HS 330 key terms

A U.S. federal law that protects the privacy and security of individually identifiable health information and guarantees certain rights to keep or change health coverage when employment changes.

Individually identifiable health information created, received, or maintained by a covered entity or business associate, in any form, that relates to a person's health, care, or payment for care.

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a standard transaction, and therefore must comply with HIPAA rules.

A person or organization that performs functions or services for a covered entity involving access to protected health information, such as billing vendors or cloud storage providers, and must sign a written agreement.

A written contract between a covered entity and a business associate that specifies permitted uses of protected health information and required safeguards to protect it.

The HIPAA principle requiring covered entities to limit uses, disclosures, and requests for protected health information to the least amount reasonably needed to accomplish the intended purpose.

The three core purposes for which protected health information may be used or disclosed without patient authorization: delivering care, billing for it, and running the organization's routine business.

A patient's written permission allowing a covered entity to use or disclose protected health information for purposes beyond treatment, payment, and operations, with required content and revocation rights.

The process of removing identifiers from health information so that the remaining data cannot reasonably be used to identify an individual, either by expert determination or safe harbor removal of listed identifiers.

The HIPAA rule setting administrative, physical, and technical safeguards that covered entities must apply to protect electronic protected health information.

The HIPAA requirement that covered entities notify affected individuals, regulators, and sometimes the media after discovering an unauthorized acquisition, access, or disclosure of unsecured protected health information.

A systematic process of identifying threats and vulnerabilities to electronic protected health information, estimating likelihood and impact, and using results to select safeguards.

The ongoing process of selecting, implementing, and monitoring security measures to reduce identified risks to electronic health information to a reasonable and appropriate level.

Security policies and procedures that manage personnel conduct and access, such as workforce training, access authorization, contingency planning, and periodic evaluation of security practices.

Technology-based controls that protect electronic health information, including access controls, audit logging, integrity controls, person or entity authentication, and transmission encryption.

Tangible protections for facilities and equipment that house health information, such as locked server rooms, workstation placement, device disposal procedures, and visitor controls.

A method of converting data into unreadable code using keys so that only authorized parties can restore and read it, often used to render health information unusable to unauthorized viewers.

A chronological record of system activity that captures who accessed or changed information and when, supporting detection of inappropriate access and demonstrating compliance.

The technical and administrative mechanisms that determine which users may view, modify, or transmit specific health information, often based on job role and need to know.

An access design that grants permissions according to a user's job function, so staff see only the information needed for their duties rather than all available records.

A written statement a covered entity gives patients describing how their health information may be used and disclosed, their rights, and how to file a complaint.

A patient's right to receive a list of certain disclosures of their protected health information made by a covered entity, including dates, recipients, and purposes.

The individual a covered entity designates to develop, implement, and monitor privacy policies, receive complaints, and serve as a point of contact for privacy matters.

The individual a covered entity designates to oversee security of electronic protected health information, including conducting risk analysis and enforcing safeguards.

An entity that converts health data between nonstandard and standard formats for other organizations, such as processing billing claims, and is itself a HIPAA covered entity.

Combining protected health information from multiple sources to analyze and evaluate care, which a business associate may perform only under defined agreement terms.

Any employee, volunteer, trainee, or contractor whose work is under the direct control of a covered entity, regardless of whether the entity pays them.

A set of procedures for responding to emergencies or system failures, including data backup, disaster recovery, and emergency mode operations to preserve access to health information.

A written rule describing disciplinary actions applied to workforce members who fail to comply with privacy or security policies, required as an administrative safeguard.

An unintentional disclosure that occurs while otherwise permitted use or disclosure is being made and cannot reasonably be prevented, such as a name called in a waiting room.

The set of entitlements including inspecting and copying records, requesting amendments, requesting restrictions, receiving an accounting of disclosures, and requesting confidential communications.

A network that allows health care organizations to share patient health information electronically across systems, subject to privacy, security, and consent requirements.

The ability of different health information systems to exchange data and use the exchanged information correctly, supported by common standards and secure interfaces.

An impermissible use or disclosure under privacy rules that compromises the security or privacy of protected health information, presumed unless a risk assessment shows low probability of compromise.

Protected health information that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through encryption or destruction methods recognized by guidance.