HCISPP key terms

Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium, that relates to a person's past, present, or future physical or mental health, care, or payment for care.

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a HIPAA-covered transaction, and therefore must comply with the HIPAA Privacy and Security Rules.

A person or organization that performs functions or services involving PHI on behalf of a covered entity, such as claims processing, billing, or IT support, and is bound by a written contract to protect that information.

A written contract required by HIPAA that establishes permitted uses and disclosures of PHI by a business associate and obligates the associate to safeguard the information and report breaches.

The U.S. Health Insurance Portability and Accountability Act, whose Administrative Simplification provisions established national standards for electronic health transactions, privacy of health information, and security safeguards for electronic PHI.

The HIPAA regulation that governs how covered entities and business associates may use and disclose PHI, sets patient rights over their records, and requires safeguards and minimum necessary disclosures.

The HIPAA regulation requiring covered entities and business associates to protect electronic PHI through administrative, physical, and technical safeguards that ensure confidentiality, integrity, and availability.

A 2009 U.S. law that expanded HIPAA by extending security obligations directly to business associates, requiring breach notification, strengthening enforcement penalties, and promoting meaningful use of electronic health records.

The HIPAA principle that uses, disclosures, and requests for PHI should be limited to the least amount of information reasonably needed to accomplish the intended purpose, with certain exceptions such as treatment disclosures.

A written, patient-signed permission that allows a covered entity to use or disclose PHI for purposes beyond treatment, payment, and health care operations, and that must meet specific content and revocation requirements.

The three core activities for which HIPAA permits a covered entity to use and disclose PHI without patient authorization, covering clinical care, reimbursement, and administrative functions such as quality review and compliance.

A document a covered entity must give patients explaining how their PHI may be used and disclosed, their rights, and the entity's legal duties, with acknowledgement of receipt typically obtained at first service.

The process of removing identifiers from health information so it no longer identifies an individual, either through expert statistical determination or removal of a specified list of identifiers such as names, dates, and geographic data.

PHI from which direct identifiers have been removed but which may still contain dates, city, state, and ZIP code, usable for research, public health, or operations under a data use agreement.

The HIPAA requirement that covered entities notify affected individuals, the U.S. Department of Health and Human Services, and sometimes the media after discovering a breach of unsecured PHI, generally within 60 days.

Under HIPAA, the acquisition, access, use, or disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the information, subject to a risk assessment and certain exceptions.

A four-factor analysis used to determine whether an impermissible use or disclosure of PHI is a reportable breach, considering the nature of the information and recipient, unauthorized access, and the extent of mitigation.

The HIPAA Security Rule requirement to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI, and to document and update it periodically.

The ongoing process of identifying, prioritizing, and applying safeguards to reduce risks to ePHI to a reasonable and appropriate level, including implementing security measures and evaluating their effectiveness.

The level of risk that remains after security controls and mitigation measures have been applied, which organizations must document and accept, transfer, or further reduce based on their risk tolerance.

Electronic protected health information: PHI that is created, received, maintained, or transmitted in electronic form, which triggers the HIPAA Security Rule and requires administrative, physical, and technical safeguards.

Security Rule controls focused on management and workforce practices, including security management processes, assigned security responsibility, workforce training, incident procedures, contingency planning, and periodic evaluation.

Security Rule controls implemented through technology, including access control, audit controls, integrity controls, person or entity authentication, and transmission security such as encryption for ePHI.

Security Rule controls that protect the physical environment of information systems, including facility access controls, workstation use and security policies, and device and media controls for ePHI.

The conversion of data into a coded form that can only be read with the correct key; properly applied encryption can render PHI unusable and therefore outside breach notification obligations under HIPAA guidance.

An access control model that grants permissions based on a user's job role rather than individual identity, supporting least privilege and the HIPAA minimum necessary standard within clinical and administrative systems.

The security principle that users and systems should be granted only the minimum access rights needed to perform their assigned duties, reducing the potential impact of misuse or compromised accounts.

Technical and procedural mechanisms that record and examine activity in systems containing ePHI, enabling detection of inappropriate access and supporting investigation of security incidents and compliance reviews.

Under the Security Rule, the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system, which must be identified and responded to.

Documented procedures that define how an organization detects, contains, eradicates, and recovers from security incidents, including roles, communication paths, evidence handling, and post-incident review steps.

A Security Rule requirement for policies and procedures that enable data backup, disaster recovery, and emergency-mode operations, and that are tested and updated so ePHI remains available during disruptions.

The three core information security objectives: keeping data secret from unauthorized parties, keeping it accurate and unaltered, and keeping it accessible to authorized users when needed.

An electronic exchange of health information for which the U.S. Department of Health and Human Services has adopted a standard format, such as claims submission, eligibility inquiry, or remittance advice.

The electronic sharing of health information among organizations and clinicians across systems, raising governance questions about consent, access control, and accountability when data crosses organizational boundaries.

The ability of different information systems, devices, and applications to access, exchange, and use data in a coordinated manner, relying on shared standards and secure interfaces to support care coordination.

A modern HL7 standard that defines modular resources and RESTful APIs for exchanging health care data, widely used to build interoperable applications while enforcing authorization and consent controls.

A patient's agreement to the use or disclosure of their health information, which may be required by law, regulation, or organizational policy and can be general, granular, or time-limited depending on jurisdiction.

The European Union law governing personal data protection, including health data as a special category, imposing lawful basis, data subject rights, breach notification, and cross-border transfer requirements on organizations.

A structured assessment required in some jurisdictions before processing that is likely to result in high risk to individuals, such as large-scale handling of health data, documenting risks and mitigating measures.

A process that evaluates how a new system, project, or data flow affects individual privacy, identifies privacy risks, and recommends controls to comply with privacy obligations before implementation.

The disciplined process of identifying, assessing, monitoring, and mitigating risks introduced by vendors, contractors, and service providers that access systems or data, including security, privacy, and compliance risks.

Pre-contract evaluation of a supplier's security posture, privacy practices, certifications, incident history, and financial stability to determine whether the vendor can meet the organization's risk and compliance requirements.

An entity to which a business associate delegates a function involving PHI; under HIPAA the business associate must ensure the subcontractor agrees to the same restrictions and conditions through a written agreement.

An independent attestation report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy, commonly used as evidence during vendor due diligence.

A contract that limits how a recipient may use and disclose a limited data set, requiring safeguards, prohibiting re-identification, and ensuring recipients do not identify individuals whose data is included.

The entitlements of individuals over their personal data under laws such as GDPR, including access, correction, erasure, restriction, portability, and objection, which shape how health data is handled.

A U.S. incentive program that required eligible professionals and hospitals to demonstrate use of certified electronic health record technology to improve quality, safety, and coordination of care.

The secure destruction or sanitization of devices and media containing ePHI before reuse or disposal, including documented procedures for hard drives, removable media, and paper records.

A standards-development organization whose messaging and resource specifications, including HL7 v2 and FHIR, define how clinical and administrative health data is structured and exchanged between systems.