Short, plain-English definitions of the terms that come up when a clinic or practice sets up its communication, paperwork and HIPAA program: PHI, BAA, minimum necessary, patient portal, AI scribe and more. Each entry explains the term in one sentence, shows where staff meet it in practice, separates it from its neighbours, points to the primary source and links to the fuller guide on this site.
These entries are educational and not legal advice. For a decision about your practice, involve your privacy officer or counsel.
Terms A–Z
A
- Addressable vs required safeguards (HIPAA Security Rule) — Under the HIPAA Security Rule, required safeguards must be implemented as written; addressable ones must be assessed, then implemented, replaced or documented.
- AI scribe — An AI scribe is software that listens to a clinician-patient visit, transcribes it and drafts a clinical note for the clinician to review and sign in the EHR.
- Audit log — An audit log is a time-stamped record of who accessed, changed or exported data in a system, used to review activity and investigate security incidents.
B
- Breach Notification Rule — The HIPAA Breach Notification Rule requires covered entities and business associates to report breaches of unsecured PHI to patients, HHS and sometimes media.
- Business associate — A business associate is a vendor or person that creates, receives, stores or sends PHI on behalf of a HIPAA covered entity, like a billing or IT provider.
- Business associate agreement (BAA) — A business associate agreement (BAA) is a written contract in which a vendor that handles PHI for a healthcare provider agrees to safeguard it under HIPAA.
C
- Clinical communication platform — A clinical communication platform is software that lets care teams in hospitals and clinics message, call and alert each other about patient care in real time.
- Covered entity — A covered entity is a health plan, health care clearinghouse, or health care provider that conducts standard HIPAA transactions electronically, like claims.
D
- Data loss prevention (DLP) — Data loss prevention (DLP) is a set of tools and policies that detect and stop sensitive data, such as PHI, from leaving an organization without permission.
- Data residency — Data residency is the geographic location where an organization's data is stored and processed, usually set by contract, law or a vendor's hosting region.
- De-identification — De-identification is removing or masking identifiers in health information so it can no longer identify a patient and is no longer treated as PHI under HIPAA.
- Direct secure messaging — Direct secure messaging is a standards-based way for healthcare providers to send encrypted patient records and referrals to another provider's Direct address.
E
- Encryption in transit and at rest — Encryption in transit protects data while it moves across a network; encryption at rest protects data while it is stored on disks, servers or phones.
G
- Group practice — A group practice is two or more physicians or clinicians who practice under one legal entity, sharing staff, offices, billing and administrative systems.
H
- HIPAA — HIPAA is the 1996 US federal law that sets national rules for protecting patient health information and gives patients rights over their medical records.
- HIPAA authorization vs consent — A HIPAA authorization is a patient's signed, specific permission to use or disclose PHI for non-routine purposes; consent for routine care uses is optional.
- HIPAA-compliant CRM — A HIPAA-compliant CRM is customer relationship software that holds patient or referral data under a signed BAA and the safeguards HIPAA requires.
- HIPAA-compliant hosting — HIPAA-compliant hosting is cloud or server hosting where the provider signs a BAA and applies Security Rule safeguards to systems that store ePHI.
- HIPAA-compliant messaging — HIPAA-compliant messaging means exchanging messages that contain patient information through a tool and setup that meet HIPAA safeguards under a signed BAA.
- HIPAA-compliant record transfer — A HIPAA-compliant record transfer sends patient records to another provider, the patient or a third party with a valid legal basis over a secure channel.
- HIPAA-compliant voicemail — Industry term for a voicemail setup that protects protected health information in recorded messages with access controls, encryption and a signed BAA.
- HIPAA-compliant workspace — A HIPAA-compliant workspace is a physical or digital setup where staff handle patient information with the safeguards HIPAA requires, from screens to BAAs.
- HIPAA Privacy Rule — The HIPAA Privacy Rule is the federal rule that sets when covered entities and business associates may use or disclose patients' protected health information.
- HIPAA Security Rule — The HIPAA Security Rule sets standards for how covered entities and business associates protect ePHI with administrative, physical and technical safeguards.
M
- Message retention policy — A message retention policy sets how long an organization keeps staff chat messages, files and voice notes, and when they are automatically deleted.
- Minimum necessary standard — The minimum necessary standard is the HIPAA rule that staff use, share or request only the protected health information reasonably needed for the task.
N
- Notice of Privacy Practices (NPP) — A Notice of Privacy Practices (NPP) is the HIPAA document telling patients how a provider may use and share their health information and what rights they have.
O
- Office for Civil Rights (OCR) — The Office for Civil Rights (OCR) is the HHS office that enforces the HIPAA Privacy, Security and Breach Notification Rules and investigates complaints.
P
- Patient engagement — Patient engagement is the active part patients take in their own care, from booking and portal use to following plans and shared decisions with clinicians.
- Patient intake form — A patient intake form is the document a new patient fills out before a first visit, recording identity, insurance, health history and consent details.
- Patient portal: meaning, and what a HIPAA-compliant portal involves — A patient portal is a secure website or app, usually tied to a practice's EHR, where patients view records and results, message the care team and manage visits.
- Protected health information (PHI) and ePHI — Protected health information (PHI) is individually identifiable health information that a covered entity or business associate creates, holds or transmits.
S
- Secure team communication in healthcare — Secure team communication in healthcare is staff messaging, calls and file sharing protected by access controls, encryption and a BAA when it carries PHI.
- Shared responsibility for HIPAA compliance — In HIPAA, shared responsibility means a vendor secures its platform under a BAA, while the practice still controls access, staff training and how PHI is used.
T
- Telehealth platform — A telehealth platform is software that lets clinicians deliver care remotely, such as video visits, secure patient messaging and remote monitoring.
- Two-factor authentication (2FA) and single sign-on (SSO) — Two-factor authentication (2FA) asks for a second proof of identity beyond a password; single sign-on (SSO) lets staff use one company login for many apps.
W
- What Is an ABA Clinic? — An ABA clinic is a center where behavior analysts and trained technicians deliver applied behavior analysis (ABA) therapy, commonly to children with autism.