HIPAA training for staff, by role

Also in the core course — the HIPAA basics every role needs:

1. Episode 2 7 decisions · ~8 minSomething's not right
   7 situations Reporting incidents · Lost paper · Check-in within earshot · Looking up records · Questions after an incident · Near misses · Speaking up

   1. A visit summary was handed to the wrong patient yesterdayReporting incidents · 45 CFR 164.308(a)(6)
   2. A printout with patient names is missingLost paper · 45 CFR 164.530(c)
   3. Another patient may overhear an appointment timeCheck-in within earshot
   4. A colleague asks you to look up someone she's worried aboutLooking up records · 45 CFR 164.502(b)
   5. The affected patient asks what happenedQuestions after an incident
   6. A wrong address caught before SendNear misses · 45 CFR 164.308(a)(6)
   7. A colleague's mistake nobody has reported yetSpeaking up · 45 CFR 164.530(g)
2. Episode 3 7 decisions · ~8 minIs this PHI?
   7 situations What counts as PHI · Sharing with another provider · Minimum necessary · Patient questions · Patient rights requests · De-identified data

   1. A schedule, a sticky note and other everyday itemsWhat counts as PHI · 45 CFR 160.103
   2. The next clinician asks for the care notesSharing with another provider · 45 CFR 164.506
   3. Checking whether reminders reached the right peopleMinimum necessary · 45 CFR 164.502(b)
   4. A patient asks how her information is usedPatient questions
   5. A patient says her record lists a medication she never tookPatient rights requests
   6. Patient data for a public newsletterDe-identified data · 45 CFR 164.514(a)–(b)
   7. A patient asks for routine calls on a different numberPatient rights requests
3. Episode 4 7 decisions · ~8 minMessages that leave the building
   7 situations Approved channels · Voicemail · Faxing · Email to patients · Online reviews · Social media · Contact preferences

   1. A colleague working offsite needs a resultApproved channels · 45 CFR 164.312(e)
   2. Leaving a voicemail for a patientVoicemail · 45 CFR 164.522(b)
   3. Three fax numbers for one officeFaxing · 45 CFR 164.530(c)
   4. A patient wants her records in her regular inboxEmail to patients · 45 CFR 164.524(c)
   5. A one-star review describing a visitOnline reviews · 45 CFR 164.502(a)
   6. A team photo with patient names on the wall behindSocial media · 45 CFR 164.530(c)
   7. A patient asks for appointment messages on one line onlyContact preferences · 45 CFR 164.522(b)
4. Episode 5 7 decisions · ~8 minPaper, people and the printer
   7 situations Disposal · Devices that leave · Visitors · Check-in · Contractors

   1. Old intake forms cleared for destructionDisposal · 45 CFR 164.530(c)
   2. A leased copier goes back on FridayDevices that leave · 45 CFR 164.310(d)
   3. A technician arrives unannouncedVisitors · 45 CFR 164.310(a)
   4. Choosing the sign-in sheet for the standCheck-in · 45 CFR 164.530(c)
   5. Empty medicine bottles with patient labelsDisposal · 45 CFR 164.530(c)
   6. An old laptop after a replacementDevices that leave · 45 CFR 164.310(d)
   7. A contractor working near patient recordsContractors · 45 CFR 160.103
5. Episode 6 6 decisions · ~8 minWhen the system goes down
   6 situations Downtime · Ransomware · Access in an emergency · Personal apps and tools · Recovery · Core review

   1. The EHR stops during a busy morningDowntime · 45 CFR 164.308(a)(7)
   2. A ransom note on a front-desk screenRansomware · 45 CFR 164.308(a)(6)
   3. Care needs an allergy list during the outageAccess in an emergency · 45 CFR 164.312(a)
   4. Quick workarounds offered during the outagePersonal apps and tools
   5. Systems are back; the outage paperwork isn'tRecovery · 45 CFR 164.308(a)(7)
   6. Final core check: several transfers from a temporary roomCore review

Also in the front-desk add-on:

1. Episode 2 6 decisions · ~7 minCan I get a copy?
   6 situations Right of access · What you may ask for · Format and delivery · Copy fees · Deadlines and extensions · Copies to someone else

   1. A patient asks at the desk for a copy of her recordsRight of access · 45 CFR 164.524
   2. She leaves the purpose box blank and has a balance dueWhat you may ask for · 45 CFR 164.524
   3. She wants the copy by ordinary emailFormat and delivery · 45 CFR 164.524(c)
   4. An old price list charges for searchingCopy fees · 45 CFR 164.524(c)(4)
   5. Day 25, and the copy won't be ready by day 30Deadlines and extensions · 45 CFR 164.524(b)
   6. She asks to send the copy to her lawyer insteadCopies to someone else · 45 CFR 164.524(c)
2. Episode 3 7 decisions · ~8 minRequests patients make at the desk
   7 situations Contact requests · Restriction requests · Restriction intake · Patient requests · Complaints · Notice acknowledgment

   1. A patient asks to change the phone used for remindersContact requests · 45 CFR 164.522
   2. A patient with family coverage asks not to tell the planRestriction requests · 45 CFR 164.522
   3. A relative paid in full; the service still has a pending claimRestriction intake · 45 CFR 164.522
   4. A patient asks who received information last yearPatient requests
   5. A complaint at the counter and an appointment todayComplaints · 45 CFR 164.530
   6. A patient accepts the notice but declines to signNotice acknowledgment · 45 CFR 164.520
   7. A patient with a zero balance asks to keep a visit from her planRestriction requests · 45 CFR 164.522
3. Episode 4 7 decisions · ~8 minPhone checks, minors and parents
   7 situations Identity checks · Parents and records · Minor access · Authority records · Adult patients · Portal proxies · Safety and representatives

   1. A caller gives a familiar name from an unfamiliar numberIdentity checks · 45 CFR 164.514
   2. A parent asks for follow-up instructions from an ordinary visitParents and records · 45 CFR 164.502
   3. A parent asks about a separately consented teen serviceMinor access · 45 CFR 164.502
   4. One divorced parent asks to change the other's accessAuthority records · 45 CFR 164.502
   5. A patient who is now an adult, and a parent who still helpsAdult patients
   6. A parent asks for a portal login for a teenagerPortal proxies · 45 CFR 164.502
   7. A young patient reports fear before a parent handoffSafety and representatives · 45 CFR 164.502
4. Episode 5 7 decisions · ~8 minThe waiting room
   7 situations Calling patients · Counter conversations · Visitor questions · Screens in view · Emergency handoffs · Staff conversations · Pickup arrangements

   1. Two people in the room have the same first nameCalling patients · 45 CFR 164.530
   2. A patient wants to discuss the visits on her billCounter conversations · 45 CFR 164.530
   3. A neighbor asks whether a patient is hereVisitor questions · 45 CFR 164.502
   4. Patient names are readable from the waiting chairsScreens in view · 45 CFR 164.530
   5. A treating emergency crew requests a medication listEmergency handoffs
   6. A necessary staff handoff is audible to people waitingStaff conversations · 45 CFR 164.530
   7. A patient asks staff to help with her ride homePickup arrangements · 45 CFR 164.510
5. Episode 6 7 decisions · ~8 minOutside requests at the desk
   7 situations Authorizations · Outside requests · Employer requests · Requests after a death · Receiving legal papers · Accounting of disclosures · Front-desk track review

   1. A life insurer submits an older signed formAuthorizations · 45 CFR 164.508
   2. A health department sends a report requestOutside requests
   3. An employer asks for attendance confirmationEmployer requests
   4. A funeral home requests information after a deathRequests after a death
   5. A process server brings court papersReceiving legal papers · 45 CFR 164.512
   6. Two completed releases need their recordsAccounting of disclosures · 45 CFR 164.528
   7. A temporary counter has several simultaneous requestsFront-desk track review

Also in the clinician add-on:

1. Episode 2 7 decisions · ~8 minQuestions from outside
   7 situations Law enforcement requests · Subpoenas · Serious threats · Required reports · Attorneys · Crime victims

   1. Police ask for a missing person's latest contactLaw enforcement requests · 45 CFR 164.512(f)
   2. A civil subpoena arrives with a Friday deadlineSubpoenas · 45 CFR 164.512(e)
   3. A patient describes a credible plan to hurt someoneSerious threats · 45 CFR 164.512(j)
   4. A finding the law says must be reported todayRequired reports · 45 CFR 164.512
   5. An attorney asks for a summary of a patient's careAttorneys · 45 CFR 164.508
   6. A visitor takes another person's bagLaw enforcement requests · 45 CFR 164.512(f)
   7. Police ask about a patient who was a crime victimCrime victims · 45 CFR 164.512(f)
2. Episode 3 7 decisions · ~8 minMinors, representatives and therapy notes
   7 situations Personal representatives · Minors and service-specific authority · Professional judgment · Safety and representative status · Scope of representation · Conditional: psychotherapy notes · Conditional: the access copy

   1. A parent asks about care after a visit they consented toPersonal representatives · 45 CFR 164.502
   2. A parent also asks about a teen's separate serviceMinors and service-specific authority · 45 CFR 164.502
   3. The parental-access law check leaves a professional decisionProfessional judgment
   4. A reported threat changes an ordinary parent handoffSafety and representative status · 45 CFR 164.502
   5. An adult's new health-care power of attorney covers one decisionScope of representation · 45 CFR 164.502
   6. A payer asks a mental-health service for therapy notesConditional: psychotherapy notes
   7. The adult patient asks for a copy that includes separate notesConditional: the access copy
3. Episode 4 7 decisions · ~8 minTelehealth, home working and photos
   7 situations Telehealth services and agreements · Family involvement · Remote-work safeguards · Home printing · Clinical-image workflow · Clinical service contracts · Clinical draft review

   1. A patient would prefer a different video accountTelehealth services and agreements · 45 CFR 164.502
   2. Another voice joins from the patient's sideFamily involvement · 45 CFR 164.510
   3. A home workspace is within the family's view and hearingRemote-work safeguards · 45 CFR 164.310
   4. A household printer also stores jobs in a shared accountHome printing · 45 CFR 164.530
   5. A clinical image is needed for an outside consultationClinical-image workflow
   6. A new scribe has commercial and confidentiality paperworkClinical service contracts · 45 CFR 164.504
   7. A cleared scribe produces a draft after the visitClinical draft review
4. Episode 5 7 decisions · ~8 minEmergency access and teaching cases
   7 situations Emergency access · Purpose of record access · Accepted amendments · Amendment decisions · Teaching uses of patient information · Public teaching and permission · Clinician-track review

   1. An unscheduled urgent patient belongs to another chart teamEmergency access · 45 CFR 164.312
   2. A colleague worries about a friend who missed a meetupPurpose of record access · 45 CFR 164.502
   3. The clinician verifies an error in their signed noteAccepted amendments · 45 CFR 164.526
   4. A patient wants an accurate historical statement removedAmendment decisions · 45 CFR 164.526
   5. Supervised trainees practise with a past clinical caseTeaching uses of patient information
   6. A public slide still shows a face and visit datesPublic teaching and permission · 45 CFR 164.508
   7. An outreach day has care, website and attorney requestsClinician-track review

Also in the billing add-on:

1. Episode 2 7 decisions · ~8 minStatements going out
   7 situations Contact preferences · Mailing checks · Misdelivered mail · Vendors · Family and payment · Vendors and test files

   1. A patient wants statements sent to work, not homeContact preferences · 45 CFR 164.522(b)
   2. A statement run is ready, with returned mail and a new layoutMailing checks · 45 CFR 164.530(c)
   3. A statement opened by a stranger at an old addressMisdelivered mail · 45 CFR 164.402
   4. Claims go out through a clearinghouseVendors · 45 CFR 164.502(e)
   5. Someone who shares the patient's inbox asks about the careFamily and payment · 45 CFR 164.510(b)
   6. A patient asks for a reprintContact preferences · 45 CFR 164.522(b)
   7. A cheaper print supplier wants to start MondayVendors and test files · 45 CFR 164.502(e)
2. Episode 3 7 decisions · ~8 minPayer audits and records requests
   7 situations Government requests · Scope and reasonable reliance · Workers' compensation · Accounting of disclosures · Unresolved release requests · Payer purposes · Limits of government disclosure routes

   1. A Medicaid program-integrity unit requests billing recordsGovernment requests · 45 CFR 164.512
   2. An auditor explains why the sampled visit records are neededScope and reasonable reliance · 45 CFR 164.514
   3. An adjuster asks for history after a workplace injuryWorkers' compensation · 45 CFR 164.512
   4. Three completed releases need their disclosure recordsAccounting of disclosures · 45 CFR 164.528
   5. An employer's attorney calls a billing review an auditUnresolved release requests
   6. A government payer has not yet paid for the visitPayer purposes · 45 CFR 164.506
   7. A government inquiry concerns an individual's household incomeLimits of government disclosure routes · 45 CFR 164.512
3. Episode 4 7 decisions · ~8 minExports, spreadsheets and portals
   7 situations Portal identity · Report scope · Contractor assurances · Remote file handling · Tool and service coverage · Remaining external access · Billing-track review

   1. A payer portal has group and individual sign-insPortal identity · 45 CFR 164.312
   2. The owner wants a monthly collections reportReport scope · 45 CFR 164.502
   3. A billing consultancy has commercial paperwork readyContractor assurances · 45 CFR 164.504
   4. A billing spreadsheet needs finishing from homeRemote file handling · 45 CFR 164.310
   5. Three tools can combine identifiable claim spreadsheetsTool and service coverage · 45 CFR 164.502
   6. A departed biller still appears as an enabled portal userRemaining external access · 45 CFR 164.308
   7. A branch-office export contains claims, statements and an audit jobBilling-track review

Also in the manager add-on:

1. Episode 2 7 decisions · ~8 minVendors and BAAs
   7 situations Supplier relationships · Contract reports · Agreement coverage · Treatment relationships · Subcontractor assurances · Data exit · Changed supplier work

   1. An internet connection, a backup, an answering service and equipment repairsSupplier relationships · 45 CFR 160.103
   2. A draft agreement describes internal investigation of disclosuresContract reports · 45 CFR 164.504
   3. An existing telephone supplier offers a call-summary featureAgreement coverage · 45 CFR 164.502
   4. A treating provider has not signed a vendor agreementTreatment relationships · 45 CFR 164.506
   5. A business associate proposes an overseas subcontractorSubcontractor assurances · 45 CFR 164.502
   6. An ending service still holds live and archived patient filesData exit · 45 CFR 164.504
   7. A staffing agency adds an independent answering serviceChanged supplier work · 45 CFR 160.103
2. Episode 3 7 decisions · ~8 minPatient rights and sanctions
   7 situations Reviewable access denials · Denial responses · Amendment disputes · Accounting fees and timing · Applying sanctions · Protected reporting · Manager-track review

   1. A patient requests review after part of a record was withheldReviewable access denials · 45 CFR 164.524
   2. A partial-denial letter and the remaining records are readyDenial responses · 45 CFR 164.524
   3. The practice writes a rebuttal to an amendment disagreementAmendment disputes · 45 CFR 164.526
   4. A patient requests another accounting in a new calendar yearAccounting fees and timing · 45 CFR 164.528
   5. Matched violations involve staff with different lengths of serviceApplying sanctions · 45 CFR 164.530
   6. A worker reports suspected unlawful PHI handling to OCRProtected reporting · 45 CFR 164.502
   7. A move brings access, vendor, review and corrective-call tasksManager-track review

In the officer course:

1. Episode 2 7 decisions · ~8 minA letter from OCR
   7 situations OCR investigations · Risk analysis · Ending access · Business associate agreements · Breach notification deadlines · Disclosures to HHS · Documentation

   1. OCR asks for policies, risk assessments and training recordsOCR investigations · 45 CFR 160.310
   2. The latest risk assessment is three years oldRisk analysis · 45 CFR 164.308(a)(1)
   3. A former employee's login still worksEnding access · 45 CFR 164.308(a)(3)
   4. A transcription service turns out to have no BAABusiness associate agreements · 45 CFR 164.502(e)
   5. Breach notices fall due while OCR is reviewingBreach notification deadlines · 45 CFR 164.404–164.408
   6. OCR asks for complaint records with patient namesDisclosures to HHS · 45 CFR 164.502(a)
   7. OCR asks for a log the practice never keptDocumentation · 45 CFR 164.530(j)
2. Episode 3 7 decisions · ~8 minA risk analysis that holds up
   7 situations Risk-analysis scope · Analysis and supporting evidence · Risk-management priorities · Addressable decisions · Remaining risk · Changes in the environment · Revisiting a decision

   1. Patient information also lives in email, phones and copier storageRisk-analysis scope · 45 CFR 164.308
   2. A supplier attestation, a checklist and a draft assessmentAnalysis and supporting evidence · 45 CFR 164.308
   3. Failed restores and screen privacy compete for one IT visitRisk-management priorities · 45 CFR 164.306
   4. An older workstation has an encryption compatibility limitAddressable decisions · 45 CFR 164.306
   5. A working safeguard leaves some theft riskRemaining risk · 45 CFR 164.306
   6. A telehealth service adds stored recordings and attachmentsChanges in the environment · 45 CFR 164.316
   7. An update changes an old workstation's capabilitiesRevisiting a decision · 45 CFR 164.306
3. Episode 4 7 decisions · ~8 minThe breach decision
   7 situations Breach classification · Assessment evidence · The affected information · Discovery and reporting · Notification recipients · Notification content · An internal disclosure

   1. A colleague reports an accidental chart openingBreach classification · 45 CFR 164.402
   2. A patient returns a misdirected letter after reading itAssessment evidence · 45 CFR 164.402
   3. A laptop theft comes with technical protection findingsThe affected information · 45 CFR 164.402
   4. A vendor report contains three different datesDiscovery and reporting · 45 CFR 164.404
   5. A breach affects residents of two statesNotification recipients · 45 CFR 164.406
   6. A draft patient letter has several possible datesNotification content · 45 CFR 164.404
   7. A mistaken handoff crosses between two staff rolesAn internal disclosure · 45 CFR 164.402
4. Episode 5 7 decisions · ~8 minWhen systems fail: the plan
   7 situations Contingency plan components · Recovery priorities · Recovery exercises · Backup risks · Exercise evidence · Recovery and incident decisions · Facility and record access

   1. A draft explains copies and restoration, but leaves a gap between themContingency plan components · 45 CFR 164.308
   2. Care, claims and an archive request compete for recovery timeRecovery priorities · 45 CFR 164.308
   3. Nightly success reports have never been checked by bringing files backRecovery exercises · 45 CFR 164.308
   4. A rehearsal reaches three copies through one accountBackup risks · 45 CFR 164.308
   5. Staff are ready for a safeguarded practice exerciseExercise evidence · 45 CFR 164.316
   6. Records return after ransomware, but the PHI findings remain incompleteRecovery and incident decisions · 45 CFR 164.402
   7. An inaccessible room changes what recovery requiresFacility and record access · 45 CFR 164.312
5. Episode 6 7 decisions · ~8 minPolicies and the paper trail
   7 situations Adapting policies · Changing procedures and training · Documentation retention · Notice changes · Security evaluation · Documentation availability · Documentation and clinical records

   1. A downloaded procedure names a department Lakeview does not haveAdapting policies · 45 CFR 164.530
   2. Remote check-in changes reception's workChanging procedures and training · 45 CFR 164.530
   3. An archive contains a policy created and replaced on different datesDocumentation retention · 45 CFR 164.316
   4. Policy approval, a revised notice and a mailing have different datesNotice changes · 45 CFR 164.520
   5. An EHR change alters permissions and connected servicesSecurity evaluation · 45 CFR 164.308
   6. Staff cannot open the owner's procedure archiveDocumentation availability · 45 CFR 164.316
   7. An owner proposes one retention number for two kinds of filesDocumentation and clinical records