The civilian sector health care program operated pursuant to Reference Part 199 of Title 32, Code of Federal Regulations.

Releasing, transferring, provisioning of access to, or divulging in any other manner PHI outside of the entity that maintains or stores the information.

Any access to ePHI that is not otherwise required or permitted pursuant to Reference DOD 6025.18-R, “DoD Health Information Privacy Regulation,” Jan. 24, 2003.

The property of being accessible and useable upon demand by an authorized entity.

An official with statutory or operational authority and responsibility for the development, implementation, maintenance, oversight, and reporting of security requirements for electronic Protected Health Information (ePHI) in accordance with Title 45, Code of Federal Regulations.

Part of an overall contingency plan. The plan for a process whereby an enterprise would be able to continue to operate in the event of fire, vandalism, natural disaster, or system failure.

A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, distribution, or disposition of information.

Any organization acting as a military treatment facility (MTF) or a dental treatment facility (collectively known as MTFs). This includes organizations designated as garrison clinics and such groups in a military operational unit, ship, or aircraft, and any other person or organization outside of such organization’s workforce who furnishes, bills, o...

Convert enciphered text to plain text by means of a cryptographic system or convert encoded text to plain text by means of a code.

Individually identifiable health information that is created, received, maintained, or transmitted in electronic form by a covered entity or business associate. ePHI does not include individually identifiable health information in paper or oral form. DOD 6025.18-R contains additional requirements for individually identifiable health information creat...

A person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.

A person or entity that performs or assists in the performance of a function or activity (legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services) involving the use or disclosure of PHI on behalf of, or to provide services to, an organization.

The ability or the means necessary to read, write, modify, or communicate data or information, or otherwise use any system resource.

All Department of Defense health plans (such as TRICARE), health care providers (such as military treatment facilities), and other entities to the extent that such plans, providers, or entities that are subject to Health Insurance Portability and Accountability Act of 1996 (HIPAA). Formerly known as “healthcare entities.”

Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.