HIPAA Rescue Manual for Healthcare Practices

What you will learn

• Determine whether and how HIPAA applies to your organization and your business associates
• Apply the Privacy Rule: permitted uses and disclosures, patient rights and the minimum-necessary standard
• Implement the Security Rule's administrative, physical and technical safeguards
• Run a risk analysis and risk management process that stands up in an OCR audit
• Handle a breach: assessment, notification timelines and enforcement exposure
• Extend HIPAA controls to cloud services, emerging technologies and contingency planning

Course outline: 16 modules, 63 lessons

Introduction to HIPAA Compliance

• Course Overview and Objectives
• Why HIPAA Compliance Matters

HIPAA Basics - Key Definitions and Applicability

• Understanding HIPAA - History and Overview
• Key Definitions (PHI, ePHI, Covered Entity, Business Associate)
• HIPAA Administrative Simplification and Other Rules Overview

The HIPAA Privacy Rule in Depth

• Privacy Rule Fundamentals
• Permitted Uses and Disclosures of PHI
• Patient Rights Under the Privacy Rule
• Administrative Requirements of the Privacy Rule
• Privacy Rule Violations and Scenarios

HIPAA Breach Notification Rule & Enforcement

• The Breach Notification Rule - Requirements and Process
• HIPAA Enforcement and Penalty Structure
• Real-World Case Studies of Non-Compliance

HIPAA Security Rule - Overview and Key Principles

• Introduction to the Security Rule
• Key Principles - Flexibility, Scalability, and Technology Neutrality
• The Security Management Process - Foundation of Compliance

Administrative Safeguards - Managing Security

• Security Management Process
• Assigned Security Responsibility
• Workforce Security
• Information Access Management
• Security Awareness and Training
• Security Incident Procedures
• Contingency Plan
• Evaluation
• Business Associate Contracts and Other Arrangements

Physical Safeguards - Protecting the Environment

• Facility Access Controls
• Workstation Use
• Workstation Security
• Device and Media Controls

Technical Safeguards - Technology and Policies for Protection

• Access Control

Organizational Requirements, Policies & Procedures, and Documentation

• Organizational Requirements - Business Associates
• Organizational Requirements - Group Health Plans (§ 164.314(b))
• Policies and Procedures (§ 164.316(a))
• Documentation (§ 164.316(b))

HIPAA and Cloud Computing

• Introduction to Cloud Computing Models and HIPAA
• CSP Responsibilities vs. Customer Responsibilities
• Applying HIPAA Security Rule in the Cloud
• Business Associate Agreements with CSPs

HIPAA and Emerging Technologies

• Artificial Intelligence (AI) and Machine Learning (ML) in Healthcare
• Internet of Things (IoT) in Healthcare (IoMT)
• Blockchain in Healthcare
• Telehealth and Remote Communication

Final Assessment and Certification

• Purpose and Scope of the Final Assessment
• Assessment Format and Structure
• Grading, Attempts, and Certification

Risk Analysis and Management

• Security Management Process Overview (§ 164.308(a)(1))
• Risk Analysis (§ 164.308(a)(1)(ii)(A))
• Risk Management (§ 164.308(a)(1)(ii)(B))

HIPAA Audits and How to Prepare

• Overview of the OCR HIPAA Audit Program
• The Audit Process (Based on Phase 2)
• Preparing for a HIPAA Audit

Contingency Planning

• Contingency Plan Standard Overview (§ 164.308(a)(7))
• Data Backup Plan (§ 164.308(a)(7)(ii)(A))
• Disaster Recovery Plan (§ 164.308(a)(7)(ii)(B))
• Emergency Mode Operation Plan (§ 164.308(a)(7)(ii)(C))
• Testing and Revision Procedures (§ 164.308(a)(7)(ii)(D))
• Applications and Data Criticality Analysis (§ 164.308(a)(7)(ii)(E))

Security Incident Response

• Security Incident Procedures Standard Overview (§ 164.308(a)(6))
• Importance and Goals of Incident Response
• Developing an Incident Response Plan (IRP)
• Phases of Incident Response
• Documentation and Evidence Preservation
• Linking Incident Response to Breach Assessment

Frequently Asked Questions