Glossary

Technical measures that restrict ePHI to authorized users and processes only.

Periodically examining access logs to detect inappropriate activity on ePHI.

HIPAA Security Rule policies and procedures that manage the protection of ePHI.

HIPAA-required mechanisms that record and examine activity in systems holding ePHI.

Recording who accessed PHI and when, as required by the HIPAA Security Rule.

A control that ends an idle session to prevent unauthorized access to PHI.

Practices for backing up data and restoring systems after a disruptive event.

An impermissible use or disclosure of unsecured PHI that compromises its security or privacy.

The HIPAA rule requiring notice when unsecured PHI is exposed.

A vendor that handles PHI on behalf of a covered entity and is directly liable under HIPAA.

A written contract requiring a vendor that handles PHI to protect it under HIPAA.

A plan to keep essential business functions running through and after a disruption.

A narrow HIPAA exception for services that only transmit PHI without storing it.

A HIPAA-required plan for responding to emergencies that damage systems containing ePHI.

A remediation plan an organization agrees to after an OCR HIPAA enforcement action.

A healthcare provider, health plan, or clearinghouse directly regulated by HIPAA.

A HIPAA-required plan to create and maintain retrievable copies of ePHI.

A secured facility housing servers and infrastructure, subject to HIPAA physical safeguards.

A contract governing how a limited data set may be used and disclosed.

Measures that keep services available during distributed denial-of-service attacks.

Removing identifiers from health data so it is no longer PHI under HIPAA.

A physical server used by a single tenant, offering isolation useful for PHI workloads.

The records a covered entity uses to make decisions about individuals, subject to patient access rights.

The documented process for restoring systems and data after a major disruption.

PHI that is created, stored, or transmitted in electronic form.

A documented way to reach ePHI during an emergency without weakening normal controls.

Procedures to keep critical ePHI processes running during an emergency.

Scrambling PHI so it is unreadable without a key, both while stored and while transmitted.

A HIPAA de-identification method where a qualified expert certifies re-identification risk is very small.

A security control that filters network traffic to block unauthorized access.

Designing systems to minimize downtime through redundancy and failover.

The 1996 U.S. law that sets national standards for protecting sensitive patient health information.

A patient's written permission to use or disclose PHI beyond treatment, payment, or operations.

The rule setting out how HIPAA violations are investigated and penalized.

The 2013 rule that finalized HITECH changes and made business associates directly liable under HIPAA.

The HIPAA rule governing how PHI may be used and disclosed.

The HIPAA rule that sets administrative, physical, and technical safeguards for ePHI.

Hosting configured with the safeguards and a signed BAA needed to store or transmit PHI.

The specific cloud services a provider agrees to cover under its BAA; PHI may only live inside them.

A 2009 law that strengthened HIPAA enforcement, penalties, and breach notification requirements.

A certifiable security framework that maps HIPAA and other standards into one control set.

A documented plan for detecting, responding to, and recovering from security incidents.

Health information that identifies, or could identify, a specific person: the basis of PHI.

Measures ensuring ePHI is not improperly altered or destroyed.

Systems that monitor network or host activity to detect and block malicious behavior.

An international standard for information security management systems (ISMS).

The secure generation, storage, rotation, and retirement of encryption keys.

Granting each user or process only the minimum access needed to do its job.

PHI with direct identifiers removed, usable for research or operations under a data use agreement.

Distributing traffic across multiple servers to improve performance and availability.

Hosting where the provider operates and secures the servers, including patching and monitoring.

A HIPAA principle requiring access to only the minimum PHI needed to accomplish a task.

Requiring two or more independent factors to verify a user's identity.

A document telling patients how their health information may be used and disclosed.

A copy of data stored in a separate geographic location to survive a local disaster.

The HHS division that enforces HIPAA and investigates breaches and complaints.

An authorized simulated attack to find exploitable security weaknesses.

Verifying that a user or system seeking ePHI is who it claims to be.

HIPAA Security Rule controls protecting the physical facilities and hardware that hold ePHI.

Cloud infrastructure dedicated to a single organization rather than shared publicly.

Individually identifiable health information held by a covered entity or business associate.

Shared, multi-tenant cloud infrastructure; can host PHI under a BAA with proper configuration.

The maximum amount of data, measured in time, an organization can afford to lose in an outage.

The maximum acceptable time to restore a system after an outage.

Duplicating critical components so a failure doesn't cause an outage or data loss.

A patient's HIPAA right to inspect and obtain a copy of their own health information.

A HIPAA-required assessment of threats and vulnerabilities to ePHI.

Granting access to ePHI based on a user's job role rather than individually.

A HIPAA de-identification method that removes 18 specified identifiers from health data.

A HIPAA-required policy for disciplining workforce members who violate security policies.

An attempted or successful unauthorized access, use, or interference with ePHI systems.

A contract defining guaranteed service levels such as uptime and support response times.

The split of security duties between a cloud provider and its customer; the cloud secures the infrastructure, the customer secures what runs on it.

A hosting model where one customer's environment runs on infrastructure shared with no other tenant, simplifying isolation and risk analysis.

An audit report on a service provider's controls for security, availability, and confidentiality.

A SOC 2 report testing that controls operated effectively over a period of time.

A digital certificate that enables encrypted HTTPS connections to a website or service.

A vendor a business associate hires to handle PHI, who must also sign a BAA.

HIPAA Security Rule technology controls such as access control, encryption, and audit logging.

HIPAA safeguard protecting ePHI as it moves across networks.

The core purposes for which PHI can be used without separate patient authorization.

Assigning every user a distinct ID so activity on ePHI can be traced to an individual.

An encrypted network tunnel that protects data traveling between users and systems.

Automated scanning of systems to identify known security weaknesses.

A firewall that filters HTTP traffic to protect web applications from attacks.

Conscious failure to comply with HIPAA, carrying the highest penalty tier.

HIPAA-required security awareness training for all members of the workforce.