By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Zero Trust (ZT)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Zero Trust is a security strategy built on one idea: no one and nothing gets automatic trust. Every user, device, application, and connection has to prove it should have access, every time it asks for something, whether the request comes from across the world or from a workstation down the hall.
The HIMSS Dictionary describes Zero Trust as a data-focused cybersecurity approach that refuses to assume any person, device, web service, or network connection is trustworthy, even when the request starts inside the organization’s own network boundary. It notes that the model has grown to account for distributed computing and an attack surface that keeps getting larger. The Dictionary contrasts Zero Trust with single sign-on, where one login opens many services, and explains that Zero Trust instead checks credentials again whenever a resource is requested.
In practice, many organizations combine the two: single sign-on provides convenience, while Zero Trust policies keep evaluating the user, the device, and the risk of each request behind the scenes.
The National Institute of Standards and Technology (NIST) formalized the approach in Special Publication 800-207, Zero Trust Architecture, published in August 2020.
| Traditional Perimeter Model | Zero Trust Model |
|---|---|
| Trust is granted based on network location (“inside” is safe) | Trust is never assumed based on location |
| Strong walls at the edge, open movement inside | Access is checked for each resource and session |
| A stolen password can reach many systems | Access depends on identity, device health, and context |
| Large, flat networks | Segmented networks that limit how far an attacker can move |
| Security reviews happen periodically | Activity is monitored continuously and policies adapt |
⚠️ Exam Alert: Zero Trust is a strategy and architecture, not a single product. Multifactor authentication and least privilege are building blocks of Zero Trust. Microsegmentation is a network technique that supports it. Single sign-on is an authentication convenience that can coexist with Zero Trust when sessions are continuously evaluated. If an answer choice says Zero Trust can be achieved by buying one tool, it is probably wrong.
🌐 Why It Matters: Real-World Healthcare IT Context
The old perimeter model assumed that threats lived outside the network. That assumption no longer holds in healthcare. Clinicians work from home, vendors connect remotely, applications run in the cloud, and thousands of infusion pumps, monitors, and imaging devices sit on hospital networks. When an attacker steals one password through phishing, a flat network can let ransomware spread from a single workstation to the systems that run patient care.
NIST SP 800-207 describes Zero Trust through a set of tenets. All data sources and computing services are treated as resources. All communication is secured regardless of network location. Access is granted per session and decided by dynamic policy that considers the user, the device, and other signals. The organization monitors the security posture of its assets and uses what it learns to keep improving. Architecturally, NIST describes a policy engine that makes access decisions, a policy administrator that carries them out, and policy enforcement points that sit in front of resources.
NIST’s National Cybersecurity Center of Excellence has since published practical guidance, SP 1800-35, showing how commercial products can be combined into working Zero Trust architectures. The Cybersecurity and Infrastructure Security Agency (CISA) publishes a Zero Trust Maturity Model organized around identity, devices, networks, applications and workloads, and data.
Why Zero Trust is hard in healthcare:
- Legacy medical devices that cannot run security software or support modern authentication
- Shared workstations used by many clinicians in a single shift
- Time-critical care where an extra login prompt can delay treatment
- Large numbers of vendors that need remote access to support their systems
- Complex identity populations, including employees, students, contractors, and affiliated physicians
- Budget and staffing limits, especially in small and rural hospitals
Practical first steps many organizations take:
- Strong identity management with multifactor authentication for remote and privileged access
- Inventory of every device on the network, including medical devices
- Network segmentation that separates clinical devices, guest Wi-Fi, and business systems
- Least-privilege access based on role, reviewed regularly
- Continuous monitoring of logins and unusual activity
- Fast, badge-based authentication so security does not slow clinical work
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses experience Zero Trust as changes in how they log in, which devices they can use, and how often systems ask them to prove who they are.
At the Bedside
A Zero Trust program can mean more frequent identity checks. A nurse may tap a badge to unlock a workstation, confirm a push notification when accessing email from a personal phone, or re-authenticate before opening a sensitive application. Well-designed programs keep those checks fast, because a nurse responding to a deteriorating patient cannot wait through repeated login screens.
Medical devices are affected too. Infusion pumps, monitors, and other connected equipment may be placed on separate network segments, so a compromised workstation cannot reach them. When a device stops communicating with the EHR, the cause may be a network policy rather than a broken device.
In Clinical Workflow
Role-based access is a core part of Zero Trust. Nurses receive access to the patients, applications, and functions their role requires, and access changes when they transfer units or leave the organization. Requests for broader access, such as a float nurse needing a different unit’s tools, are handled through defined processes rather than shared logins.
Shared credentials and propped-open sessions are exactly what Zero Trust is designed to stop. A workstation left logged in under one nurse’s name while others document on it undermines both security and the accuracy of the legal record.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, access problems are among the most common support calls. A nurse may be unable to open a module, see a patient list, or print to a unit printer because a security template or device policy has not been set up correctly. At-the-elbow support analysts learn to route these issues quickly to the access and security teams instead of working around them with another person’s login.
Go-Live is also a natural time to introduce stronger authentication. Badge tap, multifactor enrollment, and new mobile device policies are easier to adopt when they are part of the training and planned support, rather than surprises after the new system is live.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Zero Trust appears in security architecture and risk management questions:
| CAHIMS Domain | How Zero Trust Appears |
|---|---|
| Healthcare & Technology Environments | Threat landscape; NIST and CISA guidance; remote work and cloud adoption |
| Clinical Informatics | Balancing authentication with clinical workflow; shared workstation strategies |
| Healthcare Information & Systems Management | Identity and access management, multifactor authentication, segmentation, device inventory, monitoring |
| Management & Leadership | Security strategy and roadmaps, risk analysis, vendor access policies, budget priorities |
Key Terms to Know Alongside Zero Trust
- Zero Trust Architecture (ZTA) — an enterprise security design that applies Zero Trust principles to users, devices, workflows, and resources
- Least Privilege — giving users and systems only the minimum access needed to do their work
- Multifactor Authentication (MFA) — verifying identity with two or more independent factors
- Microsegmentation — dividing a network into small zones so that access between them can be tightly controlled
- Identity and Access Management (IAM) — the processes and tools that create, manage, and remove user identities and permissions
- Policy Enforcement Point (PEP) — the component that allows, monitors, or blocks a connection based on a policy decision
HIMSS Organizational Position
HIMSS treats cybersecurity as a patient safety priority. Its Healthcare Cybersecurity Community brings together security leaders and clinicians to share practices such as identity management, segmentation, and Zero Trust planning, and HIMSS engages on cybersecurity policy through its public policy work. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — SP 800-207, Zero Trust Architecture https://csrc.nist.gov/pubs/sp/800/207/final
- NIST — SP 1800-35, Implementing a Zero Trust Architecture https://csrc.nist.gov/pubs/sp/1800/35/final
- NIST — Cybersecurity Framework https://www.nist.gov/cyberframework
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- HHS — Summary of the HIPAA Security Rule https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply