hipaa.systems
Free training episode · managers · about 8 minutes · no sign-up

People joining and leaving The job changes. The access changes with it.

You are handling office-management work at fictional Lakeview Health Partners. Ms. Ruiz remains its privacy and security officer. You carry out the agreed procedures; she decides changes to the HIPAA program. All people, records and events are fictional.

Decision 1 of 7

Decision 1 of 7

Ready for Monday

A new reception colleague starts Monday. Her tasks are appointments and check-in, not clinical care or coding.

Dana Front desk colleague

My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements

Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Which permissions should you ask IT to assign? Choose one

Right

Yes — submit the approved role permissions for her own login. Record who approved the access and confirm what IT enabled. This is carrying out Lakeview's access process, not deciding that everyone at reception needs the same rights forever.

Dana

My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

Your practice's policy Set up the person's own account for their assigned job, using the practice's access approval process. 45 CFR 164.308(a)(3)–(4); 164.312(a)(2)(i)

Why the other answers are wrong
  • Use the approved front-office cover template. Not yet — that template fits Dana's desk-and-billing cover. The starter has no billing duties. Approval for a colleague's combined role does not make it the approved scope for this job.
  • Use the approved intake-support role template. Not yet — the intake-support setup includes Sam's clinical work. This starter will handle appointments and check-in, not those clinical tasks. A role template can be valid for one job and too broad for another.

Decision 2 of 7

The training appointment

The starter's Monday includes real check-in work. You can arrange a short session before it begins.

Previous conversation

Dana: My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements: Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Dana: My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

First week

Lakeview requires a task briefing before solo patient work. A general HIPAA course and the local briefing are both scheduled; privacy training covers the practice's procedures, and security awareness covers everyone.

Dr. Avery Chen Practice owner

Where does the local briefing go in her day?

Which plan should you put on the calendar? Choose one

Right

Yes — arrange the briefing, then document the training actually provided: who attended, when, the subjects and where the record is kept. HIPAA requires new-workforce privacy training within a reasonable period and documentation. Training before PHI work where practicable is our recommendation; before solo work is Lakeview's procedure here, not a universal federal day-one deadline.

Dr. Avery Chen

I'll protect that time. The course gives the baseline; she still needs to know how our desk works.

Your practice's policy Give the local task briefing before solo work under this procedure, and keep a record of the training provided. 45 CFR 164.530(b), (j); 164.308(a)(5)

Why the other answers are wrong
  • Put the briefing ahead of her first monthly review. Not yet — a monthly review is a useful follow-up, not the first explanation of the tasks she will do alone on Monday. Lakeview's procedure puts that explanation before solo work.
  • Put the briefing ahead of her first annual refresher. Not yet — a later refresher cannot serve as Monday's task briefing. HIPAA does not itself set an annual training cycle, and Lakeview has a usable earlier session available.

Decision 3 of 7

A different job

A biller moves permanently to reception. She will no longer code claims or cover billing absences.

Previous conversation

Dana: My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements: Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Dana: My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

First week: Lakeview requires a task briefing before solo patient work. A general HIPAA course and the local briefing are both scheduled; privacy training covers the practice's procedures, and security awareness covers everyone.

Dr. Avery Chen: Where does the local briefing go in her day?

Dr. Avery Chen: I'll protect that time. The course gives the baseline; she still needs to know how our desk works.

Dana Front desk colleague

The desk permissions are ready. Do the coding permissions stay attached to her account?

Job change

The access owner has approved the reception duties. You coordinate the change; IT can adjust the existing named account and preserve its history.

What should the request cover? Choose one

Right

Yes — arrange both sides of the change and confirm the effective permissions. Keep the named account and its history; change the rights, not the identity. Record the approval and completion under Lakeview's process. If an unexpected task still needs access, return it for authorization rather than restore the former role yourself.

Dana

I'll check what was removed as well as what was added. Her new job shouldn't quietly keep the old one.

Your practice's policy A role change updates both the permissions the person gains and those their work no longer needs. 45 CFR 164.308(a)(4)(ii)(B)–(C); 164.514(d)(2)

Why the other answers are wrong
  • Add reception access; retain coding access for future cover. Not yet — the new job expressly has no billing-cover duties. Future convenience does not establish a current work need. Ask for a new approval if those duties are later assigned.
  • Add reception access; retain coding access for past claims. Not yet — having worked on a claim does not create ongoing access after that duty ends. The account history can remain available to authorized staff without keeping the former coding permissions active.

Decision 4 of 7

Friday's handover

An employee leaves Friday. You are preparing Lakeview's departure checklist, not investigating an incident.

Previous conversation

Dana: My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements: Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Dana: My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

First week: Lakeview requires a task briefing before solo patient work. A general HIPAA course and the local briefing are both scheduled; privacy training covers the practice's procedures, and security awareness covers everyone.

Dr. Avery Chen: Where does the local briefing go in her day?

Dr. Avery Chen: I'll protect that time. The course gives the baseline; she still needs to know how our desk works.

Dana: The desk permissions are ready. Do the coding permissions stay attached to her account?

Job change: The access owner has approved the reception duties. You coordinate the change; IT can adjust the existing named account and preserve its history.

Dana: I'll check what was removed as well as what was added. Her new job shouldn't quietly keep the old one.

Issued and enabled

The employee uses the EHR, work email and a separate payer portal, and holds a door key and laptop. Lakeview schedules removal at the end of authorized work and records each completion.

Dana Front desk colleague

Payroll has an exit form; IT has a device list. What will you check against the actual handover?

Which list should guide the closure checks? Choose one

Right

Yes — coordinate the account removals and return of issued items, including the separate payer portal. Record what was completed, when and by whom; take any unresolved route to the security officer promptly. HIPAA requires a termination process under its Addressable specification, not this universal Friday checklist or a prescribed last-day hour.

Dana

I'll line up the payer administrator too. Returning the laptop doesn't turn off a separate portal account.

Your practice's policy Follow the departure process across accounts and physical access, and confirm each part rather than infer it from payroll. 45 CFR 164.308(a)(3)(ii)(C); 164.310(a), (d)

Why the other answers are wrong
  • Use the payroll list of final payments and benefits. Not yet — payroll needs that list, but payment and benefits do not show which patient-information routes remain open. Use an access-and-property list for this part of the handover.
  • Use the schedule list of appointments and shift cover. Not yet — covering the departing person's work is important, but a covered shift does not close their accounts or recover their property. Check the access routes separately from the work schedule.

Decision 5 of 7

The mailbox still opens

The departing employee knew the PIN for a telephone mailbox containing patient callbacks. It can be reached from outside.

Previous conversation

Dana: My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements: Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Dana: My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

First week: Lakeview requires a task briefing before solo patient work. A general HIPAA course and the local briefing are both scheduled; privacy training covers the practice's procedures, and security awareness covers everyone.

Dr. Avery Chen: Where does the local briefing go in her day?

Dr. Avery Chen: I'll protect that time. The course gives the baseline; she still needs to know how our desk works.

Dana: The desk permissions are ready. Do the coding permissions stay attached to her account?

Job change: The access owner has approved the reception duties. You coordinate the change; IT can adjust the existing named account and preserve its history.

Dana: I'll check what was removed as well as what was added. Her new job shouldn't quietly keep the old one.

Issued and enabled: The employee uses the EHR, work email and a separate payer portal, and holds a door key and laptop. Lakeview schedules removal at the end of authorized work and records each completion.

Dana: Payroll has an exit form; IT has a device list. What will you check against the actual handover?

Dana: I'll line up the payer administrator too. Returning the laptop doesn't turn off a separate portal account.

Dana Front desk colleague

The mailbox isn't her account. We usually change that PIN at the monthly phone check.

Phone procedure

Lakeview's approved departure procedure includes shared secrets the worker knew. You can ask the phone administrator to make the change; individual EHR accounts remain separate.

When should you arrange the PIN change? Choose one

Right

Yes — arrange the change through the phone administrator and record completion. Give the new secret through the approved method to authorized staff. If the system cannot support the agreed control, record that limitation and send it to the security officer; do not decide a new exception yourself.

Dana

I'll add the shared PIN to the handover. Closing her named accounts wouldn't change what she already knows.

Your practice's policy End access through shared secrets as well as personal accounts, using the practice's approved procedure. 45 CFR 164.308(a)(3)(ii)(C), (a)(5)(ii)(D)

Why the other answers are wrong
  • Arrange the change with the monthly phone check. Not yet — the monthly check does not remove the departing worker's ability to open this mailbox in the meantime. Follow the approved departure process for the shared secret too.
  • Arrange the change with the replacement worker's arrival. Not yet — a replacement's start date does not determine when this worker's access should end. The unchanged PIN would remain a separate route into patient callbacks.

Decision 6 of 7

Two weeks of cover

An agency sends a temporary receptionist. Lakeview directly controls how she handles check-in and patient information.

Previous conversation

Dana: My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements: Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Dana: My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

First week: Lakeview requires a task briefing before solo patient work. A general HIPAA course and the local briefing are both scheduled; privacy training covers the practice's procedures, and security awareness covers everyone.

Dr. Avery Chen: Where does the local briefing go in her day?

Dr. Avery Chen: I'll protect that time. The course gives the baseline; she still needs to know how our desk works.

Dana: The desk permissions are ready. Do the coding permissions stay attached to her account?

Job change: The access owner has approved the reception duties. You coordinate the change; IT can adjust the existing named account and preserve its history.

Dana: I'll check what was removed as well as what was added. Her new job shouldn't quietly keep the old one.

Issued and enabled: The employee uses the EHR, work email and a separate payer portal, and holds a door key and laptop. Lakeview schedules removal at the end of authorized work and records each completion.

Dana: Payroll has an exit form; IT has a device list. What will you check against the actual handover?

Dana: I'll line up the payer administrator too. Returning the laptop doesn't turn off a separate portal account.

Dana: The mailbox isn't her account. We usually change that PIN at the monthly phone check.

Phone procedure: Lakeview's approved departure procedure includes shared secrets the worker knew. You can ask the phone administrator to make the change; individual EHR accounts remain separate.

Dana: I'll add the shared PIN to the handover. Closing her named accounts wouldn't change what she already knows.

The arrangement

The agency handles recruitment and payroll only, with no patient information. Her individual access and local briefing are ready. Lakeview will supervise her work at the desk.

Dr. Avery Chen Practice owner

Does being paid by the agency change which HIPAA process we use for her?

How should you bring her into this work? Choose one

Right

Yes — complete the workforce onboarding and let her start the assigned work. HIPAA's workforce definition turns on direct control, not who pays her or how long she stays. Keep the access and training records. The agency needs no BAA merely for this recruitment/payroll arrangement without PHI; classify any added service separately.

Dr. Avery Chen

Then she gets our briefing and her own access. A two-week contract doesn't put her outside our procedures.

HIPAA requires People working under the practice's direct control belong in its workforce safeguards and training, even when someone else pays them. 45 CFR 160.103 (workforce); 164.308(a)(3), (5); 164.530(b)

Why the other answers are wrong
  • Proceed under the process for an outside treating provider. Not yet — this is reception work under Lakeview's direct control, not an independent provider receiving records for treatment. The treatment-provider exception is not her relationship here.
  • Proceed under the process for a business associate's staff. Not yet — the agency supplies people and payroll, not a PHI-handling service in these facts. Lakeview directly controls this person's work. A different arrangement could put outsourced work under a business associate.

Decision 7 of 7

Back for an afternoon

A former biller returns for one afternoon to schedule follow-up appointments. No claim work is assigned.

Previous conversation

Dana: My front-office cover setup includes billing. Sam's intake-support setup includes clinical work. Which setup should IT give her?

Access arrangements: Lakeview has a reception role template. The access owner has approved it for this starter; you may submit the setup request. Each person gets a separate login.

Dana: My extra cover shouldn't become her starting point. I'll send IT her own tasks, not a copy of my account.

First week: Lakeview requires a task briefing before solo patient work. A general HIPAA course and the local briefing are both scheduled; privacy training covers the practice's procedures, and security awareness covers everyone.

Dr. Avery Chen: Where does the local briefing go in her day?

Dr. Avery Chen: I'll protect that time. The course gives the baseline; she still needs to know how our desk works.

Dana: The desk permissions are ready. Do the coding permissions stay attached to her account?

Job change: The access owner has approved the reception duties. You coordinate the change; IT can adjust the existing named account and preserve its history.

Dana: I'll check what was removed as well as what was added. Her new job shouldn't quietly keep the old one.

Issued and enabled: The employee uses the EHR, work email and a separate payer portal, and holds a door key and laptop. Lakeview schedules removal at the end of authorized work and records each completion.

Dana: Payroll has an exit form; IT has a device list. What will you check against the actual handover?

Dana: I'll line up the payer administrator too. Returning the laptop doesn't turn off a separate portal account.

Dana: The mailbox isn't her account. We usually change that PIN at the monthly phone check.

Phone procedure: Lakeview's approved departure procedure includes shared secrets the worker knew. You can ask the phone administrator to make the change; individual EHR accounts remain separate.

Dana: I'll add the shared PIN to the handover. Closing her named accounts wouldn't change what she already knows.

The arrangement: The agency handles recruitment and payroll only, with no patient information. Her individual access and local briefing are ready. Lakeview will supervise her work at the desk.

Dr. Avery Chen: Does being paid by the agency change which HIPAA process we use for her?

Dr. Avery Chen: Then she gets our briefing and her own access. A two-week contract doesn't put her outside our procedures.

Return arrangements

Her old account is disabled. The access owner approves scheduling; her briefing is complete. The front-office cover role also includes billing. You may request reactivation for this assignment; the account history must remain.

Dana Front desk colleague

She remembers the billing screens. Which rights should IT bring back for today?

What should the reactivation request specify? Choose one

Right

Yes — request the scheduling rights, confirm the actual setup and arrange their end when the afternoon assignment ends. Keep the prior account history. If a system cannot apply the assigned rights, pause that setup and give the limitation to the security officer rather than revive unnecessary access as a workaround.

Dana

Same person, different work. I'll check today's rights and when they stop, not restore the old job.

Your practice's policy Returning staff need access for the current assignment, with its own approval and end point. 45 CFR 164.308(a)(3)–(4); 164.312(a)

Why the other answers are wrong
  • Apply the access template for claims follow-up. Not yet — claim follow-up fits her former billing job, but no claim work is assigned this afternoon. A familiar person returning does not make the former role's permissions current for different work.
  • Apply the access template for front-office cover. Not yet — Lakeview's front-office cover setup includes billing as well as reception. Today's assignment is scheduling, not that combined cover role. Ask for the rights this assignment authorizes.

Shift complete

The people list is an access list

Dana

Starting, changing jobs, leaving, coming back — each one changes which doors should open.

Ms. Ruiz

Run the agreed steps and keep the record. Bring me a missing control or an exception to decide.

Match access to today's work. Confirm the changes. Keep the officer's decisions separate from your follow-through.

Your employer must teach its access approvers, training arrangements, departure timing, shared-secret controls and incident-reporting route. This episode does not assign you the officer's program decisions or certify the practice's compliance.

All episodes

The whole manager add-on

Every manager episode: $19 per learner on top of the $29 core course every role needs. With a final check, a certificate of completion and a training record.

See pricing

Managers: one practice scenario, not a complete HIPAA training program. HIPAA requires your employer to train you on its own policies and procedures (45 CFR 164.530(b)) and to run a security awareness program (164.308(a)(5)). Sources checked 2026-10-21. More: all episodes by role · HIPAA training for new employees.