HIPAA Training that teaches...
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996 that establishes national standards for protecting sensitive patient health information. It applies to healthcare providers, health plans, healthcare clearinghouses, and any business associate that handles protected health information on their behalf.
Criminal Liability
HIPAA violations can carry serious criminal penalties and can result in fines of $250,000 and ten years in prison.
Join KnowQo to Learn More
This is just a sample of our curriculum, please join KnowQo to get the entire HIPAA Training curriculum.
Protected Health Information
Any "individually identifiable health information" that is shared by covered entities (CEs) or Business Associates (BAs) is protected under HIPAA. If it includes a personal identifier + health info, it is PHI. As a rule to live by, never disclose PHI to anyone except the patient to whom it belongs. A few exceptions do exist, and they will be discussed in the next section.
Minimum Necessary
A key part of the HIPAA Privacy Rule is Minimum Necessary. As a rule to live by, it is best to share as little PHI as possible (the minimum necessary).
Notice of Privacy Practices
CEs must provide an explanation of their privacy practices to patients.Patients have the right to access their PHI. Exceptions do apply if accessing the health records could harm the patient. Patients have the right to request that their health records be modified. CEs have the right to reject these requests. Patients can request a list of who their PHI has been shared with (outside of treatment, payment, and operations). Patients have the right to request a CE limit access to their PHI; however, a CE can reject this request.
Join KnowQo to Learn More
This is just a sample of our curriculum, please join KnowQo to get the entire HIPAA Training curriculum.
Overview
The HIPAA Security Rule establishes national standards for protecting electronic protected health information (ePHI). It requires covered entities to implement safeguards — administrative, technical, and physical — to ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.
Administrative Safeguards
Regulated entities are required to have policies, procedures, and people responsibilities that protect ePHI—think management, training, and oversight rather than technology or physical security. Specifically, organizations must assess risks, designate a security official, manage workforce access, train employees, respond to incidents, plan for emergencies, and periodically evaluate their security measures. Business associate agreements must be in place before a BA can handle ePHI.
Technical Safeguards
Technical safeguards focus on the technology that protects ePHI. Organizations must ensure only authorized users can access ePHI, track activity in systems, prevent improper changes or destruction of data, verify user identities, and protect ePHI when transmitting it over networks.
Physical Safeguards
Physical safeguards focus on protecting the actual facilities, equipment, and devices that store or access ePHI. Organizations must control who can physically access these spaces, establish rules for workstation use and security, and manage how devices and media containing ePHI are moved, reused, or disposed of—including wiping ePHI before discarding hardware.
Security Rule Documentation
Organizations must create written policies and procedures to comply with the Security Rule. These documents must be kept for at least six years, made available to those responsible for implementing them, and updated as the organization or environment changes.
Business Associate Agreements
A written business associate agreement (BAA) must be in place before a BA handles ePHI. The agreement ensures the BA will comply with the Security Rule, report security incidents, and hold any subcontractors to the same standards.
Join KnowQo to Learn More
This is just a sample of our curriculum, please join KnowQo to get the entire HIPAA Training curriculum.
What is a Breach?
A breach happens when PHI is used or shared in a way that breaks the Privacy Rule and puts the information at risk. If PHI is used or shared incorrectly, it's assumed to be a breach unless a risk assessment shows the information probably wasn't compromised.
Documentation and Policies
Covered entities and business associates must keep records proving they made all required notifications—or that a notification wasn't required based on a risk assessment. Organizations must also have written breach notification policies and train their workforce on them.
Business Associate Breach
If a breach happens at a business associate, the BA must notify the covered entity within 60 days. The BA should also provide a list of affected individuals and any other information the covered entity needs to notify them.
Join KnowQo to Learn More
This is just a sample of our curriculum, please join KnowQo to get the entire HIPAA Training curriculum.