hipaa.systems
Free training episode · all staff · about 7 minutes · no sign-up

Before the first patient Fifteen minutes. Six decisions.

A short scenario for everyone who works in an outpatient practice. Fifteen minutes before opening, six everyday shortcuts — each one looks like getting ready, not like security. All people and records are fictional.

Decision 1 of 6

Decision 1 of 6

Before you've even started

7:45 a.m., Lakeview Health Partners. Fifteen minutes until opening.

Ms. Ruiz Office manager · privacy and security contact

Here at Lakeview, I'm your security contact as well as your privacy contact.

Email · IT Service Desk

Mailbox closes in 30 minutes. Verify your password here. Sender: help@lakeview-support.example — an address you haven't used before.

How do you check who sent this notice? Choose one

Right

Urgency and an unfamiliar sender make this worth checking independently. Don't click or reply. Report it through Lakeview's route, keeping the message available for review.

Ms. Ruiz

Thanks. Support confirms they didn't send it. We'll check who else received it.

Dana

I was about to open the same one. I'll send my report too.

Your practice's policy Report a suspicious message through your practice's route; verify through a contact you already trust. Organizational duties: 45 CFR 164.308(a)(5)–(6)

Why the other answers are wrong
  • Report it; call the support number printed in the email. Not yet. That number comes from the same unverified message. A call is a different medium, but not an independent source here. Use the IT contact in Lakeview's directory.
  • Report it; compare the sender's address with Lakeview's email pattern. Not yet. A familiar-looking format can be imitated. Comparing the spelling may help spot a problem, but doesn't confirm that IT sent this notice. Check through the directory contact.

Decision 2 of 6

Just until mine works

Sam is getting ready at the next workstation.

Previous conversation

Ms. Ruiz: Here at Lakeview, I'm your security contact as well as your privacy contact.

Email · IT Service Desk: Mailbox closes in 30 minutes. Verify your password here. Sender: help@lakeview-support.example — an address you haven't used before.

Ms. Ruiz: Thanks. Support confirms they didn't send it. We'll check who else received it.

Dana: I was about to open the same one. I'll send my report too.

Sam Ortiz Nurse colleague

My account still isn't ready. I need to check today's work list.

Dana Front desk colleague

You could use mine while they finish setting yours up. I'll stay beside you.

No emergency is underway. Lakeview reserves its emergency-access route for emergencies.

Both need this list for their assigned work; Dana can open it.

How can Sam get today's list while his account is being set up? Choose one

Right

Dana stays in control of her session and shows Sam the information needed for their assigned work. Sam doesn't use her controls or password. Ms. Ruiz gets his own account set up; until then, he can work from the list without signing in as someone else.

Sam Ortiz

That gives me today's jobs. I'll use my own sign-in when it's ready.

Your practice's policy Use your own authorized access; ask for help when it isn't working. Unique user identification — Required: 45 CFR 164.312(a)(2)(i)

Why the other answers are wrong
  • Use Dana's sign-in; Sam operates the computer to read the work list. Not yet. Sam would be using Dana's identity for his actions. Dana can operate her own computer and show him information for their assigned work, but she must not hand him the controls.
  • Use emergency access; Sam operates the computer to read the work list. Not yet. No emergency is underway. Lakeview reserves that route for emergencies, not an account awaiting setup. Dana can show the list while she operates her own computer.

Decision 3 of 6

A minute in the corridor

Sam calls you over to help move a supply cart.

Previous conversation

Ms. Ruiz: Here at Lakeview, I'm your security contact as well as your privacy contact.

Email · IT Service Desk: Mailbox closes in 30 minutes. Verify your password here. Sender: help@lakeview-support.example — an address you haven't used before.

Ms. Ruiz: Thanks. Support confirms they didn't send it. We'll check who else received it.

Dana: I was about to open the same one. I'll send my report too.

Sam Ortiz: My account still isn't ready. I need to check today's work list.

Dana: You could use mine while they finish setting yours up. I'll stay beside you.

No emergency is underway. Lakeview reserves its emergency-access route for emergencies.

Both need this list for their assigned work; Dana can open it.

Sam Ortiz: That gives me today's jobs. I'll use my own sign-in when it's ready.

Your workspace

Patient names are on your screen and a printout. Auto-logoff: five minutes; you'll be away for one. Turning off this screen doesn't lock the computer.

Nobody stays. Lakeview requires locked paper storage here. The designated secure drawer self-locks when shut; the covered desktop tray doesn't lock.

What do you do before leaving? Choose all that apply

Right

Lock the session and put the paper away. Lakeview's five-minute timer doesn't cover a one-minute absence, and it doesn't protect printouts.

Sam Ortiz

Ready? The cart waited for us.

Your practice's policy Before stepping away, secure both your session and any patient paperwork. 45 CFR 164.310(b)–(c), 164.530(c)

Why the other answers are wrong
  • Choose Power on the computer's monitor. Not yet. On this workstation, switching the monitor off leaves the computer unlocked. Use the computer's Lock command.
  • Put the printout in the tray and shut it. Not yet. The tray doesn't lock. The scene's drawer locks when shut and meets Lakeview's local unattended-storage rule. A tray can be appropriate in another setting; that doesn't meet the stated rule here.

Decision 4 of 6

It would save a few minutes

Back at the workstation.

Previous conversation

Ms. Ruiz: Here at Lakeview, I'm your security contact as well as your privacy contact.

Email · IT Service Desk: Mailbox closes in 30 minutes. Verify your password here. Sender: help@lakeview-support.example — an address you haven't used before.

Ms. Ruiz: Thanks. Support confirms they didn't send it. We'll check who else received it.

Dana: I was about to open the same one. I'll send my report too.

Sam Ortiz: My account still isn't ready. I need to check today's work list.

Dana: You could use mine while they finish setting yours up. I'll stay beside you.

No emergency is underway. Lakeview reserves its emergency-access route for emergencies.

Both need this list for their assigned work; Dana can open it.

Sam Ortiz: That gives me today's jobs. I'll use my own sign-in when it's ready.

Your workspace: Patient names are on your screen and a printout. Auto-logoff: five minutes; you'll be away for one. Turning off this screen doesn't lock the computer.

Nobody stays. Lakeview requires locked paper storage here. The designated secure drawer self-locks when shut; the covered desktop tray doesn't lock.

Sam Ortiz: Ready? The cart waited for us.

Sam Ortiz Nurse colleague

Could my personal AI chatbot shorten this patient message? It would save a few minutes.

Message excerpt

Includes a name, full birth date, phone number and visit date. Nothing has been sent.

Lakeview's record editor is approved for patient information. The chatbot service and account haven't been assessed.

Which workflow can Sam use for this message now? Choose one

Right

Keep the information out of this unreviewed account. Lakeview checks the service, agreement, settings and intended use before approval. For now, use the existing work process.

Sam Ortiz

I'll do this one here. We can ask about a suitable tool for the next one.

Your practice's policy Use approved tools for patient information; removing a name alone doesn't establish de-identification. 45 CFR 164.502(e), 164.514(a)–(b)

Why the other answers are wrong
  • Use the chatbot to shorten a name-free message. Not yet. The birth date, phone number and visit date remain in the text. With no expert determination, removing the name alone does not establish de-identification. Keep this message in Lakeview's work process.
  • Use the chatbot to shorten the message under a work login. Not yet. A work email identifies the login; it does not establish Lakeview's review of the service, settings or use. A new login is not permission to upload this message.

Decision 5 of 6

The empty pocket

Dana reaches for her phone.

Previous conversation

Ms. Ruiz: Here at Lakeview, I'm your security contact as well as your privacy contact.

Email · IT Service Desk: Mailbox closes in 30 minutes. Verify your password here. Sender: help@lakeview-support.example — an address you haven't used before.

Ms. Ruiz: Thanks. Support confirms they didn't send it. We'll check who else received it.

Dana: I was about to open the same one. I'll send my report too.

Sam Ortiz: My account still isn't ready. I need to check today's work list.

Dana: You could use mine while they finish setting yours up. I'll stay beside you.

No emergency is underway. Lakeview reserves its emergency-access route for emergencies.

Both need this list for their assigned work; Dana can open it.

Sam Ortiz: That gives me today's jobs. I'll use my own sign-in when it's ready.

Your workspace: Patient names are on your screen and a printout. Auto-logoff: five minutes; you'll be away for one. Turning off this screen doesn't lock the computer.

Nobody stays. Lakeview requires locked paper storage here. The designated secure drawer self-locks when shut; the covered desktop tray doesn't lock.

Sam Ortiz: Ready? The cart waited for us.

Sam Ortiz: Could my personal AI chatbot shorten this patient message? It would save a few minutes.

Message excerpt: Includes a name, full birth date, phone number and visit date. Nothing has been sent.

Lakeview's record editor is approved for patient information. The chatbot service and account haven't been assessed.

Sam Ortiz: I'll do this one here. We can ask about a suitable tool for the next one.

Dana Front desk colleague

It's not in my bag. It has work email and our patient-message app. I last used it outside.

You don't yet know where it is or whether anyone has accessed it. Ms. Ruiz is Lakeview's security contact.

Who do you contact to start Lakeview's response? Choose one

Right

Tell Ms. Ruiz now; keep looking in parallel. She coordinates account and device controls under Lakeview's procedure and checks what happened. A missing phone isn't automatically a reportable breach.

Dana

I'll tell her when and where I last had it. Then I'll retrace my steps.

Your practice's policy Report a missing work-connected device promptly, even while you're looking for it. Organizational response: 45 CFR 164.308(a)(6)(ii)

Why the other answers are wrong
  • Contact the mobile carrier with the time and place Dana last used it. Not yet. A carrier may help suspend a SIM, but that doesn't start Lakeview's response for the work email, patient app and stored information. Notify the security contact; authorized carrier action can be part of the response.
  • Contact email support with the time and place Dana last used it. Not yet. Email support can address one account, not coordinate Lakeview's missing-device response across services. Notify Ms. Ruiz; the response can include email controls and a search in parallel.

Decision 6 of 6

A familiar name, a different request

Just before opening, your phone lights up.

Previous conversation

Ms. Ruiz: Here at Lakeview, I'm your security contact as well as your privacy contact.

Email · IT Service Desk: Mailbox closes in 30 minutes. Verify your password here. Sender: help@lakeview-support.example — an address you haven't used before.

Ms. Ruiz: Thanks. Support confirms they didn't send it. We'll check who else received it.

Dana: I was about to open the same one. I'll send my report too.

Sam Ortiz: My account still isn't ready. I need to check today's work list.

Dana: You could use mine while they finish setting yours up. I'll stay beside you.

No emergency is underway. Lakeview reserves its emergency-access route for emergencies.

Both need this list for their assigned work; Dana can open it.

Sam Ortiz: That gives me today's jobs. I'll use my own sign-in when it's ready.

Your workspace: Patient names are on your screen and a printout. Auto-logoff: five minutes; you'll be away for one. Turning off this screen doesn't lock the computer.

Nobody stays. Lakeview requires locked paper storage here. The designated secure drawer self-locks when shut; the covered desktop tray doesn't lock.

Sam Ortiz: Ready? The cart waited for us.

Sam Ortiz: Could my personal AI chatbot shorten this patient message? It would save a few minutes.

Message excerpt: Includes a name, full birth date, phone number and visit date. Nothing has been sent.

Lakeview's record editor is approved for patient information. The chatbot service and account haven't been assessed.

Sam Ortiz: I'll do this one here. We can ask about a suitable tool for the next one.

Dana: It's not in my bag. It has work email and our patient-message app. I last used it outside.

You don't yet know where it is or whether anyone has accessed it. Ms. Ruiz is Lakeview's security contact.

Dana: I'll tell her when and where I last had it. Then I'll retrace my steps.

Text · unfamiliar number

Hi, it's Dr. Patel. I'm locked out. Read me the code you just received.

Sign-in notification

A one-time code for YOUR work account. You didn't start a login.

What do you do? Choose one

Right

Don't share the code, even if the caller knows a familiar name. Report the unexpected sign-in attempt and check the claimed request through the directory, not the new number.

Ms. Ruiz

Dr. Patel confirms she didn't send that. Keep both messages for our review.

Your practice's policy Keep your sign-in secrets to yourself; report unexpected attempts to use your account. Authentication: 45 CFR 164.312(d); response: 164.308(a)(6)

Why the other answers are wrong
  • Call Dr. Patel through the directory; report the request; read out your sign-in code. Not yet. The directory can establish who is asking, but the code is for your account. A genuine colleague still must not use that code under Lakeview's procedure. Report the attempt and keep the code private.
  • Call the unfamiliar number; report the request; keep your sign-in code. Not yet. Keeping the code private is right, but a call to the new number still reaches the source of the unverified request. Use the directory to check with Dr. Patel.

Shift complete

The doors open

Sam Ortiz

None of that looked like a security task.

You

It looked like getting ready.

Ms. Ruiz

HIPAA makes the practice put safeguards in place. Your part is to follow our procedures and speak up.

Use your own access. Keep patient information in approved places. Report trouble early.

Episode complete. Your employer must also teach its own policies and procedures.

All episodes

The whole core course

Every core episode, $29 per learner. With a final check, a certificate of completion and a training record.

See pricing

All staff: one practice scenario, not a complete HIPAA training program. HIPAA requires your employer to train you on its own policies and procedures (45 CFR 164.530(b)) and to run a security awareness program (164.308(a)(5)). Sources checked 2026-10-20. More: all episodes by role · HIPAA training for new employees.