Any individually identifiable health information maintained or transmitted in any form or medium, including electronic, paper, or oral, that relates to the past, present, or future physical or mental health of an individual.

HIPAA (Health Insurance Portability and Accountability Act):

A federal law in the United States that establishes standards for the privacy and security of PHI and regulates the sharing of health information.

Covered Entity:

An organization or individual, such as healthcare providers, health plans, and healthcare clearinghouses, that processes or stores PHI and is subject to HIPAA regulations.

Business Associate:

An entity that performs functions or activities on behalf of a covered entity that involves the use or disclosure of PHI, often subject to HIPAA regulations.

Privacy Rule:

A component of HIPAA that establishes national standards for the protection of individuals’ PHI and defines the rights and responsibilities related to the use and disclosure of health information.

Security Rule:

Another component of HIPAA that sets national standards for securing electronic PHI, focusing on safeguards to protect the confidentiality, integrity, and availability of health information.

Minimum Necessary Standard:

A principle under HIPAA requiring covered entities to use, disclose, and request only the minimum amount of PHI necessary for the intended purpose.

Authorization:

Written permission from an individual to use or disclose their PHI for purposes not covered by the Privacy Rule, often required in situations such as research or marketing.

Electronic Health Record (EHR):

A digital version of a patient’s paper chart, containing their medical history, diagnoses, medications, treatment plans, immunization dates, allergies, radiology images, and laboratory test results.

Data Breach Notification Rule:

A provision under HIPAA that requires covered entities to notify affected individuals, the Secretary of Health and Human Services, and, in some cases, the media, of breaches of unsecured PHI.

HITECH Act (Health Information Technology for Economic and Clinical Health Act):

Legislation that expanded and strengthened HIPAA, particularly in relation to electronic health information and data breach reporting.

De-identification:

The process of removing or altering certain identifiers from health information to reduce the risk of the information being associated with an individual.