HIPAA Compliance Mastery for Healthcare Professionals
You're responsible for patient data. Every day. And every day, one misstep-a misplaced document, a misconfigured system, a delayed breach report-could trigger audits, fines, or career-altering consequences. The pressure is real. The rules are complex. And no one has time to read 100-page rulebooks just to do their job safely. But what if you could move from anxiety to absolute clarity? What if you could walk into any compliance meeting, policy review, or audit with full confidence-knowing exactly what HIPAA requires, how to implement it, and how to prove it? HIPAA Compliance Mastery for Healthcare Professionals is the definitive, action-focused learning system designed by regulatory experts and healthcare leaders. This is not theory. It’s your roadmap from uncertainty to mastery, turning fear into authority and effort into recognition. Imagine completing this course and suddenly being the person others turn to when questions arise. One enrollee, Sarah M., a clinic operations manager in Indiana, used the templates and risk assessment framework to identify a critical gap in her EHR system. She led a department-wide correction-and presented the results to her board. Within three months, she was promoted with a 22% salary increase, citing her compliance leadership as the key factor. This program is not about memorising regulations. It’s about building fluency in HIPAA so you can act decisively, protect your organisation, and position yourself as an indispensable asset. Here’s how this course is structured to help you get there.Course Format & Delivery Details This is a self-paced, on-demand learning experience with immediate online access. You begin the moment you’re ready. No fixed dates. No deadlines. No pressure. Just flexible, focused progress aligned with your schedule and clinical responsibilities. Designed for Real Results, Fast
Most learners complete the core curriculum in 21–28 days, spending just 60–90 minutes per week. Many report applying their first corrective action or policy update within 72 hours of starting. This isn’t just learning-it’s immediate impact. Lifetime Access, Future-Proof Learning
- You receive unlimited, 24/7 access from any device-desktop, tablet, or mobile-so you can learn between shifts, on breaks, or from home.
- Your enrollment includes lifetime access to all course materials, including every future update at no additional cost. As regulations evolve, your knowledge stays current.
Expert Support & Verified Credibility
You’re not navigating this alone. Enrollees receive direct guidance from our instructor team-practicing compliance officers and former OCR auditors with decades of field experience. You can submit questions, request clarification, and receive detailed responses through the secure learning portal. Upon completion, you earn a Certificate of Completion issued by The Art of Service-a globally recognised credential trusted by healthcare employers, accreditation bodies, and compliance networks. This is not a participation badge. It’s a verified declaration of your mastery. Zero Risk, Full Confidence
We eliminate every barrier to your decision with risk-reversal you can trust: - Satisfied or fully refunded: If you complete the coursework and don’t feel a significant increase in confidence, competence, and clarity, contact us within 60 days for a full refund. No forms. No hassle.
- No hidden fees: One transparent price covers everything-access, updates, support, and certification.
- Secure checkout: We accept Visa, Mastercard, and PayPal. Your payment is encrypted with enterprise-grade security protocols.
- Access confirmed: After enrollment, you’ll receive a confirmation email. Once your course materials are verified and assigned, your access details will be sent in a separate notification. Each learner’s progress is individually tracked to ensure integrity and continuity.
This Works Even If…
- You’re not a compliance officer-but you handle patient data daily as a nurse, administrator, or IT staff member.
- You’ve attended confusing HIPAA trainings before and retained nothing.
- You’re short on time or new to regulatory frameworks.
- You work in a small practice with limited resources-or a large system with layered bureaucracy.
This program has already empowered over 14,000 healthcare professionals-from EHR coordinators in rural clinics to compliance leads at multi-state hospital systems. Their results prove it works across roles, settings, and experience levels. Your safety, reputation, and career growth depend on getting this right. This course makes it simple, structured, and certain.
Module 1: Foundations of HIPAA and the Regulatory Landscape - Understanding the history and evolution of HIPAA legislation
- Key differences between HIPAA, HITECH, and the Omnibus Rule
- The role of the U.S. Department of Health and Human Services (HHS)
- Overview of the Office for Civil Rights (OCR) and enforcement priorities
- Understanding civil and criminal penalties for non-compliance
- Defining covered entities and business associates
- Understanding hybrid entities and their compliance obligations
- Identifying when state laws override or supplement HIPAA
- The structure and purpose of the Privacy Rule
- The scope and application of the Security Rule
- Understanding the Breach Notification Rule in practice
- Defining Protected Health Information (PHI) vs. individually identifiable health information
- The concept of minimum necessary standard and its operational impact
- Understanding patient rights under HIPAA
- How consent and authorisation differ under HIPAA law
- The role of consent in treatment, payment, and operations (TPO)
- Defining incidental disclosures and acceptable risk thresholds
- Understanding safe harbor and expert determination methods for de-identification
- How the Privacy Rule applies to electronic, paper, and oral communications
- Real-world case studies of early HIPAA enforcement actions
Module 2: The HIPAA Privacy Rule – Policies, Procedures, and Patient Rights - Detailed breakdown of the Privacy Rule’s key provisions
- Developing a compliant Notice of Privacy Practices (NPP)
- Required elements of the NPP and formatting best practices
- Distributing the NPP to patients: timing and documentation
- Managing patient authorisations for use and disclosure
- Designing legally valid authorisation forms
- Understanding when authorisations are not required
- Handling authorisations that are incomplete or expired
- Implementing patient access rights to medical records
- Setting response timeframes for access requests
- Charging reasonable fees for record copies
- Handling requests for electronic copies (ePHI)
- Restricting disclosures at patient request
- Accommodating restrictions on disclosures to health plans
- Amending PHI upon patient request
- Evaluating amendment requests with clinical accuracy in mind
- Documenting denial of amendment requests
- Tracking disclosures of PHI for purposes other than TPO
- Maintaining an accounting of disclosures log
- Exemptions from the accounting requirement
Module 3: The HIPAA Security Rule – Safeguarding ePHI - Understanding electronic Protected Health Information (ePHI)
- Three categories of Security Rule safeguards: administrative, physical, technical
- Defining the scope of systems and devices that house ePHI
- Role of risk analysis in Security Rule compliance
- Conducting a comprehensive security risk assessment (SRA)
- Identifying system vulnerabilities and threat sources
- Assessing likelihood and impact of potential breaches
- Documenting risk assessment findings for audit readiness
- Developing a risk management plan based on SRA results
- Implementing security controls to mitigate identified risks
- Assigning security responsibility: Security Officer roles and duties
- Developing a sanctions policy for non-compliance
- Establishing contingency plans for ePHI access
- Business associate agreement (BAA) requirements for security
- Incident response planning for security events
- Workforce security: authorisation and supervision procedures
- Information system activity reviews and audit logs
- Disaster recovery planning and data restoration
- Emergency mode operations planning
- Testing and revising contingency plans annually
Module 4: Administrative Safeguards – Building a Compliance Culture - Appointing a qualified HIPAA Privacy Officer
- Designating a HIPAA Security Officer and defining responsibilities
- Creating a compliance committee and reporting structure
- Integrating HIPAA into organisational policies and SOPs
- Developing a compliance enforcement policy
- Implementing disciplinary procedures for policy violations
- Workforce training and awareness program requirements
- Scheduling recurring HIPAA training for all staff
- Tailoring training content by role and data access level
- Documenting training completion and maintaining records
- Conducting management oversight of compliance programs
- Performing regular compliance reviews and audits
- Detecting and correcting non-compliance issues
- Collecting and responding to workforce complaints
- Establishing a reporting mechanism for privacy concerns
- Conducting periodic self-audits using checklists
- Creating written policies for all required administrative standards
- Maintaining policy versions, updates, and approvals
- Using policy management software for consistency
- Aligning compliance with accreditation standards (e.g. Joint Commission)
Module 5: Physical Safeguards – Securing Facilities and Devices - Controlling physical access to facilities housing ePHI
- Implementing facility security plans
- Visitor sign-in and escort procedures
- Securing workstations and mobile devices
- Configuring automatic logoff settings for ePHI access
- Managing workstation use policies
- Defining authorised users and access zones
- Locking file cabinets and record storage areas
- Disposal of paper-based PHI: shredding protocols
- Secure destruction of electronic media (hard drives, USBs)
- Tracking and inventorying devices that store ePHI
- Implementing device encryption standards
- Using asset logs with serial numbers and locations
- Developing policies for home-based work
- Securing telehealth equipment used offsite
- Managing lost or stolen devices with reporting protocols
- Establishing clean desk policies across departments
- Using badge access systems and biometric controls
- Monitoring physical access with security cameras
- Creating visitor logs and time-stamped entries
Module 6: Technical Safeguards – Protecting Data in Transit and at Rest - Implementing access controls for ePHI systems
- Developing unique user identification protocols
- Using emergency access procedures during crises
- Enforcing automatic logoff after period of inactivity
- Enabling encryption and decryption mechanisms
- Selecting AES-256 or equivalent encryption standards
- Encrypting data at rest and in transit
- Securing email transmissions containing ePHI
- Using secure messaging platforms compliant with HIPAA
- Implementing audit controls on systems that store ePHI
- Reviewing system logs for unauthorised access
- Integrating audit tools with SIEM platforms
- Conducting regular audit trail reviews
- Deploying integrity controls to prevent data tampering
- Using hash functions to verify data integrity
- Implementing authentication processes for user logins
- Using multi-factor authentication (MFA) for all privileged accounts
- Securing remote access to healthcare networks
- Setting up virtual private networks (VPNs) with audit tracking
- Monitoring transmission security with intrusion detection
Module 7: Business Associate Agreements (BAAs) and Third-Party Risk - Defining a business associate under HIPAA
- Identifying vendors that require a BAA
- Common examples: cloud providers, billing companies, IT firms
- Understanding downstream subcontractors and chain liability
- Required elements of a valid BAA
- Permitted uses and disclosures by business associates
- Obligations to report breaches and security incidents
- Ensuring BAAs align with HHS model language
- Conducting due diligence before signing BAAs
- Evaluating vendor compliance history and certifications
- Maintaining an inventory of all BAAs
- Tracking renewal dates and compliance checkpoints
- Conducting third-party risk assessments
- Assessing vendors’ security practices and controls
- Auditing business associates periodically
- Managing cloud service providers and ePHI storage
- Ensuring email hosting platforms are BAA-compliant
- Handling software-as-a-service (SaaS) applications
- Verifying that mobile health apps meet HIPAA standards
- Terminating relationships with non-compliant vendors
Module 8: Risk Analysis and Risk Management – The Core of Compliance - Why risk analysis is the cornerstone of HIPAA compliance
- Distinguishing risk analysis from general security checks
- OCR’s expectations for thoroughness and documentation
- Using the NIST framework to guide risk analysis
- Mapping ePHI across systems, devices, and people
- Identifying data flow and access points
- Assessing threats: natural, human, environmental
- Evaluating vulnerabilities in software, hardware, and processes
- Calculating risk levels using likelihood and impact matrices
- Prioritising risks for remediation
- Developing mitigation strategies for high-risk items
- Documenting risk decisions and rationale
- Obtaining leadership sign-off on risk findings
- Updating risk analysis annually or after major changes
- Integrating risk management into change control processes
- Using templates to standardise risk documentation
- Aligning risk analysis with Meaningful Use requirements
- Preparing risk analysis for external audits
- Training staff on risk reporting procedures
- Using risk analysis to justify security investments
Module 9: Breach Identification, Response, and Notification - Defining a HIPAA breach under the Breach Notification Rule
- Understanding the four-factor risk assessment for breach determination
- Assessing the nature and extent of PHI involved
- Identifying the unauthorised person who accessed the data
- Determining whether PHI was actually acquired or viewed
- Assessing the likelihood of PHI compromise
- Documenting breach risk assessment decisions
- Reporting breaches internally within 24 hours
- Activating your incident response team
- Containing the breach and securing affected systems
- Preserving evidence for forensic analysis
- Notifying affected individuals within 60 days
- Drafting compliant breach notification letters
- Providing identity protection services when required
- Reporting breaches to HHS through the OCR portal
- Understanding reporting thresholds: small vs. large breaches
- Notifying the media for breaches affecting 500+ individuals
- Maintaining a public breach notification list
- Submitting annual breach reports to OCR
- Learning from breaches to improve safeguards
Module 10: Policies, Documentation, and Audit Readiness - Creating a central HIPAA policy manual
- Standardising policy format and approval workflow
- Maintaining version control and revision history
- Ensuring policies align with current regulations
- Using policy templates for consistency and compliance
- Documenting risk assessments and risk management plans
- Storing signed BAAs in a secure repository
- Tracking workforce training records for 6 years
- Maintaining audit logs and access reports
- Compiling an accounting of disclosures
- Preparing for OCR audits with checklist reviews
- Understanding the phases of a desk audit vs. on-site audit
- Responding to audit notification letters promptly
- Selecting and organising required documentation
- Conducting mock audits to test readiness
- Assigning audit response team roles
- Communicating with auditors professionally and transparently
- Maintaining a privacy compliance dashboard
- Using compliance software for tracking and alerts
- Ensuring documentation is searchable and retrievable
Module 11: Special Scenarios and High-Risk Use Cases - Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Understanding the history and evolution of HIPAA legislation
- Key differences between HIPAA, HITECH, and the Omnibus Rule
- The role of the U.S. Department of Health and Human Services (HHS)
- Overview of the Office for Civil Rights (OCR) and enforcement priorities
- Understanding civil and criminal penalties for non-compliance
- Defining covered entities and business associates
- Understanding hybrid entities and their compliance obligations
- Identifying when state laws override or supplement HIPAA
- The structure and purpose of the Privacy Rule
- The scope and application of the Security Rule
- Understanding the Breach Notification Rule in practice
- Defining Protected Health Information (PHI) vs. individually identifiable health information
- The concept of minimum necessary standard and its operational impact
- Understanding patient rights under HIPAA
- How consent and authorisation differ under HIPAA law
- The role of consent in treatment, payment, and operations (TPO)
- Defining incidental disclosures and acceptable risk thresholds
- Understanding safe harbor and expert determination methods for de-identification
- How the Privacy Rule applies to electronic, paper, and oral communications
- Real-world case studies of early HIPAA enforcement actions
Module 2: The HIPAA Privacy Rule – Policies, Procedures, and Patient Rights - Detailed breakdown of the Privacy Rule’s key provisions
- Developing a compliant Notice of Privacy Practices (NPP)
- Required elements of the NPP and formatting best practices
- Distributing the NPP to patients: timing and documentation
- Managing patient authorisations for use and disclosure
- Designing legally valid authorisation forms
- Understanding when authorisations are not required
- Handling authorisations that are incomplete or expired
- Implementing patient access rights to medical records
- Setting response timeframes for access requests
- Charging reasonable fees for record copies
- Handling requests for electronic copies (ePHI)
- Restricting disclosures at patient request
- Accommodating restrictions on disclosures to health plans
- Amending PHI upon patient request
- Evaluating amendment requests with clinical accuracy in mind
- Documenting denial of amendment requests
- Tracking disclosures of PHI for purposes other than TPO
- Maintaining an accounting of disclosures log
- Exemptions from the accounting requirement
Module 3: The HIPAA Security Rule – Safeguarding ePHI - Understanding electronic Protected Health Information (ePHI)
- Three categories of Security Rule safeguards: administrative, physical, technical
- Defining the scope of systems and devices that house ePHI
- Role of risk analysis in Security Rule compliance
- Conducting a comprehensive security risk assessment (SRA)
- Identifying system vulnerabilities and threat sources
- Assessing likelihood and impact of potential breaches
- Documenting risk assessment findings for audit readiness
- Developing a risk management plan based on SRA results
- Implementing security controls to mitigate identified risks
- Assigning security responsibility: Security Officer roles and duties
- Developing a sanctions policy for non-compliance
- Establishing contingency plans for ePHI access
- Business associate agreement (BAA) requirements for security
- Incident response planning for security events
- Workforce security: authorisation and supervision procedures
- Information system activity reviews and audit logs
- Disaster recovery planning and data restoration
- Emergency mode operations planning
- Testing and revising contingency plans annually
Module 4: Administrative Safeguards – Building a Compliance Culture - Appointing a qualified HIPAA Privacy Officer
- Designating a HIPAA Security Officer and defining responsibilities
- Creating a compliance committee and reporting structure
- Integrating HIPAA into organisational policies and SOPs
- Developing a compliance enforcement policy
- Implementing disciplinary procedures for policy violations
- Workforce training and awareness program requirements
- Scheduling recurring HIPAA training for all staff
- Tailoring training content by role and data access level
- Documenting training completion and maintaining records
- Conducting management oversight of compliance programs
- Performing regular compliance reviews and audits
- Detecting and correcting non-compliance issues
- Collecting and responding to workforce complaints
- Establishing a reporting mechanism for privacy concerns
- Conducting periodic self-audits using checklists
- Creating written policies for all required administrative standards
- Maintaining policy versions, updates, and approvals
- Using policy management software for consistency
- Aligning compliance with accreditation standards (e.g. Joint Commission)
Module 5: Physical Safeguards – Securing Facilities and Devices - Controlling physical access to facilities housing ePHI
- Implementing facility security plans
- Visitor sign-in and escort procedures
- Securing workstations and mobile devices
- Configuring automatic logoff settings for ePHI access
- Managing workstation use policies
- Defining authorised users and access zones
- Locking file cabinets and record storage areas
- Disposal of paper-based PHI: shredding protocols
- Secure destruction of electronic media (hard drives, USBs)
- Tracking and inventorying devices that store ePHI
- Implementing device encryption standards
- Using asset logs with serial numbers and locations
- Developing policies for home-based work
- Securing telehealth equipment used offsite
- Managing lost or stolen devices with reporting protocols
- Establishing clean desk policies across departments
- Using badge access systems and biometric controls
- Monitoring physical access with security cameras
- Creating visitor logs and time-stamped entries
Module 6: Technical Safeguards – Protecting Data in Transit and at Rest - Implementing access controls for ePHI systems
- Developing unique user identification protocols
- Using emergency access procedures during crises
- Enforcing automatic logoff after period of inactivity
- Enabling encryption and decryption mechanisms
- Selecting AES-256 or equivalent encryption standards
- Encrypting data at rest and in transit
- Securing email transmissions containing ePHI
- Using secure messaging platforms compliant with HIPAA
- Implementing audit controls on systems that store ePHI
- Reviewing system logs for unauthorised access
- Integrating audit tools with SIEM platforms
- Conducting regular audit trail reviews
- Deploying integrity controls to prevent data tampering
- Using hash functions to verify data integrity
- Implementing authentication processes for user logins
- Using multi-factor authentication (MFA) for all privileged accounts
- Securing remote access to healthcare networks
- Setting up virtual private networks (VPNs) with audit tracking
- Monitoring transmission security with intrusion detection
Module 7: Business Associate Agreements (BAAs) and Third-Party Risk - Defining a business associate under HIPAA
- Identifying vendors that require a BAA
- Common examples: cloud providers, billing companies, IT firms
- Understanding downstream subcontractors and chain liability
- Required elements of a valid BAA
- Permitted uses and disclosures by business associates
- Obligations to report breaches and security incidents
- Ensuring BAAs align with HHS model language
- Conducting due diligence before signing BAAs
- Evaluating vendor compliance history and certifications
- Maintaining an inventory of all BAAs
- Tracking renewal dates and compliance checkpoints
- Conducting third-party risk assessments
- Assessing vendors’ security practices and controls
- Auditing business associates periodically
- Managing cloud service providers and ePHI storage
- Ensuring email hosting platforms are BAA-compliant
- Handling software-as-a-service (SaaS) applications
- Verifying that mobile health apps meet HIPAA standards
- Terminating relationships with non-compliant vendors
Module 8: Risk Analysis and Risk Management – The Core of Compliance - Why risk analysis is the cornerstone of HIPAA compliance
- Distinguishing risk analysis from general security checks
- OCR’s expectations for thoroughness and documentation
- Using the NIST framework to guide risk analysis
- Mapping ePHI across systems, devices, and people
- Identifying data flow and access points
- Assessing threats: natural, human, environmental
- Evaluating vulnerabilities in software, hardware, and processes
- Calculating risk levels using likelihood and impact matrices
- Prioritising risks for remediation
- Developing mitigation strategies for high-risk items
- Documenting risk decisions and rationale
- Obtaining leadership sign-off on risk findings
- Updating risk analysis annually or after major changes
- Integrating risk management into change control processes
- Using templates to standardise risk documentation
- Aligning risk analysis with Meaningful Use requirements
- Preparing risk analysis for external audits
- Training staff on risk reporting procedures
- Using risk analysis to justify security investments
Module 9: Breach Identification, Response, and Notification - Defining a HIPAA breach under the Breach Notification Rule
- Understanding the four-factor risk assessment for breach determination
- Assessing the nature and extent of PHI involved
- Identifying the unauthorised person who accessed the data
- Determining whether PHI was actually acquired or viewed
- Assessing the likelihood of PHI compromise
- Documenting breach risk assessment decisions
- Reporting breaches internally within 24 hours
- Activating your incident response team
- Containing the breach and securing affected systems
- Preserving evidence for forensic analysis
- Notifying affected individuals within 60 days
- Drafting compliant breach notification letters
- Providing identity protection services when required
- Reporting breaches to HHS through the OCR portal
- Understanding reporting thresholds: small vs. large breaches
- Notifying the media for breaches affecting 500+ individuals
- Maintaining a public breach notification list
- Submitting annual breach reports to OCR
- Learning from breaches to improve safeguards
Module 10: Policies, Documentation, and Audit Readiness - Creating a central HIPAA policy manual
- Standardising policy format and approval workflow
- Maintaining version control and revision history
- Ensuring policies align with current regulations
- Using policy templates for consistency and compliance
- Documenting risk assessments and risk management plans
- Storing signed BAAs in a secure repository
- Tracking workforce training records for 6 years
- Maintaining audit logs and access reports
- Compiling an accounting of disclosures
- Preparing for OCR audits with checklist reviews
- Understanding the phases of a desk audit vs. on-site audit
- Responding to audit notification letters promptly
- Selecting and organising required documentation
- Conducting mock audits to test readiness
- Assigning audit response team roles
- Communicating with auditors professionally and transparently
- Maintaining a privacy compliance dashboard
- Using compliance software for tracking and alerts
- Ensuring documentation is searchable and retrievable
Module 11: Special Scenarios and High-Risk Use Cases - Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Understanding electronic Protected Health Information (ePHI)
- Three categories of Security Rule safeguards: administrative, physical, technical
- Defining the scope of systems and devices that house ePHI
- Role of risk analysis in Security Rule compliance
- Conducting a comprehensive security risk assessment (SRA)
- Identifying system vulnerabilities and threat sources
- Assessing likelihood and impact of potential breaches
- Documenting risk assessment findings for audit readiness
- Developing a risk management plan based on SRA results
- Implementing security controls to mitigate identified risks
- Assigning security responsibility: Security Officer roles and duties
- Developing a sanctions policy for non-compliance
- Establishing contingency plans for ePHI access
- Business associate agreement (BAA) requirements for security
- Incident response planning for security events
- Workforce security: authorisation and supervision procedures
- Information system activity reviews and audit logs
- Disaster recovery planning and data restoration
- Emergency mode operations planning
- Testing and revising contingency plans annually
Module 4: Administrative Safeguards – Building a Compliance Culture - Appointing a qualified HIPAA Privacy Officer
- Designating a HIPAA Security Officer and defining responsibilities
- Creating a compliance committee and reporting structure
- Integrating HIPAA into organisational policies and SOPs
- Developing a compliance enforcement policy
- Implementing disciplinary procedures for policy violations
- Workforce training and awareness program requirements
- Scheduling recurring HIPAA training for all staff
- Tailoring training content by role and data access level
- Documenting training completion and maintaining records
- Conducting management oversight of compliance programs
- Performing regular compliance reviews and audits
- Detecting and correcting non-compliance issues
- Collecting and responding to workforce complaints
- Establishing a reporting mechanism for privacy concerns
- Conducting periodic self-audits using checklists
- Creating written policies for all required administrative standards
- Maintaining policy versions, updates, and approvals
- Using policy management software for consistency
- Aligning compliance with accreditation standards (e.g. Joint Commission)
Module 5: Physical Safeguards – Securing Facilities and Devices - Controlling physical access to facilities housing ePHI
- Implementing facility security plans
- Visitor sign-in and escort procedures
- Securing workstations and mobile devices
- Configuring automatic logoff settings for ePHI access
- Managing workstation use policies
- Defining authorised users and access zones
- Locking file cabinets and record storage areas
- Disposal of paper-based PHI: shredding protocols
- Secure destruction of electronic media (hard drives, USBs)
- Tracking and inventorying devices that store ePHI
- Implementing device encryption standards
- Using asset logs with serial numbers and locations
- Developing policies for home-based work
- Securing telehealth equipment used offsite
- Managing lost or stolen devices with reporting protocols
- Establishing clean desk policies across departments
- Using badge access systems and biometric controls
- Monitoring physical access with security cameras
- Creating visitor logs and time-stamped entries
Module 6: Technical Safeguards – Protecting Data in Transit and at Rest - Implementing access controls for ePHI systems
- Developing unique user identification protocols
- Using emergency access procedures during crises
- Enforcing automatic logoff after period of inactivity
- Enabling encryption and decryption mechanisms
- Selecting AES-256 or equivalent encryption standards
- Encrypting data at rest and in transit
- Securing email transmissions containing ePHI
- Using secure messaging platforms compliant with HIPAA
- Implementing audit controls on systems that store ePHI
- Reviewing system logs for unauthorised access
- Integrating audit tools with SIEM platforms
- Conducting regular audit trail reviews
- Deploying integrity controls to prevent data tampering
- Using hash functions to verify data integrity
- Implementing authentication processes for user logins
- Using multi-factor authentication (MFA) for all privileged accounts
- Securing remote access to healthcare networks
- Setting up virtual private networks (VPNs) with audit tracking
- Monitoring transmission security with intrusion detection
Module 7: Business Associate Agreements (BAAs) and Third-Party Risk - Defining a business associate under HIPAA
- Identifying vendors that require a BAA
- Common examples: cloud providers, billing companies, IT firms
- Understanding downstream subcontractors and chain liability
- Required elements of a valid BAA
- Permitted uses and disclosures by business associates
- Obligations to report breaches and security incidents
- Ensuring BAAs align with HHS model language
- Conducting due diligence before signing BAAs
- Evaluating vendor compliance history and certifications
- Maintaining an inventory of all BAAs
- Tracking renewal dates and compliance checkpoints
- Conducting third-party risk assessments
- Assessing vendors’ security practices and controls
- Auditing business associates periodically
- Managing cloud service providers and ePHI storage
- Ensuring email hosting platforms are BAA-compliant
- Handling software-as-a-service (SaaS) applications
- Verifying that mobile health apps meet HIPAA standards
- Terminating relationships with non-compliant vendors
Module 8: Risk Analysis and Risk Management – The Core of Compliance - Why risk analysis is the cornerstone of HIPAA compliance
- Distinguishing risk analysis from general security checks
- OCR’s expectations for thoroughness and documentation
- Using the NIST framework to guide risk analysis
- Mapping ePHI across systems, devices, and people
- Identifying data flow and access points
- Assessing threats: natural, human, environmental
- Evaluating vulnerabilities in software, hardware, and processes
- Calculating risk levels using likelihood and impact matrices
- Prioritising risks for remediation
- Developing mitigation strategies for high-risk items
- Documenting risk decisions and rationale
- Obtaining leadership sign-off on risk findings
- Updating risk analysis annually or after major changes
- Integrating risk management into change control processes
- Using templates to standardise risk documentation
- Aligning risk analysis with Meaningful Use requirements
- Preparing risk analysis for external audits
- Training staff on risk reporting procedures
- Using risk analysis to justify security investments
Module 9: Breach Identification, Response, and Notification - Defining a HIPAA breach under the Breach Notification Rule
- Understanding the four-factor risk assessment for breach determination
- Assessing the nature and extent of PHI involved
- Identifying the unauthorised person who accessed the data
- Determining whether PHI was actually acquired or viewed
- Assessing the likelihood of PHI compromise
- Documenting breach risk assessment decisions
- Reporting breaches internally within 24 hours
- Activating your incident response team
- Containing the breach and securing affected systems
- Preserving evidence for forensic analysis
- Notifying affected individuals within 60 days
- Drafting compliant breach notification letters
- Providing identity protection services when required
- Reporting breaches to HHS through the OCR portal
- Understanding reporting thresholds: small vs. large breaches
- Notifying the media for breaches affecting 500+ individuals
- Maintaining a public breach notification list
- Submitting annual breach reports to OCR
- Learning from breaches to improve safeguards
Module 10: Policies, Documentation, and Audit Readiness - Creating a central HIPAA policy manual
- Standardising policy format and approval workflow
- Maintaining version control and revision history
- Ensuring policies align with current regulations
- Using policy templates for consistency and compliance
- Documenting risk assessments and risk management plans
- Storing signed BAAs in a secure repository
- Tracking workforce training records for 6 years
- Maintaining audit logs and access reports
- Compiling an accounting of disclosures
- Preparing for OCR audits with checklist reviews
- Understanding the phases of a desk audit vs. on-site audit
- Responding to audit notification letters promptly
- Selecting and organising required documentation
- Conducting mock audits to test readiness
- Assigning audit response team roles
- Communicating with auditors professionally and transparently
- Maintaining a privacy compliance dashboard
- Using compliance software for tracking and alerts
- Ensuring documentation is searchable and retrievable
Module 11: Special Scenarios and High-Risk Use Cases - Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Controlling physical access to facilities housing ePHI
- Implementing facility security plans
- Visitor sign-in and escort procedures
- Securing workstations and mobile devices
- Configuring automatic logoff settings for ePHI access
- Managing workstation use policies
- Defining authorised users and access zones
- Locking file cabinets and record storage areas
- Disposal of paper-based PHI: shredding protocols
- Secure destruction of electronic media (hard drives, USBs)
- Tracking and inventorying devices that store ePHI
- Implementing device encryption standards
- Using asset logs with serial numbers and locations
- Developing policies for home-based work
- Securing telehealth equipment used offsite
- Managing lost or stolen devices with reporting protocols
- Establishing clean desk policies across departments
- Using badge access systems and biometric controls
- Monitoring physical access with security cameras
- Creating visitor logs and time-stamped entries
Module 6: Technical Safeguards – Protecting Data in Transit and at Rest - Implementing access controls for ePHI systems
- Developing unique user identification protocols
- Using emergency access procedures during crises
- Enforcing automatic logoff after period of inactivity
- Enabling encryption and decryption mechanisms
- Selecting AES-256 or equivalent encryption standards
- Encrypting data at rest and in transit
- Securing email transmissions containing ePHI
- Using secure messaging platforms compliant with HIPAA
- Implementing audit controls on systems that store ePHI
- Reviewing system logs for unauthorised access
- Integrating audit tools with SIEM platforms
- Conducting regular audit trail reviews
- Deploying integrity controls to prevent data tampering
- Using hash functions to verify data integrity
- Implementing authentication processes for user logins
- Using multi-factor authentication (MFA) for all privileged accounts
- Securing remote access to healthcare networks
- Setting up virtual private networks (VPNs) with audit tracking
- Monitoring transmission security with intrusion detection
Module 7: Business Associate Agreements (BAAs) and Third-Party Risk - Defining a business associate under HIPAA
- Identifying vendors that require a BAA
- Common examples: cloud providers, billing companies, IT firms
- Understanding downstream subcontractors and chain liability
- Required elements of a valid BAA
- Permitted uses and disclosures by business associates
- Obligations to report breaches and security incidents
- Ensuring BAAs align with HHS model language
- Conducting due diligence before signing BAAs
- Evaluating vendor compliance history and certifications
- Maintaining an inventory of all BAAs
- Tracking renewal dates and compliance checkpoints
- Conducting third-party risk assessments
- Assessing vendors’ security practices and controls
- Auditing business associates periodically
- Managing cloud service providers and ePHI storage
- Ensuring email hosting platforms are BAA-compliant
- Handling software-as-a-service (SaaS) applications
- Verifying that mobile health apps meet HIPAA standards
- Terminating relationships with non-compliant vendors
Module 8: Risk Analysis and Risk Management – The Core of Compliance - Why risk analysis is the cornerstone of HIPAA compliance
- Distinguishing risk analysis from general security checks
- OCR’s expectations for thoroughness and documentation
- Using the NIST framework to guide risk analysis
- Mapping ePHI across systems, devices, and people
- Identifying data flow and access points
- Assessing threats: natural, human, environmental
- Evaluating vulnerabilities in software, hardware, and processes
- Calculating risk levels using likelihood and impact matrices
- Prioritising risks for remediation
- Developing mitigation strategies for high-risk items
- Documenting risk decisions and rationale
- Obtaining leadership sign-off on risk findings
- Updating risk analysis annually or after major changes
- Integrating risk management into change control processes
- Using templates to standardise risk documentation
- Aligning risk analysis with Meaningful Use requirements
- Preparing risk analysis for external audits
- Training staff on risk reporting procedures
- Using risk analysis to justify security investments
Module 9: Breach Identification, Response, and Notification - Defining a HIPAA breach under the Breach Notification Rule
- Understanding the four-factor risk assessment for breach determination
- Assessing the nature and extent of PHI involved
- Identifying the unauthorised person who accessed the data
- Determining whether PHI was actually acquired or viewed
- Assessing the likelihood of PHI compromise
- Documenting breach risk assessment decisions
- Reporting breaches internally within 24 hours
- Activating your incident response team
- Containing the breach and securing affected systems
- Preserving evidence for forensic analysis
- Notifying affected individuals within 60 days
- Drafting compliant breach notification letters
- Providing identity protection services when required
- Reporting breaches to HHS through the OCR portal
- Understanding reporting thresholds: small vs. large breaches
- Notifying the media for breaches affecting 500+ individuals
- Maintaining a public breach notification list
- Submitting annual breach reports to OCR
- Learning from breaches to improve safeguards
Module 10: Policies, Documentation, and Audit Readiness - Creating a central HIPAA policy manual
- Standardising policy format and approval workflow
- Maintaining version control and revision history
- Ensuring policies align with current regulations
- Using policy templates for consistency and compliance
- Documenting risk assessments and risk management plans
- Storing signed BAAs in a secure repository
- Tracking workforce training records for 6 years
- Maintaining audit logs and access reports
- Compiling an accounting of disclosures
- Preparing for OCR audits with checklist reviews
- Understanding the phases of a desk audit vs. on-site audit
- Responding to audit notification letters promptly
- Selecting and organising required documentation
- Conducting mock audits to test readiness
- Assigning audit response team roles
- Communicating with auditors professionally and transparently
- Maintaining a privacy compliance dashboard
- Using compliance software for tracking and alerts
- Ensuring documentation is searchable and retrievable
Module 11: Special Scenarios and High-Risk Use Cases - Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Defining a business associate under HIPAA
- Identifying vendors that require a BAA
- Common examples: cloud providers, billing companies, IT firms
- Understanding downstream subcontractors and chain liability
- Required elements of a valid BAA
- Permitted uses and disclosures by business associates
- Obligations to report breaches and security incidents
- Ensuring BAAs align with HHS model language
- Conducting due diligence before signing BAAs
- Evaluating vendor compliance history and certifications
- Maintaining an inventory of all BAAs
- Tracking renewal dates and compliance checkpoints
- Conducting third-party risk assessments
- Assessing vendors’ security practices and controls
- Auditing business associates periodically
- Managing cloud service providers and ePHI storage
- Ensuring email hosting platforms are BAA-compliant
- Handling software-as-a-service (SaaS) applications
- Verifying that mobile health apps meet HIPAA standards
- Terminating relationships with non-compliant vendors
Module 8: Risk Analysis and Risk Management – The Core of Compliance - Why risk analysis is the cornerstone of HIPAA compliance
- Distinguishing risk analysis from general security checks
- OCR’s expectations for thoroughness and documentation
- Using the NIST framework to guide risk analysis
- Mapping ePHI across systems, devices, and people
- Identifying data flow and access points
- Assessing threats: natural, human, environmental
- Evaluating vulnerabilities in software, hardware, and processes
- Calculating risk levels using likelihood and impact matrices
- Prioritising risks for remediation
- Developing mitigation strategies for high-risk items
- Documenting risk decisions and rationale
- Obtaining leadership sign-off on risk findings
- Updating risk analysis annually or after major changes
- Integrating risk management into change control processes
- Using templates to standardise risk documentation
- Aligning risk analysis with Meaningful Use requirements
- Preparing risk analysis for external audits
- Training staff on risk reporting procedures
- Using risk analysis to justify security investments
Module 9: Breach Identification, Response, and Notification - Defining a HIPAA breach under the Breach Notification Rule
- Understanding the four-factor risk assessment for breach determination
- Assessing the nature and extent of PHI involved
- Identifying the unauthorised person who accessed the data
- Determining whether PHI was actually acquired or viewed
- Assessing the likelihood of PHI compromise
- Documenting breach risk assessment decisions
- Reporting breaches internally within 24 hours
- Activating your incident response team
- Containing the breach and securing affected systems
- Preserving evidence for forensic analysis
- Notifying affected individuals within 60 days
- Drafting compliant breach notification letters
- Providing identity protection services when required
- Reporting breaches to HHS through the OCR portal
- Understanding reporting thresholds: small vs. large breaches
- Notifying the media for breaches affecting 500+ individuals
- Maintaining a public breach notification list
- Submitting annual breach reports to OCR
- Learning from breaches to improve safeguards
Module 10: Policies, Documentation, and Audit Readiness - Creating a central HIPAA policy manual
- Standardising policy format and approval workflow
- Maintaining version control and revision history
- Ensuring policies align with current regulations
- Using policy templates for consistency and compliance
- Documenting risk assessments and risk management plans
- Storing signed BAAs in a secure repository
- Tracking workforce training records for 6 years
- Maintaining audit logs and access reports
- Compiling an accounting of disclosures
- Preparing for OCR audits with checklist reviews
- Understanding the phases of a desk audit vs. on-site audit
- Responding to audit notification letters promptly
- Selecting and organising required documentation
- Conducting mock audits to test readiness
- Assigning audit response team roles
- Communicating with auditors professionally and transparently
- Maintaining a privacy compliance dashboard
- Using compliance software for tracking and alerts
- Ensuring documentation is searchable and retrievable
Module 11: Special Scenarios and High-Risk Use Cases - Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Defining a HIPAA breach under the Breach Notification Rule
- Understanding the four-factor risk assessment for breach determination
- Assessing the nature and extent of PHI involved
- Identifying the unauthorised person who accessed the data
- Determining whether PHI was actually acquired or viewed
- Assessing the likelihood of PHI compromise
- Documenting breach risk assessment decisions
- Reporting breaches internally within 24 hours
- Activating your incident response team
- Containing the breach and securing affected systems
- Preserving evidence for forensic analysis
- Notifying affected individuals within 60 days
- Drafting compliant breach notification letters
- Providing identity protection services when required
- Reporting breaches to HHS through the OCR portal
- Understanding reporting thresholds: small vs. large breaches
- Notifying the media for breaches affecting 500+ individuals
- Maintaining a public breach notification list
- Submitting annual breach reports to OCR
- Learning from breaches to improve safeguards
Module 10: Policies, Documentation, and Audit Readiness - Creating a central HIPAA policy manual
- Standardising policy format and approval workflow
- Maintaining version control and revision history
- Ensuring policies align with current regulations
- Using policy templates for consistency and compliance
- Documenting risk assessments and risk management plans
- Storing signed BAAs in a secure repository
- Tracking workforce training records for 6 years
- Maintaining audit logs and access reports
- Compiling an accounting of disclosures
- Preparing for OCR audits with checklist reviews
- Understanding the phases of a desk audit vs. on-site audit
- Responding to audit notification letters promptly
- Selecting and organising required documentation
- Conducting mock audits to test readiness
- Assigning audit response team roles
- Communicating with auditors professionally and transparently
- Maintaining a privacy compliance dashboard
- Using compliance software for tracking and alerts
- Ensuring documentation is searchable and retrievable
Module 11: Special Scenarios and High-Risk Use Cases - Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Handling PHI in research studies and IRB approvals
- Using limited data sets with data use agreements
- De-identification for public health reporting
- Sharing PHI during emergencies and disasters
- Communications with family and friends during crises
- Disclosures for public health and safety activities
- Reporting communicable diseases to health departments
- Handling PHI in worker’s compensation cases
- Complying with workers’ comp laws and HIPAA
- Handling disclosures to law enforcement
- Responding to subpoenas and court orders
- Differentiating between court orders and subpoenas
- Obtaining patient authorisation when required
- Protecting psychotherapy notes under special rules
- Storing mental health records with enhanced safeguards
- Managing substance abuse treatment records (42 CFR Part 2)
- Coordinating between HIPAA and 42 CFR
- Sharing PHI with coroners and medical examiners
- Disclosures for cadaveric organ donation
- Complying with family medical leave (FMLA) requests
Module 12: Patient Communications, Marketing, and Social Media - Understanding restrictions on marketing communications
- Distinguishing between TPO and marketing uses
- Obtaining valid authorisations for marketing
- Prohibiting PHI use in fundraising without authorisation
- Using PHI in facility directories with patient consent
- Allowing patients to opt out of directory inclusion
- Guidelines for sharing information with visitors
- Managing social media posts involving patients
- Prohibiting unauthorised photo and video sharing
- Developing a social media policy for staff
- Handling patient testimonials and reviews
- Obtaining releases for promotional content
- Responding to online inquiries without disclosing PHI
- Using chatbots and AI assistants securely
- Training staff on digital communication boundaries
- Monitoring third-party review platforms
- Deleting accidental PHI disclosures promptly
- Responding to online privacy complaints
- Conducting monthly social media audits
- Reporting violations to the Privacy Officer
Module 13: Telehealth, Remote Work, and Mobile Health - Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security
Module 14: Implementation, Action Planning, and Continuous Improvement - Creating your 90-day HIPAA improvement roadmap
- Identifying your top three compliance gaps
- Setting SMART goals for remediation
- Assigning action items to team members
- Establishing milestone checkpoints
- Tracking progress with a compliance scorecard
- Presenting findings to leadership and boards
- Building a culture of continuous compliance
- Scheduling quarterly compliance reviews
- Integrating updates from regulatory alerts
- Subscribing to HHS and OCR bulletins
- Participating in compliance web updates (text-based)
- Joining healthcare compliance networks
- Leveraging The Art of Service alumni resources
- Accessing updated templates and policy samples
- Participating in peer discussion forums
- Earning the Certificate of Completion
- Displaying your credential on LinkedIn and CVs
- Using your certification in performance reviews
- Preparing for promotion or new compliance roles
- Applying HIPAA to telehealth platforms
- Selecting compliant video conferencing tools
- Using encrypted platforms with BAAs in place
- Avoiding consumer-grade apps (e.g. FaceTime, Zoom free)
- Securing patient portals and messaging systems
- Verifying patient identity before ePHI exchange
- Documenting telehealth consent processes
- Storing telehealth recordings securely if used
- Setting up home offices for PHI access
- Using virtual desktops to isolate ePHI
- Securing Wi-Fi networks for remote work
- Managing mobile devices with MDM solutions
- Implementing remote wipe capabilities
- Policies for using personal devices (BYOD)
- Configuring privacy settings on mobile EHR apps
- Training staff on telehealth security best practices
- Conducting telehealth risk assessments
- Documenting telehealth policies in compliance manual
- Maintaining audit trails for virtual visits
- Ensuring continuity of care with security