By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: CIA Triad (Confidentiality, Integrity, Availability)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
The CIA triad is a model that guides information security policy using three goals: confidentiality, integrity, and availability. It is sometimes called the AIC triad to avoid confusion with the intelligence agency of the same initials.
The HIMSS Dictionary describes the three elements as the most crucial components of security. Each answers a different question about information: who can see it, whether it is accurate, and whether people can use it when needed.
| Goal | Question It Answers | Healthcare Example |
|---|---|---|
| Confidentiality | Is information limited to authorized people? | Role-based access, encryption, privacy audits |
| Integrity | Is information accurate and unaltered by unauthorized change? | Audit trails, validation, preventing tampering |
| Availability | Can authorized users reach it when needed? | Redundancy, backups, downtime procedures |
⚠️ Exam Alert: Confidentiality is about who may see information, integrity is about whether it is correct and unchanged, and availability is about whether it can be used when needed. A ransomware attack that locks a system primarily attacks availability, while a snooping employee violates confidentiality, and an unauthorized edit to a medication list violates integrity.
🌐 Why It Matters: Real-World Healthcare IT Context
The triad gives security teams and clinicians a shared vocabulary. When a risk is described by the goal it threatens, it becomes easier to choose controls and to explain tradeoffs.
HIPAA builds directly on these goals. The Security Rule‘s general requirements direct covered entities and business associates to ensure the confidentiality, integrity, and availability of all electronic protected health information they create, receive, maintain, or transmit, to protect against reasonably anticipated threats or hazards, and to protect against impermissible uses or disclosures. Almost every Security Rule safeguard can be traced to one or more of the three goals. NIST’s FIPS 199 uses the same three objectives to categorize federal information systems by potential impact, a method many healthcare organizations borrow.
Confidentiality controls include role-based access, minimum necessary rules, strong authentication, encryption at rest and in transit, and monitoring for inappropriate access. In practice, many confidentiality incidents in hospitals come from workforce members looking at records without a job-related reason, which makes audit trails and education as important as technology.
Integrity controls protect accuracy. They include input validation, version control, digital signatures, checksums, change management, and audit logs. In clinical systems, integrity also covers matching the right data to the right patient and preventing silent corruption as data moves across interfaces. The earlier Word of the Day on data integrity covers this in more depth.
Availability controls keep systems and data usable. Redundant hardware, backups, disaster recovery plans, capacity planning, and downtime procedures all serve availability. In health care, availability is a patient safety issue because clinicians need medication lists, allergies, and results at the point of care. Research on ransomware attacks against US health care delivery organizations documents the rise of this threat, and disruptions to care operations are among the consequences organizations plan for.
The goals can pull in different directions. Tight confidentiality controls, such as short session timeouts, may slow care and reduce availability. Making data widely available to support care coordination can weaken confidentiality unless access is well governed. Strong integrity controls, such as approvals for every change, can delay urgent updates. Good security design balances the three according to risk, not by maximizing one at the expense of the others, and the HIPAA flexibility-of-approach provision allows organizations to choose measures that fit their size, complexity, and risks.
Risk analysis is where the triad becomes practical. For each system, the team asks what would happen if the wrong people could see its data, if its data were changed without anyone noticing, or if it were unavailable for an hour or a day. The answers differ by system. An EHR rates high on all three goals. A medication dispensing cabinet depends heavily on availability and integrity. A public website matters little for confidentiality but still needs integrity so patients are not misled. Ranking systems this way directs limited security effort and budget to the places where a failure would hurt patients most, and it gives clinical leaders a clear way to discuss priorities with technical teams.
Many frameworks extend the triad. Authenticity, accountability, and non-repudiation are often added to describe who did what and whether they can later deny it. Privacy is related but distinct: it concerns the appropriate use of personal information, while confidentiality is the security means for restricting access.
Common triad-related failures:
- Excessive access that weakens confidentiality
- Unmanaged changes or interface errors that damage integrity
- Single points of failure that threaten availability
- Security controls that clinicians work around because they slow care
- Focusing on one goal and neglecting the others
- Incident plans that cover breaches but not outages
What supports all three goals:
- Risk analysis tied to each goal
- Role-based access, encryption, and monitoring
- Change control, validation, and audit trails
- Redundancy, backups, and tested recovery plans
- Downtime procedures practiced with clinical teams
- Training that connects each goal to daily work
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses uphold all three goals during every shift, often without naming them.
At the Bedside
Confidentiality shows up as logging out of workstations, not sharing passwords, using privacy screens, and accessing only the records needed for care. Conversations in hallways and photos on personal phones are confidentiality risks too.
Integrity shows up as accurate documentation: right patient, right values, right time. Copying and pasting old assessments forward without review, or scanning a copied barcode, damages the trustworthiness of the record.
Availability shows up when the system is slow or down. Knowing downtime procedures, where paper forms are kept, and how to reconcile documentation afterward keeps care safe.
In Clinical Workflow
Reporting suspicious emails, lost badges, missing devices, and odd system behavior supports all three goals. A phishing email threatens confidentiality and availability at once, and early reports limit the damage.
Nurse leaders and informaticists help balance security with workflow. When a control seems to slow care, raising it with specifics helps find a better design rather than a workaround.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live prepares for each goal: access roles and break-the-glass rules for confidentiality, validated interfaces and testing for integrity, and downtime plans, backup workstations, and command center support for availability.
At-the-elbow support analysts reinforce habits that protect the triad, such as secure logins, correct patient selection, and reporting problems early.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
The triad is a core concept in security and risk questions:
| CAHIMS Domain | How the CIA Triad Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule requirements, threat landscape |
| Clinical Informatics | Clinical impact of integrity and availability failures |
| Healthcare Information & Systems Management | Controls mapped to each goal, risk analysis, disaster recovery |
| Management & Leadership | Balancing security and usability, governance, policy |
Key Terms to Know Alongside the CIA Triad
- Confidentiality — limiting information access and disclosure to authorized parties
- Integrity — protecting information from improper modification or destruction
- Availability — ensuring timely and reliable access for authorized users
- Risk Analysis — process of identifying threats and vulnerabilities to the three goals
- Non-Repudiation — assurance that an action cannot later be credibly denied
- Security Categorization — rating systems by potential impact on each goal
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community, education, and research. Members can find related resources through the HIMSS Resource Center.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.306, Security Standards: General Rules https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.306
- NIST — FIPS 199, Standards for Security Categorization of Federal Information and Information Systems https://csrc.nist.gov/pubs/fips/199/final
- NIST — SP 800-66 Rev. 2, Implementing the HIPAA Security Rule https://csrc.nist.gov/pubs/sp/800/66/r2/final
- HHS — The Security Rule https://www.hhs.gov/hipaa/for-professionals/security/index.html
- Neprash et al. (2022), JAMA Health Forum — Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations https://pubmed.ncbi.nlm.nih.gov/36580326/
- NIST — Cybersecurity Framework https://www.nist.gov/cyberframework
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply