# Rules of the Record Glossary

> 25 terms from the Health Tech book's Rules of the Record part, each defined in a line and linked to the chapter that explains it.

- **Authorization (HIPAA):** a patient's signed permission for a use or disclosure HIPAA doesn't otherwise allow, with required elements and statements, an expiration, and revocable in writing ([Consent, Authorization & Proxies](https://www.syntaqx.com/books/health-tech/consent-and-authorization#authorization-under-hipaa)).
- **Break-the-glass:** an explicit, time-limited, reviewed grant of emergency access to one patient's record, satisfying the Security Rule's required emergency access procedure ([Security for Health Data](https://www.syntaqx.com/books/health-tech/health-records-security#access-control-and-break-the-glass)).
- **CHPL (Certified Health IT Product List):** ONC's public list of certified health IT products with their criteria, real world testing and attestations ([Cures Act, Information Blocking & Certification](https://www.syntaqx.com/books/health-tech/information-blocking-and-certification#the-certification-program)).
- **Consumer health data:** personal information that identifies a consumer's past, present or future health status, regulated outside HIPAA by Washington, Nevada and Connecticut laws ([State Health Privacy & Sensitive Data](https://www.syntaqx.com/books/health-tech/state-health-privacy#consumer-health-data-laws)).
- **Cyber device:** a medical device with sponsor-validated software that can connect to the internet and could be vulnerable to cybersecurity threats, subject to FD&C Act section 524B ([Security for Health Data](https://www.syntaqx.com/books/health-tech/health-records-security#medical-device-security)).
- **Designated record set:** the medical and billing records a provider keeps, and any records used to make decisions about individuals; the scope of the right of access ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#the-right-of-access)).
- **EHI (electronic health information):** electronic PHI that would be in a designated record set, excluding psychotherapy notes and litigation material; what information blocking protects ([Cures Act, Information Blocking & Certification](https://www.syntaqx.com/books/health-tech/information-blocking-and-certification#what-counts-as-ehi)).
- **Emergency access procedure:** the Security Rule's required way to obtain necessary ePHI in an emergency ([Security for Health Data](https://www.syntaqx.com/books/health-tech/health-records-security#access-control-and-break-the-glass)).
- **HICP (Health Industry Cybersecurity Practices):** HHS 405(d)'s voluntary sector guidance, five threats and ten practices in small and medium-to-large volumes ([Security for Health Data](https://www.syntaqx.com/books/health-tech/health-records-security#hhs-405-d-hicp-and-the-performance-goals)).
- **HPH CPGs (Healthcare and Public Health Cybersecurity Performance Goals):** HHS's ten essential and ten enhanced voluntary security goals for the sector ([Security for Health Data](https://www.syntaqx.com/books/health-tech/health-records-security#hhs-405-d-hicp-and-the-performance-goals)).
- **HTI rules (Health Data, Technology, and Interoperability):** ONC's numbered rulemakings for certification and information blocking, HTI-1 (2024) through HTI-5 (final October 2026) ([Cures Act, Information Blocking & Certification](https://www.syntaqx.com/books/health-tech/information-blocking-and-certification#the-hti-rules)).
- **Information blocking:** a practice by a provider, certified developer or HIN likely to interfere with access, exchange or use of EHI, unless an exception applies ([Cures Act, Information Blocking & Certification](https://www.syntaqx.com/books/health-tech/information-blocking-and-certification#the-actors)).
- **Information blocking exception:** one of ten regulatory safe harbors in 45 CFR Part 171, such as preventing harm, privacy, infeasibility and manner ([Cures Act, Information Blocking & Certification](https://www.syntaqx.com/books/health-tech/information-blocking-and-certification#the-ten-exceptions)).
- **Marketing (HIPAA):** a communication encouraging purchase or use of a product or service, needing an authorization unless an exclusion such as treatment or refill reminders applies without third-party pay ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#marketing)).
- **MHMDA (My Health My Data Act):** Washington's consumer health data law, with separate consent to collect and share, a signed authorization to sell and a geofence ban ([State Health Privacy & Sensitive Data](https://www.syntaqx.com/books/health-tech/state-health-privacy#consumer-health-data-laws)).
- **Minimum necessary:** the HIPAA standard limiting PHI used or disclosed to what the purpose needs, with exceptions such as treatment disclosures ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#tpo-minimum-necessary-and-incidental-disclosures)).
- **NPP (notice of privacy practices):** the notice every covered provider gives patients, with a good-faith written acknowledgment; updated by February 16, 2026 ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#the-notice-of-privacy-practices)).
- **Part 2 (42 CFR Part 2):** federal confidentiality rules for substance use disorder treatment records from federally assisted programs, aligned with HIPAA by the 2024 rule ([State Health Privacy & Sensitive Data](https://www.syntaqx.com/books/health-tech/state-health-privacy#part-2-substance-use-disorder-records)).
- **Personal representative:** someone with legal authority to make health care decisions for an individual, treated as the individual under HIPAA ([Consent, Authorization & Proxies](https://www.syntaqx.com/books/health-tech/consent-and-authorization#minors-proxies-and-personal-representatives)).
- **Psychotherapy notes:** a mental health professional's separately kept notes of counseling session contents, needing an authorization for most uses and outside the right of access ([State Health Privacy & Sensitive Data](https://www.syntaqx.com/books/health-tech/state-health-privacy#genetic-mental-health-and-other-sensitive-categories)).
- **Right of access:** a patient's right to a copy of their designated record set within 30 days (one 30-day extension), in the format asked for if readily producible, at a cost-based fee ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#the-right-of-access)).
- **Sensitive services (California):** gender-affirming care, abortion and contraception, whose records California requires EHR businesses to segregate and shield from out-of-state access ([State Health Privacy & Sensitive Data](https://www.syntaqx.com/books/health-tech/state-health-privacy#california-cmia-and-sensitive-services)).
- **TPO (treatment, payment and health care operations):** the uses and disclosures HIPAA permits without authorization ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#tpo-minimum-necessary-and-incidental-disclosures)).
- **USCDI (United States Core Data for Interoperability):** the versioned floor of data elements certified APIs must support; v3 is the certification baseline from January 1, 2026 ([Cures Act, Information Blocking & Certification](https://www.syntaqx.com/books/health-tech/information-blocking-and-certification#uscdi)).
- **Wall of shame:** the industry's name for OCR's public breach portal listing every breach of 500 or more individuals ([HIPAA in Practice](https://www.syntaqx.com/books/health-tech/hipaa-in-practice#breach-notification-and-the-wall-of-shame)).

---

Canonical URL: https://www.syntaqx.com/books/health-tech/glossary/rules-of-the-record