CHPS key terms

Individually identifiable health information held or transmitted by a covered entity or business associate in any form or medium, including demographic data that relates to a person's health, care, or payment for care.

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a standard transaction, and is therefore subject to HIPAA rules.

A person or organization that performs functions or services for a covered entity involving access to PHI, such as billing, claims processing, or consulting, and is bound by a written agreement.

A written contract that establishes permitted uses and disclosures of PHI by a business associate and requires appropriate safeguards, breach reporting, and return or destruction of data.

The requirement to limit uses, disclosures, and requests for PHI to the least amount reasonably needed to accomplish the intended purpose, except where rules specify otherwise.

A process that removes identifiers so health information no longer identifies an individual, either through safe harbor removal of specified identifiers or expert statistical determination.

The federal regulation setting standards for how covered entities may use and disclose PHI, including patient rights, authorization requirements, and administrative obligations.

The federal regulation requiring covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic PHI.

Policies and procedures that manage workforce conduct and security operations, including risk analysis, workforce training, access management, and contingency planning.

Controls that protect facilities, equipment, and media from unauthorized access, including locked areas, workstation placement rules, device controls, and disposal procedures.

Technology-based controls that protect electronic PHI, such as access controls, audit logging, encryption, authentication, and integrity mechanisms.

A systematic assessment of potential threats, vulnerabilities, and likelihood of harm to the confidentiality, integrity, and availability of electronic PHI, used to drive safeguard decisions.

The ongoing process of selecting, implementing, and evaluating safeguards to reduce identified risks to an acceptable level, and monitoring them for continued effectiveness.

A structured log that records identified risks, their likelihood and impact, assigned owners, and mitigation status so leadership can track and prioritize treatment.

The mechanisms that determine who may view or use a resource and under what conditions, often enforced through unique user IDs, authentication, and permission settings.

An access model that grants permissions based on a user's job role rather than individual discretion, simplifying administration and supporting minimum necessary access.

The principle of granting users only the access needed to perform their assigned duties, and no more, to reduce exposure of sensitive information.

The process of verifying that a user or system is who it claims to be, commonly through passwords, tokens, biometrics, or multi-factor methods.

A verification approach requiring two or more independent evidence types, such as a password plus a one-time code, making unauthorized access harder.

The transformation of data into a coded form that can only be read with the correct key, protecting confidentiality during storage and transmission.

Protecting stored data on devices, servers, or backups so that if media is lost or stolen, contents remain unreadable without decryption keys.

Protecting data while moving across networks, typically using protocols that secure connections between systems so intercepted traffic cannot be read.

A chronological record of system activity, including who accessed what and when, used to detect misuse, support investigations, and demonstrate compliance.

The periodic examination of recorded system activity to identify anomalies, unauthorized access, or policy violations, and to confirm that logging controls work as intended.

An attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations in an information system.

Under HIPAA, the acquisition, access, use, or disclosure of PHI in a manner not permitted that compromises the security or privacy of the information, subject to exceptions.

The requirement to notify affected individuals, regulators, and sometimes the media after a breach of unsecured PHI, within defined timeframes and content standards.

A documented four-factor analysis of the probability that PHI was compromised, considering the nature of the data, the recipient, whether it was actually viewed, and mitigation.

A documented set of procedures for detecting, containing, investigating, and recovering from security incidents, including roles, communication steps, and post-incident review.

The immediate actions taken to limit the spread or impact of an incident, such as isolating systems, disabling accounts, or blocking network access.

A document that explains to patients how their health information may be used and disclosed, their rights, and the organization's legal duties.

A patient's written permission allowing a covered entity to use or disclose PHI for purposes not otherwise permitted, with required content and revocation rights.

A patient's right to receive a record of certain disclosures of their PHI made by a covered entity, including dates, recipients, and purposes.

Ongoing education that teaches workforce members to recognize threats such as phishing, follow privacy and security policies, and report suspected incidents promptly.

A social engineering attack that uses deceptive messages to trick recipients into revealing credentials or installing malicious software, a common entry point for breaches.

The practice of collecting, keeping, and sharing only the information actually needed for a stated purpose, reducing exposure and compliance burden.

The controlled destruction or sanitization of devices and storage media before reuse or discard, so residual data cannot be recovered by unauthorized parties.

Documented procedures for backing up data, recovering systems, and continuing critical operations during and after disruptions such as outages, disasters, or cyberattacks.

The designated individual responsible for developing, implementing, and overseeing privacy policies, handling patient complaints, and ensuring compliance with privacy regulations.

The designated individual accountable for the organization's security program, including safeguard implementation, risk analysis coordination, and incident oversight.