Vital Signs

S/MIME is a method for sending email that is digitally signed and encrypted. This post explains the HIMSS Dictionary definition and the IETF standard behind it, then reviews six sources: RFC 8551, DirectTrust’s description of Direct secure messaging, a Texas project that cut messages not sent for lack of an address from 50 to 42 percent, a review of workflow problems with Direct messaging, a usability study of email encryption with 12 test participants, and a dental guide to sending sensitive data.

Data perturbation is a privacy-preserving data mining method for electronic health records, in which data are altered on purpose so that individual values are harder to recover. This post explains the HIMSS Dictionary definition and its two approaches, then reviews six sources: the HIPAA de-identification standard, a local differential privacy study on eICU data, an HbA1c prediction study with and without privacy noise, a 2026 perturbation framework for data mining, a re-identification risk review of primary care records, and a randomized response survey of 1,200 participants in Pakistan.

A smartcard is an integrated circuit card with a built-in processor that can run security algorithms, control data access, or perform other functions. This post explains the HIMSS Dictionary definition and how smartcards differ from magnetic-stripe and QR cards, then reviews five sources: the federal rule for two-factor sign-in on electronic controlled-substance prescriptions, a 2015 authentication scheme analysis, a Nigerian study of patient-held cards among 35 pregnant women, a Philippine proposal for a health smart card, and a Taiwanese visitor tracking system that read national insurance cards.

A brute force attack tries every possible value for a password until it finds the right one. This post explains the HIMSS Dictionary definition and why length, rate limiting, and multifactor authentication matter, then reviews six sources: NIST SP 800-63B-4 digital identity guidelines, the HIPAA person or entity authentication standard, a log study of more than one million brute force attacks on five servers, a simulation of an IoMT key scheme, a clinician cyber hygiene review, and a smartcard with fingerprint two-factor system for hospitals.

Business e-mail compromise, or BEC, is a sophisticated scam that targets businesses working with foreign suppliers or businesses that regularly make wire transfer payments. This post explains the HIMSS Dictionary definition, then reviews five sources: the FBI Internet Crime Complaint Center’s 2024 annual report, a multicenter study of simulated phishing at six US health care institutions, an evaluation of mandatory phishing training for high-risk employees, a randomized experiment with a real phishing simulation at a Norwegian hospital, and a review of cybersecurity do’s and don’ts in health care.

An access control list, or ACL, is a list of permissions attached to an object that specifies who or what may access it and which operations they may perform. This post explains the HIMSS Dictionary definition, then reviews six sources: NIST’s guide to attribute-based access control, the HIPAA Security Rule’s access control standard, a systematic review of role-based access control in health information systems, a patient-centric consent extension of role-based access, a hospital model that cut the number of roles by 68 percent, and an adaptive access governance model aimed at insider breaches.

Kerberos is a ticket-based protocol that lets trusted computers verify each other’s service requests over a network, like the Internet, that cannot be trusted. This post explains the HIMSS Dictionary definition, then reviews five sources: the Kerberos Version 5 specification in RFC 4120, a radiology single sign-on integration using a directory service, an XML security scheme that pairs Kerberos authentication with authorization, a ticket-based security scheme for multicenter research data, and a smartcard-based single sign-on design for telemedicine.

A cyberattack is an attack carried out through cyberspace that targets an organization’s use of computing to disrupt, disable, destroy, or maliciously control its environment, damage the integrity of its data, or steal controlled information. This post explains the HIMSS Dictionary definition, then reviews five sources: a cohort study of cardiac arrests at hospitals next to a ransomware-infected organization, an analysis of the 2017 WannaCry attack on the NHS, a description of a hospital shutdown and recovery, an economic case study of attacks on Portuguese public hospitals, and a systematic review of patient harms during hospital cyberattacks.

A Trojan horse is a computer program that appears to have a useful function but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting the legitimate authorizations of the user who runs it. This post explains the HIMSS Dictionary definition, then reviews five sources: NIST’s guide to malware incident prevention and handling, a large analysis of mobile health apps on Google Play, a review of ransomware in hospitals and trauma centers, a review of linear accelerator cybersecurity, and a scoping review of machine learning for health care cybersecurity.

Nonrepudiation refers to cryptographic receipts created so that the author of a message cannot falsely deny sending it, and to proof for a third party that only the signer could have created a signature. This post explains the HIMSS Dictionary definition, then reviews six sources: the NIST Digital Signature Standard, a notary archive model for signed patient documents, a public key infrastructure for e-referral and e-prescription, a blockchain-based medical record exchange design, a post-quantum authentication protocol for connected medical devices, and the FDA rule on electronic signatures.

Acceptable risk is the level of risk at which, after weighing the costs and benefits of reducing it, no action is judged to be warranted at a given time. This post explains the HIMSS Dictionary definition, then reviews six sources: NIST’s guidance on managing and assessing information security risk, the HIPAA requirements for risk management and for reasonable and appropriate safeguards, a framework that keeps patient safety and cybersecurity risk models separate, and a comparison of cybersecurity regulation for AI-enabled medical device software in Korea, the United States, and the European Union.

A security control assessment tests or evaluates an information system’s management, operational, and technical security controls to find out whether they are in place, working as intended, and meeting security requirements. This post explains the HIMSS Dictionary definition, then reviews six sources: NIST SP 800-53A, the NIST Risk Management Framework in SP 800-37, NIST SP 800-115 on technical testing, the HIPAA risk analysis and evaluation requirements, an analysis of 5,752 healthcare cyber incidents, and a cyber risk assessment approach for connected medical devices.

Intrusion detection is the act of detecting actions that threaten the confidentiality, integrity, or availability of a protected resource. This post explains the HIMSS Dictionary definition and the NIST classes of IDPS, then reviews five sources: NIST SP 800-94, a critical survey of AI-based intrusion detection for the Internet of Medical Things, a review of 24 primary studies on trustworthy detection, a deep learning model for MQTT attacks, and a governance-aware response framework tested in simulation.

AAA stands for authentication, authorization, and accounting, a security principle that checks who a user is, decides what the user may do, and records what the user did. This post explains the HIMSS Dictionary definition and how it maps to the HIPAA Security Rule, then reviews six sources: RFC 2903 on the generic AAA architecture, RFC 6733 on the Diameter protocol, the HIPAA technical safeguards, a systematic review of EHR security and privacy, a study of single sign-on in 55 hospitals, and a single sign-on study on a triage unit.

Voice ID, or voice authentication, is a type of user authentication that relies on voice print biometrics, built on the idea that vocal characteristics are unique to each person. This post explains the HIMSS Dictionary definition, then reviews five sources: NIST’s 2025 digital identity guidance, which says biometric comparison based on voice shall not be used, a survey of 170 people on passwordless authentication methods, a survey of audio deepfake detection, a forensic study of cloned voices, and a study that used speech pause patterns to detect cloned audio.

Symmetric-key cryptography protects data with one shared key that both parties use to encrypt and decrypt. It is simpler and faster than public-key methods, but the key has to be exchanged securely. This post explains the HIMSS Dictionary definition, then reviews five sources: NIST’s AES standard, NIST guidance on storage encryption, the HIPAA Security Rule’s encryption provisions, a patient-centric EHR system that combines AES with elliptic curve cryptography, and a lightweight cipher proposed for wireless body area networks.

Quantum computing is an area of research and development that uses the properties of quantum mechanics to perform some calculations faster than classical computers that rely on Boolean logic. This post explains the HIMSS Dictionary definition, then reviews five sources: NIST’s first post-quantum key establishment standard, NIST’s post-quantum digital signature standard, a review of post-quantum cryptography for healthcare, a review of quantum machine learning in diabetes, and a simulated hybrid quantum-classical model for ICU mortality prediction.

A computer virus is malicious software that is embedded in an existing program, copies itself into other programs when the host runs, and cannot run on its own. This post explains the HIMSS Dictionary definition and how NIST SP 800-83 separates viruses from worms and Trojan horses, then reviews four sources: a 1992 investigation of a computer virus outbreak in a hospital pharmacy handled with infection control methods, the HIPAA requirement for protection from malicious software, a systematic review of human factors in healthcare cybersecurity, and a review of cybersecurity do’s and don’ts.

A digital signature is a mathematical technique for confirming that a message, a piece of software, or a digital document is genuine and unaltered. This post explains the HIMSS Dictionary definition and how public and private keys work, then reviews six sources: NIST FIPS 186-5 and FIPS 204 on signature algorithms, the DEA rule that requires digital signatures for electronic controlled substance prescriptions, the HL7 FHIR Provenance resource, and two 2026 studies on post-quantum signatures for healthcare ledgers and Internet of Things devices.

Physical safeguards are the physical measures, policies, and procedures that protect an organization’s electronic information systems, buildings, and equipment from natural and environmental hazards and unauthorized intrusion. This post explains the HIMSS Dictionary definition and the four standards in 45 CFR 164.310, then reviews five sources: breach statistics from 2010 to 2018, a comparison of for-profit and non-profit breach types, a ranking of locations to secure first, and two surveys of hospital information security safeguards.