By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Threat
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
In information security, a threat is, according to the HIMSS Dictionary, any circumstance or event that could harm an organization’s operations, including its mission, functions, image, or reputation, its assets, or the people it serves, by way of an information system. The harm may come from unauthorized access, destruction, disclosure, or modification of information, or from denial of service. The Dictionary also uses the word for the potential that a threat source will successfully take advantage of a particular vulnerability.
Three terms are often confused. A threat is something that could cause harm, such as a ransomware group, a phishing email, an insider with bad intent, a power failure, or a flood. A vulnerability is a weakness that a threat could use, such as unpatched software, a weak password, or a misconfigured server. A risk combines the two with likelihood and impact: how probable it is that a particular threat will exploit a particular vulnerability, and how bad the result would be. Reducing risk means addressing the threat, the vulnerability, the impact, or several of these.
| Concept | Question It Answers | Example |
|---|---|---|
| Threat source | Who or what could cause harm? | Criminal group, careless user, storm |
| Threat event | What could happen? | Phishing email, ransomware infection |
| Vulnerability | Where are we weak? | Unpatched server, shared password |
| Likelihood | How probable is it? | Frequent for phishing, rarer for sabotage |
| Impact | How bad would it be? | Systems down, care delayed, data exposed |
⚠️ Exam Alert: A threat is a potential cause of harm; a vulnerability is a weakness; a risk is the combination of likelihood and impact. Threats can be intentional or accidental, and natural or human-made. A threat actor is a person or group behind an attack, while the threat event is the action.
🌐 Why It Matters: Real-World Healthcare IT Context
Threats shape the daily work of hospital security teams, and clinical staff feel the consequences when those threats succeed. Three recent studies illustrate how.
The first is about what ransomware does to clinical work. A 2024 qualitative study in the Annals of Emergency Medicine interviewed nine emergency care professionals and IT staff who had been through large ransomware attacks on hospitals in Europe and the United States between 2017 and 2022. The researchers constructed five themes: patient care continuity, challenges during recovery, personal effects on staff, preparedness and lessons, and future recommendations. Participants said the attacks had a significant effect on emergency department workflow, care delivery, and the well-being of providers, and that preparedness for such incidents was limited. The authors noted that hospitals were hesitant to take part, so the sample was small, but the accounts give the view from the front line that technical reports omit.
The second looks across the research. A 2026 literature review in the Journal of Emergency Medicine concluded that cyberattacks on health care delivery organizations had grown in frequency and severity, with emergency departments disproportionately affected because they rely on electronic systems and operate under time pressure. The review described ransomware and other malicious software disrupting care, delaying diagnostics, and compromising data integrity. It cited a retrospective study that found a significant increase in cardiac arrests, with unfavorable neurological outcomes, at a hospital near one that suffered a 2021 cyberattack, which suggests regional effects on nearby facilities. It also reported simulations and surveys that exposed gaps in preparedness and security habits among emergency staff. The review is a synthesis of varied sources, including gray literature and expert opinion, so the strength of evidence differs between findings, but its recommendations are practical: regional planning, realistic simulation, and proactive downtime protocols.
The third looks at the human route in. Phishing remains a dominant way for attackers to reach health care systems. A 2026 study in the Journal of Medical Internet Research at a large Norwegian hospital tested whether a brief priming message based on cognitive dissonance, shown just before a real phishing simulation, would reduce clicks. In the randomized subset, 65 percent of the control group (22 of 34) clicked, compared with 44 percent of the primed group (14 of 32), while 53 percent of the 753 staff who did not respond to the invitation clicked. The overall statistical test did not show a significant difference (P = .22), so the authors stated that the evidence does not establish a reliable effect and that larger studies are needed. The result is useful for another reason: in a real hospital simulation, roughly half or more of staff clicked, which is consistent with the multi-institution findings discussed in the post on ePHI. Awareness training is necessary, but it is not enough alone.
Healthcare organizations monitor the threat landscape through intelligence sharing. The Health Information Sharing and Analysis Center (Health-ISAC) says its role is to help health sector organizations prevent, detect, and respond to cyber and physical security events through shared, actionable threat information. Security teams use such feeds, along with vendor advisories and government alerts, to learn which threats are active and which vulnerabilities are being exploited, and to adjust patching, monitoring, and staff alerts accordingly.
Turning that awareness into protection involves layered defenses. Technical measures include email filtering, multifactor authentication, patching, network segmentation, backups kept separate from the main network, and monitoring. Process measures include incident response plans, downtime procedures that clinical staff actually practice, and vendor oversight. Cultural measures include making it easy and safe to report a suspicious message. The point of naming a threat precisely is to select the right defense: a phishing threat calls for training and email controls, while a ransomware threat also calls for backups and recovery plans, and a power failure calls for generators and manual workflows.
Common threat-related problems:
- Treating all threats as the same instead of ranking them
- Confusing threats with vulnerabilities in reports
- Downtime plans that exist on paper but are not practiced
- Staff who hesitate to report mistakes or suspicious messages
- Little awareness of threats reported by peers and industry groups
- Dependence on one control, such as training alone
What supports good threat management:
- A current threat list tied to the risk assessment
- Participation in an information sharing community
- Layered technical, process, and cultural controls
- Realistic downtime and recovery exercises
- Simple, blame-free reporting of suspicious activity
- Regular review as the threat landscape changes
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses are both targets of threats, such as phishing, and the people who keep care going when a threat succeeds.
At the Bedside
A suspicious email, an unfamiliar USB drive, or a pop-up on a workstation can be the first sign of a threat. Nurses who pause, avoid clicking, and report right away give security teams time to respond. When systems go down, nurses use downtime forms, paper orders, and manual medication checks to keep patients safe.
In Clinical Workflow
Nurse managers know which downtime procedures staff have actually practiced. They schedule drills, keep downtime supplies on the unit, and make sure new staff know where to find them. They also communicate openly when staff report mistakes, so people do not hide them.
Nurse informaticists help write and test downtime procedures, advise on which clinical functions are most critical to restore first, and join tabletop exercises that simulate cyber incidents.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live brings many new users and credentials at once, which creates openings for phishing and credential misuse. At-the-elbow support analysts remind staff to guard passwords and badges, report suspicious messages, and use the approved downtime process, because the same preparation used for planned downtime helps in an attack.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Threats appear in security, risk, and continuity questions:
| CAHIMS Domain | How Threats Appear |
|---|---|
| Healthcare & Technology Environments | Threat landscape, regulation, sharing communities |
| Clinical Informatics | Downtime procedures, patient safety, clinical continuity |
| Healthcare Information & Systems Management | Technical controls, monitoring, incident response |
| Management & Leadership | Risk assessment, governance, awareness training |
Key Terms to Know Alongside Threat
- Vulnerability — weakness that a threat could exploit
- Risk — combination of the likelihood of a threat exploiting a vulnerability and the impact
- Threat Actor — person or group that carries out a malicious action
- Ransomware — malicious software that blocks access to data or systems until payment
- Phishing — deceptive messages that try to steal credentials or install malware
- Incident Response Plan — documented process for detecting, containing, and recovering from incidents
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community, research, and education. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- NIST — Computer Security Resource Center Glossary: Threat https://csrc.nist.gov/glossary/term/threat
- Health-ISAC (Health Information Sharing and Analysis Center) https://health-isac.org/
- van Boven et al. (2024), Annals of Emergency Medicine — Hacking Acute Care: A Qualitative Study on the Health Care Impacts of Ransomware Attacks Against Hospitals https://pubmed.ncbi.nlm.nih.gov/37318433/
- Kahl et al. (2026), Journal of Emergency Medicine — Cybersecurity and Emergency Medicine: A Literary Review https://pubmed.ncbi.nlm.nih.gov/42150298/
- Yeng et al. (2026), Journal of Medical Internet Research — Cognitive Dissonance-Based Priming Intervention: Randomized Encouragement With In-the-Wild Phishing Simulation Attack in Health Care https://pubmed.ncbi.nlm.nih.gov/42224651/
- Gordon et al. (2019), JAMA Network Open — Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions https://pubmed.ncbi.nlm.nih.gov/30848810/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply