By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Security Incident
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A security incident is an event that threatens an information system or its data. The HIMSS Dictionary describes it as an occurrence that actually or potentially endangers the confidentiality, integrity, or availability of a system or the information it processes, stores, or transmits, or that violates, or is about to violate, security policies, procedures, or acceptable use rules.
The HIPAA Security Rule uses a more compact definition. At 45 CFR 164.304, a security incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. The word “attempted” matters: a blocked intrusion attempt is still an incident that a covered entity must be prepared to handle, though not every attempt is reportable as a breach.
An incident is not necessarily a breach. Under 164.402, a breach is the acquisition, access, use, or disclosure of protected health information in a manner not permitted by the Privacy Rule that compromises its security or privacy. An impermissible use or disclosure is presumed to be a breach unless the covered entity or business associate shows a low probability that the PHI was compromised, based on a risk assessment of at least four factors: the nature and extent of the PHI involved, including the likelihood of re-identification; the unauthorized person who used it or received it; whether it was actually acquired or viewed; and the extent to which the risk has been mitigated. If a breach of unsecured PHI occurred, 164.404 requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery.
| Event | Security Incident? | Breach of PHI? |
|---|---|---|
| Failed login attempts blocked by controls | Yes (attempted) | No |
| Ransomware encrypts a server with ePHI | Yes | Presumed, pending risk assessment |
| Lost unencrypted laptop with PHI | Likely (possible unauthorized access) | Presumed unless low probability of compromise |
| Outage from failed hardware | Not under HIPAA‘s definition, which requires unauthorized activity | No |
| Staff member views a neighbor’s chart | Yes (policy violation) | Yes, unless low probability of compromise |
⚠️ Exam Alert: A security incident is a broad event category; a breach is a specific PHI event that triggers notification. The Security Rule requires security incident procedures; the Breach Notification Rule sets deadlines and content. Incident response has phases such as preparation, detection, containment, recovery, and lessons learned.
🌐 Why It Matters: Real-World Healthcare IT Context
The Security Rule requires covered entities and business associates to maintain security incident procedures. Under 45 CFR 164.308(a)(6), they must identify and respond to suspected or known incidents, mitigate harmful effects to the extent practicable, and document incidents and their outcomes. Related provisions require regular review of information system activity, such as audit logs and security incident tracking reports, and periodic evaluation of security policies and procedures. In other words, the law expects an organization to have a plan before an incident occurs.
NIST’s incident response guidance reflects current thinking. Revision 3 of Special Publication 800-61, published in April 2025 under the title Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, ties incident response to the broader NIST Cybersecurity Framework and treats it as part of managing risk, not a separate technical function.
The clinical consequences are documented. A 2024 qualitative study in Annals of Emergency Medicine interviewed nine emergency care providers and IT staff about large ransomware attacks on hospitals in Europe and the United States between 2017 and 2022. Five themes emerged: continuity of patient care, challenges during recovery, personal effects on staff, preparedness and lessons identified, and recommendations. Participants reported significant effects on emergency department workflow, acute care delivery, and the well-being of staff, and described limited preparedness. The authors noted that many hospitals were hesitant to participate, and the sample is small, so the study illustrates experience and does not measure frequency.
A 2026 literature review in the Journal of Emergency Medicine synthesized peer-reviewed and gray literature on cybersecurity incidents and emergency care. It reported that ransomware and other malicious software disrupt care, delay diagnostics, and compromise data integrity, and described a retrospective study in which a 2021 cyberattack at one health system was followed by a significant increase in cardiac arrests, with unfavorable neurological outcomes, at a geographically close hospital that was not itself attacked. Simulations and surveys revealed gaps in preparedness and hygiene among ED staff. The review concluded that regional planning, realistic simulation training, and proactive downtime protocols can help departments withstand attacks. It is a narrative review, and the evidence on patient outcomes comes from limited studies, but it shows that incidents can affect regional care capacity.
Good incident management is a team activity. Technical staff detect and contain the problem, privacy and compliance staff assess whether PHI is involved, clinical leaders decide how care continues, and communications staff inform patients, regulators, and the public as required. Organizations rehearse with tabletop exercises that include downtime: how are orders placed, medications given, results reported, and patients identified when the EHR is unavailable? Reporting culture matters too, since many incidents begin with a staff member who notices a suspicious email or an odd system behavior, and fast reporting limits damage.
Common security incident problems:
- Staff do not recognize or report suspicious activity
- No tested downtime procedures for clinical care
- Unclear roles during an incident
- Delayed risk assessment for breach decisions
- Poor logging that limits investigation
- Dependence on vendors whose own incidents affect the organization
What supports effective incident response:
- A written, practiced incident response plan
- Easy ways for staff to report concerns quickly
- Downtime procedures and paper forms that units rehearse
- Audit logs and monitoring that support investigation
- Clear decision paths for breach risk assessment and notification
- Post-incident reviews that lead to changes
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are both reporters of incidents and the staff who keep patients safe when systems fail.
At the Bedside
A nurse who clicks an odd link, notices an unfamiliar person at a workstation, or finds a device behaving oddly reports it right away, since early reports limit harm. During a system outage, bedside nurses switch to downtime procedures: paper medication records, manual patient identification, and verbal handoffs.
In Clinical Workflow
Nurse managers keep downtime kits stocked, ensure staff know where forms are, and lead drills. Charge nurses coordinate priorities when results and orders are delayed, and the house supervisor links with the incident command structure.
Nurse informaticists contribute to downtime plans, help design the recovery process so that paper records are back-entered completely, and take part in tabletop exercises that test clinical scenarios.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live includes downtime and business continuity planning, because the new system changes what a unit must do when it is unavailable. At-the-elbow support analysts and command center staff also learn the reporting path for suspected security problems, so that unusual behavior during go-live is escalated quickly.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Security incidents appear in security, compliance, and business continuity questions:
| CAHIMS Domain | How Security Incidents Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule, Breach Notification Rule, regulation |
| Clinical Informatics | Downtime procedures, patient safety during outages |
| Healthcare Information & Systems Management | Monitoring, logging, incident response, recovery |
| Management & Leadership | Incident command, communication, risk management |
Key Terms to Know Alongside Security Incident
- Breach of Unsecured PHI — impermissible use or disclosure of unsecured PHI that compromises it
- Incident Response Plan — documented procedures for detecting, containing, and recovering from incidents
- Ransomware — malicious software that blocks access to systems or data until payment is made
- Downtime Procedures — manual processes used when electronic systems are unavailable
- Audit Log — record of system activity used to investigate events
- Tabletop Exercise — discussion-based simulation of an incident
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community, research, and education. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.304, Definitions https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.304
- eCFR — 45 CFR 164.308, Administrative Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- eCFR — 45 CFR 164.404, Notification to Individuals https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404
- NIST — SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile https://csrc.nist.gov/pubs/sp/800/61/r3/final
- van Boven et al. (2024), Annals of Emergency Medicine — Hacking Acute Care: A Qualitative Study on the Health Care Impacts of Ransomware Attacks Against Hospitals https://pubmed.ncbi.nlm.nih.gov/37318433/
- Kahl et al. (2026), Journal of Emergency Medicine — Cybersecurity and Emergency Medicine: A Literary Review https://pubmed.ncbi.nlm.nih.gov/42150298/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply