HIPAA and HITRUST Glossary

Plain-language definitions for teams navigating healthcare compliance.

Browse by category

Browse A-Z

Showing 302 terms

B

Breach Investigation

Breach Notification Rule

Bridge Assessment

Business Associate Breach Reporting

Business Associate Contracts

Business Associate Disclosures

Business Associate Functions

Business Associate Responsibilities

D

Data Aggregation Services

Data Backup Plan

Data Backup and Storage

Data Governance Program

Data Return or Destruction

Data Use Agreement

Date of Discovery

De-identified Information

Deceased Individuals

Denial of Access

Department of Justice (DOJ) Referral

Designated Record Set

Device and Media Controls

Disclosures to Family and Friends

Documentation Retention Schedule

Downstream Business Associate

E

Electronic Health Information

Electronic Media

Electronic Protected Health Information

Emergency Access Procedure

Emergency Disclosures

Emergency Mode Operation Plan

Encryption and Decryption

Enforcement Rule

Executive Sponsorship

Expert Determination Method

External Assessor Firm

F

Facility Access Controls

Facility Directory

Facility Security Plan

Fee Limitations

Flexibility of Approach

Flow-Down Provisions

Form and Format of Access

Four-Factor Risk Assessment

Fundraising Communications

G

Genetic Information

Genetic Information Nondiscrimination Act (GINA)

Group Health Plan

H

HHS Breach Portal

HHS Office of Inspector General

HIPAA Compliance Officer

HITRUST Academy

HITRUST Alliance

HITRUST Assessment XChange

HITRUST Results Distribution System

HITRUST Third-Party Assurance Program

Hardware Inventory

Health Care Clearinghouse

Health Care Provider

Health Industry Cybersecurity Practices

Health Information

Health Oversight Activities

Health Sector Coordinating Council

J

Judicial and Administrative Proceedings

L

Lack of Knowledge (Tier 1)

Law Enforcement Delay

Law Enforcement Disclosures

Letter of Certification

Limited Data Set

Log-in Monitoring

Low Probability of Compromise

M

Maintenance Records

Managed Maturity

Maturity Levels

Measured Maturity

Mechanism to Authenticate ePHI

Message Authentication

Minimum Necessary Standard

Monitoring Period

More Stringent State Law

N

NIST SP 800-111

NIST SP 800-53 Mapping

National Provider Identifier (NPI)

Non-Retaliation

Notice of Enforcement Discretion

Notice of Privacy Practices

Notification Content Requirements

O

OCR Audit Program

ONC Health IT Certification Program

Office for Civil Rights (OCR)

Opportunity to Agree or Object

Organized Health Care Arrangement

Q

Quality Assurance (QA) Review

T

Technical Assistance

Technical Safeguards

Termination Procedures

Third-Party Directive

Third-Party Governance

Threat Catalogue

Timeliness of Access

Transactions and Code Sets Rule

Transmission Security

Treatment, Payment, and Health Care Operations

Trusted Exchange Framework and Common Agreement

U

Unique Identifiers Rule

Unique User Identification

United States Core Data for Interoperability

Uses and Disclosures

V

Validated Assessment

Voluntary Compliance

W

Whistleblower Disclosures

Willful Neglect Corrected (Tier 3)

Willful Neglect Uncorrected (Tier 4)

Workers' Compensation Disclosures

Workforce Clearance Procedure

Workforce Member

Workforce Security

Workforce Training Program

Workstation Security

Workstation Use