HIM Module 4: Secondary Data Sources, Information Privacy, and Data Security

Comprehensive vocabulary flashcards covering Secondary Data Sources, Information Privacy and Confidentiality, and Data Security.

Primary Data Source

Data contained in original healthcare records created during direct patient care, such as an electronic health record (EHR) encounter record.

Secondary Data Source

Data derived from primary sources and repurposed for uses other than direct patient care, such as quality improvement, research, population health, and administrative functions.

Facility-Specific Indices

Organized listings—including disease, operation, and physician indices—that arrange facility cases by diagnosis, procedure, or provider to help locate records and evaluate trends.

Cancer Registry

A disease-specific registry that tracks cancer patients through case definition, case finding, data collection, reporting, and follow-up, commonly aligned with American College of Surgeons standards.

Trauma Registry

A specialized registry tracking patients with traumatic injuries, utilizing tools such as the Abbreviated Injury Scale (AIS) and supported by certified staff such as Certified Specialists in Trauma Registry (CSTR).

Abbreviated Injury Scale (AIS)

An injury severity scoring system and data collection tool utilized in trauma registries to classify and measure the extent of traumatic patient injuries.

Medicare Provider Analysis and Review (MEDPAR)

A federal administrative database consisting of inpatient hospital and skilled nursing facility claims for Medicare beneficiaries, containing charges, ICD diagnosis/procedure codes, and MS-DRGs.

National Practitioner Data Bank (NPDB)

A national database storing information regarding medical malpractice payments, adverse licensing sanctions, and professional review actions, queried by healthcare facilities during provider credentialing.

Vital Statistics

Official population data monitoring births, pregnancies, deaths, marriages, and divorces, maintained and shared with the National Center for Health Statistics.

Health Information Exchange (HIE)

The cross-organizational sharing and mobilization of healthcare information for primary patient care that can also be repurposed for quality dashboards and population health reporting.

Privacy

The right of an individual to be let alone and to control the access, use, and disclosure of their personal and health information.

Confidentiality

The legal and ethical obligation of a provider or organization to protect information that has been shared by an individual within a trusting relationship, such as the physician–patient relationship.

Use

Under HIPAA, the internal sharing, examination, application, analysis, or utilization of protected health information within an organization.

Disclosure

Under HIPAA, the release, transfer, provision of access to, or divulging of protected health information to external individuals or outside entities.

Covered Entity (CE)

A health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically in connection with covered HIPAA financial or administrative transactions.

Business Associate (BA)

A third-party vendor or person who performs functions or activities involving protected health information on behalf of a covered entity, bound by a Business Associate Agreement.

Designated Record Set (DRS)

A group of medical, billing, and case or claims management records maintained by or for a covered entity that is used to make healthcare or payment decisions about an individual.

Minimum Necessary Standard

A HIPAA principle requiring covered entities to evaluate practices and limit requests, uses, and disclosures of protected health information to only what is reasonably needed to accomplish the intended purpose.

Treatment, Payment, and Operations (TPO)

The foundational functions of clinical delivery, billing, and health system administrative activities that possess specific exceptions under the HIPAA Privacy Rule regarding patient authorizations.

Information Blocking

Conduct prohibited under the 21st Century Cures Act that is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information.

Notice of Privacy Practices (NPP)

A mandatory HIPAA document that informs patients how their protected health information will be used and disclosed, detailing their individual privacy rights and how to submit complaints.

Breach

An unauthorized acquisition, access, use, or disclosure of unsecured protected health information that compromises the security or privacy of that information.

Medical Identity Theft

A form of fraud occurring when an individual misrepresents their identity to illegally obtain medical services, treatment, or reimbursement, creating altered or intertwined medical records.

FACTA Red Flags Rule

A federal regulation requiring entities to implement programs to identify, detect, and respond to warning signs or indicators of identity theft across alerts, suspicious documents, unusual activity, and external notices.

Data Security

The implementation of technical, physical, and administrative measures to protect health information at rest and in transit from unauthorized access, modification, destruction, or accidental loss.

Data Integrity

A core security property ensuring that health information remains complete, accurate, consistent, timely, and reliable across its entire lifecycle.

Data Availability

The principle ensuring that health data and information systems remain continuously accessible and operational for patient care 24 hours a day, 7 days a week.

Social Engineering

Manipulative human-centered cyber threats—such as phishing, spear phishing, baiting, tailgating, and pretexting—used to deceive authorized individuals into compromising security credentials or disclosing sensitive data.

Pretexting

A social engineering scheme where an attacker invents an invented scenario or false pretext to manipulate a target into releasing information or granting unauthorized system access.

Role-Based Access Control (RBAC)

An access safeguard model that restricts system access and software permissions based on the specific job duties and role of an authorized workforce member.

Chief Security Officer (CSO)

An executive role responsible for strategic planning, information system security policies, monitoring audit trails, coordinating training, and conducting risk assessments.

Trigger Events

Predefined audit criteria—such as accessing VIP charts, viewing records of patients with the same last name, or opening records inactive for 120 days—that flag an electronic access log for security review.

Audit Triggers

Occurrences such as patient or employee complaints, staff errors, insider wrongdoing, third-party errors, and security incidents that initiate a focused forensic audit of electronic access logs.