HIPAA security and cybersecurity glossary

HIPAA basics

PHI (protected health information)

Individually identifiable health information that a covered entity or business associate holds or transmits, in any form: paper, spoken or electronic. Names, dates, contact details and record numbers become PHI when tied to health care or payment.

ePHI (electronic protected health information)

PHI in electronic form, such as records in an EHR, X-rays, emails and faxes saved as PDFs. The HIPAA Security Rule applies only to ePHI.

Covered entity

A health plan, a health care clearinghouse, or a health care provider that conducts certain transactions electronically. A practice that submits insurance claims electronically is generally a covered entity.

Business associate

A person or company that performs functions or services for a covered entity that involve PHI, such as an IT company, a cloud fax service or a billing company. HHS lists an attorney whose legal services to a health plan involve access to PHI as one example, which is why some law firms are business associates.

BAA (business associate agreement)

The written contract a covered entity must have with each business associate, with terms required by 45 CFR 164.504(e). It sets permitted uses of PHI and requires safeguards, breach reporting and the same terms for subcontractors. See HIPAA compliant email for how Google and Microsoft offer theirs.

Conduit exception

The narrow rule that a service which only transmits PHI, like the postal service, isn’t a business associate. HHS says it is limited to transmission-only services, so a service that stores PHI, even encrypted, needs a BAA. It comes up often with online fax.

Rules and regulators

Security Rule

The HIPAA rule at 45 CFR Part 164, Subpart C, that requires administrative, physical and technical safeguards for ePHI. It is flexible by design and lets each organization scale its measures to its size and risks.

Privacy Rule

The HIPAA rule that governs how PHI may be used and disclosed in any form, and gives patients rights such as access to their records. It covers questions like whether you can fax a referral or email a patient.

Breach Notification Rule

The HIPAA rule that requires notice to affected individuals, HHS and sometimes the media after a breach of unsecured PHI. Individual notice is due without unreasonable delay and no later than 60 days after discovery.

Required vs addressable

The two labels on Security Rule implementation specifications. Required ones must be done; for addressable ones, you implement them if reasonable and appropriate, or document why not and use an equivalent alternative, under 45 CFR 164.306(d).

OCR (Office for Civil Rights)

The HHS office that enforces HIPAA’s Privacy, Security and Breach Notification Rules. It investigates complaints and breaches and announces settlements and penalties.

NPRM (notice of proposed rulemaking)

A proposed regulation published for public comment. HHS’s HIPAA Security Rule NPRM was published January 6, 2025, and is not law as of October 2026; the healthcare guide tracks its status.

HICP (Health Industry Cybersecurity Practices)

Voluntary guidance from HHS’s 405(d) program. The 2023 edition lists five top threats and ten practices, and Technical Volume 1 is written for small organizations.

CPGs (Cybersecurity Performance Goals)

HHS’s voluntary list of healthcare cybersecurity goals, split into essential and enhanced goals. Essential goals include MFA, email security, basic training and unique credentials.

ABA Model Rules

The American Bar Association’s model rules of professional conduct, which states adapt into their own binding rules. Rule 1.1 (competence) and Rule 1.6 (confidentiality) are the ones that matter most for law firm security.

Risk and governance

Risk analysis

The required, written assessment of risks and vulnerabilities to all of an organization’s ePHI, under 45 CFR 164.308(a)(1)(ii)(A). People also call it a HIPAA risk assessment or security risk assessment; the risk assessment guide covers it.

Risk management

The required follow-through on the risk analysis: security measures that reduce risks to a reasonable and appropriate level. In practice it is a list of fixes with owners and dates.

SRA Tool

The HHS Security Risk Assessment Tool, made by ONC and OCR for small and medium-sized providers. Version 3.7 is available as a Windows app and an Excel workbook.

Security official

The person a covered entity or business associate names as responsible for its security policies and procedures, required by 45 CFR 164.308(a)(2). In a small practice it can be the office manager or an owner.

Asset inventory

A list of every device and system that stores or reaches ePHI, including computers, servers, phones, imaging equipment and network gear. HICP lists it as a basic practice, and the checklist starts with it.

Least privilege

Giving each person and account only the access needed for their job. It limits how far an attacker gets with one stolen login.

Threats

Phishing

Email, text or phone messages that trick people into clicking a link, opening a file or giving up a password. HICP lists social engineering, which includes phishing, as the first of its five top threats.

BEC (business email compromise)

A scam that uses a compromised or spoofed business email account to redirect payments or steal data. The FBI describes it as often starting with social engineering or a computer intrusion.

Ransomware

Malicious software that encrypts data and demands payment to restore access. HHS says a ransomware attack that encrypts ePHI is presumed to be a breach unless a risk assessment shows a low probability of compromise.

Insider threat

Data loss caused by someone inside the organization, by mistake or on purpose. HICP lists insider, accidental or malicious data loss among its top five threats.

Credential stuffing

Trying stolen usernames and passwords from one breach on other sites. It works when people reuse passwords, which a password manager helps prevent.

Security controls

MFA (multifactor authentication)

Signing in with a second factor beyond a password, such as an app prompt, a code or a security key. CISA recommends phishing-resistant MFA, like FIDO security keys or passkeys, as the standard.

Phishing-resistant MFA

MFA that can’t be tricked by a fake login page, mainly FIDO and WebAuthn security keys and passkeys. CISA calls it the only widely available option of that kind.

EDR (endpoint detection and response)

Software on each computer and server that watches for suspicious behavior, not only known malware, and can isolate a device. Cyber insurance applications may ask about it.

Managed EDR

EDR plus a provider’s security team that reviews alerts and responds. It fits practices with no one to watch alerts after hours.

MDR (managed detection and response)

A service where a security team monitors your endpoints, accounts and sometimes network and cloud apps, and responds to threats, often around the clock. It goes further than managed EDR.

XDR (extended detection and response)

Detection and response that pulls together signals from endpoints, email, identity and cloud apps in one place. The term is used differently by different vendors, so ask what a product actually covers.

SIEM (security information and event management)

A system that collects and searches logs from many sources to spot threats. HHS’s enhanced CPGs include centralized log collection, which a SIEM provides.

Password manager

An app that creates and stores unique passwords and shares them securely among staff. It supports the Security Rule’s password management specification and replaces shared spreadsheets.

Immutable backup

A backup copy that can’t be changed or deleted for a set period, even by an administrator. It protects backups from ransomware that tries to encrypt or erase them.

Offline backup

A backup copy disconnected from your network, so an attacker on the network can’t reach it. CISA’s ransomware guide recommends offline, encrypted backups that are regularly tested.

Network segmentation

Splitting a network into separate zones, such as clinical devices, staff computers and guest Wi-Fi. It keeps an infection in one zone from spreading to the rest.

Email, encryption and fax

Encryption at rest

Encryption of stored data, such as a laptop’s disk or files on a server. It is an addressable specification under the Security Rule, and encrypted data that is lost may not count as unsecured PHI for breach notification.

Encryption in transit

Encryption of data while it moves, such as email between servers or a file upload. Under 45 CFR 164.312(e)(2)(ii) it is addressable.

TLS (Transport Layer Security)

The protocol that encrypts connections between servers and browsers. For email, it protects the message between servers but each provider along the path can read it.

DLP (data loss prevention)

Rules that detect sensitive data, like Social Security numbers or diagnoses, and block or encrypt messages and files that contain it. Google’s HIPAA guidance suggests DLP rules for Gmail and Chat, covered on the Google Workspace page.

T.38

The standard protocol for sending fax over IP networks in real time. It lets existing fax machines and fax servers work without copper phone lines.

Incidents and insurance

Incident response plan

A written plan that says who does what when something goes wrong: who to contact, how to contain the problem, and how to recover. The Security Rule requires security incident procedures, and insurers ask for a plan.

Breach of unsecured PHI

An impermissible use or disclosure that compromises PHI that wasn’t encrypted or destroyed to HHS’s standard. It triggers notice duties unless a four-factor risk assessment shows a low probability of compromise.

Cyber insurance

Insurance that covers costs from cyber incidents, such as investigation, notification, recovery and some liability. HIPAA doesn’t require it; HICP lists it under cybersecurity governance.