HIPAA
HIPAA’s three working rules are the Privacy Rule, the Breach Notification Rule, and this one, which covers electronic protected health information.
What is the Security Rule?
“Who is permitted to see health data, what they may do with it, and whether the person agreed” is the class definition of this lens.
What is privacy?
Lucy and Ethel hid the chocolates they could not wrap in their hats and mouths. The human factors term for a fix like that, which hides the problem from the people who could solve it.
What is a workaround?
The term for an AI answer that is fluent, confident, and wrong
What is a hallucination?
Jason’s three task types for AI: predictive, generative, and this one, where the AI takes actions on its own.
What is agentic?
Installed in 1986, Boise State’s field was the first non-green football field in the country. Its nickname, borrowed from a cartoon.
What is the Smurf Turf?
The Privacy Rule standard that says you share the amount the task needs and no more.
What is minimum necessary?
This lens asks whether the intended user can complete the intended task without training, without error, and repeatedly.
What is usability?
The model in which an error reaches the patient only when the holes in several layers of defense line up.
What is the Swiss cheese model?
In the ETHICAL framework, T stands for this: if you used AI, say so, and label AI-generated content
What is Transparency?
The AI mindset progression from the first AI class: Automation (AI does it for me), then this (AI is my partner), then Agency (I supervise the AI).
What is augmentation?
The four principles are autonomy, beneficence, justice, and this one, “do no harm.”
What is nonmaleficence?
Calling a patient’s name in a full waiting room is permitted because the Privacy Rule treats it as this kind of disclosure, as long as reasonable safeguards are in place.
What is an incidental disclosure?
Every time a patient retypes a medication list into a new portal or app, this lens has failed.
What is interoperability?
Trusting the machine’s output over what you can see for yourself, as when Michael Scott followed the GPS into a lake.
What is automation bias?
Most free AI tools treat your chat history as training data. Jason’s phrase for what that makes you.
What is the product? (“You are the product.”)
Jason called Boisestate.ai a one-way street because what you type is not stored or used for this.
What is training the model?
The 18th-century British racehorse on our closing slide every week, whose name is pronounced “potatoes.”
Who is Potoooooooo? Also accept: Pot-8-Os.
Under the Privacy Rule, patients may inspect and get a copy of their own records, and the organization has 30 days to provide them. The name of this right.
What is the right of access?
Of the labels FDA-cleared, FDA-approved, FDA-registered, and clinical-grade, these two mean the FDA actually reviewed the product.
What are FDA-cleared and FDA-approved? (FDA-registered means only that the manufacturer listed its facility. Clinical-grade has no regulatory meaning.)
The Joint Commission estimates that this percentage range of clinical alarm signals do not require any intervention.
What is 85% to 99%?
Jason’s name for the integrity check: are you using AI to learn the subject and get stronger, or to skip the work?
What is the push-up test?
When a model has not seen enough data from a group of patients, its advice for them is less accurate. Jason’s name for this kind of bias.
What is bias by omission?
Cells taken from this woman during cancer treatment in 1951, without her knowledge, are still used in research, and her genome was posted online in 2013 without asking her family.
Who is Henrietta Lacks?
A breach affecting this many people or more must be reported to HHS and the media, and it goes on a public federal list anyone can search.
What is 500?
An abnormal lab result lands in a patient’s MyChart on a Friday afternoon before anyone has called her. This federal law’s information blocking rule is why results post right away.
What is the 21st Century Cures Act?
In a 2013 study, 83% of radiologists searching lung CT scans for nodules missed this, even though it was 48 times the size of a nodule.
What is a gorilla? Also accept: inattentional blindness.
In the ETHICAL framework, this letter’s principle covers the absolute prohibition on entering protected health information into public AI tools.
What is L, Legal and Regulatory?
Rare conditions plus an age plus a location can put a name back on a record. Jason’s name for the belief that removing the name makes health data safe to share.
What is the de-identification myth?
In 2026, which country became the 21st member state of the Eurozone by adopting the Euro on 1/1/26?
What is Bulgaria?
A lost laptop full of patient records is usually not a reportable breach if the data were protected this way, because no one can read them.
What is encryption?
this feature lets a family member view a patient’s My Chart record with a separate login of their own instead of sharing a password.
What is proxy access?
In just culture, human error gets consoled and reckless behavior gets punished. This middle category gets coached.
What is at-risk behavior?
Anthropic’s AI Fluency framework names four competencies that all begin with this letter.
What is D? (Delegation, Description, Discernment, Diligence)
Jason’s term for treating large language models as inconsistent systems with uncertain and changing abilities rather than as predictable tools.
What is jagged intelligence?
This IBM computer beat two human champions on Jeopardy in 2011, was turned into a health care AI business, and was sold off in 2022
What is Watson?