patients and visitors. It should be isolated from systems that create, receive, maintain, or transmit ePHI.
A prioritized workflow that turns risk analysis findings into assigned actions, due dates, evidence, and closure notes. Remediation tracking is what makes risk analysis operational.
A practical document explaining how to follow a policy in daily work. Guidelines should stay consistent with approved HIPAA policies and training.
A regulated-system validation concept often seen in life sciences. It is not a HIPAA requirement, but validation evidence may matter where health data systems overlap.
A unique label assigned to a device. Asset tags help track laptops, drives, and equipment that may access or store ePHI.
A specialized device that protects cryptographic keys and performs cryptographic operations within a controlled boundary.
The pre-2013 interim standard asking whether an incident posed significant risk of harm to the individual. The Omnibus Rule replaced it with the presumption of breach plus the four-factor low probability of compromise assessment.
A fixed-length value generated from data to help detect changes. Hashes can support integrity checks for files, logs, and evidence packets.
Comparing cryptographic hashes to check whether data matches a recorded value. A matching hash supports integrity but does not establish lawful origin.
Information collected by consumer health apps. It may fall outside HIPAA unless handled by a covered entity or business associate, but it can still be sensitive and regulated elsewhere.
Care, services, or supplies related to the health of an individual, including preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition or functional status of an individual or affecting the structure or function of the body; and the sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
Also known as: Clearinghouse
A public or private entity, including a billing service, repricing company, community health management information system, and value-added networks and switches, that either processes health information received from another entity from a nonstandard format into standard data elements or a standard transaction, or receives a standard transaction and converts it into nonstandard format or content for a receiving entity.
A component or combination of components of a hybrid entity designated as performing covered functions, in accordance with § 164.105(a)(2)(iii)(D).
Activities of the covered entity, to the extent related to its covered functions, including: quality assessment and improvement; population-based activities to improve health or reduce costs; case management and care coordination; reviewing competence and qualifications of professionals, evaluating performance, credentialing, training, accreditation, certification, and licensing; conducting or arranging medical review, legal services, and auditing functions, including fraud and abuse detection and compliance; business planning and development; and business management and general administrative activities, including customer service, internal grievance resolution, sale or transfer of assets, and creating de-identified information or limited data sets.
A legal instrument naming someone to make health care decisions under applicable law. The person's authority may establish personal representative rights under HIPAA.
A provider of services as defined in section 1861(u) of the Social Security Act, a provider of medical or health services as defined in section 1861(s), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.
An administrative transaction for reviewing or authorizing health care services and related referrals. HIPAA specifies standards for covered electronic transactions.
A person authorized under applicable law to make health care decisions for another individual. The scope of authority determines corresponding personal representative rights.
A set of healthcare-focused cybersecurity practices developed through a public-private effort. It can guide safeguards but is not itself a HIPAA regulation.
Any information, including genetic information, whether oral or recorded in any form or medium, that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse, and relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for health care.
Defined for information blocking: an individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of technology or services for access, exchange, or use of electronic health information among more than two unaffiliated individuals or entities.
A standards organization and family of standards for exchanging health information. Different HL7 standards serve different messaging and interoperability purposes.
An individual or group plan that provides, or pays the cost of, medical care. The definition enumerates 17 categories, including group health plans, health insurance issuers, HMOs, Medicare Parts A and B, Medicaid, Medicare supplement issuers, long-term care policy issuers (excluding certain nursing home fixed indemnity policies), multi-employer welfare plans, and listed government programs. Excepted-benefit policies and government programs whose principal purpose is not providing or paying for health care are excluded.
A planned unique identifier for health plans that was never fully implemented as a required standard. Current HIPAA identifier requirements focus on NPIs for providers and EINs for employers in transactions.
The ONC certification criterion for a standardized API for patient and population services: certified health IT must support FHIR-based API access, the technical foundation for patient-facing apps and data exchange.
When acting as a business associate, a clearinghouse may receive a standard transaction on a covered entity's behalf and translate it into nonstandard format for the entity, and receive nonstandard transactions and translate them into standard ones.
HCPCS is defined at § 162.103 and adopted at § 162.1002 as a standard code set for physician services, other health care services, and medical supplies, orthotics, and durable medical equipment.
The verification standard: before disclosure, verify the identity of a person requesting PHI and their authority to have access, if not already known, and obtain any required documentation, statements, or representations.
The Department of Health and Human Services. In Parts 160 through 164, Secretary means the Secretary of HHS or any officer or employee to whom the authority has been delegated.
An architecture designed to keep a service operating despite component failures. It does not replace data backup or disaster recovery.
The Health Insurance Portability and Accountability Act of 1996. Established national standards for protecting individually identifiable health information. Key provisions include the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule. Despite its name, the law's privacy and security impact far exceeds its original insurance portability focus.
An administrative safeguard concept involving HIPAA Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving HIPAA Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving HIPAA Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving HIPAA Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving HIPAA Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving HIPAA Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving HIPAA Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving HIPAA Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving HIPAA Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving HIPAA Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving HIPAA Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving HIPAA PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving HIPAA Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving HIPAA Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving HIPAA Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving HIPAA User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving HIPAA Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving HIPAA Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The Health Information Technology for Economic and Clinical Health Act of 2009. Made business associates directly liable for HIPAA violations, established the Breach Notification Rule, increased penalties, required periodic audits, and created the public breach portal. Most enforcement mechanisms that give HIPAA its teeth come from HITECH.
A proprietary control framework incorporating requirements and guidance from multiple sources. A HITRUST certification does not by itself establish compliance with every HIPAA obligation.
An HL7 messaging standard widely used for clinical and administrative exchanges, including registration, orders, and results.
An HL7 standards family developed using a formal information-model approach. Implementations and document standards vary by use case.
A one-time password calculated from a shared secret and counter. It does not use the same time-based progression as TOTP.
Encryption that permits selected computations on ciphertext, producing a result that can be decrypted later. Capabilities and performance vary by scheme.
A designated intermediary that separates identifiers from information provided to researchers or other users. The arrangement still needs appropriate permissions and disclosure controls.
A decoy system or service designed to attract or observe unauthorized activity. It must be isolated so it does not create additional exposure.
A decoy credential, record, or other artifact intended to trigger detection when used or accessed unexpectedly.
A database operated in a cloud or vendor environment. If it stores ePHI, the hosting arrangement needs safeguards, access controls, and usually a BAA.
An EHR vendor hosting a provider's records maintains ePHI on the provider's behalf and is a business associate by definition; the BAA and Security Rule obligations attach.
An alternate facility maintained with substantial operational capability for rapid recovery. Actual readiness depends on data synchronization and tested procedures.
A browser mechanism requiring HTTPS for a host for a specified period. It helps prevent insecure protocol downgrades after the policy is known.
A cookie carrying the HttpOnly attribute, which prevents access through ordinary browser scripting. It helps reduce some token-theft risks.
The PHI definition draws the line: records a covered entity holds in its role as employer (sick notes, FMLA paperwork, drug test results in HR files) are excluded from PHI, while identical clinical information in the patient record is PHI.
Manual evaluation by a qualified person before making a compliance-sensitive decision, such as breach determination, disclosure approval, or denial of access. Human review helps avoid automated policy errors.
Under the Common Rule, a living individual about whom a researcher obtains qualifying information or biospecimens through interaction, intervention, or identifiable private material.
A workflow requiring human participation in a defined decision or processing step. The reviewer needs enough information and authority to influence the outcome.
A workflow in which a human supervises an automated process and can intervene. Meaningful supervision depends on visibility, timing, and intervention capability.
A single legal entity that is a covered entity, whose business activities include both covered and non-covered functions, and that designates health care components in accordance with the rules.
The United States clinical modification of ICD-10 used to classify diagnoses. It differs from ICD-10-PCS, which classifies inpatient procedures.
An OpenID Connect token containing claims about authentication and the user. It is intended for the client and is not interchangeable with an API access token.
A violation of the same HIPAA requirement or prohibition as another violation. The grouping is relevant when determining the number of violations for civil monetary penalties.
A biospecimen for which a subject's identity is or may readily be determined by the researcher or associated with the specimen under the Common Rule.
Private information for which a subject's identity is or may readily be determined by the researcher or associated with the information under the Common Rule.
The people, process, and technology used to manage users, authentication, roles, access reviews, and termination. IAM is central to ePHI access control.
A NIST level describing confidence in the identity-proofing process linking a claimed identity to a real person.
Connecting a record or observation to a particular person. Combining datasets can enable disclosure even when direct identifiers were removed.
The process of verifying a person's identity before granting portal access, releasing records, or enrolling them in a system. Weak identity proofing can lead to improper disclosure of PHI.
A repository for clinical images, scanned documents, or diagnostic files. Archives containing patient identifiers require access control, retention, and backup safeguards.
A population-based system that consolidates immunization information from participating providers and other sources. Access and reporting rules vary by jurisdiction.
A backup that cannot be altered or deleted for a defined period. Immutable backups can improve ransomware resilience and support contingency planning.
The Privacy Rule's baseline standard: a covered entity or business associate may not use or disclose PHI except as the rule permits or requires. Every breach starts as an impermissible use or disclosure.
An acknowledgment reporting whether transaction content conforms to the applicable implementation requirements. It does not necessarily mean a claim was paid or clinically approved.
Detailed instructions for using a transaction standard in a particular business setting. Under HIPAA, adopted implementation specifications define required transaction use.
Specific requirements or instructions for implementing a standard.
A workflow where received faxes wait for review and routing. Queues can contain PHI and should have restricted access and timely cleanup.
The person assigned to coordinate incident response activities. The role should manage escalation, communications, evidence preservation, and decision tracking.
A collected set of logs, screenshots, notices, timelines, and decisions used to evaluate a privacy or security incident. It supports consistent breach assessment and later investigation response.
The required security incident procedures standard: identify and respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and their outcomes.
A rating that indicates the impact and urgency of a privacy or security event. Severity levels help determine response timelines, notification review, and leadership involvement.
A use or disclosure incident to an otherwise permitted use or disclosure is itself permitted, provided the entity applied reasonable safeguards and the minimum necessary standard. Overheard hallway conversations despite precautions are the classic example.
Destroying material through controlled burning. Disposal must use a suitable process and comply with applicable environmental and handling requirements.
An assurance-report approach including relevant subservice-organization controls within the description and examination scope.
A contract term allocating responsibility for certain losses. Vendor agreements involving PHI should review indemnity alongside BAAs, insurance, and liability limits.
The workforce definition turns on direct control, not payroll: a contractor working under the entity's direct control is workforce; one operating independently with PHI is analyzed as a business associate.
A behavior or pattern suggesting an attack is underway, such as suspicious credential use or execution sequences. It focuses on activity rather than only known artifacts.
An observable artifact suggesting possible compromise, such as a malicious file hash, domain, or unusual registry value. An indicator alone may not prove an incident.
An attribute, such as age or location, that may help identify a person when combined with other information. Removing names alone does not eliminate re-identification risk.
Prompt injection delivered through material an AI system retrieves or receives from another source, such as a document or tool response.
A relationship in which the provider delivers health care based on the orders of another provider, and typically furnishes services, products, or reports of diagnosis or results directly to that other provider rather than to the individual. Labs and pathologists are the classic examples.
A patient-rights concept involving Individual Access Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
TEFCA services enabling individuals to access their own health information through participating organizations. Applicable identity and consent requirements govern the service.
A patient-rights concept involving Individual Audit Evidence. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Backup Test. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Claims Transaction. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Compliance Calendar. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Contingency Task. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Eligibility Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Encryption Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Evidence Packet. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Exception Register. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Incident Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual PHI Handling. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Policy Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Privacy Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Retention Check. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Risk Finding. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Security Control. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual System Inventory. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Training Record. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual User Provisioning. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Vendor Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Individual Workforce Attestation. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A subset of health information, including demographic information collected from an individual, that is created or received by a health care provider, health plan, employer, or health care clearinghouse; relates to a person's physical or mental health, health care, or payment for health care; and identifies the individual or provides a reasonable basis to believe it could be used to identify the individual.
The risk that seemingly limited data can reveal sensitive facts when combined with other information. Inference risk matters for analytics, location, and small populations.
A practice by an actor (health care provider, health IT developer of certified health IT, or health information network or exchange) that is likely to interfere with access, exchange, or use of electronic health information, except as required by law or covered by a regulatory exception. For developers and networks the standard is knows or should know; for providers, knows the practice is unreasonable and likely to interfere.
An organized management system for assessing and treating information-security risk, establishing responsibilities, and improving controls over time.
The required specification to implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
A person's voluntary agreement to research after receiving understandable information about it. Informed consent to participate does not automatically authorize PHI use or disclosure under HIPAA.
Malware designed to collect sensitive information such as passwords, session cookies, files, or browser data.
Examining infrastructure configuration code for security weaknesses before or during deployment. Deployed settings still require verification.
Risk before considering specified controls or treatments. It provides a starting point for evaluating how safeguards change exposure.
Checking incoming data against allowed types, structure, ranges, and values. Validation should occur at the trusted processing boundary.
Unsafe handling of serialized data that allows unintended objects, behavior, or code execution when the data is reconstructed.
Risk arising from someone with authorized access who intentionally or unintentionally causes harm. Insider threats can include misuse, negligence, or compromised accounts.
A committee that reviews human-subject research. Under HIPAA, it may approve a documented waiver or alteration of research authorization when the regulatory criteria are satisfied.
Determination of eligibility or coverage is named inside the Privacy Rule's definition of payment, making verification a permitted payment activity under § 164.506; the electronic version is the 270/271 eligibility transaction at § 162.1202.
An initiative developing implementation profiles that show how existing healthcare standards work together for defined clinical and operational needs.
A service account used by one system to connect to another. Integration accounts should be unique, scoped, rotated, and monitored.
The property that data or information have not been altered or destroyed in an unauthorized manner.
The addressable specification under transmission security: implement measures to ensure that electronically transmitted ePHI is not improperly modified without detection until disposed of.
Analyzing an application from within while it runs during testing. Instrumentation combines execution context with security checks.
An identifier for an EDI interchange envelope. It helps distinguish transmissions and associate envelope-level acknowledgments.
The outer structure wrapping an EDI transmission. It identifies trading parties and supplies control information for processing.
Software that routes, transforms, and manages messages between healthcare applications. Message queues and error logs may contain PHI.
A self-directed review of policies, procedures, training, access, vendors, or safeguards. Internal audits help catch compliance gaps before a complaint, breach, or regulator review.
Connected medical devices and associated systems that collect or exchange health information. Device inventory, network protection, and maintenance are important safeguards.
A security system that detects suspected malicious network or host activity and can block it. Blocking decisions may affect legitimate traffic.
A maintained list of applications, databases, devices, integrations, and repositories that store or transmit ePHI. It is a practical foundation for risk analysis.
An international standard specifying requirements for an information security management system. Certification concerns a defined scope and does not replace HIPAA compliance responsibilities.
Correctional institution is defined at § 164.501; a covered entity may disclose an inmate's PHI to the institution or law enforcement custodian when necessary for the individual's health care, safety and security of the institution, officers, employees, transport, or law enforcement on the premises.
Care delivered inside a correctional institution operates under the correctional provisions: disclosures to the institution are permitted for treatment, institutional safety, and custody purposes, and inmates lack certain rights such as notice acknowledgment while in custody.
An attempt to bypass an AI system's behavioral restrictions or safeguards. Successful generation does not establish authorized access or lawful use.
Small timing variation in logs, alerts, or network signals. Analysts should account for jitter when reconstructing incidents involving ePHI systems.
A short operational reference that helps workforce members follow privacy or security procedures. Job aids should match the approved policy and avoid creating conflicting instructions.
A process that maps workforce duties to system permissions. It supports role-based access and helps justify why each role needs specific ePHI access.
A check that PHI access is tied to the user's actual job function. It supports minimum necessary and role-based access decisions.
Temporary access for trainees or observers. Access should be supervised, limited, and documented when PHI may be visible.
Coordinated access changes when people join an organization, change roles, or leave. It aligns account permissions with current responsibilities.
An administrative safeguard concept involving Joint Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Joint Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Joint Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Joint Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Joint Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An accreditation review that may examine privacy, documentation, safety, and operational controls. It is not a HIPAA audit but can surface related compliance gaps.
An administrative safeguard concept involving Joint Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Joint Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Joint Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Joint Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Joint Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Joint Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An investigation involving multiple parties, such as a covered entity, business associate, insurer, or regulator. Roles, evidence, and communications should be coordinated.
Covered entities participating in an organized health care arrangement may produce a single joint notice meeting stated conditions; provision of the joint notice by any one participating entity satisfies the requirement for the others at that service delivery site.
A patient-rights concept involving Joint Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Joint PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Joint Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Joint Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Joint Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A shared review between a covered entity and vendor covering safeguards, incidents, access, and open remediation items.
An administrative safeguard concept involving Joint System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Joint User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Joint Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A business arrangement between two or more parties. When a healthcare joint venture involves PHI, the parties must analyze covered entity status, business associate roles, BAAs, and permitted uses.
An administrative safeguard concept involving Joint Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A record of manual financial or billing adjustments. If entries reference patients or claims, they should be protected and retained appropriately.
A format for encrypting content and carrying associated cryptographic information. It protects confidentiality when correctly implemented and managed.
A format for protecting content with a digital signature or message authentication code. Signing does not conceal the content.
A compact format carrying claims between parties. Depending on its form, it may be signed, encrypted, or neither; validation is essential.
In judicial or administrative proceedings, PHI may be disclosed in response to a court or tribunal order (limited to what the order expressly authorizes), or to a subpoena or discovery request accompanied by satisfactory assurances of notice to the individual or a qualified protective order.
The litigation pathway: court order, or subpoena and discovery requests with satisfactory assurances (notice to the individual or a qualified protective order); the disclosure is limited to the PHI expressly authorized.
A large data export from an EHR, billing system, or analytics tool. Bulk exports raise minimum necessary, access, encryption, and retention concerns.
An intermediary system used to reach other systems in a protected environment. Its accounts, sessions, and network reach require careful control.
Controls that reduce improper or unsolicited faxing of patient information. Fax workflows should verify recipient numbers and minimize PHI on cover sheets.
The legal authority of a regulator, court, or state over an entity or matter. HIPAA obligations may intersect with state privacy, breach, medical record, and consumer protection laws.
A preservation requirement driven by a regulator, court, or state law. It may override routine destruction schedules for PHI or compliance evidence.
A state, federal, or local legal requirement that applies in addition to HIPAA. More stringent privacy laws may need to be followed alongside HIPAA.
An accountability model that distinguishes human error, risky behavior, and reckless conduct. It can help sanctions policies stay consistent and fair.
An approach limiting administrators to the commands or capabilities required for a defined task, reducing unnecessary administrative power.
Temporary access granted only when needed for a specific task, incident, or patient care purpose. It reduces standing privileges and can support minimum necessary access.
A short record explaining why a safeguard, disclosure, or addressable specification decision was made. It helps preserve compliance reasoning for later review.
A disclosure supported by a permitted purpose, authorization, legal requirement, or patient right. The reason and scope should be documented when not routine.
A health record for a minor. Parent access, minor consent, abuse concerns, and state law can change who may access or authorize disclosure.
Sorting out HIPAA? A free 30-minute review maps your gaps.
Book your free 30-minute intro callA property in which each record shares selected identifying attributes with at least k records, including itself. It does not prevent every form of disclosure.
Obtaining service-ticket material and attempting offline recovery of a service account's password. Strong account secrets and appropriate account design reduce the risk.
A network authentication protocol used in many enterprise environments. When used for ePHI systems, ticket lifetimes, account hygiene, and logging matter.
A technical safeguard or security operations concept involving Key Access Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A compliance oversight concept involving Key Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Key Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A protected copy of an encryption key used for recovery. Key backups need stronger controls than ordinary files because they can unlock sensitive data.
A technical safeguard or security operations concept involving Key Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Claims Transaction. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Compliance Calendar. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Contingency Task. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A metric used to monitor whether a control is operating as intended. The metric needs a defined purpose and interpretation.
A person or role responsible for protecting, issuing, rotating, or recovering encryption keys. Key custodian duties should be separated from ordinary user access where practical.
A function deriving cryptographic key material from an input secret or other material. Password-based and other KDFs have different design requirements.
A patient-rights concept involving Key Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Key Eligibility Workflow. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A process for securely storing encryption keys so authorized recovery is possible if primary access is lost. Key escrow must be tightly controlled because misuse can expose encrypted ePHI.
A technical safeguard or security operations concept involving Key Evidence Packet. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Exception Register. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Procedures for generating, distributing, storing, rotating, and destroying encryption keys. HIPAA does not specify key management by name, but effective encryption requires it. Poorly managed keys (stored alongside encrypted data, shared, or never rotated) undermine encryption entirely.
A patient-rights concept involving Key Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
Also known as: Key Performance Indicator
A metric used to monitor compliance program performance, such as training completion, BAA coverage, unresolved risks, access review completion, or incident closure time.
A technical safeguard or security operations concept involving Key PHI Handling. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Policy Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Privacy Workflow. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Retention Check. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Risk Finding. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A metric that warns of increased privacy or security risk, such as terminated users with active accounts or overdue patching on ePHI systems.
The planned replacement of encryption keys. Rotation limits exposure if a key is compromised and supports disciplined encryption management.
A technical safeguard or security operations concept involving Key Security Control. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key System Inventory. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key Training Record. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A technical safeguard or security operations concept involving Key User Provisioning. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A vendor and business associate oversight concept involving Key Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A technical safeguard or security operations concept involving Key Workforce Attestation. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Workstation habits and screen placement that reduce shoulder-surfing and accidental viewing. It is a practical physical safeguard in reception and shared spaces.
A message authentication method using a secret key to verify integrity. It can help detect unauthorized changes in sensitive data workflows.
A tool that records keystrokes. Malicious keyloggers can capture passwords, messages, and information entered into clinical systems.
A launch checklist used when onboarding a new system, vendor, or location. It should cover PHI flows, access roles, BAAs, training, and safeguards.
A model describing stages of an attack, from reconnaissance through actions on objectives. It helps security teams map defenses around ePHI systems.
Patient intake through a shared kiosk or tablet. It needs screen privacy, session reset, authentication, and sanitation of cached PHI.
An encryption key managed by a key management service. KMS keys protecting ePHI should have restricted administration, rotation, and audit logs.
An internal support article explaining approved procedures. Articles that mention PHI workflows should be reviewed so they do not conflict with HIPAA policies.
An authentication factor based on something the user knows, such as a password or PIN. Strong systems combine it with possession or biometric factors for multi-factor authentication.
The handoff of operational knowledge during staff changes or vendor transitions. For HIPAA programs, transfer should preserve policy ownership, evidence, and risk context.
Access granted to analysts, billing staff, compliance staff, or managers who need records for operations rather than direct care.
A software flaw listed as actively exploited by attackers. Systems handling ePHI should prioritize remediation of known exploited vulnerabilities.
A backup verified to restore correctly and free of corruption or malware. Backup testing matters because untested backups may fail during an incident.
A process for confirming that a message or file came from an expected source. It helps reduce phishing and misdirected PHI workflows.
A list of active workforce and service accounts. It supports access reviews, deprovisioning, and detection of orphaned accounts.
A dashboard tracking compliance and security metrics. It should summarize evidence status without exposing unnecessary PHI.
A container-platform object used to store credentials or keys. Secrets tied to ePHI applications should be encrypted, scoped, and rotated.
A privacy property requiring sufficient diversity of sensitive values within groups of otherwise similar records. It addresses some disclosure risks left by k-anonymity.
Rules for marking documents, exports, tickets, or files by sensitivity. Labels help workforce members recognize PHI and apply the right handling steps.
A system managing laboratory orders, specimens, processing, and results. Its interfaces and user permissions affect access to sensitive information.
A differential privacy mechanism adding calibrated Laplace-distributed noise to a numerical query. Calibration depends on sensitivity and the privacy parameter.
The single highest-value safeguard for portable devices: it implements the encryption specification and keeps a lost laptop outside the breach rules because the PHI is not unsecured.
A model trained to process and generate language. It can produce plausible errors and may expose sensitive information through inputs, outputs, or integrations.
A record entry made after the original event. Late entries should be clearly marked and preserve integrity of the original documentation timeline.
A required delay in breach notifications when a law enforcement official determines notification would hinder an investigation or damage national security. Different documentation rules apply to written and oral requests.
Permitted disclosures to law enforcement officials: as required by law or legal process; limited identification and location information about suspects, fugitives, witnesses, or missing persons; about victims in stated circumstances; about decedents; crime on the premises; and crime emergencies.
A person or entity receiving Part 2 records through a permitted route, such as patient consent or a qualifying court order. Continuing use and disclosure restrictions depend on the applicable Part 2 provisions.
A Notice of Privacy Practices presented through a short overview linked to or accompanied by the complete notice. The full notice must still meet HIPAA's content and delivery requirements. See Notice of Privacy Practices (NPP).
A directory service used to manage users and groups. When tied to ePHI system access, directory accuracy affects authentication, authorization, and termination controls.
Monitoring for water or other fluid leaks that could damage equipment, records, or facilities. Alerts should reach people able to act.
A security principle that limits systems to necessary services, ports, and features. It reduces attack surface for systems handling ePHI.
An older application or device that may lack modern security features. Legacy systems containing ePHI need compensating safeguards and documented risk decisions.
A person appointed under applicable law to exercise specified authority for another person. Guardianship orders may limit health care and record-access powers.
Also known as: Legal Medical Record
The official business record of patient care maintained by a provider. It often overlaps with the designated record set, but the two concepts are not always identical.
A process preserving records when litigation, investigation, audit, or enforcement action is reasonably anticipated. A legal hold can override normal destruction schedules.
A written statement from management, counsel, or a vendor about facts relevant to compliance. It should be supported by evidence where possible.
A contract limit on damages. For vendors handling PHI, liability caps should be reviewed against breach, indemnity, and regulatory risk.
Licensing and credentialing activities appear in the definition of health care operations, permitting the PHI uses they entail.
The licensed health care professional designated to review a reviewable access denial. The reviewer must not have participated in the original denial decision.
Managing systems, vendors, policies, and accounts from creation through retirement. Lifecycle discipline prevents stale access, outdated policies, and unsupported ePHI repositories.
An administrative safeguard concept involving Limited Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Limited Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Limited Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Limited Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Limited Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
PHI that excludes 16 listed direct identifiers of the individual and of relatives, employers, and household members. It may retain dates and some geography, and may be used or disclosed only for research, public health, or health care operations, and only under a data use agreement.
A patient-rights concept involving Limited Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Limited Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Limited Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Limited Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Limited Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Limited Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Limited PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Limited Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Limited Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Limited Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Limited User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Limited Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A narrowly bounded waiver of sanctions and penalties for selected HIPAA requirements during qualifying emergencies. It does not suspend the entire Privacy Rule.
An administrative safeguard concept involving Limited Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy threat-modeling framework covering linking, identifying, non-repudiation, detecting, data disclosure, unawareness, and non-compliance.
The ability to connect records or observations believed to concern the same individual. Linked information may reveal identity or sensitive facts.
A record of a chat interaction. If patients discuss care, billing, or identifiers, transcripts become PHI and need retention and access controls.
Using legitimate system tools and built-in capabilities to perform malicious actions. Detection requires attention to context and behavior.
A user account managed on a single device or application rather than through a central identity provider. Local accounts should be inventoried, secured, and removed when no longer needed.
An account with elevated privileges on a device or application. Local admin rights should be limited because they can bypass normal safeguards.
Differential privacy applied to a person's data before or as it is submitted to an aggregator. It reduces reliance on trusting the central collector.
A weakness allowing unintended local files to be included or read through an application. It can expose secrets or enable further exploitation.
Protection of location information that may reveal care, diagnosis, or visit patterns. Location data tied to healthcare can create sensitive PHI inferences.
Connecting events from multiple logs to identify relationships or sequences. Reliable timestamps and identifiers improve the accuracy of the resulting picture.
The period audit and security logs are kept. Retention should align with investigation needs, policy requirements, and the six-year HIPAA documentation rule where applicable.
The addressable specification for procedures to monitor log-in attempts and report discrepancies.
Access granted through software permissions rather than physical entry. Logical access controls include authentication, authorization, session management, and logging.
A terminology assigning identifiers to laboratory tests, clinical observations, and related information. Consistent codes support interpretation across systems.
Documentation maintained by skilled nursing, assisted living, or long-term care providers. It is PHI when held by a covered provider.
A lost or stolen device holding ePHI is a security incident to respond to, mitigate, and document; if the data was unencrypted, breach notification analysis follows because the PHI was unsecured.
The documented response path for a missing device, implementing the security incident procedures standard and feeding the breach risk assessment when unsecured ePHI is involved.
Rules for receiving, sorting, scanning, and sending mail that may include PHI. Procedures reduce misrouting and unattended-document exposure.
Software, for example a virus, designed to damage or disrupt a system.
Malicious content or redirection delivered through online advertising. An apparently legitimate site may display the harmful advertisement.
Combines the awareness specification (procedures for guarding against, detecting, and reporting malicious software) with the security incident procedures standard (identify, respond, mitigate, document).
Also known as: Adversary-in-the-Middle (AiTM)
Intercepting or altering communications between parties who believe they are communicating directly. Correctly validated encryption helps prevent many such attacks.
A backup service operated by an internal IT team or vendor. If the service stores or can access ePHI backups, BAA and safeguard requirements apply.
A service combining security monitoring, investigation, and response assistance. Its scope and authority depend on the service agreement.
A platform-managed identity for a workload or service that reduces the need to store manually managed credentials. Permissions still require careful assignment.
Also known as: Managed Service Provider
An IT provider that creates, receives, maintains, or transmits ePHI for a covered entity is a business associate; maintaining or hosting ePHI alone triggers the definition, even without viewing it.
A controlled entry space with interlocked doors designed to restrict simultaneous passage and support access verification.
A temporary process used when normal systems are unavailable or not ready. Workarounds involving PHI should be approved, documented, and retired.
A communication about a product or service that encourages recipients to purchase or use it. Marketing does not include refill reminders (if any payment received is reasonably related to the cost of making the communication) or communications for treatment, care coordination, or to describe the entity's own health-related products and services, EXCEPT that those become marketing when the covered entity receives financial remuneration from a third party whose product is being promoted. Marketing communications require prior written authorization that discloses the remuneration.
Automatically mapping excessive client-supplied fields into internal objects, allowing changes to properties the user should not control.
Processes for maintaining consistent shared reference data across systems. In healthcare, this may involve provider, organization, or product records.
A system that links patient identities across records and facilities. MPI accuracy affects patient matching, privacy, and safe information exchange.
A business associate violation significant enough to trigger the covered entity's duty to take reasonable steps to cure or end it, and failing that, to terminate the contract if feasible.
The longest period an activity can remain unavailable before the resulting impact becomes unacceptable. It helps constrain recovery objectives.
The average measured interval between a defined event's occurrence and its detection. Comparisons require consistent start and end definitions.
The average measured time to reach a defined response milestone after detection or another stated starting point. MTTR can also mean repair or recovery, so the definition must be explicit.
Recording cryptographic measurements of boot components for later evaluation. Measurement alone does not necessarily block unauthorized execution.
The record showing media were disposed of and tracked: disposal procedures are required, and the addressable accountability specification calls for maintaining a record of the movements of hardware and electronic media and any person responsible.
The required specification for procedures to remove ePHI from electronic media before the media are made available for re-use.
A process making access to data on storage media infeasible at an appropriate level of effort. The method should fit the media and sensitivity, using suitable clearing, purging, or destruction procedures. See Disposal and Zeroization.
Protection of medical devices and their connected software or networks against unauthorized access, disruption, and manipulation. Device inventory, supported software, controlled access, and coordinated updates help protect safety and ePHI. See Internet of Medical Things (IoMT).
Hardware or software performing specified transfer, storage, conversion, or display functions for medical-device data. FDA classification depends on the actual intended functions.
Recognition under applicable law of a minor's authority over specified health care decisions. It can affect parental access and personal representative status.
Review of health care services for medical necessity, coverage, or justification of charges is named within the Privacy Rule's definition of payment.
Also known as: Medical Record Number
A safe harbor identifier category: medical record numbers must be removed for de-identification. Operationally, the MRN is the patient's unique identifier within a provider's systems.
Comparing medication information across sources and care transitions to identify and resolve discrepancies. The process relies on accurate and appropriately shared records.
Revealing whether an individual is included in a dataset, such as a disease-specific registry. Membership itself may expose sensitive information.
An attempt to determine whether a particular person's or record's data was used to train a model.
Unintended alteration of memory that can affect program behavior or security. Causes include unsafe access, bounds errors, and use of invalid memory.
A cryptographic value used to verify message integrity and authenticity. It can support trustworthy transmission of sensitive health data.
Disclosure of information in file names, headers, logs, or document properties. Metadata can reveal patient identity, diagnosis, location, or workflow details.
Repeated authentication prompts intended to wear down a user until they approve an attacker's login. Number matching and phishing-resistant methods address different parts of this risk.
Grouping similar records and replacing selected values with a group summary. It reduces individual detail while preserving some analytical usefulness.
Creating small security boundaries around workloads or services and controlling traffic between them. It limits unauthorized movement within a network.
A framing protocol commonly used to transport HL7 messages over a connection. MLLP alone does not encrypt the transmitted information.
A research-waiver criterion addressing protection and timely destruction of identifiers, plus assurances limiting further use or disclosure. It concerns privacy risk, not just clinical risk.
A reporting rule that suppresses small counts to reduce re-identification risk. It is often used in analytics, quality reporting, and public health datasets.
A privacy-rule concept involving Minimum Necessary Access Review. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A compliance oversight concept involving Minimum Necessary Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Minimum Necessary Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Minimum Necessary Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A privacy-rule concept involving Minimum Necessary Claims Transaction. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving Minimum Necessary Compliance Calendar. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Minimum Necessary Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Minimum Necessary Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Minimum Necessary Eligibility Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A technical safeguard or security operations concept involving Minimum Necessary Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A privacy-rule concept involving Minimum Necessary Evidence Packet. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving Minimum Necessary Exception Register. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A technical safeguard or security operations concept involving Minimum Necessary Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Minimum Necessary Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Minimum Necessary PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
The implementation specifications: for routine and recurring disclosures, standard protocols limiting PHI to the minimum necessary; for all other disclosures, criteria and individual review of each request.
An administrative safeguard concept involving Minimum Necessary Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Minimum Necessary Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Minimum Necessary Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Minimum Necessary Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Minimum Necessary Security Control. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
When using, disclosing, or requesting PHI, make reasonable efforts to limit it to the minimum necessary to accomplish the intended purpose. Does not apply to disclosures to or requests by a provider for treatment, disclosures to the individual, uses or disclosures under an authorization, disclosures to the Secretary, and uses or disclosures required by law.
An administrative safeguard concept involving Minimum Necessary System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Minimum Necessary Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Minimum Necessary User Provisioning. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A vendor and business associate oversight concept involving Minimum Necessary Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Minimum Necessary Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A description of how someone could abuse a system or cause an unwanted outcome. It complements descriptions of intended functionality.
A knowledge base organizing observed adversary tactics and techniques. It supports threat-informed testing and detection planning.
A knowledge graph of defensive techniques and their relationships to attack behavior and digital artifacts.
Software embedded in a mobile application to collect usage or diagnostic information. Its collection and sharing behavior may expose health data to third parties.
Also known as: Mobile Device Management
Technology used to enforce security settings on phones, tablets, and laptops. MDM can require encryption, passcodes, remote wipe, app controls, and separation of work data.
A DICOM workflow supplying imaging equipment with scheduled procedure and patient information. Incorrect worklist selection can associate images with the wrong patient.
A document describing a model's intended uses, evaluation, limitations, and other relevant characteristics. It supports informed deployment decisions.
A change in a model's behavior or performance over time, often because data or operating conditions change. Monitoring helps identify when reevaluation is needed.
A structured assessment of model performance, safety, or other properties for defined tasks and conditions. Results do not necessarily generalize beyond the tested setting.
An attack attempting to reconstruct information about training data or individuals from access to a model or its outputs.
A model retaining specific training examples closely enough that they may be reproduced or inferred. Memorization can create privacy risks for sensitive training data.
Manipulating a model or model updates to introduce malicious behavior or degrade performance, including during distributed training.
A template policy adapted to an organization's actual workflows. Model policies are useful only when customized, approved, trained, and followed.
Access control requiring two or more verification factors before granting access to ePHI. While HIPAA does not explicitly name MFA, the 2025 Security Rule NPRM proposes making it a required specification. Many practices already use MFA for EHR access.
A cloud environment where multiple customers share provider infrastructure. HIPAA use requires proper logical separation, safeguards, and a BAA when the provider handles ePHI.
TLS authentication in which both sides authenticate using certificates. Certificate issuance, validation, and lifecycle management remain important.
The adopted standard medical data code set for drugs and biologics in retail pharmacy transactions: National Drug Codes as maintained and distributed by HHS in collaboration with drug manufacturers.
The federal system used to assign and maintain National Provider Identifiers and associated provider information. NPI records should be kept current.
A proposed identifier for health plans that has not been implemented as a required standard. Organizations should avoid assuming an adopted plan identifier exists.
The standard unique health identifier for health care providers: a 10-position all-numeric identifier with a check digit and no embedded intelligence. Covered providers must obtain an NPI, disclose it on request, use it in standard transactions, and report changes within 30 days.
A committee maintaining standards for institutional claims, including the UB-04 form and related billing data definitions.
A committee maintaining the standard professional claim form and related guidance, including provider taxonomy resources.
The National Council for Prescription Drug Programs telecommunications standard version adopted for specified retail pharmacy transactions under HIPAA.
An event that could have caused a privacy or security incident but was caught before harm occurred. Tracking near misses improves training and controls.
The workforce minimum necessary specification: identify the persons or classes of persons who need access to PHI to carry out their duties, the categories of PHI needed, and appropriate conditions on that access.
Technology that decides whether devices may connect to a network. NAC can enforce posture checks before access to networks with ePHI systems.
Shared storage connected to a network. NAS devices containing PHI need access controls, encryption where appropriate, backups, and patching.
Monitoring network activity to identify suspicious behavior and support investigation or response. Encrypted traffic can limit direct content visibility.
A map of systems, segments, connections, and data flows. Current diagrams make risk analysis and incident response more accurate.
A safeguard that limits or monitors outbound traffic from systems and networks. Egress controls can reduce unauthorized PHI exports and improve breach detection.
A record of network traffic metadata between systems. Flow logs help investigate unusual transfers, lateral movement, and possible PHI exfiltration.
Dividing a network into zones to limit movement between systems. Segmentation can reduce the blast radius of malware and protect systems containing ePHI from unnecessary exposure.
A firewall combining traffic filtering with capabilities such as application awareness and intrusion prevention. Features and inspection limits vary by product.
The National Institute of Standards and Technology. Develops cybersecurity standards referenced by OCR. Key documents: NIST SP 800-66 (HIPAA Security Rule implementation), the Cybersecurity Framework, and NIST SP 800-53 (security controls). HHS has cited NIST guidance in multiple enforcement actions.
Documentation generated under the surprise billing rules (notice and consent records, good faith estimates, required disclosures) lives under 45 CFR Part 149.
Adding controlled random variation to data or results to reduce disclosure risk. Arbitrary noise does not automatically provide differential privacy.
A confidentiality contract. An NDA may protect business information, but it does not replace a BAA when a vendor handles PHI for a covered entity.
Assurance that a person cannot reasonably deny a transaction or action. Digital signatures, audit logs, and strong authentication support non-repudiation.
For disclosures not made on a routine and recurring basis, develop criteria designed to limit PHI to the minimum necessary and review each request individually against those criteria.
A test, staging, or development environment. Live PHI should be avoided there unless safeguards, approvals, and masking controls are in place.
The format in which records are provided to a requester. Patient access workflows should honor requested electronic form when readily producible.
A patient-rights concept involving Notice Access Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Audit Evidence. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Backup Test. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Claims Transaction. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Compliance Calendar. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Contingency Task. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
Breach notice methods: written notice by first-class mail to the last known address (or email if the individual agreed), substitute notice when contact information is insufficient, and urgent notice by telephone in addition to written notice when there is possible imminent misuse.
A patient-rights concept involving Notice Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Eligibility Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Encryption Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Evidence Packet. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Exception Register. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Incident Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
HHS's notice imposing a HIPAA civil monetary penalty when a timely hearing request is not made. It states the penalty and payment requirements.
Individuals have a right to adequate written notice of the entity's uses and disclosures of PHI, the individual's rights, and the entity's legal duties, with a required header, content elements, effective date, distribution rules, posting requirements, and website availability.
HHS's formal notice proposing a HIPAA civil monetary penalty. It states the basis and amount and explains how to request a hearing.
A patient-rights concept involving Notice Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice PHI Handling. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Policy Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Privacy Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Retention Check. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Risk Finding. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Security Control. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice System Inventory. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Training Record. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice User Provisioning. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Vendor Review. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A patient-rights concept involving Notice Workforce Attestation. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
Also known as: Notification to Individuals
Individual breach notice must describe, to the extent possible, what happened and when, the types of information involved, steps individuals should take, what the entity is doing to investigate and mitigate, and contact procedures. Written notice goes by first-class mail, or email if the individual agreed, without unreasonable delay and no later than 60 days after discovery.
A record of breach or incident notices sent to patients, HHS, media, business associates, or partners. It supports evidence of timely notification.
The National Provider System assigns a single, unique NPI to each provider (with subpart enumeration rules), collects and maintains provider information, deactivates NPIs when appropriate, reactivates on request, and never reassigns a deactivated NPI to another provider.
A provider with a direct treatment relationship must make a good faith effort to obtain the individual's written acknowledgment of receipt of the notice at first service delivery, and if not obtained, document the effort and why it failed.
Clinical and administrative documentation maintained by a nursing facility. These records are PHI when held by a covered provider or related business associate.
A framework for delegated authorization using access tokens. It lets an application request limited access to resources without receiving the user's password.
Tricking a user into granting an application's requested permissions. The attacker may obtain authorized-looking access without stealing the user's password.
A storage feature restricting deletion or modification of objects for a retention period or hold. Its guarantees depend on mode, configuration, and privileges.
A technical approach that applies access controls, labels, or encryption directly to files, records, or data objects. It can help protect PHI even when data moves across systems.
Cloud storage for files and unstructured data. Object buckets containing PHI need access policies, encryption, logging, and lifecycle controls.
The HHS division that enforces HIPAA. Investigates complaints, conducts compliance reviews, provides technical assistance, and imposes penalties. Most investigations begin with patient complaints or breach reports, not random audits.
An administrative safeguard concept involving OCR Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving OCR Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
HHS's published procedures and criteria for evaluating selected HIPAA requirements during audits. The protocol helps organizations understand evidence requests but does not replace the underlying regulations.
A patient-rights concept involving OCR Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving OCR Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving OCR Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving OCR Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving OCR Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving OCR Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving OCR Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving OCR Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving OCR Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving OCR PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving OCR Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving OCR Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving OCR Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving OCR User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving OCR Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving OCR Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A process for securing records, devices, mail, voicemail, and systems during temporary or permanent closure. It supports continuity and privacy protection.
A backup not continuously accessible from active systems or networks. Reconnecting it for updates or restoration requires care to avoid contamination.
A vendor that stores, processes, supports, or accesses PHI from outside the United States. Offshore arrangements require careful BAA terms, security review, and awareness of payer or state restrictions.
The 2013 final rule implementing HITECH Act provisions into HIPAA. Extended requirements directly to business associates, strengthened the breach notification standard (from "harm" to "probability of compromise"), and expanded patient rights. The reason BAs are directly subject to enforcement today.
Temporary or after-hours access needed for care, support, or incident response. On-call access should be role-limited and logged.
A protocol for obtaining the revocation status of a certificate. Response validation and availability influence its effectiveness.
A web form used to collect patient or billing information. Forms collecting PHI need secure transport, storage, access controls, and vendor review.
Privacy considerations when a healthcare organization responds to public reviews. A patient's public post does not itself authorize the organization to confirm treatment or disclose additional PHI; responses should avoid patient-specific disclosures without an applicable permission.
The Exchange enrollment provision: the initial open enrollment period and the annual open enrollment period during which qualified individuals may enroll in or change qualified health plans.
The common name for clinical note sharing driven by the information blocking rules: withholding electronic health information such as clinical notes can be information blocking under § 171.103 unless a regulatory exception applies.
An identity layer built on OAuth 2.0 that lets applications verify authentication and receive identity claims. Its ID tokens differ from access tokens.
An organization's ability to continue critical services during disruption. For healthcare, resilience connects contingency planning, backups, downtime procedures, and vendor readiness.
A day-to-day control that turns written policy into actual practice, such as access reviews, ticket approvals, log checks, badge procedures, or breach drills.
An affirmative permission model where a person actively agrees to a use or disclosure. HIPAA uses authorization for many non-TPO uses, while state law may impose opt-in rules.
A patient's choice to decline certain communications or directory listings when permitted. Preferences should be documented and honored across relevant workflows.
A maintained record of individuals who have declined a specified activity or information-sharing arrangement. The effect of an opt-out depends on the governing rules.
Technology that converts scanned images into searchable text. OCR output can create new PHI repositories when medical records, IDs, or billing documents are indexed.
A system used to enter medications, labs, imaging, or service orders. Because it creates and transmits PHI, access, integrity, and audit controls matter.
The relative speed at which different digital evidence sources may change or disappear. It guides collection priorities during an investigation.
An organization involved in obtaining and coordinating organs for transplantation. HIPAA permits specified disclosures for organ, eye, or tissue donation and transplantation.
A clinically integrated care setting in which individuals typically receive health care from more than one provider; an organized system of health care in which participating covered entities hold themselves out to the public as joint participants and engage in joint utilization review, quality assessment, or shared financial risk; or specified arrangements between group health plans and health insurance issuers or HMOs. OHCA members may share PHI for the arrangement's operations and may use a joint notice of privacy practices.
Confirming identity or request details through a separate communication channel. It reduces risk for password resets, portal invites, and sensitive disclosures.
The mandatory restriction: when the individual or someone on their behalf (other than the plan) has paid for the item or service in full, the entity must honor a request not to disclose it to the health plan for payment or operations, unless disclosure is required by law.
Steps for operating through a system outage, implementing the emergency mode operation specification for protection of ePHI during the event.
A control or process for checking messages before they leave the organization. It can catch misaddressed emails or attachments containing PHI.
Transforming data for safe inclusion in a particular output context, such as HTML. The correct encoding depends on that context.
A third party billing for a provider handles PHI for a covered function and is a business associate; billing is named in the definition.
Coding vendors receive PHI to assign billing codes on the provider's behalf, a business associate function requiring a BAA.
A risk, audit, or incident action that missed its due date. Tracking overdue items helps leadership prioritize unresolved HIPAA exposure.
A record incorrectly containing information from more than one patient. An overlay can cause clinical errors and inappropriate disclosure.
A record of when a user bypasses a normal restriction or alert. Override logs should be reviewed for appropriateness and potential privacy concerns.
Sorting out HIPAA? A free 30-minute review maps your gaps.
Book your free 30-minute intro callA database query separating executable query structure from supplied data values. It is a primary defense against SQL injection.
A parent's or guardian's agreement to a child's participation in research under applicable research rules. It differs from the child's assent and HIPAA authorization.
A program meeting the definition in 42 CFR Part 2, including qualifying providers that hold themselves out as providing substance use disorder diagnosis, treatment, or referral. Federal assistance affects Part 2 applicability.
Using a captured password hash directly to authenticate in systems that support the relevant protocol behavior, without recovering the plaintext password.
Using a stolen authentication ticket, commonly a Kerberos ticket, to access systems as the associated identity.
A public-key credential used to authenticate to a particular service, often unlocked with a device PIN or biometric check. Passkeys may be device-bound or synchronized.
A tool commonly used to satisfy the addressable password management specification: procedures for creating, changing, and safeguarding passwords.
Trying a few common passwords across many accounts, often to avoid per-account lockout thresholds. Monitoring must look across accounts as well as individual failures.
Authentication that does not rely on a user entering a reusable password. Security depends on the authenticator, recovery process, and resistance to phishing.
Identifying, testing, and applying software updates to fix known vulnerabilities. The Security Rule's requirement to protect against reasonably anticipated threats encompasses keeping systems updated. Unpatched software is a leading entry point for ransomware in healthcare. OCR has cited failure to patch in multiple enforcement actions.
Manipulating a file path to access locations outside an intended directory. Validating and constraining resolved paths helps prevent it.
Patient app access to records rides on the standardized API for patient and population services certification criterion; CMS program rules (Title 42) require payers to expose Patient Access APIs built on the same standards.
The good faith estimate requirement: providers and facilities must give uninsured or self-pay individuals an estimate of expected charges for scheduled items and services, within the section's timeframes and content requirements.
Determining which records or identifiers refer to the same patient. It combines matching rules, evidence, and handling of uncertain results.
The process of linking records to the correct individual. Matching errors can cause wrong-record access, disclosure, or clinical safety problems.
A secure online system that lets patients view records, send messages, request appointments, or pay bills. Portal access requires identity proofing, authentication, audit logging, and appropriate privacy controls.
Combining records determined to belong to the same patient. The process should preserve history and support correction of mistaken merges.
Separating records that were incorrectly merged. Correction requires careful attribution of clinical content and identifiers.
A federal law establishing protections for qualifying patient safety work product. Its confidentiality rules operate alongside HIPAA rather than replacing HIPAA obligations.
The processes through which a provider collects, manages, or analyzes information for reporting to a PSO. Designation alone does not protect otherwise excluded records.
An entity listed under the federal patient safety framework to collect and analyze patient safety information. HIPAA and patient safety confidentiality rules may both apply.
Information qualifying for protection under the patient safety statute and regulations. Ordinary medical records and information required for external reporting are not automatically PSWP.
Health-related information created or recorded by patients or others outside traditional clinical encounters, such as home measurements or symptom reports.
Information about health status reported directly by a patient without interpretation by a clinician or other observer.
Activities of a health plan to obtain premiums or determine or fulfill its coverage and benefit responsibilities, and activities of a provider or plan to obtain or provide reimbursement for health care. Includes eligibility and coverage determinations, adjudication or subrogation of claims, risk adjusting, billing, claims management, collection activities, medical necessity and justification-of-charges review, utilization review (precertification, preauthorization, concurrent and retrospective review), and limited disclosures to consumer reporting agencies.
The named HIPAA transaction pairing payment (EFT) with the explanation of payment (X12N 835 remittance advice).
Matching a health care payment with its related remittance advice. Matching identifiers help reconcile the financial transfer and payment explanation.
Also known as: Penetration Testing
Not required by HIPAA. Testing results serve as evidence for the required risk analysis and the periodic technical evaluation standard.
Permissions accumulating as a user's roles change without removal of obsolete access. Regular review can identify excess privileges.
The required standard to implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.
A person with authority under applicable law to act on behalf of an individual in making health care decisions, or for a decedent's estate, must be treated as the individual for Privacy Rule purposes, subject to the abuse, neglect, and endangerment exception at § 164.502(g)(5).
Changing data through controlled transformations to reduce disclosure risk. Methods must be evaluated for privacy protection and analytical distortion.
A privacy-rule concept involving PHI Access Review. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A compliance oversight concept involving PHI Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving PHI Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving PHI Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A privacy-rule concept involving PHI Claims Transaction. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving PHI Compliance Calendar. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving PHI Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving PHI Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving PHI Eligibility Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A technical safeguard or security operations concept involving PHI Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A privacy-rule concept involving PHI Evidence Packet. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A privacy-rule concept involving PHI Exception Register. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A technical safeguard or security operations concept involving PHI Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving PHI Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving PHI Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving PHI Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving PHI Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving PHI Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving PHI Security Control. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving PHI System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving PHI Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving PHI User Provisioning. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A vendor and business associate oversight concept involving PHI Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving PHI Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Not named in the regulation. Phishing defenses fall under the security awareness and training standard, including the specification for guarding against, detecting, and reporting malicious software.
Multi-factor authentication designed to prevent a fake website from successfully relaying or stealing usable authentication credentials. Cryptographic binding to the legitimate service is central.
Physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.
A system for storing, retrieving, displaying, and distributing medical images. Image files and their metadata may contain PHI.
A code indicating the setting where a healthcare service was furnished. Accurate setting information affects claim processing.
A tracked plan describing security weaknesses, planned corrective actions, responsible parties, and completion milestones.
Defined as at section 3(16)(B) of ERISA: the employer, for a plan established by a single employer; the employee organization, for a plan maintained by one; or the association, committee, joint board of trustees, or similar group, for a multi-employer plan.
Restoring data to a selected earlier state using backups, snapshots, or transaction history. It helps recover from unwanted changes or corruption.
Both rules require implementing reasonable and appropriate written policies and procedures to comply with their standards, maintained in accordance with the documentation requirements and changed as needed.
A combination of attributes belonging to only one person in the relevant population. It differs from uniqueness within a smaller sample.
A message inviting a patient to create portal access. It should verify destination details and avoid exposing more PHI than necessary.
An authentication factor based on something the user has, such as a hardware key, authenticator app, smart card, or security token. It is commonly paired with a password for MFA.
A study designed to evaluate interventions under conditions close to routine practice. Practical study design does not remove consent or privacy requirements.
Coverage limitations based on a health condition that existed before enrollment. HIPAA historically limited these exclusions; the Affordable Care Act generally prohibits them in group health plans and individual health insurance, with limited exceptions such as grandfathered individual coverage.
HIPAA standards preempt contrary state law, with exceptions: Secretary-granted exception determinations, state laws more stringent than the federal standard, public health reporting laws, and certain health plan reporting and audit laws. More stringent state privacy protections survive.
The health plan premium payments transaction, conducted with the adopted ASC X12N 820 standard.
A safeguard intended to stop an unwanted event before it occurs, such as access restrictions or safe input handling.
A review body that may approve a HIPAA research authorization waiver or alteration. Its membership and procedures must satisfy the Privacy Rule's conditions.
Parameters controlling permitted privacy loss in a differential privacy process. Repeated analyses can consume or compose that budget.
Configuring a system's initial settings to limit unnecessary data collection, access, or sharing. Defaults should reflect the actual processing purpose.
Integrating privacy considerations into a system's architecture and lifecycle from the beginning, rather than adding protections only after deployment.
The roles, policies, decision processes, and oversight used to manage how an organization handles personal information.
An assessment of how a system or activity handles personal information and affects individuals' privacy. It identifies risks and planned safeguards.
A measure of how much an observation can distinguish neighboring datasets in differential privacy. It is not the same as a count of exposed records.
A covered entity must designate, and document, a privacy official responsible for developing and implementing its privacy policies and procedures, plus a contact person or office for complaints and further information.
The privacy standards for individually identifiable health information: permitted and required uses and disclosures, authorization requirements, individual rights (notice, access, amendment, accounting, restrictions), and administrative requirements.
A display filter that limits viewing from side angles. It can reduce casual observation but does not replace appropriate workstation placement and access controls.
Systematically examining how a system could cause privacy harm, including misuse, unexpected inference, and inappropriate information flows.
Technology designed to reduce privacy risks during data processing or sharing. PETs do not replace legal permissions or governance.
A cryptographic technique for finding common elements between parties' sets while limiting disclosure of other elements.
Obtaining permissions beyond those originally granted. It may involve exploiting a vulnerability, misconfiguration, or excessive administrative access.
Controls for high-power accounts and administrative sessions, such as credential vaulting, approval, time-limited access, and session recording.
Matching records using weighted evidence or likelihood estimates rather than requiring every identifying field to agree exactly.
Procedures are reported with the adopted code sets: CPT-4 and HCPCS for physician and other health care services, ICD-10-PCS for inpatient hospital procedures, and CDT for dental services.
An exception allowing a covered entity to provide an individual with a promotional gift of nominal value without obtaining a HIPAA marketing authorization.
Instructions placed in input that attempt to redirect an AI system away from its intended task or controls. Untrusted documents and tool outputs can carry injections.
The storage and retention of inputs submitted to an AI service. Retention settings and contract terms affect ongoing exposure of sensitive information.
An OAuth extension using a verifier and challenge to reduce misuse of intercepted authorization codes. It supplements the authorization-code flow.
A demonstration showing that a vulnerability can be exploited. A demonstration does not necessarily represent the full practical attack capability.
Also known as: PHI
Individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by FERPA, the student treatment records described at 20 U.S.C. 1232g(a)(4)(B)(iv), employment records held by a covered entity in its role as employer, and records of a person who has been deceased for more than 50 years.
A remittance adjustment applied at the provider level rather than to a particular claim or service line.
Replacing identifying values with codes or alternative labels while retaining a way to reconnect them. Pseudonymized health data may still be PHI.
Notes recorded in any medium by a mental health professional documenting or analyzing the contents of conversation during a private, group, joint, or family counseling session, that are separated from the rest of the individual's medical record. Excludes medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.
Permitted disclosures without authorization to public health authorities for preventing or controlling disease, injury, or disability, including reporting disease, births and deaths, child abuse or neglect, FDA-regulated product safety, communicable disease exposure, and workplace medical surveillance in stated circumstances.
A formally declared emergency under applicable public health authority. The declaration's legal effects depend on the statute and any accompanying waivers.
The systems, policies, and roles used to issue, manage, validate, and revoke public-key certificates.
Breaking paper down into pulp to destroy recorded information. Appropriate processing can support secure disposal of paper records.
A collaborative approach in which offensive and defensive teams work together to improve detection and protection through shared findings.
Restricting personal-data use to specified, legitimate purposes. HIPAA permissions and other applicable laws determine which purposes are allowed.
Stating why personal information will be collected or used. Clear purposes support proportionate collection and appropriate access decisions.
Authentication approval requested through a notification on a registered device. Repeated unsolicited prompts can be a sign of an attack.
The technical specifications supporting exchange between QHINs under TEFCA. It defines applicable exchange mechanisms and technical requirements.
An administrative safeguard concept involving Qualified Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Qualified Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Qualified Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Qualified Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Qualified Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Qualified Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Qualified Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Qualified Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Qualified Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A network designated to connect with other QHINs under TEFCA's requirements. Participants exchange information through those network arrangements.
A health plan that has in effect a certification that it meets the standards of Part 156 Subpart C, issued or recognized by each Exchange through which the plan is offered.
A technical safeguard or security operations concept involving Qualified Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A person with appropriate role, authority, or expertise for a specific compliance task. Documentation should show why the individual was assigned.
A patient-rights concept involving Qualified Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Qualified PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Qualified Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Qualified Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A court or tribunal order, or a stipulation, that prohibits the parties from using or disclosing the PHI for any purpose other than the litigation and requires return or destruction of the PHI, including copies, at the end of the proceeding.
An administrative safeguard concept involving Qualified Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A professional role used in some security assessment programs. It is not a HIPAA-defined certification, but assessor evidence may support broader vendor or control review.
An administrative safeguard concept involving Qualified Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Part 2's analog to a business associate agreement: the agreement by which a service organization receiving Part 2 records acknowledges it is bound by the Part 2 rules and will resist unauthorized efforts to obtain the records.
An administrative safeguard concept involving Qualified System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Qualified User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Qualified Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Qualified Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An activity evaluating whether services or processes meet established standards. Certain healthcare quality activities fall within HIPAA health care operations.
Quality assessment activities are health care operations by definition, permitting use of PHI without authorization under § 164.506.
A limited record sample used to test process accuracy. Samples containing PHI should be minimized, protected, and destroyed when no longer needed.
Quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, are the first-listed health care operations.
An organized effort to improve care processes or outcomes. Whether an activity is health care operations or research depends on its actual purpose and design.
A metric used to assess care, outcomes, safety, or performance. Measures may rely on PHI and should follow minimum necessary and reporting rules.
Submitting care quality or performance data to a payer, registry, or government program. Reports should use minimum necessary data and appropriate agreements.
A controlled location where suspicious files, messages, or records are isolated for review. If PHI is present, access and retention still need safeguards.
A scheduled review of user permissions. It helps detect excessive access, stale accounts, role drift, and termination failures before they create incidents.
A recurring review of training, incidents, risks, policies, BAAs, and evidence. It keeps HIPAA work from becoming a once-a-year scramble.
A recurring patch process for lower-risk updates. Critical vulnerabilities affecting ePHI systems may need faster handling outside the routine cycle.
A recurring review of business associates and key vendors. It checks BAA status, incidents, security evidence, subcontractors, and service changes.
A search or lookup of patient information in an EHR, HIE, or other system. Queries should be tied to a permitted purpose and captured in audit logs.
A health information exchange model where one system searches another for patient records. Access should be tied to identity, purpose, consent rules, and audit logs.
A disclosure that must be reviewed because its authority, recipient, or minimum necessary scope is unclear. It should be paused or escalated before release when possible.
A completed form from a patient, workforce member, or vendor. Responses may contain PHI, compliance evidence, or security information requiring protection.
The workflow for routing access requests, amendment requests, incidents, claims, or privacy tasks to the right owner. Good queue management helps meet HIPAA deadlines and documentation expectations.
Reviewing work queues for stuck claims, referrals, faxes, portal messages, or incidents. Queues containing PHI need timely handling and access limits.
An electronic transaction waiting to be processed or transmitted. Queues containing PHI need access controls, retention rules, monitoring, and error handling.
A lawsuit brought by a private person on behalf of the government under a law such as the False Claims Act. Health information involved remains subject to applicable protections.
A short incident procedure for urgent privacy or security events. It should identify first actions, escalation contacts, evidence preservation, and breach review triggers.
Phishing using a QR code to direct someone to deceptive content. The encoded destination may be difficult to inspect before opening.
The minimum attendance needed for governance decisions to be valid. Defining quorum helps document oversight and accountability for privacy and security decisions.
Controls that limit storage, message, or export volume. Quotas can reduce accidental bulk exposure of PHI and support monitoring for abnormal activity.
A weakness caused by operations occurring in an unexpected timing or order. Concurrent requests may bypass checks or corrupt state.
A system managing radiology workflows, such as scheduling, examination tracking, and reporting. It commonly connects with imaging and clinical-record systems.
A survey or data-collection method using randomization so an individual's response is less directly revealing while aggregate estimates remain possible.
A ransomware encryption of ePHI is a security incident by definition (unauthorized access and interference with system operations), and under OCR guidance it is presumptively a breach of unsecured PHI unless the four-factor assessment demonstrates a low probability of compromise.
An act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the entity did not act with willful neglect.
The business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.
Matching an EFT payment to its corresponding 835 remittance advice by trace number, governed by the Phase III CORE 370 Reassociation Rule adopted as an operating rule.
An identifier used to connect a payment with its corresponding remittance information. It supports automated healthcare payment reconciliation.
The organization responsible for specified coordination, implementation, and oversight functions under TEFCA. It administers the Common Agreement framework.
A 2021 HITECH amendment requiring OCR to consider whether an entity had recognized security practices in place for the prior 12 months when determining fines. Includes NIST Cybersecurity Framework compliance and Section 405(d) of the Cybersecurity Act of 2015. Provides tangible incentive to adopt industry-standard security frameworks.
A service identifying where records about a patient may be available. It helps route discovery or retrieval requests across organizations.
Required documentation must be retained for six years from the date of its creation or the date when it last was in effect, whichever is later. This is a documentation retention rule; HIPAA does not set medical record retention periods, which are state law.
Withholding entire records from a data release to reduce disclosure risk. Suppression can affect completeness and analysis quality.
A backup secret used to regain access when a normal authenticator is unavailable. Recovery codes should be securely stored and retired after use.
A system, service, credential, or resource that another activity needs to recover. Dependencies influence restoration order.
The targeted point in time to which data must be recoverable after disruption. It expresses the tolerable loss of recent data.
The targeted maximum time to restore a service after disruption. It guides recovery planning and capability choices.
A group conducting authorized adversarial testing of an organization's defenses. The engagement's scope and rules define permitted activity.
The referral certification and authorization transaction, conducted with the adopted ASC X12N 278 standard.
A credential used to obtain new access tokens without repeating the original interactive authorization. Its longevity makes secure storage and revocation important.
The documented plan for reducing identified risks; it implements the required risk management specification, which calls for measures sufficient to bring risk to a reasonable and appropriate level.
A code supplying additional explanation about a claim adjustment or remittance processing. It often complements a CARC.
Access to systems from outside the organization's controlled network. Remote access to ePHI should use MFA, encryption, device controls, logging, and clear workforce rules.
Malware providing an attacker with remote control of a compromised device. Capabilities may include surveillance, file access, and command execution.
Providing verifiable evidence about a remote system's hardware or software state. The verifier must evaluate the evidence against trusted expectations.
Execution of attacker-controlled code on another system. Vulnerable software or unsafe input processing may provide the entry point.
A weakness allowing an application to include content from an attacker-controlled remote location, potentially leading to code execution.
Collecting and reviewing patient measurements outside a traditional care setting through connected tools or devices. Data flows may involve several service providers.
A control that deletes managed data from a lost, stolen, or retired device. Remote wipe supports mobile and BYOD protection for ePHI.
A mandate contained in law that compels a use or disclosure of PHI and is enforceable in a court of law. Includes court orders and court-ordered warrants; subpoenas or summonses issued by a court, grand jury, inspector general, or authorized administrative body; civil or authorized investigative demands; Medicare conditions of participation; and statutes or regulations requiring production of information, including when payment is sought under a government benefit program.
A specification the regulation marks as required must be implemented as written. No assessment, alternative measure, or documentation substitute applies.
A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.
A controlled environment in which approved researchers analyze restricted data. Access restrictions and review of exported results help limit disclosure.
The written plan describing a research study's objectives, methods, participants, and procedures. Its information needs help define appropriate PHI access and permissions.
Finding and inviting potential study participants. Accessing or disclosing PHI for recruitment requires an applicable HIPAA permission or authorization pathway.
A collection of data or specimens maintained for research use. Identifiable health information may remain subject to HIPAA and applicable research protections.
A formal settlement between OCR and an entity resolving a compliance investigation. Typically includes a monetary payment and a corrective action plan. Published on the HHS website as enforcement precedent.
No intimidation, threats, coercion, discrimination, or other retaliatory action against individuals for exercising Privacy Rule rights, filing a complaint, participating in an investigation or hearing, or opposing an unlawful act or practice in good faith.
Manipulating material available to a retrieval system so an AI system uses misleading or malicious content in its responses.
An AI approach that retrieves external information to help generate an answer. Access permissions must apply to retrieval as well as the generated response.
A code identifying a category of services or charges on an institutional claim. It helps describe how facility charges are grouped.
Also known as: Reviewable Grounds for Denial of Access
A denial of an individual's PHI access based on specified harm-related grounds that carries a right to independent review by a licensed health care professional.
Access to PHI to prepare a research protocol or assess feasibility. The researcher must provide required representations, including that PHI will not be removed from the covered entity.
The individual's right to inspect and obtain a copy of PHI in a designated record set, excluding psychotherapy notes and litigation-prepared information; in the form and format requested if readily producible; within 30 days with one 30-day extension; for a reasonable, cost-based fee. The entity must also transmit copies to a third party the individual clearly designates in a signed writing.
An OCR enforcement initiative focused on individuals' timely, appropriately priced access to health records under HIPAA. It addresses failures to honor the Right of Access.
The individual's right to have a covered entity amend PHI in a designated record set. The entity acts within 60 days (one 30-day extension) and either makes the amendment and notifies relevant parties, or issues a written denial explaining the basis and the individual's rights.
A contractual right to examine specified controls, records, or practices. Scope, access limits, and usable evidence determine its practical value.
Also known as: Request for Restriction
Individuals may request restrictions on uses and disclosures for treatment, payment, operations, and to persons involved in care. The entity need not agree, except it MUST agree when the disclosure would go to a health plan for payment or operations and the item or service was paid out of pocket in full.
Not separately defined in the regulation. The Security Rule operationalizes risk through the required risk analysis and risk management specifications: assess threats and vulnerabilities to ePHI, then reduce them to a reasonable and appropriate level.
A documented decision that a residual risk is at a reasonable and appropriate level, made using the flexibility factors: size, complexity, and capabilities; technical infrastructure; costs; and probability and criticality of the risks.
An administrative safeguard concept involving Risk Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The required specification to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the entity.
The broad amount and types of risk an organization is willing to pursue or retain in achieving its objectives.
A compliance oversight concept involving Risk Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Risk Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Risk Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Risk Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Risk Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Risk Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Risk Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Risk Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Risk Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
The required specification to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).
A patient-rights concept involving Risk Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Risk PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The working inventory of identified risks and their treatment. Not named in the rule, but the standard way entities document that risk management decisions were made and tracked.
An administrative safeguard concept involving Risk Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The amount or range of risk an organization is willing to accept for a particular activity. It guides decisions about controls and escalation.
An administrative safeguard concept involving Risk Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Risk User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Risk Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Risk Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Adapting authentication requirements using signals about the login's risk, such as device history, location, or unusual behavior.
Reviewing and modifying a user's right of access when duties change implements the addressable access establishment and modification specification.
Analyzing existing permissions and usage to identify useful access roles. Inherited excessive access should not simply be copied into the new roles.
A common method of satisfying information access management: access rights granted by job role, consistent with documented policies for authorizing access to ePHI.
An investigation of underlying causes of a failure or incident. Useful findings distinguish causes from symptoms and support corrective action.
Software designed to conceal unauthorized access or activity, often by modifying low-level operating-system behavior.
Monitoring or enforcing security rules while software executes. It can detect or block behavior that static review did not reveal.
A National Library of Medicine terminology providing normalized names and identifiers for clinical drugs and links to related drug vocabularies.
Also known as: Safe Harbor De-identification; The 18 Identifiers
Remove 18 categories of identifiers of the individual and of the individual's relatives, employers, and household members, and have no actual knowledge that the remaining information could be used alone or in combination to identify the individual.
The 18 categories cover names; location details below the state level, subject to the three-digit ZIP exception; individual-related dates other than year and ages over 89, subject to the age-90-or-older exception; telephone and fax numbers; email addresses; Social Security numbers; medical record numbers; health-plan beneficiary numbers; account numbers; certificate or license numbers; vehicle identifiers; device identifiers; web URLs; IP addresses; biometric identifiers; full-face and comparable photographs; and other unique identifying numbers, characteristics, or codes, subject to the permitted re-identification-code exception.
The Privacy Rule requires appropriate administrative, technical, and physical safeguards to protect PHI from impermissible use or disclosure; the Security Rule's general rules require protecting the confidentiality, integrity, and availability of all ePHI against reasonably anticipated threats and impermissible uses.
A covered entity or business associate may not receive direct or indirect remuneration in exchange for PHI, except under an authorization stating that remuneration will result, or within listed exceptions including public health, research (cost-based), treatment and payment, sale of the business, business associate services, individual access fees, and disclosures required by law.
A cookie setting controlling whether the browser sends it with certain cross-site requests. It helps limit some CSRF risks.
Sanctions applied to workforce members must be documented, and the documentation retained under § 164.530(j).
Both rules require appropriate sanctions against workforce members who fail to comply with the entity's security or privacy policies and procedures.
A judicial authorization for a specified search or seizure. HIPAA permits certain disclosures in compliance with a warrant, subject to the applicable legal conditions.
Research using information or specimens originally collected for another purpose. Permissions depend on identifiability, applicable research rules, and HIPAA status.
Processes and tools for protecting passwords, keys, tokens, and other secrets throughout creation, storage, distribution, rotation, and retirement.
Searching code, repositories, files, or other content for exposed credentials and secrets. Discovered secrets may require revocation, not just deletion.
An emergency authority allowing specified federal healthcare requirements to be waived or modified when statutory conditions are met. Any HIPAA relief is limited in scope and duration.
Also known as: ACA Nondiscrimination
The Affordable Care Act provision prohibiting specified discrimination in covered health programs and activities. It relates to HIPAA practice through accessible services, communications, and careful handling of sensitive patient information; it is a separate civil-rights law.
An architectural approach combining wide-area networking and cloud-delivered security functions. Product scope and controls vary.
A boot process that verifies authorized software before execution. It helps prevent unauthorized boot components from taking control of a device.
A cookie carrying the Secure attribute, which limits transmission to secure connections. The attribute does not itself protect against all script access.
Encrypted file transfer implements the transmission security standard: guarding against unauthorized access to ePHI moving over an electronic communications network.
Encrypted messaging platforms implement the transmission security standard when ePHI moves between parties over a network.
Cryptographic methods allowing parties to compute a joint result while limiting disclosure of their inputs. Protection depends on protocol assumptions and implementation.
Holding a print job until an authorized user releases it at the printer. This reduces sensitive documents left in output trays.
A development process integrating security into design, implementation, testing, release, and maintenance. Security checks occur throughout the lifecycle.
A service controlling users' access to web resources through filtering, inspection, and policy enforcement.
Security or security measures encompass all of the administrative, physical, and technical safeguards in an information system.
An administrative safeguard concept involving Security Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An XML-based standard for exchanging authentication and authorization assertions, commonly used for enterprise federation and single sign-on.
A compliance oversight concept involving Security Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Security Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
The required standard to implement a security awareness and training program for all members of the workforce, including management. Its addressable specifications cover security reminders, protection from malicious software, log-in monitoring, and password management.
A technical safeguard or security operations concept involving Security Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An approved set of minimum security settings or controls for a system or environment. Exceptions and changes should be assessed and documented.
An administrative safeguard concept involving Security Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Security Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Security Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Security Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Security Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An approved deviation from a security requirement. Exceptions should be time-limited, risk-rated, and tied to compensating safeguards.
An administrative safeguard concept involving Security Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations, in an information system.
A technical safeguard or security operations concept involving Security Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A platform that collects and analyzes security logs from multiple systems. Correlation and alerting help identify activity that individual logs may not reveal.
Metadata describing security or handling requirements for information. Applications must interpret and enforce labels for them to provide protection.
The required standard to implement policies and procedures to prevent, detect, contain, and correct security violations. Its four implementation specifications are risk analysis, risk management, sanction policy, and information system activity review.
The security official every covered entity and business associate must identify as responsible for developing and implementing security policies and procedures. In small practices this is often the same person as the Privacy Officer.
Tools that coordinate security workflows and automate response steps across systems. Automated actions need appropriate permissions, validation, and oversight.
A patient-rights concept involving Security Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Security PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Security Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Security Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
A vendor or customer questionnaire used to evaluate safeguards, policies, incident response, and compliance posture. It supports due diligence but should be validated against evidence where possible.
An administrative safeguard concept involving Security Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The security standards for the protection of electronic protected health information: general rules, administrative safeguards, physical safeguards, technical safeguards, organizational requirements, and documentation requirements, applying to covered entities and business associates.
A collection of cloud-delivered security capabilities for access to web, cloud, and private applications. It is the security-focused portion of SASE.
An administrative safeguard concept involving Security System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Security User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Security Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Security Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Also known as: Separation of Duties
A control that separates responsibilities so one person cannot perform conflicting high-risk actions unchecked. It can reduce fraud, misuse, and admin abuse.
Removing specified organizational data or managed applications from a device while retaining other content. Its coverage and reliability depend on the management platform.
A diagnosis that may carry additional stigma or legal protection. Access and disclosure should account for minimum necessary and any stricter state or federal rules.
An attack causing a server to make unintended requests to attacker-chosen destinations, potentially reaching internal services or sensitive metadata.
A contract provision defining performance expectations such as uptime, response time, backup recovery, or incident notice. SLAs for PHI vendors should align with contingency and breach response needs.
An identity representing an application or service within an identity system. Its permissions can expose resources even when no human user is logged in.
Taking control of an authenticated session, often through a stolen session token or cookie. The attacker may bypass the need to log in again.
Technology that records or reconstructs a user's interactions with an application. Captured screens, text, and events may reveal PHI.
Invalidating an existing authenticated session or its credentials. Disabling an account alone may not immediately end every active session.
AI tools used without an organization's authorization or oversight. Unmanaged use can expose PHI and bypass approved contracts or access controls.
A model dividing security and compliance duties between an organization and its vendor, especially in cloud services. The customer remains responsible for its own configuration, access decisions, and policies.
An allocation of security duties between a provider and customer. Responsibilities differ by service and must be understood beyond marketing descriptions.
Remaining in a designated protected location during an emergency rather than evacuating. Appropriate action depends on the hazard and emergency plan.
Physically cutting records or media into pieces using an appropriate process. For PHI, the resulting material must be sufficiently protected against reconstruction or recovery. See Disposal.
A portable format for describing log-based security detection logic. Rules require conversion, data mapping, and testing in the target environment.
Patient arrival records that may be used with reasonable safeguards and appropriately limited information. Avoid displaying unnecessary medical details, such as the reason for a visit. See Incidental Use and Disclosure.
Fraudulently transferring a telephone number to an attacker-controlled SIM or account. It can redirect calls, messages, and SMS authentication codes.
An arrangement allowing one authenticated session to access multiple applications. Its convenience makes secure authentication, session controls, and timely account revocation especially important.
Distinguishing one individual's record or behavior from others, even without knowing the person's name. It is one way data releases can threaten privacy.
A low count in a statistical group that may make individuals easier to identify or infer information about. No universal HIPAA minimum cell size applies.
A health plan with annual receipts of $5 million or less under HIPAA's definition. The term was used in setting certain compliance dates.
A specification for launching and authorizing applications in a FHIR-based environment, including standalone and EHR-associated workflows.
A specification for authorizing backend applications to access FHIR services without an interactive user login, using registered credentials and defined scopes.
An approach combining FHIR with standardized application authorization and launch workflows. Applications still need appropriate permissions and protection of patient data.
Phishing delivered through SMS or other text messages. Messages may lure recipients to fake login pages or malicious downloads.
An assurance report addressing service-organization controls relevant to user entities' internal control over financial reporting. It is not a general HIPAA assessment.
An independent report on a service organization's controls. SOC 2 can support vendor due diligence, but it is not a HIPAA certification and does not replace a BAA.
A general-use assurance report concerning selected Trust Services Criteria. It provides less detailed information than a SOC 2 report.
Manipulating people into revealing information or performing unsafe actions. Common methods include impersonation, urgency, intimidation, and deceptive requests.
HIPAA does not specifically address social media, but the rules apply regardless of platform. Posting patient photos, sharing treatment details, or discussing identifiable patients on social media is a PHI disclosure requiring authorization. Even well-intentioned posts can violate HIPAA.
An inventory of software components and their relationships within a product. It helps identify affected dependencies when vulnerabilities are discovered.
Identifying third-party software components and evaluating issues such as known vulnerabilities or licensing obligations.
An architecture controlling visibility and access to services through identity and policy decisions rather than relying only on network location.
A phishing attempt tailored to a particular person or organization. Specific names, roles, or business details make the message more convincing.
A group of HIPAA disclosure permissions for specified military, national security, protective-service, correctional, and government-benefit activities. Each permission has its own conditions; a government request alone is not blanket authority to disclose PHI.
Manipulating an application's database queries through unsafe handling of input. Parameterized queries help prevent input from being treated as executable SQL.
A rule, condition, or requirement describing products, systems, services, or practices: classification of components, specification of materials, performance, or operations, or delineation of procedures; or, with respect to the privacy of health information, a rule, condition, or requirement of Subpart E.
A transaction that complies with an adopted HIPAA standard. A covered entity conducting a covered transaction with another covered entity using electronic media must conduct it as a standard transaction.
An organization that develops and maintains technical standards through a defined process. Publication of a standard does not automatically mean HIPAA has adopted it.
Also known as: Physician Self-Referral Law
The federal physician self-referral law generally prohibiting referrals for designated health services payable by Medicare to an entity with a prohibited financial relationship, unless an exception applies. It addresses referral and payment conduct, while HIPAA governs associated health-information handling.
Under the HITECH Act, state AGs can bring civil actions in federal court on behalf of residents affected by HIPAA violations. Provides an independent enforcement mechanism beyond OCR. Several state AGs have brought actions after large breaches.
An ISO/IEC 27001 document identifying relevant controls, their inclusion or exclusion rationale, and implementation status within the management-system scope.
Examining source code or compiled code for security weaknesses without running the application. Findings require interpretation and validation.
Methods that reduce the chance that released data reveal individuals or confidential attributes. Examples include suppression, generalization, and carefully designed noise.
Requiring stronger or additional authentication before a sensitive action or when risk increases during a session.
A threat-modeling framework covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
A language and data model for representing and sharing cyber threat intelligence in a structured form.
A person to whom a business associate delegates a function, activity, or service, other than as a member of the business associate's workforce. A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate.
Taking control of a subdomain because its DNS points to an abandoned or claimable external resource.
A subpoena requiring production of documents or other material. Receiving it does not automatically authorize disclosure of every requested health record.
A supplier engaged by another data processor to handle personal data. In HIPAA relationships, the actual activities determine whether a subcontractor business associate exists.
Records of federally assisted substance use disorder treatment programs carry protections beyond HIPAA: patient consent requirements for disclosure, limits on redisclosure, and restrictions on use in proceedings against the patient. Within Title 45, such records held by covered entities remain PHI as well.
Separately maintained notes by a Part 2 program provider who is a SUD or mental health professional documenting or analyzing counseling conversations. Routine clinical summaries and specified treatment information are excluded; Part 2 gives qualifying notes special consent protections.
Group-plan information summarizing claims history, expenses, or types of claims, with specified identifiers removed but five-digit ZIP codes allowed. HIPAA permits limited disclosures to plan sponsors for obtaining premium bids or modifying, amending, or terminating the plan; it is not the same as fully de-identified data.
An attack delivered through a trusted supplier, software component, update, or service relationship. The supplier becomes a route into downstream organizations.
An arrangement in which a person receives assistance while retaining decision-making authority. A supporter does not automatically gain full access to the person's health records.
Artificially generated records intended to reproduce useful characteristics of real data. Synthetic data can still reveal sensitive information if generation or validation is inadequate.
A standard for provisioning and managing identity records across systems. SCIM can automate account creation, updates, group membership, and deactivation.
Exposure of an AI system's internal instructions through responses, logs, or other behavior. Leaked text may reveal sensitive operational information.
A structured clinical terminology representing concepts and their relationships. It supports consistent recording and exchange of clinical meaning.
A privacy property limiting how much a group's sensitive-value distribution differs from the overall dataset's distribution. It is not a HIPAA de-identification certification.
An X12 acknowledgment reporting acceptance or rejection of an interchange envelope. It addresses envelope-level processing rather than final claim adjudication.
A discussion-based walkthrough used to satisfy the addressable testing and revision specification: periodic testing and revision of contingency plans.
Entering a controlled area by following an authorized person without obtaining independent authorization. Visitor and door procedures help reduce the risk.
A seal designed to reveal attempted opening or interference. It provides evidence of tampering rather than preventing every attempt.
A code identifying a health care provider's classification or specialization. A taxonomy code describes provider type rather than uniquely identifying the provider.
The Secretary may provide technical assistance to covered entities and business associates to help them comply voluntarily with the administrative simplification provisions.
The technology and the policy and procedures for its use that protect electronic protected health information and control access to it.
Also known as: Telemedicine
Delivering healthcare services through electronic communications. HIPAA applies the same way as in-person care. ePHI must be protected during transmission and storage. Telehealth platforms must be HIPAA-compliant and covered by a BAA.
Software used to provide remote care. If it creates, receives, maintains, or transmits PHI for a covered provider, HIPAA safeguards and often a BAA are required.
Separation between customers sharing a service or infrastructure. Isolation must prevent unauthorized access across tenant boundaries.
Also known as: Business Associate Contract Termination Provisions
A covered entity that knows of a pattern of activity or practice of its business associate in material breach must take reasonable steps to cure or end the violation, and if unsuccessful, terminate the contract if feasible. The BAA itself must authorize termination for violation of a material term.
At termination, the contract must require return or destruction of retained PHI if feasible. If that is infeasible, its protections continue and further uses and disclosures are limited to the purposes making return or destruction infeasible. See 45 CFR § 164.504(e)(2)(ii)(J).
Also known as: Termination Procedures; Offboarding
The operational artifact implementing the addressable termination procedures specification: terminating access to ePHI when employment or another workforce arrangement ends.
Connecting codes or concepts between terminology systems. Incorrect mappings can change clinical meaning or create inaccurate records.
A TPA processing or administering claims for a health plan is a business associate; claims processing or administration is the first activity listed in the business associate definition.
Identifying reasonably anticipated threats is a component of the required risk analysis of risks and vulnerabilities to ePHI.
A proactive search for malicious activity that existing alerts may have missed. Hunters use hypotheses, system evidence, and knowledge of attacker behavior.
Information about threats, adversaries, techniques, and indicators that supports security decisions. Useful intelligence includes context and relevance to the environment.
Systematically identifying threats, attack paths, and needed safeguards for a system or process. Modeling is most useful when tied to specific design decisions.
Selecting and evaluating defenses using knowledge of relevant adversary behavior. It connects security priorities to plausible attack paths.
A support system used to track requests and incidents. If tickets include PHI, the system needs access controls, retention rules, and user guidance.
Keeping system clocks aligned to a trusted time source. Consistent timestamps help reconstruct access, changes, and incident timelines.
A temporary code calculated from a shared secret and time interval. An attacker may still capture and relay it through phishing.
A race in which a condition changes after it is checked but before the protected operation uses it.
Cryptographically associating a token with a particular client or key to reduce misuse if the token is stolen.
A protocol allowing a protected service to ask an authorization server about a token's status and associated metadata.
Invalidating a token through the authorization system. Immediate effects depend on token type, caching, and how resource servers validate tokens.
A controlled store that maps tokens back to sensitive values. A token vault protecting PHI-derived values needs strong access control and monitoring.
Replacing sensitive values with tokens that have no useful meaning outside a controlled system. Tokenization may reduce exposure but does not automatically remove HIPAA obligations if re-identification remains possible.
Malicious instructions embedded in a tool's returned content to influence an AI system's later decisions or actions.
Replacing values above a threshold with a capped value or category. It reduces exposure of unusual high values while limiting detail.
A covered entity may use or disclose PHI for its own treatment, payment, or health care operations without individual authorization, and for another entity's in stated circumstances. The three terms are defined at § 164.501.
An X12 Type 3 Technical Report describing how to implement a transaction for a specific business purpose.
The adopted CAQH CORE operating rules include the Phase III CORE 370 EFT and ERA Reassociation Rule, which uses the trace number to let providers match the EFT payment to its 835 remittance advice.
A labeling system communicating permitted sharing boundaries for information. Labels should be applied and interpreted using the applicable TLP specification.
The Privacy Rule requires training the workforce on privacy policies as necessary for their functions and documenting it; the Security Rule requires a security awareness and training program for the entire workforce including management.
An administrative safeguard concept involving Training Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The documentation that required training was provided, retained in written or electronic form under § 164.530(j).
A compliance oversight concept involving Training Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Training Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Training Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Training Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Obtaining actual or closely reproduced training content through a model's behavior. Sensitive training information may be exposed.
A patient-rights concept involving Training Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Training Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Training Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Training Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A documented reason a workforce member missed, delayed, or received alternate training. Exceptions should be tracked until resolved.
An administrative safeguard concept involving Training Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Training Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Training Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Training PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Training User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Training Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Training Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The transmission of information between two parties to carry out financial or administrative activities related to health care, including health care claims or equivalent encounter information, payment and remittance advice, coordination of benefits, claim status, enrollment and disenrollment, eligibility, premium payments, referral certification and authorization, first report of injury, health claims attachments, EFT and remittance advice, and other transactions the Secretary may prescribe.
A defined collection of EDI segments representing a business transaction, such as a claim or eligibility inquiry.
An identifier assigned to a transaction set for tracking and matching acknowledgments within an EDI exchange.
The adopted format specification for each named transaction; covered entities conducting those transactions electronically must use the adopted standard.
The HIPAA regulations establishing standards for specified electronic administrative transactions and associated code sets. These requirements support consistent exchange between covered entities. See Electronic Data Interchange (EDI) and Administrative Simplification.
A record of messages or files sent between systems. Logs help prove when PHI was sent, where it went, and whether delivery failed.
The required standard to implement technical security measures to guard against unauthorized access to ePHI being transmitted over an electronic communications network.
TLS is a standard technology used to meet the transmission security standard and its encryption specification for ePHI in transit.
The provision, coordination, or management of health care and related services by one or more health care providers, including coordination or management with a third party, consultation between providers relating to a patient, and referral of a patient from one provider to another.
The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment.
The Privacy Rule distinguishes direct treatment relationships, where the provider delivers care and results to the individual, from indirect ones, where care is based on another provider's orders and results flow through that provider.
A result correctly identifying that the tested condition is absent. It should be evaluated within the limits of the test.
A result correctly identifying that the tested condition is present. Confirmation depends on the defined condition and supporting evidence.
AICPA criteria used to evaluate controls concerning security, availability, processing integrity, confidentiality, and privacy, as applicable to the engagement.
A protocol supporting exchange of cyber threat intelligence over HTTPS. It is commonly used to transport STIX information.
A person the individual identifies for involvement in care or notification; disclosures to them are limited to PHI directly relevant to that involvement, with the individual given the opportunity to agree or object when practicable.
A national framework and common agreement supporting trusted health information exchange through participating networks. Participation does not remove HIPAA obligations.
An isolated execution environment designed to protect code and data from certain surrounding software. Its protections depend on hardware and threat assumptions.
A hardware or firmware security component providing functions such as protected key storage and platform measurements.
Also known as: Type 1 Report
An assurance report addressing control design at a specified date. It does not evaluate operating effectiveness across a period in the same way as Type II.
Also known as: Type 2 Report
An assurance report addressing control design and operating effectiveness over a specified period. Scope, exceptions, and complementary controls matter when evaluating it.
Registering names similar to legitimate domains or packages to exploit typing errors or confusion.
Sorting out HIPAA? A free 30-minute review maps your gaps.
Book your free 30-minute intro callA standard paper institutional claim form, also called CMS-1450. Its electronic counterpart is associated with the X12 837I implementation.
Software used without review or approval. If it stores or transmits PHI, it can create shadow IT risk and missing BAA exposure.
Within the definition of security incident: the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.
A disruption that prevents access to ePHI or critical systems. It should trigger downtime procedures, contingency plan review, and possible incident documentation.
A research authorization that is optional for receiving the associated research-related treatment. When combined with a conditioned authorization, participation in the optional activity requires a clear opt-in opportunity.
Also known as: Substitute Notice
When contact information is insufficient or out of date: for fewer than 10 unreachable individuals, an alternative written, phone, or other means; for 10 or more, a conspicuous 90-day website posting or major print or broadcast media notice, plus a toll-free number active for at least 90 days.
A device holding ePHI not encrypted per the HHS guidance holds unsecured PHI; its loss or theft is presumptively a breach unless the four-factor assessment shows a low probability of compromise.
A centralized log source that combines events across systems. It helps investigations by connecting identity, device, application, and data-access activity.
A platform for managing laptops, phones, tablets, and other endpoints. UEM can enforce encryption, patches, passcodes, and remote wipe.
A National Library of Medicine collection of resources linking biomedical vocabularies and concepts. It supports terminology mapping and information retrieval.
An administrative safeguard concept involving Unique Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Unique Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Unique Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Unique Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Unique Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Device identifiers and serial numbers are a listed safe harbor category to remove. (UDI is also an FDA labeling term; the HIPAA hook is the identifier list.)
A patient-rights concept involving Unique Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Unique Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Unique Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Unique Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The adopted HIPAA identifiers: the NPI for health care providers and the EIN for employers. No standard unique patient identifier has ever been adopted.
A technical safeguard or security operations concept involving Unique Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Unique Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Unique PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Unique Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Unique Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Unique Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Unique Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A check that each workforce member has an individual account instead of shared credentials. Unique IDs support accountability and audit controls.
The required specification to assign a unique name or number for identifying and tracking user identity.
An administrative safeguard concept involving Unique User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Unique Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Unique Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A record having a combination of attributes not shared by other records in a defined dataset. Uniqueness can increase identification risk.
A standardized set of health-data classes and elements supporting interoperable exchange. It identifies data expectations rather than replacing privacy rules.
A recipient whose identity or authority has not been verified. PHI should not be disclosed until the recipient and purpose are confirmed.
Also known as: Unreviewable Grounds for Denial of Access
A denial on grounds for which HIPAA does not require independent review, such as excluded psychotherapy notes or certain confidentiality protections. A written denial still explains applicable rights.
Protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through a technology or methodology specified by the Secretary in guidance. Under that guidance, PHI is secured only by encryption meeting the guidance or by destruction; anything else that is lost or impermissibly disclosed triggers breach analysis.
Information that does not live in a neatly defined database field, such as PDFs, scanned records, emails, images, notes, and attachments. Unstructured PHI is often missed in risk analysis.
A folder, shared drive, inbox, or archive containing PHI outside core clinical systems. These repositories are often missed in access reviews and retention plans.
Software no longer receiving security updates. Unsupported systems that handle ePHI create risk and usually require upgrade, isolation, or documented compensating controls.
Billing for a higher-level service than was actually provided. It is primarily a fraud and billing compliance issue, but related records and investigations may involve PHI.
Documentation created during urgent care visits. It is PHI when held by a covered provider and should flow into access, amendment, billing, and retention workflows.
An HL7 FHIR implementation guide specifying profiles and exchange expectations for common United States healthcare data.
A risk created when confusing workflows cause privacy or security mistakes. Poorly designed systems can lead to wrong-patient disclosure, misrouting, or improper access.
Policies and technical settings that restrict or monitor USB devices. Controls can reduce unauthorized data transfers and malicious device use.
With respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of the information WITHIN the entity that maintains it. Movement outside the entity is a disclosure.
Testing performed before a system goes live. For ePHI systems, testing should avoid live PHI unless safeguards and approvals are in place.
Analyzing activity patterns of users and other entities to identify unusual behavior. An anomaly requires context before it is treated as malicious.
Security monitoring that detects unusual access patterns. It can help identify snooping, compromised accounts, or abnormal ePHI exports.
Removing access for departing or role-changed users; the addressable specification requires procedures for terminating access to ePHI when the employment or other arrangement ends.
Granting and documenting access implements the addressable access authorization and access establishment and modification specifications: policies for granting access to ePHI and for establishing, documenting, reviewing, and modifying a user's right of access.
Named within the definition of payment: utilization review activities, including precertification and preauthorization of services, and concurrent and retrospective review.
A covered entity may disclose proof of immunization to a school required by law to have it, with the agreement of a parent, guardian, or other person in loco parentis, or of the individual if an adult or emancipated minor. The agreement may be oral but must be documented.
Core elements: a specific and meaningful description of the information; the persons authorized to make the disclosure; the recipients; the purpose; an expiration date or event; and the individual's signature and date. Required statements cover the right to revoke, treatment or payment conditioning rules, and redisclosure risk. It must be in plain language, and the individual gets a copy.
A rule that checks transaction, form, or data quality before processing. Validation reduces rejected claims, data errors, and misrouted PHI.
A National Library of Medicine service for managing and distributing value sets used in clinical quality measures and other healthcare applications.
Payment and delivery models that reward quality, outcomes, or efficiency. Data sharing for these programs often involves PHI and healthcare operations.
A report documenting an exception from expected policy, process, or security behavior. Variance tracking supports investigation and corrective action.
A password, key, token, or certificate stored in a controlled secrets vault. Vaulting reduces exposure of credentials that protect ePHI systems.
A database designed to store and search vector representations of information. Stored vectors and associated metadata can carry sensitive information.
HIPAA has no vendor category. A vendor that creates, receives, maintains, or transmits PHI for a covered entity is a business associate; one that never touches PHI is outside the rule.
A review of third-party accounts, portals, integrations, and support access. It helps confirm vendors still need access and that access matches the BAA and contract.
A vendor and business associate oversight concept involving Vendor Audit Evidence. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Vendor Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Vendor Backup Test. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
Also known as: Business Associate Breach Notification
A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days from discovery, identifying to the extent possible each individual affected and providing information the covered entity needs for its own notices.
A vendor and business associate oversight concept involving Vendor Claims Transaction. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Compliance Calendar. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A maintained list of vendor security, privacy, legal, and support contacts. Current contacts matter during incidents and BAA reviews.
A vendor and business associate oversight concept involving Vendor Contingency Task. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A patient-rights concept involving Vendor Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
Vetting behind the required satisfactory assurances that a vendor receiving PHI will appropriately safeguard it; the assurances themselves must be documented in the BAA.
A vendor and business associate oversight concept involving Vendor Eligibility Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Encryption Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A set of documents supporting vendor security and compliance review, such as policies, reports, diagrams, attestations, and incident history.
A vendor and business associate oversight concept involving Vendor Evidence Packet. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Exception Register. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A plan for ending a vendor relationship while protecting PHI. It should cover data return, deletion, transition support, access shutdown, and evidence.
A vendor and business associate oversight concept involving Vendor Incident Log. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
The regulatory core of vendor management: a covered entity may disclose PHI to a business associate only with satisfactory assurances, documented in a BAA, that the vendor will appropriately safeguard the information.
The program wrapper around the BAA requirements: identify vendors handling PHI, obtain satisfactory assurances in a compliant BAA, and act on known violations.
A vendor and business associate oversight concept involving Vendor Monitoring Rule. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An archive designed to store imaging information in formats usable across different vendor systems. Interoperability does not remove security and retention responsibilities.
A patient-rights concept involving Vendor Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A vendor and business associate oversight concept involving Vendor PHI Handling. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Policy Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Privacy Workflow. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Retention Check. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A review of a vendor's access to PHI, security controls, subcontractors, breach history, and contractual obligations. It helps determine whether a BAA and additional safeguards are required.
A vendor and business associate oversight concept involving Vendor Risk Finding. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Security Control. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor System Inventory. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Training Record. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor User Provisioning. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
A vendor and business associate oversight concept involving Vendor Workforce Attestation. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
Health information is defined to include information that is oral, not just recorded. Speaking PHI to an unauthorized listener is a disclosure exactly as handing over a document would be.
A process for managing changes to policies, procedures, forms, and technical configurations. Version control helps prove which document was in effect at a given time.
Responsibility for another person's acts. HIPAA can attribute violations by an agent acting within the scope of agency to the covered entity or business associate under federal common-law agency principles.
A recording of a telehealth encounter. If retained, it is PHI and needs consent review, access controls, retention rules, and secure storage.
A remotely delivered desktop environment. Virtual desktops accessing ePHI still need authentication, logging, clipboard controls, and endpoint safeguards.
A VPN tunnel is a common technical measure satisfying the transmission security standard for ePHI crossing open networks.
A telehealth or scheduling feature that queues patients before a visit. It should limit exposure of names, visit reasons, and other PHI to unauthorized users.
Phishing or social deception conducted through voice calls. Attackers may impersonate support staff, officials, colleagues, or patients.
Rules for leaving messages that may include patient information. Policies should define what can be said, when authorization is needed, and how preferences are honored.
Capturing information from system memory for investigation. Memory may contain processes, connections, credentials, and other short-lived evidence.
The Secretary will, to the extent practicable and consistent with the enforcement provisions, seek the cooperation of covered entities and business associates in obtaining compliance.
A policy explaining how researchers can report vulnerabilities and what testing is authorized. Clear scope and response expectations support responsible reporting.
A sequence of exploited weaknesses whose combined effect produces access or impact not available from one weakness alone.
An ongoing process for finding, assessing, prioritizing, and addressing weaknesses. It includes validation and tracking, not just running scans.
Not named in the rule; automated scanning is a standard input to the required risk analysis, which must identify technical vulnerabilities affecting ePHI.
Permission from an IRB or Privacy Board to omit or change research authorization requirements when specified privacy and practicability criteria are met.
Breaches affecting 500 or more individuals must be reported to the Secretary contemporaneously with individual notice, and HITECH requires HHS to post them publicly. Breaches under 500 are logged and reported within 60 days after the end of the calendar year.
An alternate facility with some equipment and capabilities prepared for recovery, but requiring additional activation or restoration before full operation.
Compromising a site or service frequently used by a target group to reach that group's members.
Information from watches, sensors, or trackers. It may become PHI when collected or maintained by a covered entity or business associate for care or payment.
A control that filters or monitors web-application traffic for suspected attacks. It supplements secure application design rather than replacing it.
A web standard allowing applications to register and use public-key credentials through authenticators. Credentials are bound to a relying party.
An online system where patients, staff, or partners access information. Portals handling PHI need authentication, session controls, encryption, logging, and support procedures.
A malicious script or program providing remote control through a compromised web server. It can support persistent access and data theft.
An automated message sent from one system to another when an event occurs. Webhooks carrying PHI require secure transport, authentication, logging, and recipient controls.
A small tracking technology embedded in a webpage. On healthcare sites, pixels can create privacy risk if they transmit visit or patient-context data.
A recurring confirmation that backups completed and failures were resolved. Backup checks support contingency planning and reduce recovery surprises.
A covered entity is not in violation when a workforce member or business associate, in good faith believing the entity engaged in unlawful conduct or care that endangers patients, discloses PHI to a health oversight agency, public health authority, accreditation organization, or an attorney retained to evaluate the whistleblower's options.
A guided implementation process for a practice, vendor, or client. For HIPAA, onboarding should include PHI flow mapping, access roles, BAAs, training, and evidence setup.
A domain approved for communication, integration, or file exchange. Whitelisting should be paired with verification and ongoing vendor review.
Conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated. Willful neglect triggers the highest penalty tiers and mandatory investigation.
Monitoring that detects unauthorized or suspicious wireless activity. It can help protect networks supporting ePHI systems.
A review of how information moves through a business process. Workflow audits can reveal unnecessary PHI exposure, missing safeguards, and inefficient handoffs.
Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the entity's direct control, whether or not they are paid by it.
An administrative safeguard concept involving Workforce Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Workforce Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Workforce Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Workforce Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Workforce Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The addressable specification to implement procedures to determine that a workforce member's access to ePHI is appropriate.
An administrative safeguard concept involving Workforce Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A limited HIPAA allowance for a workforce member who is a crime victim to disclose specified information about the suspected perpetrator to law enforcement.
A patient-rights concept involving Workforce Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Workforce Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Workforce Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Workforce Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Workforce Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
Any person within the workforce definition: employees, volunteers, trainees, and others under the entity's direct control in the performance of work, paid or unpaid.
An administrative safeguard concept involving Workforce Monitoring Rule. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Workforce Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Workforce PHI Handling. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Privacy Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
Train all workforce members on privacy policies and procedures as necessary and appropriate for their functions: each new member within a reasonable period, and retraining after material changes. The Security Rule separately requires a security awareness and training program. Training must be documented.
The record proving who was trained and when; the rule requires documenting that training has been provided.
An administrative safeguard concept involving Workforce Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Workforce User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A vendor and business associate oversight concept involving Workforce Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
Access granted to a shared group rather than an individual. Workgroup permissions should be reviewed so membership changes do not silently expand PHI access.
An identity assigned to software or a computing workload for authentication and authorization. Examples include services, containers, and automated jobs.
A list of desktops, laptops, tablets, and shared terminals that access ePHI. Inventory supports patching, encryption, location tracking, and disposal controls.
The required standard to implement physical safeguards for all workstations that access ePHI, restricting access to authorized users.
The required standard for policies and procedures specifying the proper functions to be performed, the manner of performance, and the physical attributes of the surroundings of workstations that access ePHI.
The written policy implementing the workstation use standard: what workstations that access ePHI may be used for, how, and in what physical surroundings.
A tool designed to prevent changes to storage media during evidence access or acquisition. Its proper operation should be verified.
A storage approach allowing data to be written and then read without ordinary modification. Implementation and retention controls determine protection against deletion.
The signed receipt of the Notice of Privacy Practices a direct treatment provider must make a good faith effort to obtain at first service delivery, or document the attempt.
Sending PHI to the wrong person is an impermissible disclosure, presumed to be a breach unless the four-factor assessment demonstrates a low probability that the PHI has been compromised.
A documentation, access, or disclosure error involving the wrong individual. It can create patient safety risk and may require privacy incident review.
A digital certificate used to support identity verification and encrypted communication. Certificates can help secure APIs, portals, VPNs, and other systems that transmit ePHI.
The ASC X12 standards and Technical Reports Type 3 adopted for HIPAA transactions are incorporated by reference at § 162.920, which lists each adopted X12 implementation specification.
The adopted standard for the eligibility for a health plan inquiry: ASC X12N 270, with NCPDP standards for retail pharmacy.
The adopted standard for the eligibility for a health plan response: ASC X12N 271.
The adopted standard for the health care claim status request: ASC X12N 276.
The adopted standard for the health care claim status response: ASC X12N 277.
An X12 implementation used to acknowledge claim acceptance or rejection during front-end processing. It differs from the 277 claim-status response.
The adopted standard for the referral certification and authorization transaction: ASC X12N 278, with NCPDP standards for retail pharmacy.
The adopted standard for the health plan premium payments transaction: ASC X12N 820.
The adopted standard for enrollment and disenrollment in a health plan: ASC X12N 834.
The adopted standard for the health care payment and remittance advice transaction: ASC X12N 835.
The adopted standard for the health care claims or equivalent encounter information transaction: the ASC X12N 837 professional, institutional, and dental implementations, plus the NCPDP standards for retail pharmacy drug claims.
An X12 implementation for dental health care claims. It carries information specific to dental billing workflows.
An X12 implementation for institutional health care claims. It is commonly associated with hospital and facility billing.
An X12 implementation for professional health care claims. It differs from the institutional and dental claim implementations.
A standard acknowledgment used to report whether a transaction file was received and syntactically accepted. It supports transaction troubleshooting.
A healthcare transaction standard term related to X12 Access Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Audit Evidence. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Authorization Workflow. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Backup Test. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Claims Transaction. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
Companion guides operate under trading partner agreements, which may not change a data element or segment definition, condition, or use, add elements or segments, use unadopted codes, or change the meaning or intent of the adopted implementation specification.
A healthcare transaction standard term related to X12 Compliance Calendar. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Contingency Task. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Disclosure Log. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Eligibility Workflow. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Encryption Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Evidence Packet. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Exception Register. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Incident Log. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Patient Request. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 PHI Handling. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Policy Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Privacy Workflow. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Retention Check. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Risk Finding. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Security Control. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 System Inventory. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A party exchanging standard transactions under a trading partner agreement (defined at § 160.103 as an agreement related to the exchange of information in electronic transactions); § 162.915 limits what such agreements may modify.
A healthcare transaction standard term related to X12 Training Record. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 User Provisioning. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Vendor Review. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
A healthcare transaction standard term related to X12 Workforce Attestation. In a HIPAA program, it helps teams understand how eligibility, claims, remittance, enrollment, or payment data moves between covered entities, clearinghouses, and payers.
The insurance subcommittee of ASC X12 whose Technical Reports Type 3 (TR3s) define most adopted HIPAA transaction standards, incorporated by reference at § 162.920.
An access-control policy language used to express authorization rules. It can support fine-grained decisions for systems that manage sensitive health data.
A health information exchange profile for moving clinical documents using physical or electronic media. When documents identify patients, HIPAA safeguards still apply.
Security technology that correlates alerts across endpoints, networks, email, cloud, and identity systems. XDR can improve detection and response for threats to ePHI.
The process of reviewing correlated security alerts from an XDR platform. Triage should determine scope, affected systems, PHI exposure, and escalation needs.
A documented response workflow for alerts from extended detection and response tools. Playbooks should include PHI exposure checks and escalation criteria.
A health information exchange profile for sharing clinical documents across organizations. Access controls, audit trails, and permitted-purpose rules remain important when PHI is exchanged.
A web-compatible document format sometimes used in clinical exchange contexts. If it identifies a patient, it should be treated as PHI.
A standard for encrypting XML content. It can protect structured healthcare payloads, but key management and transport security remain necessary.
Structured data encoded in XML for exchange between systems. XML payloads containing PHI require the same access, transmission, logging, and retention safeguards as other ePHI.
Checking an XML payload against an expected schema. Validation helps reject malformed healthcare data before it disrupts workflows or exposes information.
A structured configuration format often used for infrastructure and applications. YAML files should not store PHI or secrets unless protected by strong controls.
A malware detection rule used by security teams. YARA can support detection of threats targeting systems that process or store ePHI.
A scheduled removal of stale users, excessive roles, and abandoned groups. Cleanup supports least privilege before the next compliance cycle.
An administrative safeguard concept involving Year-End Access Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A compliance oversight concept involving Year-End Audit Evidence. It helps organizations prepare for complaints, audits, investigations, corrective action, and documentation requests.
A patient-rights concept involving Year-End Authorization Workflow. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A technical safeguard or security operations concept involving Year-End Backup Test. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Year-End Claims Transaction. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Compliance Calendar. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Contingency Task. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A patient-rights concept involving Year-End Disclosure Log. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
An administrative safeguard concept involving Year-End Eligibility Workflow. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Year-End Encryption Review. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
An administrative safeguard concept involving Year-End Evidence Packet. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Exception Register. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A technical safeguard or security operations concept involving Year-End Incident Log. It helps protect ePHI through controlled access, monitoring, encryption, logging, or system configuration.
A patient-rights concept involving Year-End Patient Request. It helps covered entities handle individual requests, disclosures, notices, or corrections consistently while protecting PHI.
A privacy-rule concept involving Year-End PHI Handling. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Year-End Policy Review. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A privacy-rule concept involving Year-End Privacy Workflow. It helps teams decide when PHI may be used, disclosed, limited, corrected, retained, or shared.
An administrative safeguard concept involving Year-End Retention Check. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Risk Finding. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A scheduled review of risk analysis results, unresolved remediation items, incidents, vendor changes, and policy updates before the next compliance cycle.
An administrative safeguard concept involving Year-End Security Control. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End System Inventory. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End Training Record. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
An administrative safeguard concept involving Year-End User Provisioning. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
A documented request for key vendors to confirm controls, incidents, subcontractors, and contact details. It supports ongoing business associate oversight.
A vendor and business associate oversight concept involving Year-End Vendor Review. It helps covered entities track third-party responsibilities, contract expectations, PHI handling, and follow-up evidence.
An administrative safeguard concept involving Year-End Workforce Attestation. It helps healthcare organizations document policies, workforce responsibilities, risk decisions, and compliance evidence.
The amount of deductible a member has accumulated during the plan year. It appears in eligibility and benefits workflows and is PHI when tied to a person.
A scheduled review of business associate agreements and vendor relationships. It helps catch missing contracts, outdated contacts, and changed PHI workflows.
The rule sets no annual cycle; it requires security measures to be reviewed and modified as needed to continue reasonable and appropriate protection, and periodic evaluation against the standards.
The risk analysis requirement itself states no frequency; HHS guidance treats it as an ongoing process, and annual refresh is common practice rather than regulatory text.
A schedule for required and role-specific privacy or security training. It should account for new hires, annual refreshers, and policy changes.
An internal status for elevated concern that does not yet meet incident severity. Defined alert levels help workforce members escalate privacy or security issues consistently.
Operational management of appointment capacity. Scheduling data can reveal care relationships and should be handled as PHI when linked to patients.
Access temporarily delegated or transferred to another authorized person, such as coverage during leave. It should be documented and removed when the need ends.
A limit on access to a minor's records based on consent rules, safety concerns, or law. Restrictions should be configured consistently across portals and workflows.
Mental or behavioral health documentation involving a minor. Access and disclosure may be affected by minor consent, state law, and safety concerns.
A visit where a minor may have confidentiality rights under state law. Records and portal access should reflect the applicable privacy rule.
When state or other law lets a minor consent to their own care, the parent is not automatically the personal representative for that care; state law controls parental access, and where state law is silent, the provider has documented discretion.
Health records involving minors. HIPAA usually treats a parent or guardian as the personal representative, but exceptions can apply for minor consent, abuse, or state law.
Proof of immunization may go to a school legally required to have it with a documented agreement from a parent, guardian, person acting in loco parentis, or the emancipated or adult individual.
Patient portal access for minors and guardians. It needs careful configuration because adolescent consent, proxy access, and state law can conflict.
Parental access can be limited when the minor lawfully consented to the care, when confidentiality was agreed, or when the provider reasonably believes the personal representative situation involves abuse, neglect, or endangerment.
Portal proxy access for parents tracks personal representative status: full access while the parent is the minor's personal representative, restricted for minor-consented services where state law limits parental access.
Separating sensitive minor records or data elements so access can be managed correctly. Segmentation helps avoid inappropriate proxy disclosure.
An authorization involving a minor's records. Validity depends on who may sign under HIPAA, state law, and the service involved.
A hardware security key commonly used as a possession factor for MFA. Hardware keys can reduce phishing risk for systems that access ePHI.
A statistical signal that a value is unusual compared with a population. In healthcare analytics, small or unusual groups may increase re-identification risk.
A privileged access model where elevated rights are not continuously assigned. Users request time-limited privilege when needed, reducing account compromise risk.
A security operations term for Zero Trust Access Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security model that continuously verifies users, devices, access, and context rather than assuming internal network traffic is trusted. It can support least privilege and stronger ePHI protection.
A security operations term for Zero Trust Audit Evidence. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Authorization Workflow. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Backup Test. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Claims Transaction. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Compliance Calendar. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Contingency Task. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Disclosure Log. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Eligibility Workflow. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Encryption Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Evidence Packet. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Exception Register. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Incident Log. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Patient Request. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust PHI Handling. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A component that evaluates identity, device, context, and policy before granting access. It supports finer control than broad network trust.
A security operations term for Zero Trust Policy Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Privacy Workflow. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Retention Check. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Risk Finding. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Security Control. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A segmentation approach that limits access between users, workloads, and applications based on identity and context. It reduces lateral movement toward ePHI systems.
A security operations term for Zero Trust System Inventory. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Training Record. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust User Provisioning. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Vendor Review. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A security operations term for Zero Trust Workforce Attestation. It supports HIPAA safeguards by reducing implicit trust, limiting access to ePHI, and documenting how systems are protected and reviewed.
A notice about a newly discovered vulnerability without a complete fix. Advisories should trigger risk review for affected ePHI systems.
A plan for responding when a critical vulnerability has no patch. It should define monitoring, isolation, compensating controls, vendor contact, and leadership escalation.
A software flaw unknown to the vendor or without an available patch. Organizations should use layered safeguards, monitoring, and incident response to reduce exposure.
A starting access model where users receive no permissions until a role-based need is approved. It supports least privilege for ePHI systems.
Automated device setup that applies security settings before first use. It can help enforce encryption, passcodes, and managed apps on devices accessing ePHI.
Securely erasing keys or sensitive data from memory or storage. Zeroization supports disposal, media reuse, and incident containment.
A malicious compressed file that expands massively when opened. Email and upload workflows should scan archives before they reach systems handling PHI.
Safe harbor requires removing all geographic subdivisions smaller than a state, except the initial three digits of a ZIP code when the three-digit area contains more than 20,000 people; for areas of 20,000 or fewer, the three digits become 000.
Rules for creating, sending, receiving, scanning, and extracting compressed files. ZIP archives containing PHI need encryption, recipient verification, and malware controls.
A compressed package of records produced for transfer or release. Exports containing PHI should be encrypted, verified, and tracked.
Also known as: Vacated Account
A forgotten active account belonging to a departed user; evidence the termination procedures specification is not operating.
A vendor account that outlived the vendor relationship. Termination procedures and the BAA obligation to return or destroy PHI at contract termination both point at closing it.
Containing an incident within a defined network or application zone. It helps preserve critical clinical functions and limit ePHI exposure.
Restoring systems by network, application, or business zone after an incident. Zonal recovery can prioritize critical care and ePHI access functions.
Separating systems into controlled zones so a compromise in one area does not automatically expose ePHI elsewhere.
A DNS operation that can expose domain records if misconfigured. Attackers can use exposed records to map healthcare systems and target services.
Access that changes based on network, device, location, or trust zone. It can reduce exposure when users connect from unmanaged environments.
A firewall design that applies rules between network zones. It can isolate ePHI systems from guest, administrative, or vendor networks.
Backup storage separated by trust level, geography, or function. Zoning can protect clean backups from ransomware and administrative mistakes.
Zero Trust Network Access, a model that grants application access based on identity, device posture, and context. It can replace broad VPN access for ePHI systems.
One Guy Consulting helps small practices and business associates put these terms into practice: risk assessments, written policies, training, and BAAs.
All 1,941 terms in plain English, 143 pages. Add your name and email and the download starts right away.
