By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Health Information Privacy
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Health information privacy is an individual’s right to control how their identifiable health data are acquired, used, and disclosed. The HIMSS Dictionary defines it this way and refers readers to HIPAA, the main US federal law in the area. Privacy is a question of who is allowed to have information and for what purpose. It is related to, but different from, confidentiality (the duty of those holding information to protect it) and security (the technical and administrative measures that protect it).
HIPAA’s Privacy Rule, at 45 CFR part 164 subpart E, sets the framework. Its general rule at 164.502(a) says that a covered entity or business associate may not use or disclose protected health information except as the rules permit or require. Permitted uses include disclosures to the individual and uses for treatment, payment, and health care operations. Other uses and disclosures need the individual’s written authorization or fit a specific exception, such as public health activities.
Individuals also have rights. Under 164.524, a person generally has a right to inspect and obtain a copy of protected health information in a designated record set, and the covered entity must act on a request no later than 30 days after receiving it, subject to the extension provisions. Under 164.528, a person has a right to an accounting of certain disclosures made in the six years before the request, excluding disclosures for treatment, payment, and operations, to the individual, and under authorization, among other exceptions.
| Concept | Meaning | Example |
|---|---|---|
| Privacy | Control over use and disclosure | Patient decides whether a researcher may use identifiable data |
| Confidentiality | Duty to keep information private | Nurse does not discuss a patient in a public hallway |
| Security | Safeguards for data | Encryption, access control, audit logs |
| Right of access | Patient may obtain a copy | Request for records within 30 days |
| Accounting of disclosures | Patient may learn certain disclosures | List of disclosures to a public health agency |
⚠️ Exam Alert: Privacy concerns rights and permitted uses; security concerns safeguards; confidentiality concerns the duty. HIPAA applies to covered entities and business associates, not to every holder of health data. A request for access and a request for an accounting of disclosures are different rights.
🌐 Why It Matters: Real-World Healthcare IT Context
Patients share sensitive information with clinicians because they trust that it will be handled properly. Data now flow to payers, health information exchanges, researchers, analytics vendors, and technology companies, and the rules and expectations do not always match.
An interview study in Applied Clinical Informatics illustrates the gap. Researchers interviewed 24 informatics leaders from 22 US health care organizations about sharing clinical data for purposes beyond treatment, payment, and operations. They found considerable variation in policies and practices, and in how leaders understood the terms “data sharing” and “research,” which ranged from academic and public health uses and health information exchange to selling data for corporate research or contracting with aggregators. Themes included that organizations rarely make data-sharing policies readily available, have widely varying approval processes, most commonly rely on HIPAA de-identification, are concerned about EHR vendors’ use of data, lack transparency to the public, and give individual patients little control. The study found no change in practices in the year after the 2022 Supreme Court decision on abortion rights, and the authors recommended updating HIPAA, adding re-identification and onward-sharing limits to contracts, coordinating approvals, and offering transparency and opt-out options. It is a small interview sample, but it shows the range of practice behind the label “compliant.”
Patient attitudes also matter. A 2025 survey in JMIR Medical Informatics examined what influences the public’s willingness to share different types of health data, using a web-based survey with 257 valid responses recruited through a Chinese survey platform. The authors found that data control reduced the perceived risks of sharing, that people who discount future benefits heavily overestimated the costs and risks, and that willingness was driven mainly by perceived costs. They suggested that giving individuals more control over their data, or offering direct short-term incentives, may promote sharing. Because the sample comes from one country’s online panel, results may not transfer to US patients, but the central idea is consistent: when people feel in control, they perceive less risk.
Operationally, privacy programs combine policies, training, technology, and monitoring. They define who may access which records and why, and audit access for inappropriate viewing, such as staff looking up friends, relatives, or celebrities. They process access requests promptly, since the regulation sets a 30-day expectation, and keep records that support accounting of disclosures. They also manage consent and authorization for special categories of information under applicable federal and state laws, and review new technologies, such as patient apps and AI tools, before they receive PHI. Privacy staff work with security teams on incidents, since an impermissible disclosure may be a breach that triggers notification.
Common privacy problems:
- Snooping in records by workforce members
- Slow or incomplete responses to patient access requests
- Unclear rules for data used beyond treatment, payment, and operations
- Disclosures that cannot be traced for an accounting
- Vendors and apps receiving data without review
- Patients who do not know how their data are used
What supports strong health information privacy:
- Role-based access and routine audit of access
- Clear workflows for access and accounting requests
- Public, plain-language statements of data-sharing practices
- Contracts that limit vendor use and onward sharing
- Training with real scenarios
- Patient control options where law and operations allow
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses handle sensitive information in every encounter and are often the first to receive a privacy question.
At the Bedside
Nurses protect privacy in simple ways: closing curtains and doors, lowering voices, confirming who may receive information, and logging out of workstations. Families often ask for updates, and nurses check the patient’s preferences and the facility’s rules before sharing.
In Clinical Workflow
Unit nurses direct patients who want a copy of their record to the proper channel and know where to report a possible violation. Nurse managers review access audit reports for their units and counsel staff after inappropriate access. Nurses in research and public health settings watch the line between care and secondary uses.
Nurse informaticists contribute to role definitions, break-the-glass workflows, and privacy review of new tools. They help ensure that restrictions requested by patients can be honored in daily work.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live changes who can see what, because roles, security classes, and patient privacy flags are all rebuilt or reviewed. At-the-elbow support analysts learn quickly when a role is too narrow to do the job or too broad to be safe, and they route those findings to security and privacy teams.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Health information privacy appears in law, governance, and security questions:
| CAHIMS Domain | How Privacy Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA, state law, patient rights, ethics |
| Clinical Informatics | Consent, sensitive data, patient access, data use |
| Healthcare Information & Systems Management | Access control, audit logs, disclosure tracking |
| Management & Leadership | Privacy program, training, incident response, vendor oversight |
Key Terms to Know Alongside Health Information Privacy
- Protected Health Information (PHI) — individually identifiable health information handled by covered entities and business associates
- Covered Entity — health plan, clearinghouse, or provider that conducts standard transactions
- Minimum Necessary — standard to use or disclose only the information needed for a purpose
- Authorization — individual’s written permission for specified uses or disclosures
- Accounting of Disclosures — record of certain disclosures that an individual may request
- Right of Access — individual’s right to inspect and obtain a copy of their health information
HIMSS Organizational Position
HIMSS supports privacy and security in health information through its public policy work, Healthcare Cybersecurity Community, and research. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.502, Uses and Disclosures of Protected Health Information: General Rules https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
- eCFR — 45 CFR 164.524, Access of Individuals to Protected Health Information https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
- eCFR — 45 CFR 164.528, Accounting of Disclosures of Protected Health Information https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.528
- Jackson et al. (2025), Applied Clinical Informatics — Ethical Dimensions of Clinical Data Sharing by U.S. Health Care Organizations for Purposes Beyond Direct Patient Care: Interviews With Health Care Leaders https://pubmed.ncbi.nlm.nih.gov/39362293/
- Wei et al. (2025), JMIR Medical Informatics — The Impact of Data Control and Delayed Discounting on the Public’s Willingness to Share Different Types of Health Care Data: Empirical Study https://pubmed.ncbi.nlm.nih.gov/39864171/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply