HIPAA Compliance Training Free

How to Use this Course

About the Course HIPAA is huge, with hundreds of pages in the regulations. There's really no "one size fits all" - The best HIPAA training is tailored to a role. "What It's About" isn't as important as "How Do I Do It". This course includes the "highlights" as we see them. We have generalized as much as is reasonable - practical HIPAA training is about a mindset, not about the minutiae of the regulations.

HIPAA Overview

What does HIPAA provide? Select all that apply

HIPAA was intended to... improve portability and continuity of health insurance coverage combat waste, fraud, and abuse in health insurance and health care delivery promote the use of medical savings accounts improve access to long-term care services and coverage simplify the administration of health insurance Source: PUBLIC LAW 104–191—AUG. 21, 1996

Who must comply with HIPAA? Select all that apply

What Information is Protected?

Which of the following are personal health identifiers? Select all that apply

When in doubt, treat every piece of patient data as if it is protected information.

Every HIPAA violation is treated the same.

The Privacy Rule of 2000

The Privacy Rule applies to both print and electronic medical records.

HIPAA establishes only criminal penalties for unauthorized disclosure of personal health information.

The Privacy Rule requires patients to receive plain language notice of:

Which of the following are considered Covered Entities? Select all that apply

The Security Rule

Security policies and procedures, if well-designed, do not need to be reviewed and updated.

Covered Entities (CE) must... Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits. Protect against any reasonably anticipated threats or hazards to the security or integrity of such information. Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required. Ensure compliance with the rule by its workforce. Source: 45 C.F.R. § 164.306(a) - Security standards: General rules

To determine appropriate safeguards, CE's should conduct two analyses: Risk Analysis to discover potential unauthorized access and disclosure of PHI Security Analysis to identify security measures that can be reasonably implemented to address risks identified in the risk analysis

The HIPAA Security Rule safeguards include: Select all that apply

Administrative Safeguards include: Select all that apply

Breach and Enforcement

So, what's a breach look like? Records may be... stolen intentionally lost from improper IT procedures destroyed when a pipe bursts and destroys equipment (environmental) - compounded when there is no backup (human error) viewed by an unauthorized person (e.g., another patient “shoulder surfing” and viewing someone else's PHI (misuse) security credentials stolen through phishing or social engineering (more about these in the next lesson)

Is Sam posting a picture of a patient's unique tattoo to a social media site a breach?

Under the Breach Rule, patients may be notified of a breach by:

Which of the following is an example of a "Social" breach?

Threats and Remedies

Now, let's take a closer look at external and internal threats.

PHI is valuable to hackers because...

Well-executed analyses; robust, layered safeguards; and, frequent reviews of safeguards are usually adequate to protect against external threats.

Which of the following are true of internal threats?

Examples of internal threats affecting PHI include...

Best Practices

Only practices with more than 5,000 patients need Privacy and Security Officers.

In a small practice, one person can fulfill all of the roles required to implement, maintain, and monitor security safeguards.

Office Practices Be neat - do not let records lay about. Have policies and procedures. Meet frequently, even informally, to discuss privacy and security. Reward people who demonstrate good practices. Build a robust “social firewall” - make your people suspicious of any request for PHI. Control personal smartphone and device use - well, we can hope. Banish gossip - make it the office ethic. Create a collaborative atmosphere, a community of practice, in which all employees are encouraged to participate in building robust security practices.

Scenario #1

What happened? Select all that apply

What should Dakota have done? Select all that apply

Your office receives an unexpected email from a known consultant with a link to provide practice information, bank account information, and access credentials for the practice management system. What do you do?

Why do phishing attempts frequently include a link to an external site?

The Dakota and Premera Blue Cross cases were both adversely affected by phishing attacks.

Phishing attempts frequently appear as legitimate emails from known sources.

Scenario #2

What should Alex do? Select all that apply

When should the Office of Civil Rights be notified following a breach? Select all that apply

Which of the following practices can mitigate against losing unencrypted PHI? Select all that apply

HIPAA Knowledge Check

Certificate of Completion

Glossary of HIPAA Terms

References