Vital Signs

A privacy impact assessment, or PIA, is a structured method for identifying and assessing privacy risks across the life of a program or system by documenting what personally identifiable information is collected, how it is maintained, protected, and shared. This post explains when federal law and GDPR call for one, how a PIA differs from a HIPAA security risk analysis, what published examples show, and how nurses and informaticists contribute.

A nursing information system is the part of the health information system that handles nursing documentation, especially maintenance of the nursing record. This post explains what it includes, how it relates to the EHR and to nursing terminologies, what recent studies found about near-misses, workarounds, and mobile systems, and how nurses and nurse informaticists shape it.

An infobutton is a link inside the EHR that sends the clinical context, such as the medication, diagnosis, patient age, or user role, to a knowledge resource so the response fits the situation. This post explains the HL7 Context-Aware Knowledge Retrieval standard, how requests and responses work, what a systematic review found about infobutton design, and how nurses and informaticists can use infobuttons for evidence and patient education.

ETL, short for extract, transform, load, is the process of pulling data from one database, converting it into the form a target needs, and writing it into that target. This post explains the three steps, how ETL differs from real-time interfaces, how the OHDSI community describes designing, mapping, implementing, and quality-checking an ETL, what two studies found when converting EHR data, and where nurses and clinical experts fit.

The chief information security officer, or CISO, leads an organization’s information security program and is responsible for securing digital information. This post explains typical CISO responsibilities, how the role relates to the HIPAA security official, how governance frameworks such as the NIST Cybersecurity Framework and 405(d) HICP support the role, what research shows about ransomware effects on care, and how nurses and clinical leaders partner with security.

Atomic data are data elements at the lowest level of detail, captured once at the source and available to be combined, summarized, and reused many ways. This post explains how atomic data differ from free text and summary data, how standards such as FHIR Observation and USCDI depend on them, what research says about structuring the EHR for secondary use, and why nurses and informaticists must agree on what each data point means.

Virtualization is the creation of a virtual rather than physical version of something, such as an operating system, a server, a storage device, or network resources. This post explains server and desktop virtualization, why hospitals use them, the security recommendations in NIST SP 800-125, and what a qualitative study found about virtual desktops and tap-on-tap-off logins in an emergency department.

Security Assertion Markup Language, or SAML, is an XML-based standard for exchanging authentication and authorization information between an identity provider and a service provider. This post explains the roles and flow of a SAML login, what assertions contain, how SAML relates to OpenID Connect, OAuth, and SMART on FHIR, and why single sign-on matters for clinicians.

A recovery time objective, or RTO, is the maximum tolerable time a computer system, network, or application can be down after a failure or disaster. This post explains how RTOs are set through business impact analysis, how they differ from recovery point objectives and actual downtime, how the HIPAA contingency plan requirements relate, and what research shows about EHR outages and clinical operations.

A licensed independent practitioner, or LIP, is a clinician permitted by law and by the organization to provide care without direction or supervision within the scope of the license and the privileges granted. This post explains how state law, medical staff credentialing, and hospital rules define the role, why the term matters for EHR order entry and security, and how one hospital used an LIP identifier to improve critical result communication.

Federally qualified health centers are community-based providers that receive HRSA Health Center Program funding to provide primary care to underserved communities. This post explains the program requirements, how CMS pays FQHCs under a prospective payment system, what HRSA data show about size and reach, and why health IT support, reporting, and EHR optimization are central to safety-net care.

A designated record set is the group of records a HIPAA covered entity maintains that includes medical and billing records, health plan enrollment and claims records, and other records used to make decisions about individuals. This post explains the regulatory definition, why it sets the boundary for patient access and amendment rights, how it differs from the legal health record, and where informatics decisions come in.

The chief medical information officer, or CMIO, is the physician leader who guides how clinical information systems are developed, implemented, and improved, and who works with IT leaders to turn clinician needs into specifications. This post explains typical responsibilities, how the title relates to CCIO and CNIO, what the AMIA task force recommended on education and skills, and how nurses and CMIOs partner.

An acceptable use policy, or AUP, tells employees and other workforce members how they may use an organization’s technology and data. This post explains what a good AUP covers, how it connects to HIPAA workstation, training, and sanction requirements and to NIST rules of behavior, and what the NCSBN social media guidance adds for nurses.

Cross-Enterprise Document Sharing, or XDS, is an Integrating the Healthcare Enterprise profile for registering, locating, and retrieving clinical documents across organizations. This post explains the registry and repository model, what an affinity domain is, what XDS does not do, and what recent studies say about technical implementation and governance.

A standard operating procedure, or SOP, documents the established steps for carrying out a task or responding to a situation. This post explains how SOPs differ from policies and guidelines, what the HIPAA Security Rule and CLIA require to be written down, why downtime procedures are a classic informatics SOP, and how to keep procedures current, findable, and usable.

Requirements are the needs, functions, and constraints that a software implementation or specification must satisfy. This post explains functional versus non-functional requirements, how to elicit them from clinicians, what makes a requirement testable, how traceability connects them to testing and go-live, and what research says about user-centered requirements work in health care.

The Minimum Data Set, or MDS, is the standardized assessment federal rules require for residents of Medicare- and Medicaid-certified nursing homes. This post explains the assessment schedule in 42 CFR 483.20, how care area assessments feed care plans, how MDS data reach CMS, what two recent studies found about data quality, and how MDS differs from the Nursing Minimum Data Set.

A healthcare clearinghouse converts health information between nonstandard formats and the standard transactions HIPAA requires, and the regulation treats it as a covered entity. This post explains the regulatory definition, the transactions involved, how clearinghouses differ from payers and vendors, and what the 2024 Change Healthcare cyberattack showed about dependence on a few intermediaries.

A data use agreement, or DUA, is the contract a HIPAA covered entity must have with the recipient of a limited data set. This post explains what the agreement must contain, which purposes are allowed, how a DUA differs from a business associate agreement and from de-identified data, and where nurses and informatics staff meet DUAs in research, quality, and analytics work.