Vital Signs

Risk management is the ongoing work of directing and controlling an organization with regard to risk, and in health care it spans clinical safety as well as information security. This post explains the four meanings in the HIMSS Dictionary, the HIPAA risk management requirement, the NIST Risk Management Framework, what a study of eight organizations found about adherence to EHR safety practices, and what a review of 300 failure modes in adaptive radiotherapy shows about where risk concentrates.

ePHI is protected health information that is created, stored, transmitted, or received electronically, and it is the information the HIPAA Security Rule exists to protect. This post explains the regulatory definition, the Security Rule’s general requirements and technical safeguards, what a 6,612-breach analysis shows about hacking and business associates, and what phishing simulation studies in US health care found about employee click rates and training.

A risk assessment is the process of identifying, analyzing, and evaluating risks, and the report that summarizes an organization’s vulnerabilities, estimated costs of damage, and defensive measures. This post explains the HIPAA risk analysis requirement, how NIST Special Publication 800-30 structures the process, and what a 6,612-breach analysis, a scoping review of machine learning cybersecurity, and a review of medical device threats say about where risk is concentrated.

A contingency plan is an alternative plan that takes effect when normal operations are interrupted by an emergency, failover, or disaster. This post explains the five elements in the HIPAA Security Rule’s contingency plan standard, what a scoping review found about 701 days of hospital downtime in the US, what an analysis of 204 EHR downtime events in a hospital showed, and how nurses carry out the plan at the bedside.

A consent directive is the record of a person’s privacy choices, stating who may perform which operations on their health data, for which purposes, under what conditions, and for how long. This post explains how it differs from a paper consent form, what 42 CFR 2.31 requires of written consent for substance use disorder records, and what interviews with 16 stakeholders and a multi-system prototype show about building granular consent.

A vulnerability assessment is a systematic examination of a system to find, rank, and understand its security weaknesses and to judge whether safeguards are adequate. This post explains how it differs from a HIPAA risk analysis and a penetration test, what NIST guidance covers, and what a study that scanned 144 pieces of networked equipment in a radiology department found.

A security incident is an event that actually or potentially threatens the confidentiality, integrity, or availability of an information system or its data, or that violates security policy. This post explains the HIPAA definition in 45 CFR 164.304, the response requirement in 164.308, how an incident becomes a breach with a 60-day notice deadline, and what interviews and a literature review found about ransomware and emergency care.

Health information privacy is an individual’s right to control how identifiable health data are acquired, used, and disclosed. This post explains the HIPAA general rule on uses and disclosures, the right of access with its 30-day timeline, and the right to an accounting of disclosures, then looks at what an interview study of health care leaders and a survey on data control found about sharing and patient choice.

Data de-identification is the process of removing or altering information so that health data no longer identify an individual. This post explains the two HIPAA methods in 45 CFR 164.514, expert determination and Safe Harbor with 18 identifiers, and what studies found about re-identification risk in clinical notes, rare disease patients, and organizational data sharing practices.

A business associate is a person or organization that creates, receives, maintains, or transmits protected health information on behalf of a HIPAA covered entity, or provides certain services that involve access to it. This post explains who counts under 45 CFR 160.103, what the required contract says, and what two studies of OCR breach data found about business associates and the effect of the Omnibus Rule.

A privacy officer is the person a covered entity appoints to develop and implement its policies and procedures for complying with the HIPAA privacy requirements. This post explains the requirements in 45 CFR 164.530, including training, complaints, sanctions, mitigation, and documentation, how the role differs from the security official, and why informatics nurses are well placed for it.

Emergency access is the granting of user rights to reach protected health information and applications under emergency conditions outside normal workflows. This post explains the HIPAA requirement for an emergency access procedure, how break-the-glass overrides work, what a systematic review and dynamic access research say, and how nurses and analysts balance fast care with patient privacy.

Attribute-based access control, or ABAC, is a logical access control model that decides whether to allow an action by evaluating rules against attributes of the user, the object, the action, and the environment. This post explains how it differs from role-based access control, what a hospital study reported about role explosion and efficiency, and what nurses and analysts should know.

Vishing, or voice phishing, is a fraud tactic in which attackers use phone calls, voicemail, or VoIP to trick people into revealing sensitive information or taking harmful actions. This post explains how it works in health care, what a 3,000-call multilingual research dataset adds to detection work, what the HIPAA Security Rule requires for training, and the verification habits that stop it.

DS4P, or Data Segmentation for Privacy, is a standard that lets a provider tag a clinical document with privacy metadata describing the data’s classification and any redisclosure limits set by law. This post explains how security labels work, why 42 CFR Part 2 and other rules create demand for segmentation, what an automated FHIR segmentation study found, and how nurses and informaticists handle sensitive information.

An advanced persistent threat is a sophisticated, well-resourced adversary that gains a foothold in an organization’s systems and stays for a long time to steal information or disrupt operations. This post explains how APT campaigns work, why health care and research data attract them, which defenses matter most, and how clinicians and informaticists contribute.

Access control is the process of granting or denying requests to use information and information services and to enter physical facilities. This post explains the HIPAA technical safeguard for access control, the NIST control family behind it, how least privilege, separation of duties, and emergency access work in clinical settings, and what studies show about inappropriate access to records.

A privacy impact assessment, or PIA, is a structured method for identifying and assessing privacy risks across the life of a program or system by documenting what personally identifiable information is collected, how it is maintained, protected, and shared. This post explains when federal law and GDPR call for one, how a PIA differs from a HIPAA security risk analysis, what published examples show, and how nurses and informaticists contribute.

The chief information security officer, or CISO, leads an organization’s information security program and is responsible for securing digital information. This post explains typical CISO responsibilities, how the role relates to the HIPAA security official, how governance frameworks such as the NIST Cybersecurity Framework and 405(d) HICP support the role, what research shows about ransomware effects on care, and how nurses and clinical leaders partner with security.

Security Assertion Markup Language, or SAML, is an XML-based standard for exchanging authentication and authorization information between an identity provider and a service provider. This post explains the roles and flow of a SAML login, what assertions contain, how SAML relates to OpenID Connect, OAuth, and SMART on FHIR, and why single sign-on matters for clinicians.