[Code of Federal Regulations]

[Title 45, Volume 1]

[Revised as of October 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 45CFR164.304]



[Page 743-744]

 

                        TITLE 45--PUBLIC WELFARE

 

                    SUBTITLE A--DEPARTMENT OF HEALTH

                           AND HUMAN SERVICES

 

PART 164_SECURITY AND PRIVACY--Table of Contents

 

Subpart C_Security Standards for the Protection of Electronic Protected 

                           Health Information

 

Sec.  164.304  Definitions.



    As used in this subpart, the following terms have the following 

meanings:

    Access means the ability or the means necessary to read, write, 

modify, or communicate data/information or otherwise use any system 

resource. (This definition applies to ``access'' as used in this 

subpart, not as used in subpart E of this part.)

    Administrative safeguards are administrative actions, and policies 

and procedures, to manage the selection, development, implementation, 

and maintenance of security measures to protect electronic protected 

health information and to manage the conduct of the covered entity's 

workforce in relation to the protection of that information.

    Authentication means the corroboration that a person is the one 

claimed.

    Availability means the property that data or information is 

accessible and useable upon demand by an authorized person.

    Confidentiality means the property that data or information is not 

made available or disclosed to unauthorized persons or processes.

    Encryption means the use of an algorithmic process to transform data 

into a form in which there is a low probability of assigning meaning 

without use of a confidential process or key.

    Facility means the physical premises and the interior and exterior 

of a building(s).

    Information system means an interconnected set of information 

resources under the same direct management control that shares common



[[Page 744]]



functionality. A system normally includes hardware, software, 

information, data, applications, communications, and people.

    Integrity means the property that data or information have not been 

altered or destroyed in an unauthorized manner.

    Malicious software means software, for example, a virus, designed to 

damage or disrupt a system.

    Password means confidential authentication information composed of a 

string of characters.

    Physical safeguards are physical measures, policies, and procedures 

to protect a covered entity's electronic information systems and related 

buildings and equipment, from natural and environmental hazards, and 

unauthorized intrusion.

    Security or Security measures encompass all of the administrative, 

physical, and technical safeguards in an information system.

    Security incident means the attempted or successful unauthorized 

access, use, disclosure, modification, or destruction of information or 

interference with system operations in an information system.

    Technical safeguards means the technology and the policy and 

procedures for its use that protect electronic protected health 

information and control access to it.

    User means a person or entity with authorized access.

    Workstation means an electronic computing device, for example, a 

laptop or desktop computer, or any other device that performs similar 

functions, and electronic media stored in its immediate environment.