HIPAA: Protections and Compliance

Course Overview

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has settled or imposed civil money penalties in over 150 cases totaling nearly $145 million in enforcement actions. In the first five months of 2025 alone, OCR announced 10 resolution agreements for HIPAA violations, with penalties ranging from $25,000 to $3,000,000. Violations most commonly stem from failure to conduct security risk analyses, unauthorized disclosures of protected health information, unsecured electronic PHI, and delayed breach notifications. Small practices and large health systems alike face enforcement action.

This course trains your employees on the core requirements of HIPAA and their responsibilities for protecting patient health information. Your team will learn what constitutes protected health information, the minimum necessary standard, permitted uses and disclosures, patient rights under the Privacy Rule, electronic PHI security requirements, and breach notification obligations. The training prepares employees to handle health information correctly in both routine and unusual situations.

What You'll Learn

• What HIPAA is and which organizations qualify as covered entities and business associates
• The Privacy Rule: permitted uses, disclosures, minimum necessary standard, and patient rights
• The Security Rule: administrative, physical, and technical safeguards for electronic PHI
• What constitutes protected health information (PHI) and the 18 HIPAA identifiers
• Breach notification requirements including timelines, reporting to HHS, and individual notification
• Employee responsibilities for safeguarding PHI in daily operations
• Penalties for HIPAA violations including civil monetary penalties and criminal sanctions

Who Needs This Training

• Front desk and registration staff at medical, dental, and behavioral health offices
• Health plan administrators and insurance company employees who process claims
• IT and security staff responsible for maintaining systems containing electronic PHI
• Business associates including billing companies, IT vendors, and shredding services
• Human resources staff at self-insured employers who administer group health plans
• Supervisors at covered entities responsible for enforcing HIPAA policies in their departments

Regulatory Background