HCISPP cheat sheet

Healthcare delivery models: fee-for-service pays per encounter; capitation pays per patient per period; value-based care ties payment to quality and outcome measures.

HIPAA covered entities are health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with standard transactions.

Business associates are persons or entities performing functions or services for a covered entity that involve access to protected health information, including subcontractors of business associates.

The HIPAA Privacy Rule protects individually identifiable health information held or transmitted by covered entities and their business associates in any form, electronic or paper.

The HIPAA Security Rule applies only to electronic protected health information and sets administrative, physical, and technical safeguard requirements.

Common clinical information systems: EHR (longitudinal record), HIS (hospital operations), LIS (laboratory), RIS/PACS (imaging), pharmacy management, and e-prescribing systems.

Healthcare data stakeholders include patients, providers, payers, clearinghouses, pharmacies, laboratories, public health agencies, and health information exchanges.

Clinical workflows generate data at registration, triage, order entry, results reporting, medication administration, discharge, and billing, each creating distinct privacy and integrity risks.

Breach notification under the HIPAA Breach Notification Rule generally requires individual notice within 60 days of discovery, plus HHS notice and media notice for large breaches.

Information governance assigns decision rights and accountability for data, defining who may create, modify, access, retain, and dispose of health information.

The HIPAA Privacy Rule minimum necessary standard requires reasonable efforts to limit PHI use, disclosure, and request to the minimum needed for the purpose.

Data classification tiers commonly used in healthcare: public, internal, confidential (PHI), and restricted (sensitive categories such as behavioral health, HIV, genetic data).

Retention schedules must satisfy both legal minimums (varies by jurisdiction and record type) and defensible disposal; the HIPAA Security Rule requires policies for disposal of ePHI.

The designated record set is the group of records a covered entity uses to make decisions about individuals, and it is the unit subject to patient access and amendment rights.

Accounting of disclosures tracks certain PHI disclosures outside treatment, payment, and operations; the right to an accounting extends six years back.

Data stewardship roles typically include the privacy officer, security officer, data owner, data custodian, and clinical content owners.

De-identification under HIPAA uses either the Safe Harbor method (removal of 18 specified identifiers) or the Expert Determination method.

A legal health record is the organization's official record of care; it may differ from the designated record set and from the full EHR content.

Access control models: role-based (per job function), attribute-based (per attributes and context), mandatory (per classification labels), and discretionary (per owner discretion).

Authentication factors are knowledge (password), possession (token, smart card), and inherence (biometric); MFA requires two or more distinct factor types.

Encryption at rest protects stored ePHI; encryption in transit protects data on networks; HIPAA treats properly encrypted PHI as not unsecured, affecting breach notification duties.

HL7 v2 remains the dominant messaging standard for clinical data exchange; FHIR uses RESTful APIs and resource-based JSON/XML payloads.

Network segmentation separates clinical devices and guest networks from systems holding ePHI, limiting lateral movement after compromise.

Medical device security constraints include long lifecycle, inability to install agents, vendor-controlled patching, and regulatory clearance implications for changes.

Audit logging must capture who accessed what, when, from where, and what action occurred; log integrity requires protection from modification by the actors being logged.

Availability controls include redundancy, backups, failover, and tested restoration procedures; clinical availability failures are patient safety events.

Interoperability participants include health information exchanges, which may operate as centralized, federated, or hybrid models with different consent handling.

HIPAA consists of the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

HITECH strengthened HIPAA by extending Security Rule obligations directly to business associates and adding breach notification and higher penalty tiers.

The HIPAA Security Rule safeguard categories are administrative, physical, and technical, plus organizational requirements and policies and procedures documentation.

Required implementation specifications must be implemented; addressable specifications require a documented risk-based decision to implement or document why not.

HIPAA civil penalties are tiered by culpability, ranging from lack of knowledge to willful neglect not corrected, with annual caps per identical provision.

The 21st Century Cures Act information blocking rule prohibits practices that interfere with access, exchange, or use of electronic health information, subject to exceptions.

GDPR applies to processing of personal data of individuals in the EU and imposes breach notification generally within 72 hours to the supervisory authority.

ISO/IEC 27001 specifies requirements for an information security management system; ISO/IEC 27799 provides health-sector guidance for applying it.

NIST SP 800-66 provides an implementation guide for the HIPAA Security Rule, and NIST Cybersecurity Framework organizes controls into identify, protect, detect, respond, and recover functions.

PCI DSS applies where payment card data is stored, processed, or transmitted, and is separate from but often overlapping with HIPAA obligations.

Privacy governs appropriate use and disclosure of information; security governs the safeguards that protect confidentiality, integrity, and availability.

HIPAA authorization must include a description of the information, the purpose, the recipient, an expiration, and the individual's signature, among other elements.

Permitted disclosures without authorization include treatment, payment, healthcare operations, and specific public-interest purposes such as public health reporting and required law enforcement requests.

The HIPAA breach definition presumes any acquisition, access, use, or disclosure not permitted by the Privacy Rule is a breach unless a risk assessment rebuts the presumption.

The four-factor breach risk assessment considers the nature and extent of PHI, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent of risk mitigation.

The HIPAA Security Rule requires a risk analysis as the first administrative safeguard and an ongoing risk management program to reduce identified risks.

Psychotherapy notes receive heightened protection and generally require specific authorization for disclosure, separate from the general medical record.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Workforce security controls include unique user identification, emergency access procedures, automatic logoff, and termination procedures for access rights.

Risk is commonly expressed as likelihood multiplied by impact; risk assessment identifies, estimates, and prioritizes risks against criteria.

Threat, vulnerability, likelihood, and impact are distinct inputs; combining a threat with an existing vulnerability produces the potential for harm.

Qualitative assessment uses ordinal scales and expert judgment; quantitative assessment uses monetary loss estimates and annualized loss expectancy.

Single loss expectancy equals asset value times exposure factor; annualized loss expectancy equals single loss expectancy times annualized rate of occurrence.

Risk treatment options are mitigate, transfer, avoid, and accept; residual risk is the risk remaining after treatment and must be accepted by accountable management.

The HIPAA Security Rule risk analysis scope covers all ePHI the entity creates, receives, maintains, or transmits, regardless of format or location.

A risk register records risk description, owner, rating, treatment plan, target date, and current status, and is reviewed on a defined cycle.

Control selection frameworks include NIST SP 800-53, ISO/IEC 27002, and CIS Controls; control effectiveness must be measured, not assumed.

Business impact analysis identifies critical clinical processes and recovery time and recovery point objectives that drive contingency planning.

A business associate agreement is required before a covered entity discloses PHI to a business associate and must establish permitted uses, safeguards, reporting duties, and return or destruction terms.

Business associate agreements must flow down: subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate also require agreements.

Due diligence before contracting typically covers security certifications, audit reports, breach history, insurance, subcontractor use, and data location.

Contract clauses should include breach notification timelines, right to audit, minimum security requirements, data return and destruction, and liability allocation.

Ongoing monitoring includes periodic reassessment, attestation collection, and review of security ratings or audit reports such as SOC 2 Type II.

Concentration risk arises when many critical functions depend on one vendor or a small number of vendors, creating correlated failure exposure.

Fourth-party risk is exposure created by a vendor's own subcontractors and suppliers, which the contracting organization must understand even when it does not contract with them directly.

Vendor offboarding requires revocation of access, retrieval or confirmed destruction of data, and documented closure of the relationship record.

Supply chain controls for medical devices and software include software bill of materials review, patch commitments, and end-of-support planning in contracts.