HCISPP flashcards

34 cards. Read the term and the definition here. The deck at the top of this page is optional.

Covered entity definition

A health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically in connection with a standard transaction. Covered entities carry primary HIPAA compliance obligations.

Business associate

A person or entity that performs functions or services for a covered entity involving access to protected health information. Subcontractors of business associates that touch PHI are also business associates.

Value-based care

A payment and delivery model that ties reimbursement to quality, cost, and patient outcome measures rather than volume of services. It increases demand for accurate, interoperable clinical data.

Health information exchange

An organization or network enabling electronic movement of health information among disparate systems. Models include centralized, federated, and hybrid, with differing consent and record-location approaches.

Breach notification timeline

Under HIPAA, individuals generally must be notified within 60 days of discovery of a breach. HHS is notified at the same time, or annually for smaller breaches.

Minimum necessary standard

A HIPAA Privacy Rule requirement to make reasonable efforts to limit PHI use, disclosure, and requests to the minimum needed to accomplish the intended purpose, excluding treatment disclosures.

Designated record set

The group of records a covered entity uses to make decisions about individuals, including medical and billing records. It defines the scope of patient access and amendment rights.

Safe Harbor de-identification

A HIPAA method removing 18 specified identifiers, including names, dates beyond year, geographic subdivisions smaller than state, and full-face photos, with no actual knowledge of re-identifiability.

Legal health record

The organization's official record of the care delivered to a patient. It may be a subset of the full EHR and can differ from the HIPAA designated record set.

Data stewardship roles

Assignments such as data owner, data custodian, privacy officer, and security officer that distribute accountability for data quality, access decisions, and safeguard operation.

Accounting of disclosures

A patient right to receive a listing of certain PHI disclosures not related to treatment, payment, or operations, generally covering the six years before the request.

Role-based access control

An access control model granting permissions based on job function rather than individual identity. It simplifies administration but requires careful role design and periodic review.

Multi-factor authentication

Authentication using two or more distinct factor types: knowledge, possession, and inherence. Two passwords are not multi-factor because they share one factor type.

Encryption and breach presumption

PHI that is encrypted to HHS-specified standards is generally treated as not unsecured, so a breach of well-encrypted data may not trigger notification obligations.

FHIR standard

A healthcare interoperability standard using RESTful APIs and modular resources in JSON or XML. It supports modern application access and exchange beyond older HL7 v2 messaging.

Medical device security limits

Clinical devices often cannot run security agents, have long service lives, and depend on vendor-controlled patching, so compensating network controls are commonly required.

Audit log integrity

Audit records must capture access details and be protected from alteration or deletion by the users and administrators they record, typically through separate logging infrastructure.

Addressable specification

A HIPAA Security Rule implementation specification that must be implemented or, if not reasonable, documented with the rationale and an equivalent alternative measure.

HITECH Act effect

The HITECH Act extended HIPAA Security Rule obligations directly to business associates and added breach notification duties and higher civil penalty tiers.

Information blocking

A practice that interferes with access, exchange, or use of electronic health information, prohibited under the 21st Century Cures Act subject to defined exceptions.

GDPR breach notification

Controllers generally must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

ISO/IEC 27001

An international standard specifying requirements for establishing, operating, and continually improving an information security management system, applicable to healthcare organizations.

NIST SP 800-66

A NIST publication providing an implementation guide for the HIPAA Security Rule, mapping safeguard requirements to risk-based practices and control frameworks.

Privacy versus security

Privacy concerns appropriate use and disclosure of health information and individual rights. Security concerns the safeguards protecting confidentiality, integrity, and availability of that information.

Breach risk assessment factors

Four factors: nature and extent of PHI involved, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent of risk mitigation achieved.

Psychotherapy notes

Notes recorded by a mental health professional documenting counseling session contents, held separate from the medical record and generally requiring specific patient authorization to disclose.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Containment limits spread before eradication removes the cause.

HIPAA authorization elements

A valid authorization describes the information, purpose, recipient, expiration, and revocation rights, and is signed and dated by the individual or personal representative.

Single loss expectancy

The monetary loss from one incident, calculated as asset value multiplied by exposure factor. It feeds annualized loss expectancy when multiplied by annual rate of occurrence.

Risk treatment options

Mitigate by applying controls, transfer through insurance or contracts, avoid by eliminating the activity, or accept and document. Residual risk remains after treatment.

HIPAA risk analysis

A required administrative safeguard that assesses potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI across the whole organization.

Business associate agreement

A contract required before PHI is disclosed to a business associate, establishing permitted uses, safeguards, breach reporting, subcontractor flow-down, and data return or destruction.

Fourth-party risk

Risk arising from a vendor's own subcontractors and suppliers. The contracting organization must understand this exposure even without a direct contractual relationship.

Vendor due diligence

Pre-contract evaluation of a third party's security posture, including audit reports, certifications, breach history, insurance, subcontractor use, and data location.