hipaa.systems
Free training episode · privacy and security officers · about 8 minutes · no sign-up

The privacy contact's afternoon One afternoon. Six decisions.

Take the privacy and security contact's seat in a fictional outpatient practice. Staff bring you the difficult moments. Decide what to check, what to record and what cannot wait. All people and records are fictional.

Decision 1 of 6

Decision 1 of 6

The reply that sounds reassuring

1:10 p.m., Lakeview Health Partners. You take Ms. Ruiz's role: office manager and privacy/security contact.

Dana Front-desk colleague

I sent a patient's lab summary as an attachment to the wrong address. The stranger replied: 'Deleted.'

Assessment notes

The information, identifiers and recipient have been assessed; the deletion reply is recorded as mitigation. No conclusion yet.

Which factor still needs its own entry? Choose one

Right

Thank Dana, preserve the facts and limit further exposure. Check the exceptions; otherwise presume a breach unless an assessment supports low probability of compromise. Record the information, recipient, actual viewing and mitigation. The deletion reply is evidence, not the verdict.

Dana

I'll keep the original and their reply. I'm glad I told you instead of guessing.

HIPAA requires Support and document a decision not to notify; a reassuring reply alone isn't enough. 45 CFR 164.402; 164.414

Why the other answers are wrong
  • Add an entry about what was done to stop further sharing. Not yet. That is mitigation, already addressed by the recorded deletion reply. The assessment also needs to address whether the recipient actually acquired or viewed the attachment. More mitigation evidence can help, but doesn't replace that factor.
  • Add an entry about what patient details the attachment contained. Not yet. The notes already assess the information and identifiers. That factor matters, but repeating it doesn't address whether the attachment was actually acquired or viewed. Investigate and record that remaining factor, including uncertainty.

Decision 2 of 6

A useful trial

1:25 p.m. Sam shows you an appointment reminder trial.

Previous conversation

Dana: I sent a patient's lab summary as an attachment to the wrong address. The stranger replied: 'Deleted.'

Assessment notes: The information, identifiers and recipient have been assessed; the deletion reply is recorded as mitigation. No conclusion yet.

Dana: I'll keep the original and their reply. I'm glad I told you instead of guessing.

Sam Ortiz Nurse colleague

It would save calls. I've tested it with made-up people; I'd like to connect tomorrow's list.

Trial setup

Connecting sends tomorrow's names and visit types to the company's servers today. Messages start next week; payment starts next month. No contract review yet.

Which step first requires the BAA to be in effect? Choose one

Right

This service stores PHI on Lakeview's behalf for practice administration: it is a business associate for that work. Put the required BAA in place and complete the practice's security review before real data enters. A BAA alone isn't approval of every feature.

Sam Ortiz

I'll leave the connection off. We can still test the reminder wording with invented appointments.

HIPAA requires Establish the vendor's role and required BAA before sharing PHI for its work. 45 CFR 160.103; 164.502(e); 164.504(e)

Why the other answers are wrong
  • Have the BAA in effect before starting the paid subscription. Not yet. Payment starts next month, but patient information would reach the company today. A free trial doesn't postpone the business-associate agreement required before that transfer.
  • Have the BAA in effect before starting automatic reminder delivery. Not yet. Reminders start next week, but the company receives and stores the list today. Sending messages isn't the first PHI-handling step; the agreement must cover the earlier transfer too.

Decision 3 of 6

Three days left

1:40 p.m. Dana brings the records-request tracker.

Previous conversation

Dana: I sent a patient's lab summary as an attachment to the wrong address. The stranger replied: 'Deleted.'

Assessment notes: The information, identifiers and recipient have been assessed; the deletion reply is recorded as mitigation. No conclusion yet.

Dana: I'll keep the original and their reply. I'm glad I told you instead of guessing.

Sam Ortiz: It would save calls. I've tested it with made-up people; I'd like to connect tomorrow's list.

Trial setup: Connecting sends tomorrow's names and visit types to the company's servers today. Messages start next week; payment starts next month. No contract review yet.

Sam Ortiz: I'll leave the connection off. We can still test the reminder wording with invented appointments.

Request tracker

Day 27 since receipt. No extension used. The archive problem prevents completion by day 30; the team can finish by day 45.

Dana Front-desk colleague

The patient left a voicemail asking how it's going.

How do you handle the extra time? Choose one

Right

Send the written statement now, giving the reason and the actual date for completion; retain a copy. Update the tracker and deliver as promised. HIPAA allows only one extension, up to 30 more days. A stricter applicable deadline still needs checking.

Dana

I'll put the calendar date in the letter, not 'about two weeks', and save the copy.

HIPAA requires An access extension needs written reasons and a completion date within the first 30 days. 45 CFR 164.524(b)(2)

Why the other answers are wrong
  • Make an extension call on day 28; log the reasons and a day-45 completion date. Not yet. Calling and keeping a note can help, but the individual must receive the written reasons and completion date within the original 30 days. Add the written statement in time.
  • Deliver the completed copy on day 45; enclose reasons for using the extra time. Not yet. The written extension statement is due within the first 30 days, not with the completed copy on day 45. The archive delay does not move that notice deadline.

Decision 4 of 6

Someone everyone trusts

2:05 p.m. An access review brings a different kind of incident.

Previous conversation

Dana: I sent a patient's lab summary as an attachment to the wrong address. The stranger replied: 'Deleted.'

Assessment notes: The information, identifiers and recipient have been assessed; the deletion reply is recorded as mitigation. No conclusion yet.

Dana: I'll keep the original and their reply. I'm glad I told you instead of guessing.

Sam Ortiz: It would save calls. I've tested it with made-up people; I'd like to connect tomorrow's list.

Trial setup: Connecting sends tomorrow's names and visit types to the company's servers today. Messages start next week; payment starts next month. No contract review yet.

Sam Ortiz: I'll leave the connection off. We can still test the reminder wording with invented appointments.

Request tracker: Day 27 since receipt. No extension used. The archive problem prevents completion by day 30; the team can finish by day 45.

Dana: The patient left a voicemail asking how it's going.

Dana: I'll put the calendar date in the letter, not 'about two weeks', and save the copy.

Review finding

A senior colleague opened a neighbour's chart out of curiosity. No care or work assignment; the colleague confirms the lookup.

Dr. Avery Chen Practice owner

They've helped this practice for years. Let's handle this fairly.

Which entries meet the documentation duties here? Choose all that apply

Right

Use the same policy and relevant factors, not status or popularity; record any sanction applied. Separately, complete the breach review. Appropriate doesn't mean identical penalties for unlike cases. Restrict unnecessary access and mitigate harm while the review proceeds.

Dr. Avery Chen

Fair means we use the process for everyone, not that we quietly skip it for someone we like.

HIPAA requires Apply and document appropriate sanctions; separately address the privacy incident. 45 CFR 164.530(e); 164.308(a)(1)(ii)(C); 164.402

Why the other answers are wrong
  • Record the meeting date and job title as the sanction entry. Not yet. Those details identify a meeting and worker, but don't say what sanction was applied. Document the action taken; an appropriately documented warning can be sufficient under the practice's policy.
  • Record the colleague's explanation as the decision about patient notification. Not yet. The colleague's account is useful evidence, not the practice's notification decision. Assess what happened under the breach rules and record the conclusion and its reasons; their explanation alone doesn't settle it.

Decision 5 of 6

Monday's starter

2:35 p.m. Sam is preparing the new colleague's induction.

Previous conversation

Dana: I sent a patient's lab summary as an attachment to the wrong address. The stranger replied: 'Deleted.'

Assessment notes: The information, identifiers and recipient have been assessed; the deletion reply is recorded as mitigation. No conclusion yet.

Dana: I'll keep the original and their reply. I'm glad I told you instead of guessing.

Sam Ortiz: It would save calls. I've tested it with made-up people; I'd like to connect tomorrow's list.

Trial setup: Connecting sends tomorrow's names and visit types to the company's servers today. Messages start next week; payment starts next month. No contract review yet.

Sam Ortiz: I'll leave the connection off. We can still test the reminder wording with invented appointments.

Request tracker: Day 27 since receipt. No extension used. The archive problem prevents completion by day 30; the team can finish by day 45.

Dana: The patient left a voicemail asking how it's going.

Dana: I'll put the calendar date in the letter, not 'about two weeks', and save the copy.

Review finding: A senior colleague opened a neighbour's chart out of curiosity. No care or work assignment; the colleague confirms the lookup.

Dr. Avery Chen: They've helped this practice for years. Let's handle this fairly.

Dr. Avery Chen: Fair means we use the process for everyone, not that we quietly skip it for someone we like.

Sam Ortiz Nurse colleague

They've sent last month's course certificate from their previous employer. They're starting here Monday.

The earlier course covered record requests and caller identity checks. Those steps are unchanged here; Lakeview uses different incident contacts and permitted channels.

Which topic fills the local-training gap shown here? Choose one

Right

Use prior learning as a starting point. Teach Lakeview's relevant privacy, breach-reporting and security rules, and write down when and what was taught. HIPAA says new-workforce privacy training within a reasonable period, not a universal first-day or annual deadline. Lakeview gives essential instructions before unsupervised work.

Sam Ortiz

I'll cover our reporting route and channels before the first independent shift, then record what we covered.

HIPAA requires Teach new staff the relevant local rules within a reasonable period and keep a record. 45 CFR 164.530(b)(1)–(2); 164.308(a)(5)

Why the other answers are wrong
  • Teach the record-request steps on Monday; record what was covered. Not yet. Those are useful topics, but the scene says the earlier course covered them and those steps are unchanged here. This gap concerns Lakeview's different reporting contacts and communication channels.
  • Teach the caller-identity steps on Monday; record what was covered. Not yet. Caller checks are important, but they were covered and remain unchanged here. They don't teach the different local reporting contacts and communication channels this worker needs.

Decision 6 of 6

This time, the patient calls

3:10 p.m. Marion Ellis calls you directly.

Previous conversation

Dana: I sent a patient's lab summary as an attachment to the wrong address. The stranger replied: 'Deleted.'

Assessment notes: The information, identifiers and recipient have been assessed; the deletion reply is recorded as mitigation. No conclusion yet.

Dana: I'll keep the original and their reply. I'm glad I told you instead of guessing.

Sam Ortiz: It would save calls. I've tested it with made-up people; I'd like to connect tomorrow's list.

Trial setup: Connecting sends tomorrow's names and visit types to the company's servers today. Messages start next week; payment starts next month. No contract review yet.

Sam Ortiz: I'll leave the connection off. We can still test the reminder wording with invented appointments.

Request tracker: Day 27 since receipt. No extension used. The archive problem prevents completion by day 30; the team can finish by day 45.

Dana: The patient left a voicemail asking how it's going.

Dana: I'll put the calendar date in the letter, not 'about two weeks', and save the copy.

Review finding: A senior colleague opened a neighbour's chart out of curiosity. No care or work assignment; the colleague confirms the lookup.

Dr. Avery Chen: They've helped this practice for years. Let's handle this fairly.

Dr. Avery Chen: Fair means we use the process for everyone, not that we quietly skip it for someone we like.

Sam Ortiz: They've sent last month's course certificate from their previous employer. They're starting here Monday.

The earlier course covered record requests and caller identity checks. Those steps are unchanged here; Lakeview uses different incident contacts and permitted channels.

Sam Ortiz: I'll cover our reporting route and channels before the first independent shift, then record what we covered.

Marion Ellis Patient

I heard staff discussing my appointment in the waiting room. I want to complain. Can I contact HHS as well?

You haven't checked what happened. Marion has another appointment booked.

Ways to contact us

Phone, mail or secure message.

Which event marks Lakeview's receipt of this complaint? Choose one

Right

Record the complaint, investigate and write down the outcome, if any. Confirm that complaining won't affect care. Marion can also complain to HHS OCR. Review what happened without assuming the complaint proves a breach or dismissing it as incidental.

Marion Ellis

Thank you. I wanted someone to listen, not to lose my next appointment.

HIPAA requires Provide a complaint process, keep its record and never retaliate for speaking up. 45 CFR 164.530(d), (g); 160.306

Why the other answers are wrong
  • Give her the OCR link; use her written follow-up as the receipt date. Not yet. Lakeview accepts complaints by phone. A later written account can add detail, but today's call is already a complaint received by Lakeview.
  • Give her the OCR link; use the first staff interview as the receipt date. Not yet. Interviewing staff is part of reviewing the complaint, not when Lakeview received it. Record today's phone complaint; the investigation and its outcome are separate.

Shift complete

Before you leave the desk

Dr. Avery Chen

Did everything get closed this afternoon?

You

Not everything. But each issue has an owner, a record and a next step.

Contain what you can. Check before concluding. Record the decision, and use the same fair process for everyone.

Episode complete. Your employer must also teach its own policies and procedures.

All episodes

The whole privacy and security officer course

A separate course for the person accountable for the practice's HIPAA program, built on the core course. It opens after its planned episodes are written; the price is set at launch. With a final check, a certificate of completion and a training record.

See the course and get notified

Privacy and security officers: one practice scenario, not a complete HIPAA training program. HIPAA requires your employer to train you on its own policies and procedures (45 CFR 164.530(b)) and to run a security awareness program (164.308(a)(5)). Sources checked 2026-10-20. More: all episodes by role · HIPAA training for new employees.