CHP key terms

Individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate in any form or medium. It includes demographic data that could identify a person.

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a standard transaction. These organizations must comply with the full privacy and security rules.

A person or organization that performs functions or services for a covered entity involving access to protected health information, such as claims processing, billing, or legal services. A written agreement must govern the relationship.

A written contract between a covered entity and a business associate that establishes permitted uses and disclosures of protected health information and requires appropriate safeguards. It must also address breach reporting and return or destruction of data.

A person or entity to whom a business associate delegates a function involving protected health information. Subcontractors must meet the same privacy and security obligations through a written agreement.

The three core activities for which a covered entity may use or disclose protected health information without patient authorization. Treatment covers care delivery, payment covers reimbursement, and operations cover administrative and quality activities.

The principle that a covered entity should limit uses, disclosures, and requests for protected health information to the least amount reasonably needed to accomplish the intended purpose. It does not apply to treatment disclosures or patient-authorized requests.

A written permission from a patient that allows a covered entity to use or disclose protected health information for a purpose not otherwise permitted. It must contain specific core elements and be written in plain language.

A patient's ability to withdraw a previously granted authorization at any time, provided the withdrawal is in writing. Revocation does not undo actions already taken in reliance on the original authorization.

A process that removes identifiers from health information so it no longer identifies an individual. It can be done by removing specified identifiers or by a statistical expert determination of low re-identification risk.

Protected health information that excludes direct identifiers such as names, addresses, and account numbers but may retain dates and geographic details. It may be used for research and public health purposes under a data use agreement.

A contract required when a covered entity discloses a limited data set. It restricts the recipient to specific purposes and prohibits re-identification or further disclosure of the data.

A document that explains how a covered entity may use and disclose protected health information and describes patient rights. Patients must receive it, and the entity must make a good-faith effort to obtain written acknowledgment.

A patient's right to inspect and obtain a copy of their protected health information held by a covered entity. The entity must respond within a defined timeframe and may charge only reasonable cost-based fees.

A patient's right to request a correction of inaccurate or incomplete protected health information. The covered entity may deny the request in limited circumstances and must document the decision.

A patient's right to receive a record of certain disclosures of their protected health information made by a covered entity. The accounting lists the date, recipient, purpose, and information disclosed for covered periods.

The set of protections patients have over their health information, including access, amendment, restriction requests, confidential communications, accounting of disclosures, and receipt of a privacy notice.

A patient's ability to request that a covered entity communicate with them through specific channels or at specific locations. A covered entity must accommodate reasonable requests without requiring justification.

The routine activities that permit use or disclosure of protected health information without authorization. Treatment involves care delivery, payment involves billing and claims, and operations cover administrative functions like quality review.

A permitted disclosure of protected health information to public health authorities for activities such as disease prevention, injury reporting, and vital records. Disclosures must be limited to what the authority needs.

A use or disclosure of protected health information that a law mandates, such as reporting suspected abuse or responding to a court order. The disclosure must be limited to the information the law requires.

The federal regulation that sets national standards for protecting protected health information and governs when it may be used or disclosed. It also establishes patient rights and administrative obligations for covered entities.

The federal regulation that requires covered entities and business associates to safeguard electronic protected health information. It mandates administrative, physical, and technical safeguards along with organizational and documentation requirements.

Policies and procedures that manage security practices, including risk analysis, workforce training, access management, and incident response planning. They form the governance backbone of an information security program.

Technology-based controls that protect electronic protected health information, such as access controls, audit logs, encryption, and authentication. These safeguards restrict who can view or transmit data.

Controls that protect the physical environment where health information systems and devices reside. They include facility access restrictions, workstation placement, and device and media disposal procedures.

The process of limiting who may view or use protected health information based on role and need. It includes unique user identification, authentication, and automatic logoff.

An access model that grants permissions according to a user's job duties rather than individual requests. It supports the minimum necessary principle by limiting data access to what a role requires.

The process of converting data into a coded form so that only authorized parties with the proper key can read it. Properly encrypted data may be exempt from breach notification requirements.

A record of system activity that captures who accessed what information and when. Logs support monitoring, investigation, and detection of unauthorized access to protected health information.

The ongoing review of access logs, policies, and controls to detect privacy and security violations. It includes periodic audits, random checks, and follow-up on identified issues.

A systematic assessment of potential threats, vulnerabilities, and the likelihood of harm to protected health information. It identifies where safeguards are needed and informs remediation priorities.

The process of selecting and implementing safeguards to reduce identified risks to an acceptable level. It follows risk analysis and includes cost-benefit consideration of security measures.

The legal duty to notify affected individuals, regulators, and sometimes the media after a breach of unsecured protected health information. Notification timelines and content requirements depend on the type and scope of the breach.

The acquisition, access, use, or disclosure of protected health information in a manner not permitted that compromises the security or privacy of the information. A risk assessment determines whether notification is required.

The organized process for detecting, containing, investigating, and recovering from privacy or security incidents. It includes documentation, notification decisions, and corrective actions to prevent recurrence.

Ongoing education that ensures employees understand privacy and security policies, their responsibilities, and how to report concerns. Training should be role-appropriate and documented.

A documented set of disciplinary actions applied when workforce members violate privacy or security rules. It should be applied consistently and communicated during training.

The designated individual responsible for developing, implementing, and overseeing an organization's privacy program. This role handles policy, training, complaints, and compliance monitoring.

The designated individual accountable for the organization's information security program, including safeguards, risk analysis, and incident handling. This role often works closely with the privacy officer.