CHPC key terms

An organization-wide framework of policies, roles, controls, and monitoring that a covered entity uses to protect health information, meet legal obligations, and respond to privacy risks and incidents.

The designated person accountable for developing, implementing, and overseeing the entity's privacy policies and procedures, receiving complaints, and serving as the point of contact for privacy matters.

Employees, volunteers, trainees, and other persons whose conduct is under the direct control of the covered entity or business associate, whether or not they are paid.

A documented rule describing the disciplinary consequences an organization applies when workforce members violate privacy policies, applied consistently so that enforcement deters misconduct.

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a transaction the HIPAA standards cover.

Individually identifiable health information held or transmitted by a covered entity or business associate in any form, relating to past, present, or future health, care, or payment.

Federal regulation at 45 CFR Parts 160 and 164 that sets national standards for use and disclosure of protected health information and grants individuals rights over that information.

A process that removes identifiers so information is no longer individually identifiable, achieved through expert statistical determination or safe-harbor removal of eighteen specified identifiers.

The principle that HIPAA sets a minimum floor; a state law contrary to HIPAA yields to it unless the state law is more stringent or protects privacy more.

Federal rules governing records of substance use disorder treatment programs that generally require patient consent for disclosure and are more restrictive than HIPAA in many situations.

The three core purposes for which a covered entity may use or disclose protected health information without an authorization, subject to minimum necessary limits.

The requirement to limit uses, disclosures, and requests for protected health information to the least amount reasonably needed to accomplish the intended purpose, subject to defined exceptions.

A written, signed permission from an individual that meets specific content requirements and permits a use or disclosure of protected health information not otherwise allowed by the rule.

Private notes a mental health professional records about a counseling session, kept separate from the medical record, which require a distinct authorization for most disclosures.

A communication encouraging recipients to buy or use a product or service that generally requires individual authorization, subject to narrow exceptions such as treatment communications or face-to-face encounters.

Protected health information stripped of sixteen direct identifiers but still containing dates and geographic data no smaller than a state, usable for research and public health only under a data use agreement.

A written statement a covered entity gives individuals describing how it may use and disclose protected health information, individual rights, and how to file a complaint.

An individual's right to inspect and obtain a copy of protected health information in the designated record set, generally fulfilled within thirty days with one possible thirty-day extension.

An individual's right to ask that incorrect or incomplete protected health information in the designated record set be corrected, with defined grounds for denial and a process to submit a statement of disagreement.

An individual's right to ask that the entity limit uses or disclosures of protected health information; the entity must agree when the request restricts disclosure to a health plan for an item paid out of pocket in full.

A request that the entity contact the individual by a specific method or at a specific location, which the entity must accommodate when the request is reasonable.

A person legally authorized to act on behalf of an individual, such as a parent of a minor or an agent under a health care power of attorney, who exercises the individual's privacy rights.

A report an individual may request listing non-routine disclosures of protected health information made in the prior six years, including recipient, date, and purpose of each disclosure.

A person or entity that performs a function or service for a covered entity involving the creation, receipt, maintenance, or transmission of protected health information.

A contract required before a business associate handles protected health information that establishes permitted uses, safeguards, breach reporting, subcontractor obligations, and return or destruction of data.

An entity to which a business associate delegates work involving protected health information; the business associate must impose the same privacy and security obligations through a written agreement.

A contract required when sharing a limited data set that limits the recipient to specified purposes, prohibits re-identification, and requires safeguards and reporting of improper use.

An impermissible acquisition, access, use, or disclosure of unsecured protected health information that compromises its security or privacy, presumed a breach unless a risk assessment shows low probability of compromise.

A four-factor analysis covering the nature and extent of the information, the unauthorized recipient, whether information was actually acquired or viewed, and the extent of mitigation, used to decide if notification is required.

The duty to inform affected individuals, the federal regulator, and sometimes the media within established deadlines after discovering a reportable breach of unsecured protected health information.

Reasonable steps taken to lessen the harmful effects of a privacy violation, such as retrieving records, correcting misinformation, or notifying affected parties.

An attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations, in an information system.

Security Rule requirements covering risk analysis, workforce security, access management, training, incident procedures, and contingency planning to protect electronic protected health information.

Unsecured protected health information excludes data rendered unusable, unreadable, or indecipherable through encryption meeting recognized standards, so loss of properly encrypted data is not a reportable breach.

Required education that gives staff the knowledge and skills needed to carry out their privacy responsibilities, delivered at onboarding and refreshed periodically or when practices change.

Shared organizational values and behaviors that treat protecting health information as everyone's responsibility, reinforced by leadership example, open communication, and consistent accountability.

A systematic, documented review of records, systems, or practices compared against policy and legal standards in order to identify gaps and verify compliance.

Ongoing, often automated review of access logs, system activity, and workflows used to detect unusual patterns and surface privacy problems before they grow.

A structured inquiry into a suspected violation that gathers facts, interviews those involved, determines whether policy or law was broken, and supports appropriate corrective action.

A documented set of steps, responsible owners, and deadlines an organization commits to after identifying a deficiency, used both in internal remediation and in resolving enforcement matters.