§17921 Definitions

Summary

Sets the main words used in this part and explains what counts as a "breach" of protected health information. A breach happens when protected health data is taken, seen, used, or shared without permission and that harms its privacy or security. It is not a breach if an employee accidentally accesses or uses the data in good faith while doing their job and the data is not shared further, or if an authorized person accidentally shares data with another staff member at the same facility and no one else gets or uses it. Defines key terms in one line each: breach — the unauthorized access/use/share that harms privacy or security, with the exceptions above; business associate — as defined in federal rules; covered entity — as defined in federal rules; disclose/disclosure — as defined in federal rules; electronic health record — an electronic medical record used by clinicians and staff; health care operation — as defined in federal rules; health care provider — as defined in federal rules; health plan — as defined in federal rules; National Coordinator — the head of the Office of the National Coordinator for Health Information Technology; payment — as defined in federal rules; personal health record — an electronic record of a person’s health information that they manage and control, drawing from multiple sources; protected health information — as defined in federal rules; Secretary — the Secretary of Health and Human Services; security — as defined in federal rules; State — each State, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands; treatment — as defined in federal rules; use — as defined in federal rules; vendor of personal health records — an entity (not a covered entity) that offers or keeps a personal health record.