By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: CISO (Chief Information Security Officer)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
The chief information security officer (CISO) is the executive who leads an organization’s information security. The HIMSS Dictionary describes the role as controlling information security issues and owning the protection of all digital information the organization handles, and notes that the CISO and chief security officer (CSO) titles may be interchangeable, though a CISO may also take on physical security.
In health care the CISO sits where technology, compliance, and clinical operations meet. The job covers strategy, risk management, policy, security operations, incident response, vendor risk, awareness training, and reporting to executives and the board.
| Role | Primary Focus | Relationship to the CISO |
|---|---|---|
| CISO | Enterprise security strategy, risk, and response | Leads the security program |
| HIPAA Security Official | Person identified as responsible for HIPAA security policies | Often the CISO or a delegate |
| Privacy Officer | Privacy program and patient rights | Works closely with the CISO |
| CIO | IT strategy and operations | Partner, and sometimes the CISO’s manager |
| Security Administrator | Day-to-day control operation | Reports into the security program |
| CMIO or CNIO | Clinical informatics leadership | Clinical partners for safety-sensitive decisions |
⚠️ Exam Alert: The CISO is a role of leadership and accountability for the security program. HIPAA requires that a covered entity identify a security official, but it does not mandate the title CISO. A CSO may also cover physical security. The CISO is not the same as the privacy officer, though the roles overlap.
🌐 Why It Matters: Real-World Healthcare IT Context
The CISO exists because security is a business and patient safety risk, not only a technical one. Attackers target hospitals because disruption forces decisions under pressure, and because health records are valuable. A leader with authority, visibility, and a seat at the executive table can weigh risks against budgets, clinical needs, and strategic plans.
HIPAA sets a floor. The Security Rule‘s administrative safeguards at 45 CFR 164.308 require covered entities and business associates to identify the security official responsible for developing and implementing the required policies and procedures. Many organizations name the CISO to that role. The rule also requires risk analysis and risk management, workforce training, contingency planning, and incident procedures, all of which the CISO typically oversees or coordinates.
Frameworks give structure. The NIST Cybersecurity Framework organizes cybersecurity outcomes into functions that include governance, identification, protection, detection, response, and recovery, and it is widely used to communicate about risk with executives and boards. In health care, the HHS 405(d) program publishes Health Industry Cybersecurity Practices, a voluntary set of practices organized to help organizations of different sizes reduce common threats, and HHS has published cybersecurity performance goals for the sector.
The patient safety dimension is documented. A cohort study of ransomware effects at untargeted academic hospitals adjacent to an attacked health system compared cardiac arrest incidence before, during, and after the attack. The number of total cardiac arrests rose from 21 in the pre-attack phase to 38 during the attack phase, and the total in the attack month exceeded the forecast, 41 observed against 27 forecast, with out-of-hospital arrests at 24 observed against 12 forecast. Survival with favorable neurologic outcome decreased, driven by increased out-of-hospital arrest mortality. This was an observational study of two hospitals and cannot prove cause, but it shows that a cyberattack on one organization can ripple through regional care.
Organizational culture matters as much as tools. A health system case report describing a New Jersey system’s approach emphasized that cybersecurity is a team effort in which everyone from board trustees to frontline employees is accountable, with action plans spanning technology, process improvements, governance under a chief information security officer, vendor management, and employee education. Preparedness is also trainable: a 2026 report on a multistakeholder tabletop simulation set in a 350-bed hospital hit by ransomware described how participants took on leadership, clinical, technical, compliance, and vendor roles to practice incident response, regulatory compliance, and collaboration.
The CISO’s relationships with clinical leaders are decisive. Security controls that block care get bypassed, and clinical processes that ignore security create exposure. Strong CISOs invite nursing, medicine, pharmacy, and clinical engineering into governance, listen to workflow constraints, and explain risk in terms of patient safety rather than only compliance.
Common CISO role challenges:
- Responsibility for outcomes without control over the budget or the systems
- Reporting lines that bury security under operations
- Medical devices and legacy systems that cannot be patched quickly
- Third-party vendors with access that the organization cannot fully see
- Security controls introduced without clinical input
- Burnout and turnover in security teams
What supports an effective CISO:
- Executive and board sponsorship with regular reporting
- Clear authority and a defined relationship with the CIO, CMIO, and CNIO
- A recognized framework and measurable goals
- Practiced incident response, including downtime exercises with clinical leaders
- Vendor risk management tied to contracts
- Security awareness that respects clinical realities
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are both a major target of phishing and the people who keep care going during an incident, so the CISO relationship matters.
At the Bedside
Most security actions at the bedside are simple: locking screens, protecting badges, reporting odd emails, and not sharing logins. Reports from the unit are often the first sign of trouble. Nurses who report a suspicious message or a device behaving strangely quickly give the security team a head start.
During an incident, downtime procedures take over. Nurses who have practiced with downtime forms and know the chain of command can keep care safe.
In Clinical Workflow
Nurse leaders take part in security exercises, joining tabletop scenarios that include the loss of the EHR, the phone system, or medical devices. Their participation helps the CISO see how an incident would affect medication administration, patient identification, and discharge.
Nurse informaticists and a CNIO, where one exists, partner with the CISO on controls that must fit the workflow, such as authentication on shared workstations or restrictions on personal devices.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live expands the attack surface with many new accounts, interfaces, and devices. Security teams review access roles, test authentication, and check vendor connections beforehand. At-the-elbow support analysts remind users about credential protection and route suspicious activity to the security team during the busy weeks after go-live.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
The CISO appears in security governance, HIPAA, and leadership questions:
| CAHIMS Domain | How the CISO Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule, frameworks, threat landscape |
| Clinical Informatics | Clinical impact of controls and incidents, downtime readiness |
| Healthcare Information & Systems Management | Security architecture, monitoring, incident response, vendor risk |
| Management & Leadership | Governance, board reporting, risk appetite, budget |
Key Terms to Know Alongside the CISO
- Security Official — HIPAA-required person responsible for security policies and procedures
- Risk Analysis — assessment of threats and vulnerabilities to ePHI
- NIST Cybersecurity Framework — voluntary framework organizing cybersecurity outcomes
- HICP (Health Industry Cybersecurity Practices) — 405(d) practices for health care organizations
- Incident Response — coordinated actions to detect, contain, and recover from security incidents
- Tabletop Exercise — discussion-based simulation of an incident
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity leaders through its Healthcare Cybersecurity Community, research, and education. Members can find related resources through the HIMSS Resource Center and the community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.308, Administrative Safeguards (Assigned Security Responsibility) https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- NIST — Cybersecurity Framework https://www.nist.gov/cyberframework
- Pullin (2018), Frontiers of Health Services Management — Cybersecurity: Positive Changes Through Processes and Team Culture https://pubmed.ncbi.nlm.nih.gov/30124509/
- HHS 405(d) — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- Pham et al. (2024), Critical Care Explorations — Ransomware Cyberattack Associated With Cardiac Arrest Incidence and Outcomes at Untargeted, Adjacent Hospitals https://pubmed.ncbi.nlm.nih.gov/38605720/
- Houser et al. (2026), Advances in Health Information Science and Practice — Beyond the Firewall: A Multistakeholder Simulation for Cybersecurity Response in Health Information and Informatics Practice https://pubmed.ncbi.nlm.nih.gov/42591877/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply