Comprehensive definitions of key HIPAA terms, acronyms, and compliance terminology. Click any term to learn more.
An implementation specification that must be assessed and either implemented or replaced with an equivalent alternative measure.
Read morePolicies and procedures designed to manage the selection, development, implementation, and maintenance of security measures to protect ePHI.
Read moreThe impermissible acquisition, access, use, or disclosure of PHI that compromises its security or privacy.
Read moreHIPAA rule requiring notification to affected individuals, HHS, and sometimes media following a breach of unsecured PHI.
Read moreA person or entity that performs functions involving access to PHI on behalf of a covered entity.
Read moreA written contract establishing the permitted uses and disclosures of PHI between a covered entity and a business associate.
Read moreHealth information from which all individually identifiable elements have been removed, exempt from Privacy Rule restrictions.
Read moreThe process of converting encrypted ePHI back into its original, readable form using the appropriate decryption key.
Read moreThe group of records maintained by a covered entity that includes medical, billing, and enrollment records used for individual decisions.
Read moreThe release, transfer, or provision of access to PHI outside the entity holding the information.
Read morePHI that is created, stored, transmitted, or received in electronic form, subject to both the Privacy and Security Rules.
Read moreThe process of encoding ePHI into an unusable form without the proper decryption key, providing safe harbor from breach notification.
Read moreHIPAA rule establishing procedures for investigations, hearings, and civil monetary penalties for violations.
Read moreThe electronic movement of health-related information among organizations according to nationally recognized standards.
Read moreThe federal agency responsible for enforcing HIPAA regulations through the Office for Civil Rights (OCR).
Read moreFederal law enacted in 1996 establishing national standards for protecting sensitive patient health information.
Read moreThe requirement to use, disclose, and request only the minimum PHI necessary to accomplish the intended purpose.
Read moreA security mechanism requiring two or more verification factors to access systems, significantly reducing unauthorized access risk.
Read morePhysical measures, policies, and procedures to protect electronic information systems and facilities from hazards and unauthorized access.
Read moreThe designated individual responsible for developing and implementing privacy policies and ensuring Privacy Rule compliance.
Read moreHIPAA rule establishing national standards for protecting individuals' medical records and PHI in all forms.
Read moreIndividually identifiable health information in any form relating to health conditions, healthcare provision, or payment.
Read moreA mandatory implementation specification that must be implemented by all covered entities and business associates.
Read moreA required assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
Read moreThe process of implementing security measures to reduce risks identified in the risk analysis to reasonable levels.
Read moreProtective measures categorized as administrative, physical, or technical to meet Security Rule standards.
Read moreThe attempted or successful unauthorized access, use, disclosure, modification, or destruction of information in a system.
Read moreThe designated individual responsible for developing and implementing security policies and Security Rule compliance.
Read moreHIPAA rule establishing national standards for protecting ePHI through administrative, physical, and technical safeguards.
Read moreAn AICPA auditing standard evaluating controls related to security, availability, integrity, confidentiality, and privacy.
Read moreTechnology and related policies that protect ePHI and control access, including access controls, audit logs, and encryption.
Read moreThree categories of permitted PHI uses and disclosures that do not require patient authorization.
Read moreComprehensive guide covering the Privacy Rule, Security Rule, and compliance requirements.
Frequently asked questions about HIPAA compliance, requirements, and best practices.
Templates, checklists, and resources to help you implement HIPAA compliance.