SuperHIPAA Book a demo

Guide · Glossary

HIPAA Glossary

Plain-language definitions of 56+ HIPAA terms. Each one links to its own page with context, related terms, and the §164 citation where applicable.

Laws & rules

  • HIPAA — The Health Insurance Portability and Accountability Act of 1996 — the federal law that sets US healthcare privacy and security obligations.
  • HITECH Act — The 2009 law that strengthened HIPAA — created breach notification, extended direct liability to business associates, and set the four-tier penalty structure.
  • Privacy Rule — The HIPAA regulation governing how PHI in any form may be used and disclosed, and the rights individuals hold over their information.
  • Security Rule — The HIPAA regulation requiring administrative, physical, and technical safeguards for ePHI.
  • Breach Notification Rule — The HIPAA regulation requiring notification of individuals, HHS, and sometimes the media following a breach of unsecured PHI.
  • Omnibus Rule — The 2013 final rule implementing HITECH — direct business associate liability, the revised breach standard, and updated authorisation requirements.
  • Enforcement Rule — The HIPAA regulation setting out investigation procedures and the civil money penalty structure, including culpability tiers.
  • Preemption — The principle that HIPAA overrides contrary state law — except where state law is more protective of privacy.

Data & information types

  • PHI (protected health information) — Protected health information — individually identifiable health information held or transmitted by a covered entity or business associate, in any form.
  • ePHI — PHI in electronic form — the subset the Security Rule protects.
  • IIHI (individually identifiable health information) — Individually identifiable health information — health information that identifies an individual or could reasonably be used to.
  • De-identification — Removing identifiers so information is no longer PHI and falls outside HIPAA. Two accepted methods: Expert Determination and Safe Harbor.
  • Safe Harbor (de-identification) — The de-identification method that removes 18 specified categories of identifiers, with no actual knowledge the remainder could identify the individual.
  • Expert Determination — The alternative de-identification method: a qualified statistician determines the re-identification risk is very small and documents the analysis.
  • Limited data set — PHI stripped of most direct identifiers but retaining elements like dates and geographic detail, usable under a data use agreement.
  • Data use agreement — The required contract governing a recipient's use of a limited data set.
  • Designated record set — The group of records a covered entity uses to make decisions about individuals — medical and billing records, claims and case management files.
  • Psychotherapy notes — A therapist's process notes kept separate from the medical record. They receive extra protection: most disclosures require specific authorisation.

Entities & roles

  • Covered entity — A healthcare provider that transmits standard electronic transactions, a health plan, or a healthcare clearinghouse.
  • Business associate (BA) — A person or organisation that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
  • Subcontractor — A business associate's business associate. Obligations flow downstream: each link in the chain needs its own agreement.
  • BAA (business associate agreement) — The mandatory contract establishing what a business associate may do with PHI, the safeguards required, and breach reporting duties.
  • Hybrid entity — An organisation with both covered and non-covered functions that formally designates its healthcare components to contain HIPAA's application.
  • OHCA (organised health care arrangement) — A recognised arrangement letting participating entities share PHI for joint operations under a joint notice.
  • Privacy Officer / Security Officer — The individuals a regulated entity must designate, in writing, as responsible for privacy compliance and the security programme.
  • Workforce — Employees, volunteers, trainees, and others under the entity's direct control.
  • OCR (Office for Civil Rights) — The HHS office that administers and enforces the HIPAA rules through investigations, audits, penalties, and resolution agreements.
  • HHS (US Department of Health and Human Services) — The US Department of Health and Human Services — HIPAA's parent agency.

Privacy Rule concepts

  • TPO (treatment, payment, and healthcare operations) — The three purposes for which PHI may be used and disclosed without patient authorisation.
  • Minimum necessary — The standard requiring uses, disclosures, and requests to be limited to the least PHI needed for the purpose.
  • Authorisation — The signed, specific permission required for uses and disclosures beyond what the Privacy Rule permits.
  • NPP (Notice of Privacy Practices) — The document telling individuals how their PHI may be used and what rights they hold.
  • Right of access — The individual's right to inspect and obtain a copy of their PHI in the designated record set, generally within 30 days and at limited cost.
  • Amendment — The individual's right to request correction of their records, with a process for acceptance or documented denial.
  • Accounting of disclosures — The individual's right to a list of certain disclosures of their PHI made in the prior six years.
  • Incidental disclosure — A secondary disclosure that occurs despite reasonable safeguards — an overheard name at a pharmacy counter.
  • Sale of PHI — Receiving remuneration in exchange for PHI, prohibited without specific authorisation subject to narrow exceptions.

Security Rule concepts

  • Administrative safeguards — The management layer of the Security Rule — risk analysis, workforce security, training, incident procedures, contingency planning, evaluation.
  • Physical safeguards — Facility access controls, workstation security, and device and media controls, including disposal.
  • Technical safeguards — Access control, audit controls, integrity, authentication, and transmission security for ePHI.
  • Required vs addressable — Every Security Rule implementation specification is one or the other. Addressable never means optional.
  • Risk analysis — The accurate, thorough assessment of risks to all ePHI the organisation holds — the foundational Security Rule requirement.
  • Risk management — The follow-through to risk analysis: implementing measures that reduce identified risks to a reasonable and appropriate level.
  • Audit controls — Mechanisms that record and allow examination of activity in systems containing ePHI — plus, in practice, somebody actually reviewing the output.
  • Encryption — Rendering data unreadable without a key. Addressable at rest and in transit under the Security Rule.
  • Safe harbor (encryption) — The breach-notification exemption: if compromised ePHI was encrypted to HHS standards and keys were not compromised, notification is generally not triggered.
  • Contingency plan — The required trio of data backup plan, disaster recovery plan, and emergency mode operation plan — tested, not just written.
  • Sanction policy — The required written policy for disciplining workforce members who violate privacy and security policies.

Breach & enforcement

  • Security incident — Attempted or successful unauthorised access, use, disclosure, modification, or destruction of information — or interference with operations.
  • Breach — An impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy.
  • Four-factor risk assessment — The analysis used to rebut the breach presumption after an impermissible use or disclosure of unsecured PHI.
  • Unsecured PHI — PHI not rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance.
  • Corrective action plan (CAP) — The multi-year, OCR-monitored remediation programme attached to most resolution agreements.
  • Resolution agreement — The settlement instrument closing an OCR enforcement action, typically pairing a payment with a corrective action plan.
  • Civil money penalty (CMP) — The formal penalty OCR imposes when a case does not settle, calculated under the four culpability tiers.
  • Willful neglect — Conscious, intentional failure or reckless indifference to HIPAA obligations.

Where to go next