Vital Signs

A denial-of-service attack tries to prevent legitimate users from reaching a service by flooding it with traffic or using up a shared resource. This post explains the HIMSS Dictionary definition and the distinction between DoS and DDoS, then reviews five sources: IETF RFC 4732, NIST SP 800-189 on mitigating DoS and DDoS, a study of cyberattack trends against hospitals from 2017 to 2023, a security rating of 373 Taiwanese hospital patient portals, and datasets for DDoS detection in healthcare Internet of Things settings.

An attack vector is a path that an unauthorized person or group uses to reach a target such as a system or network. This post explains the HIMSS Dictionary definition and the HIPAA risk analysis requirement, then reviews five sources: two studies of why hospital staff click on phishing messages, a review of linear accelerator cybersecurity, a framework for ICU ransomware preparedness, and a review of ransomware effects on trauma centers.

Log management is the process of generating, transmitting, storing, analyzing, and disposing of log data. This post explains the HIMSS Dictionary definition, the NIST SP 800-92 guidance, and the HIPAA requirements for audit controls and activity review, then reviews three studies that used EHR audit logs to model clinician workflow, find care team members, and measure AI scribe effects.

A hash function is a cryptographic algorithm that computes a fixed-length value from input data, in a way that is designed to prevent the original contents from being recovered from that value. This post explains the HIMSS Dictionary definition and the NIST view of one-way and collision-resistant functions, then reviews three studies of hashing for privacy-preserving record linkage: the OneFlorida network, three sickle cell disease registries, and a system that checks questionable entry of hashed identifiers.

Anti-virus software is a program designed to detect many forms of malware, stop them from infecting computers, and clean systems that are already infected. This post explains the HIMSS Dictionary definition, NIST Special Publication 800-83 Revision 1 on how to deploy anti-virus tools, and the HIPAA protection from malicious software specification, then reviews studies of ransomware in hospitals, including a South African laboratory attack, a review of ransomware in trauma centers, and a national analysis of breaches.

SSH, or Secure Shell, is a network protocol that gives administrators a secure way to reach a remote computer, along with the utilities that implement it. This post explains the HIMSS Dictionary definition, how NIST IR 7966 describes SSH uses and the risks of poorly managed SSH keys, the IETF architecture standard, and a 2025 study of defenses against brute-force attacks on remote access services.

Least privilege is the security principle that each user or system should have only the minimum access and authority needed to do its job. This post explains the HIMSS Dictionary definition and how it connects to the HIPAA Security Rule’s access control and information access management standards and the Privacy Rule’s minimum necessary standard, then reviews a systematic review of role-based access control in health information systems and a study using machine learning to find suspicious EHR access.

Sanitization is the process of removing information from media so that recovery is not possible or feasible. This post explains the HIMSS Dictionary definition, NIST Special Publication 800-88 Revision 2 and its clear, purge, and destroy methods, the HIPAA Security Rule’s required standards for disposal and media re-use, a primer on data sanitization and electronic waste, and a different use of the word in genomic data sharing.

TKIP, the Temporal Key Integrity Protocol, is a wireless security protocol from IEEE 802.11i built to strengthen WEP on existing hardware. This post explains what the HIMSS Dictionary says, what NIST Special Publication 800-97 reports about TKIP’s features and weaknesses, why NIST requires CCMP for federal wireless networks, and how the HIPAA transmission security standard applies to hospital Wi-Fi.

WEP, or Wired Equivalent Privacy, was the first security protocol for Wi-Fi networks, designed to give wireless links about the same privacy as a wired local network. This post explains the term as the HIMSS Dictionary describes it, why NIST guidance calls it inherently flawed, what replaced it, how the HIPAA Security Rule treats transmission over networks, and what two hospital wireless studies reported when WEP was still in use, in a prehospital network and a radiation oncology department.

An electronic audit trail is the record that an electronic medical record system keeps of who logged in, accessed, or changed patient information, and when. This post explains what the HIMSS Dictionary says about its uses, what the HIPAA Security Rule requires for audit controls and regular activity review, and what four recent studies learned by analyzing EHR audit logs: modeling 295 million actions with a language model, identifying ICU care teams, finding the daily frontline clinician, and measuring the real documentation-time effect of AI scribes.

Under HIPAA, psychotherapy notes are notes recorded by a mental health professional that document or analyze the contents of a counseling session and are kept separate from the rest of the patient’s record. This post explains what the definition includes and excludes, why an authorization is generally required to use or disclose them, why they fall outside the right of access, and what studies found about open notes in mental health care.

A whitelist, increasingly called an allowlist, is a list of entities approved for authorized access or privileged membership in a particular area of computing. This post explains how whitelists work, how NIST describes application whitelisting for stopping malware and unauthorized software, how a German research network manages allowlists for authentication between organizations, and what a 2025 study found when it restricted AI web retrieval to authoritative neurology sources.

SSL, or Secure Socket Layer, is the standard security technology for establishing an encrypted connection from a browser to a web server. This post explains how it works in plain language, why the modern protocol is TLS, what the NIST guidance in SP 800-52 Revision 2 requires of federal systems, how the HIPAA Security Rule treats transmission security, and what a study of the 3,000 top-ranked German-language health websites found about outdated protocol versions.

Healthcare data encryption disguises electronic health information so that unauthorized users cannot read it. This post explains encryption at rest and in transit, how the HIPAA Security Rule treats encryption as an addressable specification, what NIST guidance covers, what a scoping review of 52 primary care studies reported about insufficient encryption, and how a Portuguese case study estimated hospital cyberattack costs.

A security audit is a systematic evaluation of how well an information system conforms to established security criteria. This post explains what an audit examines, how it differs from audit logs, risk analysis, and security testing, what the HIPAA Security Rule requires for audit controls and periodic evaluation, what machine learning research found about detecting inappropriate record access, and how nursing audit log research could inform workload analysis.

Health information security refers to the physical, technological, and administrative safeguards used to protect identifiable health data from unwarranted access or disclosure. This post explains the three safeguard types, the HIPAA Security Rule’s general requirements, what a 2026 review says about clinician-level cybersecurity habits, and what a survey of 283 Israeli nurses and physicians found about WhatsApp use for clinical information.

A biometric identifier is biologically unique data that identify a person. The HIMSS Dictionary notes that under HIPAA biometric identifiers are protected health information, and the de-identification rule lists finger and voice prints among identifiers to remove. This post explains the term, what a Zambian study of ear images for infant identification reported, what a scoping review of 65 articles found on voice data ethics, and why biometrics raise privacy questions that passwords do not.

A zero-day threat exploits a security vulnerability that the software developer does not yet know about, so no fix exists at the time of the attack. This post explains why zero-days are hard to defend against, what a systematic review found about why health care systems are vulnerable, what a 2026 study of meta-learning intrusion detection reported using benchmark datasets, and what practical layers reduce exposure when no patch is available.

In information security, a threat is any circumstance or event with the potential to harm an organization, its assets, or individuals through an information system, and also the potential for a threat source to exploit a vulnerability. This post separates threat from vulnerability and risk, then reviews what interviews with emergency and IT staff, a literature review of emergency medicine, and a hospital phishing simulation in Norway say about how threats reach patient care.