Built by a paramedic and EMS supervisor with 20+ years in emergency healthcare · B.S. Cybersecurity, Cum Laude · SBA Certified SDVOSB · Connecticut Veteran-Owned Micro Business Certified
HIPAA Terms
PHI (Protected Health Information)
Individually identifiable health information that is protected by the HIPAA Privacy Rule when held or transmitted by a covered entity or business associate, subject to the rule’s definitions and exclusions. It can include clinical, billing, demographic, and other information connected to a person’s health, care, or payment. See the HHS Privacy Rule summary for the full legal definition.
Covered Entity
A health plan, health care clearinghouse, or health care provider that electronically transmits health information in connection with a transaction for which HHS has adopted a standard. Provider status depends on the actual transactions performed, not simply the fact that the organization provides care.
Business Associate
A person or organization that performs certain functions or services for a covered entity involving the creation, receipt, maintenance, or transmission of PHI, subject to HIPAA’s definitions and exceptions. Business associates can have direct obligations under HIPAA.
BAA (Business Associate Agreement)
A written contract or other arrangement required when an entity is acting as a HIPAA business associate. It defines permitted uses and disclosures and required safeguards. Not every disclosure of PHI makes the recipient a business associate, so the relationship has to be classified correctly first.
Security Risk Assessment (SRA)
The Security Rule’s required risk-analysis process for identifying and assessing potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. HHS does not require one universal format or methodology.
Minimum Necessary Standard
The HIPAA principle that only the minimum amount of PHI necessary should be used, disclosed, or requested for a given purpose.
OCR (Office for Civil Rights)
The HHS office that administers and enforces the HIPAA Privacy, Security, and Breach Notification Rules. OCR receives complaints and conducts enforcement activities.
SOC 2 Terms
Trust Service Criteria (TSC)
AICPA criteria used in SOC 2 examinations to evaluate controls relevant to Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security/common criteria are foundational; additional categories are included based on the service commitments and engagement scope.
SOC 2 Type I vs Type II
Type I addresses the suitability of control design at a specified date. Type II also addresses operating effectiveness over a specified period. The period and evidence expectations are defined in the CPA firm’s engagement rather than by a universal six- or twelve-month rule.
Readiness Assessment
A consulting review performed before a formal SOC 2 examination to identify scope, control-design, documentation, and evidence gaps. A readiness review does not issue a SOC 2 report or assurance opinion.
Control Deficiency
A gap where a control either doesn’t exist, isn’t documented, or isn’t operating as intended. The most common thing a readiness assessment finds.
AICPA
The American Institute of Certified Public Accountants, the body that defines the SOC 2 framework and Trust Service Criteria.
GRC and Cybersecurity Terms
GRC (Governance, Risk, and Compliance)
The combined discipline of how an organization is governed, how it identifies and manages risk, and how it meets regulatory and contractual obligations. Not a single tool, a way of running the business.
Risk Register
A living document listing identified risks, their likelihood and impact, and who owns addressing each one. The working tool behind most GRC programs.
Fractional GRC
Recurring governance, risk, and compliance support provided without hiring a full-time internal GRC role. The provider may help maintain risk registers, policies, vendor reviews, questionnaires, evidence, and readiness work while management retains decision authority.
Control Evidence
Records showing that a control exists and operates as described. Examples include approvals, logs, tickets, screenshots, training records, review records, configurations, reports, and other artifacts appropriate to the control.
NIST CSF (Cybersecurity Framework)
A widely used, voluntary cybersecurity risk-management framework from the National Institute of Standards and Technology. CSF 2.0 is organized around six Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Vendor Risk Management
The process of assessing and monitoring the security risk introduced by third-party vendors who have access to your systems or data.
Incident Response Plan
A documented plan for how an organization detects, responds to, and recovers from a security incident. Required by most frameworks, and useless if never tested.
BEC (Business Email Compromise)
A type of fraud where an attacker compromises or impersonates an email account to redirect payments or extract sensitive information, often targeting finance teams.
CMMC and Defense Contractor Terms
CMMC (Cybersecurity Maturity Model Certification)
The Department of Defense program for assessing implementation of specified cybersecurity requirements for contractors and subcontractors handling Federal Contract Information or Controlled Unclassified Information. The required level and assessment type depend on the contract or solicitation.
FCI (Federal Contract Information)
Information provided by or generated for the government under a federal contract that is not intended for public release, excluding information provided by the government to the public and simple transactional information necessary to process payment.
CUI (Controlled Unclassified Information)
Information that is not classified national-security information but still requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy. Whether information is CUI depends on the governing authority and contract context.
SSP (System Security Plan)
A document describing the system boundary, environment, responsibilities, and how applicable security requirements are implemented or planned within that environment.
POA&M (Plan of Action and Milestones)
A structured record of identified deficiencies and planned corrective actions, including milestones and target completion information. Whether a deficiency may remain on a POA&M depends on the governing requirement and assessment rules.
Emergency Preparedness Terms
HSEEP (Homeland Security Exercise and Evaluation Program)
FEMA exercise guidance providing guiding principles and a common approach for exercise program management, design and development, conduct, evaluation, and improvement planning.
NIMS (National Incident Management System)
The standardized approach to incident management used across federal, state, and local agencies in the U.S., providing common terminology and structure.
ICS (Incident Command System)
A standardized command structure used to manage emergency response, defining clear roles and reporting lines regardless of incident size or agency involved.
BCP (Business Continuity Plan)
A documented plan for how an organization continues operating during and after a disruption, covering people, processes, and systems.
COOP (Continuity of Operations Plan)
Similar to a BCP but typically used in government and public sector context, focused on maintaining essential functions during an emergency.
Business Impact Analysis (BIA)
A process that identifies which business functions are most critical and how quickly they need to be restored after a disruption. The foundation a BCP is built on.
MCI (Mass Casualty Incident)
An incident where the number of patients exceeds the resources immediately available to treat them, requiring triage and resource prioritization.
Tabletop Exercise Terms
Tabletop Exercise
A discussion-based exercise where participants talk through a simulated scenario to test plans, procedures, and decision-making without physically deploying resources.
Inject
A piece of new information introduced during an exercise to advance the scenario and force participants to respond to changing conditions.
Hot Wash
An immediate, informal debrief held right after an exercise ends, while observations are still fresh, before a formal after action report is written.
AAR (After Action Report)
The formal written document capturing what happened during an exercise, what worked, what didn’t, and what needs to change.
Improvement Plan
A companion document to the AAR that assigns specific corrective actions to specific owners with specific deadlines. Without this, an AAR’s findings rarely get fixed.
Facilitator
The person who runs the exercise, delivers injects, and guides discussion. A skilled facilitator pushes past surface-level answers; a weak one accepts the first thing said.
No-Fault Learning Environment
A ground rule that exercise participants will not be penalized for mistakes made during the simulation, encouraging honest engagement instead of defensive answers.
Ready to Go Further
Now you speak the language of this GRC and HIPAA glossary. Let’s put it to work.
Need to apply one of these terms to your organization? Start with Ask FSL for a general question, or use the contact page for a scoped review.
Glossary definitions are educational summaries, not legal advice, certification determinations, or substitutes for the controlling regulation, contract, standard, framework, or authoritative guidance.
Forward Career Labs LLC d/b/a Forward Security Labs · Wolcott, Connecticut ·
ForwardSecurityLabs.com ·
SBA Certified SDVOSB · Connecticut Veteran-Owned Micro Business Certified · SAM.gov Registered · CAGE: 1AFL4 · UEI: XLRANAT2ULJ9