> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.
AES-256
Advanced Encryption Standard with 256-bit key length. The current gold-standard symmetric encryption algorithm for protecting ePHI at rest. AES-256 in GCM mode is recommended for authenticated encryption that simultaneously provides confidentiality and integrity verification.
BAA
Business Associate Agreement - the mandatory contractual instrument between a HIPAA covered entity and any third-party vendor that creates, receives, maintains, or transmits PHI on the covered entity's behalf. Software builders who store or process PHI for healthcare clients must execute a BAA before accessing any data.
CFR
Code of Federal Regulations - the codification of permanent US federal regulations. HIPAA rules reside in Title 45 CFR Parts 160, 162, and 164. Regulatory citations in this pack use the format "45 CFR § [part].[section]".
CMS
Centers for Medicare & Medicaid Services - the HHS agency that administers Medicare and Medicaid. CMS also publishes interoperability rules (21st Century Cures Act) that complement HIPAA for data exchange standards.
CISA
Cybersecurity and Infrastructure Security Agency - a US federal agency that publishes healthcare cybersecurity advisories, sector risk assessments, and incident response playbooks applicable to HIPAA-covered software.
CSF
NIST Cybersecurity Framework - a voluntary risk-based framework published by the National Institute of Standards and Technology. Healthcare organisations commonly map their HIPAA Security Rule requirements to the CSF's Identify/Protect/Detect/Respond/Recover functions.
DLP
Data Loss Prevention - software solutions that detect and prevent unauthorised transmission or extraction of sensitive data such as PHI. DLP tools monitor email, web uploads, USB transfers, and clipboard operations to intercept PHI leaving authorised boundaries.
EDI
Electronic Data Interchange - the standardised electronic exchange of health care transactions defined in HIPAA's Transaction and Code Set standards (45 CFR Part 162). Builders implementing payer-provider transaction systems (837, 835, 270/271, etc.) must comply with these EDI standards.
ePHI
Electronic Protected Health Information - any PHI that is stored, created, received, or transmitted in electronic form. The HIPAA Security Rule applies exclusively to ePHI. All 18 PHI identifiers that exist in electronic systems constitute ePHI.
FHIR
Fast Healthcare Interoperability Resources - the HL7 standard for REST-based healthcare data exchange using JSON or XML resources. FHIR R4 is the current production version. PHI exchanged via FHIR APIs is ePHI subject to HIPAA.
HL7
Health Level Seven International - the standards development organisation that publishes FHIR, HL7 v2, and CDA standards for healthcare data interoperability. HL7 v2 messages (ADT, ORU, ORM) contain PHI and must be encrypted in transit.
HHS
Department of Health and Human Services - the US federal department that administers HIPAA through two sub-agencies: OCR (privacy/security enforcement) and CMS (transaction standards). HHS publishes official HIPAA guidance at hhs.gov/hipaa.
HITECH
Health Information Technology for Economic and Clinical Health Act - the 2009 federal legislation that strengthened HIPAA enforcement, introduced the Breach Notification Rule, increased penalties, and extended HIPAA obligations directly to business associates.
IAM
Identity and Access Management - the discipline and technology category covering user identity lifecycle, authentication, authorisation, and access governance. In HIPAA systems, IAM must support unique user IDs, RBAC, MFA, and automatic logoff.
IDS/IPS
Intrusion Detection/Prevention System - network security tools that monitor traffic for indicators of attack or compromise. In HIPAA environments, IDS/IPS alerts are inputs to the security incident response process required by 45 CFR § 164.308(a)(6).
JWT
JSON Web Token - a compact, URL-safe token format used for OAuth 2.0 and OpenID Connect authentication flows. When JWTs are used to gate access to ePHI APIs, they must carry minimum-necessary scopes and have short expiration times (typically 15 minutes for access tokens).
MFA
Multi-Factor Authentication - authentication requiring two or more independent credential types (something you know, have, or are). MFA is the primary technical control for satisfying HIPAA's authentication requirement and preventing credential theft breaches.
NIST SP 800-66
NIST Special Publication 800-66 - "Implementing the Health Insurance Portability and Accountability Act Security Rule". This publication provides practical guidance for implementing each HIPAA Security Rule standard, including crosswalks to the NIST Cybersecurity Framework.
NPP
Notice of Privacy Practices - the document covered entities must provide to patients describing how PHI is used and disclosed. Healthcare applications must display the NPP and record patient acknowledgement as part of their consent workflow.
OCR
Office for Civil Rights - the HHS division that enforces HIPAA Privacy, Security, and Breach Notification Rules. OCR investigates complaints, conducts audits, and levies civil monetary penalties. OCR resolution agreements are public and serve as de-facto implementation guidance.
RBAC
Role-Based Access Control - the standard access control model for HIPAA systems. Roles aggregate permissions aligned to job functions, and users are assigned one or more roles. RBAC directly implements the minimum-necessary principle at the system level.
PHI
Protected Health Information - individually identifiable health information transmitted or maintained by a covered entity or business associate. PHI encompasses 18 categories of identifiers; any record containing one or more identifiers linked to health status, provision of care, or payment for care constitutes PHI.
SIEM
Security Information and Event Management - a platform that aggregates logs from all systems, correlates events, and generates alerts for security incidents. In HIPAA environments, SIEM platforms ingest audit logs from all ePHI systems to detect unauthorised access patterns.
TLS
Transport Layer Security - the cryptographic protocol that provides authenticated, encrypted communication over networks. HIPAA requires ePHI in transit to be encrypted; TLS 1.2 is the minimum, TLS 1.3 is recommended. SSLv3, TLS 1.0, and TLS 1.1 are deprecated and must not be used.
TOTP
Time-Based One-Time Password - an MFA second factor defined in RFC 6238. TOTP codes are generated by authenticator apps (Google Authenticator, Authy) and are valid for 30 seconds. Widely used as the second factor in HIPAA-compliant MFA implementations.