eAIS key terms

The leadership structure, policies, and accountability mechanisms an eHealth organisation uses to direct security decisions, assign ownership, and ensure that information protection supports clinical and business objectives.

The amount and type of information security risk an eHealth organisation is willing to accept in pursuit of its clinical and business goals, expressed as thresholds that guide treatment decisions.

The process of selecting and applying options to modify risk, such as mitigating with controls, transferring through insurance, avoiding an activity, or formally accepting the residual level.

The risk that remains after existing and planned controls have been applied, which must be documented and accepted by an accountable owner before a system or process goes live.

A maintained record of identified risks that captures description, likelihood, impact, owner, existing controls, treatment plan, and review date so that risk decisions remain traceable over time.

A structured, evidence-based examination of controls and records against stated requirements, producing findings and corrective actions that management must track to closure.

Health information that relates to an identified or identifiable individual and is created, received, or maintained by a covered entity or its business associate, triggering specific legal safeguards.

The principle of collecting and retaining only the personal health data actually needed for a stated purpose, reducing exposure if a breach or unauthorised access occurs.

A privacy rule requiring that health data collected for one stated purpose, such as treatment, is not reused for unrelated purposes like marketing without a lawful basis or fresh consent.

A documented, voluntary agreement given by a patient after receiving clear information about what data will be collected, why, who will access it, and how it can be withdrawn.

The process of removing or transforming identifiers so that health data can no longer be reasonably linked to a specific individual, typically using removal, masking, or statistical techniques.

Replacing direct identifiers with a key or token so that data can be linked across records only with additional information kept separately and protected by stronger controls.

A formal request by a patient to obtain a copy of their personal health data, confirm what is held, and in some jurisdictions receive it in a portable machine-readable format.

A structured assessment performed before a high-risk processing activity, such as a new patient portal or analytics platform, that documents necessity, proportionality, risks, and mitigation measures.

An access model where permissions are assigned to job roles, such as nurse or radiologist, and users receive permissions by being placed into those roles rather than individually.

An access model that evaluates attributes of the user, resource, action, and environment, such as ward assignment or time of day, to make fine-grained authorisation decisions beyond static roles.

The practice of granting each user, service, or device only the minimum access needed for its current task and for the shortest necessary duration, limiting the blast radius of compromise.

An emergency access mechanism that lets clinicians override normal restrictions to treat a patient in a critical situation, while logging the event and triggering retrospective review.

Controls that secure accounts with elevated rights, including vaulting credentials, just-in-time elevation, session recording, and approval workflows for administrative actions on clinical systems.

Authentication that requires two or more independent evidence types, such as a password plus a hardware token or biometric, so a stolen password alone cannot grant access.

A federated authentication arrangement where one authenticated session grants access to multiple clinical applications, reducing password fatigue while concentrating risk on the identity provider.

Trust established between separate organisations, such as a hospital and a regional health network, so users can authenticate in their home domain and access partner resources without duplicate accounts.

Dividing a network into isolated zones, for example separating medical device networks from clinical workstations and corporate IT, so compromise in one zone cannot spread freely.

A design principle that treats no network location as inherently trusted and requires continuous verification of user, device, and context before granting access to each resource.

An ordered collection of allow and deny rules governing traffic between network zones, which must be reviewed regularly because legacy permissive rules often undermine segmentation.

A monitoring capability that inspects network or host activity for known attack signatures or anomalous behaviour and raises alerts for analyst triage and response.

An encrypted tunnel that lets remote clinicians or partner sites connect securely to internal health systems over untrusted networks, ideally paired with device checks and strong authentication.

Agent software on servers and workstations that continuously records process, file, and network behaviour, detects malicious patterns, and supports containment actions such as isolating a host.

A disciplined process for identifying, testing, deploying, and verifying software updates across clinical systems, balancing vulnerability closure against the risk of disrupting validated medical applications.

Automated probing of hosts and applications to identify known weaknesses and missing updates, producing prioritised findings that feed remediation and patch workflows.

An authorised, simulated attack against agreed systems and scope that attempts to exploit weaknesses and demonstrates real business impact beyond what automated scanning reports.

A structured exercise performed during system design that identifies assets, adversaries, attack paths, and required controls before code or infrastructure is built and costly to change.

Embedding security activities such as threat modelling, code review, dependency checks, and security testing into each phase of software development rather than adding them after release.

A machine-readable inventory of the components and dependencies in a software product, used to rapidly identify exposure when a library vulnerability or supply chain compromise is announced.

Protecting stored health data, including databases, backups, and mobile devices, by converting it to ciphertext so that stolen media or unauthorised file access does not reveal content.

Protecting data moving between systems, such as a browser and a patient portal, using protocols like TLS so that interception on the network does not expose clinical information.

The lifecycle of cryptographic keys, covering generation, secure storage, distribution, rotation, revocation, and destruction, including protection of keys from the same compromise as the data.

A tamper-resistant appliance that generates and stores cryptographic keys and performs operations inside protected hardware, so keys never appear in plaintext on general-purpose servers.

The policies, certificate authorities, and registration processes that issue and validate digital certificates, enabling trusted identity proofing and encrypted connections between health systems.

A cryptographic value created with a private key that lets a recipient verify the signer's identity and confirm that signed clinical documents or messages were not altered.

A platform that centralises logs from clinical and infrastructure systems, correlates events, and generates alerts that analysts investigate in a security operations centre.

A chronological, tamper-evident record of who accessed or changed which record and when, essential for detecting inappropriate snooping and for regulatory and forensic review.

Documented roles, escalation paths, communication steps, and containment procedures that guide an organisation from detection through recovery and lessons learned after a security incident.

Malicious software that encrypts or exfiltrates data and demands payment, a leading threat to hospitals because downtime directly threatens patient safety and clinical operations.

A study that identifies critical clinical and business functions, quantifies the harm of their disruption over time, and sets the recovery priorities and targets that drive continuity planning.

Documented arrangements, including manual workarounds and alternate sites, that keep essential patient care and supporting services running during a disruption to normal systems.

Technical procedures and infrastructure arrangements for restoring IT systems and data after a major outage, aligned with the recovery targets set during business impact analysis.

The maximum acceptable elapsed time to restore a system or function after disruption, used to design redundancy and to judge whether recovery performance is adequate.

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for clinical records that cannot be recreated once lost.

The practice of regularly testing that backups can actually be restored within target times, since untested backups frequently fail when needed during a real incident.

Protecting connected clinical equipment such as infusion pumps and imaging systems, which often run unsupported operating systems and cannot easily accept agents or patches.

The growing population of network-connected monitors, wearables, and implants that generate patient data, expanding the attack surface and complicating inventory and update management.

Recurring education that helps staff recognise phishing, handle health data correctly, and report suspected incidents, tailored to clinical workflows rather than generic office scenarios.

A controlled exercise that sends realistic fake messages to staff and measures reporting and click rates, providing evidence of awareness programme effectiveness and targets for further training.

Substituting a sensitive value, such as an identifier or card number, with a non-sensitive token that maps back only through a protected vault, limiting where real data lives.