By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Health Insurance Portability and Accountability Act (HIPAA)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
HIPAA is the federal law, signed in 1996 as Public Law 104-191 and sometimes called the Kennedy–Kassebaum Act after its Senate sponsors, that set national rules for health insurance portability and for how healthcare data is exchanged and protected.
The HIMSS Dictionary describes HIPAA in terms of its two best-known titles. Title I keeps workers and their families from losing health coverage when they change or lose a job. Title II, the Administrative Simplification provisions, called for national standards for electronic healthcare transactions and for national identifiers for providers, health plans, and employers, and it addressed the privacy and security of health data. The goal was a more efficient healthcare system built on electronic data interchange.
Most of what healthcare IT professionals mean by “HIPAA” comes from the rules HHS wrote under Title II:
| Component | What It Does |
|---|---|
| Title I: Portability | Protects insurance coverage for workers and families who change or lose jobs |
| Transactions and Code Sets | Standardizes electronic claims, eligibility checks, remittances, and other transactions, along with the code sets they use |
| Unique Identifiers | Establishes national identifiers, such as the National Provider Identifier (NPI) and the employer identifier |
| Privacy Rule | Sets limits on how Protected Health Information may be used and disclosed, and gives patients rights over their records |
| Security Rule | Requires administrative, physical, and technical safeguards for electronic PHI |
| Breach Notification Rule | Requires notice to affected individuals, HHS, and sometimes the media after a breach of unsecured PHI |
| Enforcement Rule | Defines investigations, penalties, and procedures for violations |
⚠️ Exam Alert: The Privacy Rule covers PHI in every form, including paper and spoken words. The Security Rule covers only electronic PHI. The HITECH Act of 2009 is a separate law that strengthened HIPAA enforcement, extended direct liability to business associates, and created the breach notification requirements. Also remember that HIPAA applies to covered entities (health plans, clearinghouses, and providers who conduct standard electronic transactions) and their business associates, not to every company that handles health data. And the acronym is spelled HIPAA, not “HIPPA,” a misspelling that shows up as a distractor.
🌐 Why It Matters: Real-World Healthcare IT Context
HIPAA is the compliance boundary that almost every healthcare IT decision passes through. Cloud hosting, vendor contracts, analytics projects, patient portals, texting tools, and AI pilots all start with the same questions: is this PHI, who is the covered entity, and is a business associate agreement in place?
The HHS Office for Civil Rights (OCR) enforces the Privacy, Security, and Breach Notification Rules. Its investigations come from complaints, breach reports, and compliance reviews, and resolutions range from technical assistance to corrective action plans and civil money penalties. OCR has also made patients’ right to access their own records an enforcement priority, which connects HIPAA directly to patient portals and to the information blocking rules.
Business associates are part of the picture, and the scale can be enormous. In the 2024 ransomware attack on Change Healthcare, a business associate that processes claims for much of the industry, the company ultimately reported to OCR that approximately 192.7 million individuals were affected, making it the largest healthcare breach on record.
Failure modes of HIPAA programs:
- Treating HIPAA as an annual training video instead of an operating discipline
- Sharing PHI with vendors before a business associate agreement is signed
- Security risk analyses that are outdated, incomplete, or never acted on
- Workforce access that is broader than any role requires
- Slow or incomplete responses to patients requesting copies of their records
- Assuming HIPAA covers consumer health apps that are not acting for a covered entity
Strengths of mature HIPAA programs:
- A current, enterprise-wide security risk analysis tied to a remediation plan
- Role-based access, audit logging, and regular review of who looked at what
- A business associate inventory with agreements and security expectations for each vendor
- Clear minimum necessary standards built into workflows and reports
- Timely, well-rehearsed breach assessment and notification procedures
- Privacy and security officers with real authority and executive support
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
HIPAA is often taught to nurses as a list of things not to do. In practice it is also a framework for what nurses are allowed to do to care for patients well.
At the Bedside
Nurses share information constantly, and HIPAA permits most of it. Disclosures for treatment between members of the care team are allowed. Sharing relevant information with family members involved in a patient’s care is generally permitted unless the patient objects. Incidental disclosures, such as a conversation overheard despite reasonable precautions, are not violations when safeguards are in place.
What HIPAA does not tolerate is access without a need to know. Looking up a neighbor, a coworker, a celebrity, or a family member in the EHR is a violation even if the information is never shared, and audit logs routinely catch it.
In Clinical Workflow
The minimum necessary standard shapes everyday work: report sheets that include only what the next nurse needs, whiteboards that avoid diagnoses, and printed lists that are shredded at the end of the shift. Personal phones and consumer messaging apps are a recurring risk, because photos and texts with PHI can leave the organization’s control in seconds.
Nurses also field patient questions about their own records. Patients have a right to access their information, and nurses who know the organization’s release-of-information process, and its patient portal, help patients exercise that right instead of hitting a wall.
In EHR Implementation (Go-Live Perspective)
During Epic Go-Lives, HIPAA lives in the security build: role-based templates, break-the-glass access for restricted records, audit trail configuration, and printing and download controls. Those decisions are made long before cutover, and they determine what each nurse can see on Day 1.
End-user support analysts at the elbow see the edges of that build immediately, such as a float nurse who cannot open a patient on a new unit, or a user with access broader than the role should allow. Escalating access problems through the security team, rather than sharing logins or working around restrictions, is how Go-Live support protects both patients and staff.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
HIPAA is one of the most frequently tested laws on the CAHIMS exam:
| CAHIMS Domain | How HIPAA Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA titles and rules; HITECH changes; covered entities and business associates; OCR enforcement; transaction and code set standards |
| Clinical Informatics | Minimum necessary in workflow; break-the-glass access; patient right of access; privacy in clinical communication |
| Healthcare Information & Systems Management | Security Rule safeguards; risk analysis; audit controls; encryption; business associate agreements |
| Management & Leadership | Privacy and security officer roles; workforce training and sanctions; breach response planning |
Key Terms to Know Alongside HIPAA
- Protected Health Information (PHI) — individually identifiable health information held by a covered entity or business associate
- Covered Entity — a health plan, healthcare clearinghouse, or provider that conducts standard electronic transactions
- Business Associate Agreement (BAA) — the contract that obligates a vendor handling PHI to protect it under HIPAA
- HITECH Act — the 2009 law that strengthened HIPAA enforcement and created breach notification requirements
- Minimum Necessary — the principle that uses and disclosures of PHI should be limited to what the purpose requires
- Office for Civil Rights (OCR) — the HHS office that enforces the HIPAA Privacy, Security, and Breach Notification Rules
HIMSS Organizational Position
HIMSS supports privacy and security programs through its Healthcare Cybersecurity Community, its long-running Healthcare Cybersecurity Survey, and public policy engagement with federal agencies on HIPAA modernization and cybersecurity. Members can find privacy and security guidance through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS — Health Information Privacy (HIPAA) https://www.hhs.gov/hipaa/index.html
- HHS — Summary of the HIPAA Privacy Rule https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
- HHS — Summary of the HIPAA Security Rule https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
- HHS — Breach Notification Rule https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- HHS — HIPAA Enforcement https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/index.html
- NIST SP 800-66 Rev. 2 — Implementing the HIPAA Security Rule https://csrc.nist.gov/pubs/sp/800/66/r2/final
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply