By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Cybersecurity
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Cybersecurity is the work of protecting computers, networks, devices, and electronic information from attack, misuse, and accidental harm, and of responding effectively when something goes wrong.
The HIMSS Dictionary describes cybersecurity as the practice of keeping computer systems and electronic information safe by preventing attacks and unauthorized access, detecting them when they happen, and responding to them.
Security professionals often organize their goals around the CIA triad:
| Goal | What It Protects | Healthcare Example of Failure |
|---|---|---|
| Confidentiality | Information is seen only by authorized people | Stolen credentials used to download patient records |
| Integrity | Information is accurate and unaltered | A tampered medication list or a corrupted lab interface |
| Availability | Systems and information are usable when needed | Ransomware that shuts down the EHR and imaging systems |
In healthcare, availability and integrity carry unusual weight. A delayed lab result or a missing allergy list can directly affect patient safety.
The NIST Cybersecurity Framework 2.0, published in February 2024, organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern, new in version 2.0, emphasizes that cybersecurity is an enterprise risk owned by leadership.
⚠️ Exam Alert: Cybersecurity protects systems and electronic information. Privacy governs appropriate use and disclosure of personal information. Information security is a broader term that also covers paper records. A threat is a potential danger, a vulnerability is a weakness, and risk is the likelihood and impact of a threat exploiting a vulnerability. Expect questions that ask you to classify a scenario using these terms.
🌐 Why It Matters: Real-World Healthcare IT Context
Healthcare is one of the most targeted sectors. Hospitals hold valuable data, run around the clock, depend heavily on technology, and often operate older systems and medical devices that are hard to patch. Attackers know that organizations under pressure to restore patient care may be more willing to pay.
The consequences reach patients. A 2022 study in JAMA Health Forum by Hannah Neprash and colleagues identified 374 ransomware attacks on U.S. health care delivery organizations from 2016 through 2021, which exposed the protected health information of nearly 42 million patients. The annual number of attacks more than doubled over that period, and almost half of the attacks disrupted care, including electronic system downtime, canceled appointments, and ambulance diversion. The 2024 attack on Change Healthcare showed how one vendor incident can disrupt claims and pharmacy operations nationwide.
Healthcare relies on several frameworks:
- The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information, starting with a risk analysis.
- The HHS 405(d) program publishes Health Industry Cybersecurity Practices (HICP), which pairs the most relevant threats to healthcare with practical safeguards scaled to organization size.
- The NIST Cybersecurity Framework gives organizations a common language for managing cybersecurity risk.
Recovery is part of security. Organizations that keep tested, isolated backups and practice restoring critical systems can return to normal operations far faster after an attack. Cybersecurity planning therefore overlaps with business continuity planning: deciding which systems must come back first, how long clinical areas can safely operate on downtime procedures, and how information captured on paper will be entered afterward.
Medical devices add another layer. Since 2023, FDA has required manufacturers of new connected “cyber devices” to include cybersecurity information in their premarket submissions, including a software bill of materials, which helps hospitals understand what is inside the devices they buy.
Common healthcare cybersecurity weaknesses:
- Stolen credentials from phishing, without multifactor authentication
- Unpatched systems and end-of-life software
- Flat networks that let attackers move freely
- Legacy medical devices that cannot be updated
- Third-party vendors with broad remote access
- Untested backups and recovery plans
Foundations of a strong program:
- Leadership governance with clear ownership of cyber risk
- Regular risk analysis and asset inventory, including medical devices
- Multifactor authentication and least-privilege access
- Network segmentation and timely patching
- Tested, offline or immutable backups and downtime procedures
- Ongoing workforce awareness and easy reporting of suspicious activity
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are not security engineers, but their daily habits are among the most important defenses a hospital has.
At the Bedside
Locking a workstation when stepping away, never sharing a login or badge, and using only approved devices and apps for patient information all reduce risk. A workstation left logged in at the nurses’ station is an open door for anyone who walks by.
Medical devices are part of cybersecurity too. Infusion pumps, monitors, and other connected equipment should be used as configured, and unusual behavior, such as a device displaying unexpected messages or losing its connection, should be reported rather than worked around.
Personal devices deserve attention as well. Photographing patients or screens with a personal phone, texting patient details through consumer apps, or charging unknown devices from hospital workstations can expose data or introduce malware. Approved, organization-managed tools exist for those tasks for a reason.
In Clinical Workflow
Reporting is a clinical skill in cybersecurity. Suspicious emails, unexpected phone calls asking for credentials, unfamiliar USB drives, and systems behaving strangely should go to the help desk or security team quickly. Early reports can stop an attack before it spreads.
When an attack does happen, nurses keep care going. Downtime procedures, paper documentation, and clear communication protect patients while systems are restored. Nurses who have practiced downtime drills respond more confidently when a real outage occurs.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, security training is part of every user’s preparation: new credentials, multifactor enrollment, badge use, and how to report suspicious activity. Go-Live is also a period of elevated risk, because attackers know that staff expect emails and calls about new accounts and passwords.
At-the-elbow support analysts reinforce good habits by never asking for passwords, never logging in as a user, and directing questions about suspicious messages to the official reporting process. Security teams often increase monitoring during the Go-Live period to catch unusual activity early.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Cybersecurity appears throughout the exam:
| CAHIMS Domain | How Cybersecurity Appears |
|---|---|
| Healthcare & Technology Environments | Threat landscape; HIPAA Security Rule; HHS 405(d); FDA device cybersecurity |
| Clinical Informatics | Patient safety effects of outages; downtime workflows; secure clinical communication |
| Healthcare Information & Systems Management | Identity and access management, segmentation, patching, backups, incident response |
| Management & Leadership | Governance, risk analysis, vendor risk, workforce awareness, cyber insurance and budgeting |
Key Terms to Know Alongside Cybersecurity
- CIA Triad — the security goals of confidentiality, integrity, and availability
- Risk Analysis — an assessment of threats, vulnerabilities, likelihood, and impact to electronic protected health information
- Incident Response — the organized approach to detecting, containing, and recovering from a security incident
- Software Bill of Materials (SBOM) — a list of the software components that make up a product
- NIST Cybersecurity Framework (CSF) — a framework organizing cybersecurity outcomes into Govern, Identify, Protect, Detect, Respond, and Recover
- Ransomware — malware that encrypts systems or data and demands payment
HIMSS Organizational Position
HIMSS treats cybersecurity as a patient safety priority. Its Healthcare Cybersecurity Community brings together security leaders and clinicians, HIMSS publishes research on healthcare cybersecurity, and it engages on cybersecurity policy through its public policy and advocacy work. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — The NIST Cybersecurity Framework (CSF) 2.0 https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- HHS — Summary of the HIPAA Security Rule https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
- HHS — Cyber Security Guidance Material https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity/index.html
- Neprash et al. (2022), JAMA Health Forum — Trends in Ransomware Attacks on US Health Care Delivery Organizations https://pubmed.ncbi.nlm.nih.gov/36580326/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply