HIPAA Refresher for Healthcare Workers

(HIPAA Privacy, Security, and Enforcement Training)

Table of Contents:

• HIPAA Refresher for Healthcare Workers
• Legal Notice
• Objectives
• HIPAA: Why Do I Need a Refresher?
• Who Must Abide by HIPAA?
• HIPAA Privacy Rule
• “Minimum Necessary” Principal
• Permitted Use and Disclosure of PHI
• Incidental Use and Disclosure of PHI
• Authorized Use and Disclosure of PHI
• Notice of Privacy Practices
• Individual Rights Under the Privacy Rule
• Ensuring Privacy Rule Compliance
• Additional Privacy Rule Considerations
• HIPAA Privacy Rule Scenarios
• HIPAA Security Rule
• Safeguards in Daily Practice
• HIPAA Security Rule Scenario
• HIPAA Breach Notification
• What if a Breach is Discovered?
• HIPAA Enforcement Rule
• HIPAA Enforcement Rule – Penalties
• Real Life Examples of HIPAA Breach and Violations
• Recent Updates to HIPAA
• HIPAA Compliance Checklist
• End of Course Exam

Course Content Example 1:

Why Do I Need a Refresher?

Created over 20 years ago, the Health Insurance Portability and Accountability Act (HIPAA) continues to play a significant role in the everyday practice of health care professionals and their business associates.

Maintaining the privacy and security of patient information is more challenging than ever with the increased use of portable electronic devices, such as laptops and mobile phones.

Modifications have been made to HIPAA over time as a result of the HITECH Act of 2009 and the Omnibus Final Rule of 2013.

           These changes included:

• Strengthened existing HIPAA requirements for Privacy and Security
• Expanded individual’s rights relating to their PHI
• Increased enforcement of HIPAA, including higher fines for non-compliance
• Addressed notification for breaches of PHI

Course Content Example 2:

What if a Breach is Discovered?

If an employee discovers a potential breach of PHI, it should be reported immediately to the Privacy Officer

All possible attempts should be made to remedy the breach

If a Risk Assessment determines that a notification is needed:

• Notify the affected individuals within 60 days
• File a report with the Secretary of Department of Health and Human Services
• Notify the media if more than 500 individuals were affected