By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Availability (Information Security)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Availability is the information security principle that systems and data must be accessible and usable when authorized users need them. Along with confidentiality and integrity, it forms the core CIA triad of information security.
The HIMSS Dictionary defines availability as authorized users being able to reach data and information services reliably and when they need them.
| CIA Principle | Goal | Healthcare Example |
|---|---|---|
| Confidentiality | Only authorized people can see information | Access controls on patient records |
| Integrity | Information is accurate and not improperly altered | Audit trails and validation of results |
| Availability | Information and systems are accessible when needed | The EHR is up during a medication pass |
| Availability Concept | What It Means | Example |
|---|---|---|
| Uptime | The percentage of time a system is available | A service level target for an EHR |
| Redundancy | Duplicate components to avoid single points of failure | Two network paths to a data center |
| Failover | Automatic switching to backup systems | A secondary server taking over after a failure |
| Recovery Time Objective (RTO) | Maximum acceptable time to restore a system | Restore the EHR within a set number of hours |
| Recovery Point Objective (RPO) | Maximum acceptable data loss, measured in time | No more than minutes of lost documentation |
⚠️ Exam Alert: Availability is one leg of the CIA triad. Ransomware primarily attacks availability (and often confidentiality through data theft). RTO is about how fast systems return; RPO is about how much data can be lost. The HIPAA Security Rule protects the confidentiality, integrity, and availability of ePHI.
🌐 Why It Matters: Real-World Healthcare IT Context
Healthcare runs continuously, and clinical decisions depend on timely information. When the EHR, medication systems, imaging, laboratory systems, or networks are unavailable, care slows, errors become more likely, and organizations may divert ambulances or delay procedures. Availability is therefore a patient safety issue, not just a technical metric.
The HIPAA Security Rule explicitly protects the availability of ePHI, alongside confidentiality and integrity. Its administrative safeguards require contingency planning, including data backup, disaster recovery, and emergency mode operation plans, as well as testing and criticality analysis of applications and data.
Federal security standards also treat availability as a core objective. FIPS 199 defines availability as ensuring timely and reliable access to and use of information, and it uses the potential impact of a loss of availability to help categorize systems.
Threats to availability are varied. Hardware failures, software defects, power outages, network problems, natural disasters, vendor outages, and human error can all interrupt service. Cyberattacks, especially ransomware and denial-of-service attacks, deliberately target availability. Ransomware incidents have left hospitals without EHR access for days or weeks.
Organizations design for availability through redundancy, clustering, failover, geographically separated data centers, cloud hosting options, uninterruptible power supplies, and generators. Monitoring tools detect problems early, and change management reduces outages caused by updates.
Recovery planning sets expectations. Recovery time objectives and recovery point objectives are defined for each system based on how critical it is to care and operations. Backups must be protected from tampering, including offline or immutable copies that ransomware cannot encrypt, and restoration must be tested regularly.
Planned downtime is part of availability management too. Upgrades and maintenance require scheduled downtime, which organizations minimize, schedule carefully, and support with read-only systems and downtime reports.
Dependencies are easy to miss. A clinical application may depend on identity services, interface engines, networks, printers, and third-party services, so an outage in any one of them can make the application effectively unavailable. Mapping these dependencies helps organizations set realistic recovery objectives and avoid surprises during incidents.
Availability must be balanced with other goals. Strong security controls and frequent patching can sometimes require downtime, and organizations weigh these needs carefully, using maintenance windows and redundant systems to reduce disruption.
Common availability threats:
- Ransomware and other cyberattacks
- Hardware and network failures
- Power outages and natural disasters
- Vendor and cloud service outages
- Failed upgrades or configuration changes
- Single points of failure in infrastructure
Practices that improve availability:
- Redundant infrastructure and failover
- Defined RTOs and RPOs for critical systems
- Protected, tested backups, including offline copies
- Monitoring and rapid incident response
- Careful change management and maintenance windows
- Practiced downtime procedures and read-only access
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses depend on system availability every shift and are central to safe care when systems fail.
At the Bedside
Medication administration, documentation, monitoring, and communication all rely on available systems. During unplanned downtime, nurses switch to paper medication records, downtime reports, and manual verification. Knowing where downtime kits are and how to use them is essential.
Read-only systems and printed downtime reports, such as current medication lists and active orders, provide critical information during outages. Ensuring these reports are current and accessible on each unit is part of readiness.
In Clinical Workflow
Communication becomes even more important during downtime. Clear processes for ordering, results reporting, and handoffs, often using paper forms and phone calls, reduce the risk of missed information.
After systems return, nurses back-enter key documentation according to policy, such as medications given and vital signs. Recovery procedures must ensure that information recorded on paper reaches the electronic record accurately.
Practicing downtime through drills helps nurses respond calmly. Extended outages, such as those caused by ransomware, can last days or weeks, requiring sustainable paper processes.
Reporting slow or unavailable systems promptly helps IT detect problems early, sometimes before they affect the whole organization.
Nurse leaders often help decide which reports and information are most critical during downtime, ensuring that recovery priorities match clinical needs.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, organizations configure business continuity access workstations, downtime reports, and read-only systems, and they test failover. Training includes downtime procedures for the new system.
At-the-elbow support analysts help nurses understand where to find downtime tools and how to report outages. Early system instability after Go-Live makes clear communication about availability especially important.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Availability appears in security, infrastructure, and continuity questions:
| CAHIMS Domain | How Availability Appears |
|---|---|
| Healthcare & Technology Environments | CIA triad; HIPAA Security Rule; ransomware threats |
| Clinical Informatics | Downtime procedures, read-only access, back-entry of documentation |
| Healthcare Information & Systems Management | Redundancy, failover, backups, RTO and RPO, monitoring |
| Management & Leadership | Business continuity, disaster recovery, service level agreements |
Key Terms to Know Alongside Availability
- CIA Triad — confidentiality, integrity, and availability, the core goals of information security
- Redundancy — duplicate components that prevent single points of failure
- Recovery Time Objective (RTO) — the maximum acceptable time to restore a system
- Recovery Point Objective (RPO) — the maximum acceptable amount of data loss measured in time
- Business Continuity Plan (BCP) — a plan for continuing essential operations during disruptions
- Downtime Procedures — processes for providing care when systems are unavailable
HIMSS Organizational Position
HIMSS treats system availability and resilience as patient safety priorities and addresses them through its Healthcare Cybersecurity Community, research, and education on business continuity. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — FIPS 199, Standards for Security Categorization of Federal Information and Information Systems https://csrc.nist.gov/pubs/fips/199/final
- NIST — SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final
- HHS — The Security Rule https://www.hhs.gov/hipaa/for-professionals/security/index.html
- ONC — SAFER Guides https://healthit.gov/clinical-quality-and-safety/safer-guides/
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply