Rules of the Record Glossary · Health Tech

Authorization (HIPAA): a patient's signed permission for a use or disclosure HIPAA doesn't otherwise allow, with required elements and statements, an expiration, and revocable in writing (Consent, Authorization & Proxies).
Break-the-glass: an explicit, time-limited, reviewed grant of emergency access to one patient's record, satisfying the Security Rule's required emergency access procedure (Security for Health Data).
CHPL (Certified Health IT Product List): ONC's public list of certified health IT products with their criteria, real world testing and attestations (Cures Act, Information Blocking & Certification).
Consumer health data: personal information that identifies a consumer's past, present or future health status, regulated outside HIPAA by Washington, Nevada and Connecticut laws (State Health Privacy & Sensitive Data).
Cyber device: a medical device with sponsor-validated software that can connect to the internet and could be vulnerable to cybersecurity threats, subject to FD&C Act section 524B (Security for Health Data).
Designated record set: the medical and billing records a provider keeps, and any records used to make decisions about individuals; the scope of the right of access (HIPAA in Practice).
EHI (electronic health information): electronic PHI that would be in a designated record set, excluding psychotherapy notes and litigation material; what information blocking protects (Cures Act, Information Blocking & Certification).
Emergency access procedure: the Security Rule's required way to obtain necessary ePHI in an emergency (Security for Health Data).
HICP (Health Industry Cybersecurity Practices): HHS 405(d)'s voluntary sector guidance, five threats and ten practices in small and medium-to-large volumes (Security for Health Data).
HPH CPGs (Healthcare and Public Health Cybersecurity Performance Goals): HHS's ten essential and ten enhanced voluntary security goals for the sector (Security for Health Data).
HTI rules (Health Data, Technology, and Interoperability): ONC's numbered rulemakings for certification and information blocking, HTI-1 (2024) through HTI-5 (final October 2026) (Cures Act, Information Blocking & Certification).
Information blocking: a practice by a provider, certified developer or HIN likely to interfere with access, exchange or use of EHI, unless an exception applies (Cures Act, Information Blocking & Certification).
Information blocking exception: one of ten regulatory safe harbors in 45 CFR Part 171, such as preventing harm, privacy, infeasibility and manner (Cures Act, Information Blocking & Certification).
Marketing (HIPAA): a communication encouraging purchase or use of a product or service, needing an authorization unless an exclusion such as treatment or refill reminders applies without third-party pay (HIPAA in Practice).
MHMDA (My Health My Data Act): Washington's consumer health data law, with separate consent to collect and share, a signed authorization to sell and a geofence ban (State Health Privacy & Sensitive Data).
Minimum necessary: the HIPAA standard limiting PHI used or disclosed to what the purpose needs, with exceptions such as treatment disclosures (HIPAA in Practice).
NPP (notice of privacy practices): the notice every covered provider gives patients, with a good-faith written acknowledgment; updated by February 16, 2026 (HIPAA in Practice).
Part 2 (42 CFR Part 2): federal confidentiality rules for substance use disorder treatment records from federally assisted programs, aligned with HIPAA by the 2024 rule (State Health Privacy & Sensitive Data).
Personal representative: someone with legal authority to make health care decisions for an individual, treated as the individual under HIPAA (Consent, Authorization & Proxies).
Psychotherapy notes: a mental health professional's separately kept notes of counseling session contents, needing an authorization for most uses and outside the right of access (State Health Privacy & Sensitive Data).
Right of access: a patient's right to a copy of their designated record set within 30 days (one 30-day extension), in the format asked for if readily producible, at a cost-based fee (HIPAA in Practice).
Sensitive services (California): gender-affirming care, abortion and contraception, whose records California requires EHR businesses to segregate and shield from out-of-state access (State Health Privacy & Sensitive Data).
TPO (treatment, payment and health care operations): the uses and disclosures HIPAA permits without authorization (HIPAA in Practice).
USCDI (United States Core Data for Interoperability): the versioned floor of data elements certified APIs must support; v3 is the certification baseline from January 1, 2026 (Cures Act, Information Blocking & Certification).
Wall of shame: the industry's name for OCR's public breach portal listing every breach of 500 or more individuals (HIPAA in Practice).