The definitions in plain English

This is a plain-language translation of HIPAA’s defining sections, keeping the structure of the official text with simplified wording. It is a study aid, not the law itself; for the exact binding language, use the linked eCFR text, which is the authority everywhere this page and the regulation could be read differently.

Read this page differently than the others. In HIPAA, the definitions are not the boring part before the rules. They are the rules. Whether you are regulated at all, what counts as protected, what a parent can demand, and what a vendor owes you are all decided inside definitions. The glossary gives you every term alphabetically; this page walks the defining sections the way the regulation organizes them, with the translation faithful to the text.

160.103: the definitions that decide who and what is covered

These apply across all the HIPAA rules.

“In HIPAA, the definitions are not the boring part before the rules. They are the rules.”

Covered entity. One of exactly three things: (1) a health plan; (2) a health care clearinghouse; or (3) a health care provider who transmits any health information in electronic form in connection with a transaction covered by these rules. For providers, that third clause is a genuine test with edge cases; the full walkthrough is here.

Health care provider. A provider of medical or health services, and any other person or organization that furnishes, bills, or is paid for health care in the normal course of business.

Business associate. A person or entity, outside your workforce, that creates, receives, maintains, or transmits PHI while performing a function or service for you or on your behalf: claims processing, data analysis, billing, practice management, quality assurance, and similar; or that provides services to you involving PHI access: legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. It includes health information organizations and personal health record vendors serving you, and it includes a business associate’s subcontractors that handle PHI. It does NOT include: a provider receiving PHI to treat the patient; a plan sponsor receiving certain group health plan disclosures; or a government agency determining eligibility for public benefit health programs.

Subcontractor. A person to whom a business associate delegates a function, activity, or service, other than as a member of the business associate’s own workforce. Obligations follow the data down the chain.

Workforce. Employees, volunteers, trainees, and other persons whose conduct, in the performance of work for you, is under your direct control, whether or not they are paid. The unpaid practicum student is workforce.

Health information. Any information, oral or recorded in any form, created or received by a provider, plan, public health authority, employer, life insurer, school, or clearinghouse, that relates to a person’s past, present, or future physical or mental health, the provision of health care to them, or payment for it.

Individually identifiable health information. Health information, including demographics, that identifies the individual or gives a reasonable basis to believe it could be used to identify them.

Protected health information (PHI). Individually identifiable health information held or transmitted in any form or medium: electronic, paper, or oral. Four exclusions: education records covered by FERPA; certain student treatment records; employment records you hold in your capacity as an employer; and information about a person who has been dead more than 50 years.

Electronic protected health information (ePHI). PHI transmitted by or maintained in electronic media.

Electronic media. Two things: (1) electronic storage material: hard drives, removable and portable memory, devices; and (2) transmission media used to exchange information already in electronic storage: the internet, extranets, leased and dial-up lines, private networks, and physically moved storage media. A paper-to-paper fax and a telephone voice call are not electronic media if the information did not exist in electronic form immediately before the transmission.

Transaction. The transmission of information between two parties to carry out financial or administrative activities related to health care, including: health care claims or equivalent encounter information; payment and remittance advice; coordination of benefits; claim status; enrollment and disenrollment; eligibility; premium payments; referral certification and authorization; first report of injury; health claims attachments; electronic funds transfers; and other transactions prescribed by regulation.

Standard and implementation specification. A standard is a rule, condition, or requirement adopted under these rules; an implementation specification is the specific requirements or instructions for implementing a standard.

Individual, Secretary, workforce, and the rest. The individual is the person the information is about. The Secretary means the Secretary of HHS or a designee, which in practice means HHS acting through OCR.

164.103: two structural definitions

Hybrid entity. A single legal entity that performs both covered and non-covered functions and designates its health care components. Most HIPAA obligations then attach to the designated components rather than the whole organization.

Plan sponsor and related terms carry the meanings used in the group health plan provisions; they matter mainly to employer plans, not to clinics.

164.304: the Security Rule’s vocabulary

Access. The ability or means to read, write, modify, or communicate data, or otherwise use any system resource.

Administrative safeguards. Administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect ePHI, and to manage workforce conduct in relation to it.

Authentication. Corroboration that a person is the one claimed.

Availability. The property that data or information is accessible and usable upon demand by an authorized person.

Confidentiality. The property that data or information is not made available or disclosed to unauthorized persons or processes.

Encryption. The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.

Facility. The physical premises and the interior and exterior of a building or buildings.

Information system. An interconnected set of information resources under the same direct management control and sharing common functionality: hardware, software, information, data, applications, communications, and people.

Integrity. The property that data or information has not been altered or destroyed in an unauthorized manner.

Malicious software. Software, for example a virus, designed to damage or disrupt a system.

Physical safeguards. Physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.

Security incident. The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations, in an information system. Attempted counts; your incident procedures apply before anything succeeds.

Technical safeguards. The technology, and the policy and procedures for its use, that protect ePHI and control access to it.

Workstation. An electronic computing device, for example a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment. The field tablet and the data-collection phone are workstations.

164.402: the Breach Notification Rule’s two definitions

Breach and unsecured protected health information are translated in full, with the four-factor test and the three exclusions, on the Breach Notification page. The one-line versions: a breach is an impermissible acquisition, access, use, or disclosure that compromises the PHI, presumed to be one unless a documented assessment shows low probability of compromise; unsecured PHI is PHI not encrypted or destroyed to the standards in HHS guidance.

164.501: the Privacy Rule’s definitions, including the two everyone needs

This is the section our own source documents skipped for years, and it contains the two definitions that decide real disputes in ABA clinics.

Designated record set. A group of records maintained by or for a covered entity that is: (1) the medical records and billing records about individuals maintained by or for a provider; (2) a health plan’s enrollment, payment, claims adjudication, and case or medical management record systems; or (3) records used, in whole or in part, by or for the covered entity to make decisions about individuals. A record here means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity.

Why it matters: this is the set the right of access attaches to. When a parent demands a copy of their child’s records, what they are entitled to is the designated record set. In an ABA clinic that reaches the assessments, the treatment plan, the session data, the progress notes, and the billing records, because all of it is used to make decisions about the child. It does not reach every scrap of paper in the building: quality improvement analyses, and records not used for decisions about individuals, sit outside it.

Psychotherapy notes. Notes recorded in any medium by a health care provider who is a mental health professional, documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session, and that are separated from the rest of the individual’s medical record. The definition then EXCLUDES: medication prescription and monitoring; counseling session start and stop times; the modalities and frequencies of treatment furnished; results of clinical tests; and any summary of diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

Why it matters, twice over. Psychotherapy notes get special protection: they generally need their own authorization to disclose, and they sit outside the right of access. But read the exclusion list against what an ABA clinic actually writes: session times, treatment modality and frequency, progress data, plan updates, functional status. Nearly all of it is excluded from the definition, which means standard ABA session notes and SOAP notes are NOT psychotherapy notes. The mistake runs in a dangerous direction: a clinic that withholds ordinary session notes from a parent on a claimed psychotherapy-notes basis is not exercising a protection; it is committing a right-of-access violation, which is the subject of OCR’s longest-running enforcement initiative.

Treatment, payment, and health care operations. Treatment is the provision, coordination, or management of health care and related services, including consultation and referral between providers. Payment is the activities undertaken to obtain premiums or reimbursement, or to determine coverage and provide benefits: billing, claims management, eligibility determinations, adjudication, and collections, among others. Health care operations are the covered entity’s own administrative and quality activities: quality assessment and improvement; reviewing competence and qualifications, including credentialing; training programs; accreditation, certification, licensing; business planning; and business management and general administrative activities. Together these are TPO, the purposes for which PHI generally moves without an authorization.

Marketing. A communication about a product or service that encourages the recipient to purchase or use it, with carve-outs for communications about your own treatment and care coordination, and with special rules where a third party pays for the communication. Marketing generally requires the individual’s authorization.

Other 164.501 definitions (correctional institution, data aggregation, health oversight agency, inmate, public health authority, required by law, research, and more) matter mainly to specific disclosure situations; they are translated in context on the Privacy Rule page.