John Blacksmith

Business associates cannot use protected health information for their personal needs because the HIPAA Privacy Rule strictly limits access, use, and disclosure of such information to authorized purposes defined by law and by contractual agreements with covered entities. Protected health information may only be used to perform functions or services on behalf of a covered … Read more

Information can be shared without violating HIPAA when the disclosure is not protected health information, the individual has provided a valid HIPAA authorization, or the disclosure fits within a permitted or required use or disclosure under the HIPAA Privacy Rule and any applicable restrictions are followed. HIPAA applies to protected health information held by a … Read more

A limited data set under HIPAA is protected health information that has been stripped of specified direct identifiers and that a HIPAA Covered Entity may use or disclose for research, public health activities, or health care operations under the HIPAA Privacy Rule when a compliant data use agreement is in place. A limited data set … Read more

HIPAA does not apply to employers in their capacity as employers, and it applies only when an organization functions as a HIPAA Covered Entity or Business Associate that creates, receives, maintains, or transmits protected health information as part of regulated healthcare activities. Most employers are not HIPAA Covered Entities because they do not provide healthcare, … Read more

The length of HIPAA training depends on the type of HIPAA training you are taking, but a typical HIPAA refresher course is around 90 minutes, with additional time for any specialist modules that apply to your role. For most staff in a healthcare organization or HIPAA Business Associate, the core HIPAA refresher is designed to … Read more

If you want HIPAA certification in the sense of a recognized HIPAA training certificate, you can get it by completing an HIPAA certification course that meets HIPAA training requirements and issues a verifiable certificate when you finish. The Accredited HIPAA Certification course from The HIPAA Journal provides the most reputable HIPAA certification. What An Accredited … Read more

HIPAA is still in effect, and HIPAA Covered Entities and Business Associates remain legally required to comply with the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, with enforcement administered by the U.S. Department of Health and Human Services Office for Civil Rights. HIPAA is a federal statute enacted in 1996 and … Read more

Documentation of HIPAA training is both a legal requirement under HIPAA to keep training records for at least six years and the only reliable way to prove that your workforce was actually trained, when they were trained, and on what content. HIPAA does not just require you to train your workforce on privacy and security. … Read more

A Covered Entity under HIPAA is an organization or individual that falls into one of three regulated categories under federal health privacy and security regulations: a health plan, a health care clearinghouse, or a health care provider that transmits health information in electronic form in connection with a standard transaction, and that status triggers compliance … Read more

If you are trying to get HIPAA certification online, The HIPAA Journal’s Accredited HIPAA Certification is one of the strongest choices, because it is built by specialist HIPAA experts, kept current, and designed to change how employees actually behave with Protected Health Information rather than just teaching rule citations. At the typical price point for … Read more

Facebook Messenger is not HIPAA compliant and cannot be used by HIPAA Covered Entities or Business Associates to collect, transmit, or disclose Protected Health Information, except when a patient who is the subject of the Protected Health Information requests communication through Facebook Messenger and the provider implements precautions to avoid an impermissible disclosure. Facebook Messenger … Read more

A HIPAA breach is an impermissible use or disclosure of unsecured protected health information that violates the HIPAA Privacy Rule and is presumed to be a breach under the HIPAA Breach Notification Rule unless the covered entity or business associate completes a documented risk assessment showing a low probability that the protected health information was … Read more

A HIPAA violation can trigger an Office for Civil Rights investigation, mandatory corrective action and monitoring, breach notification duties when unsecured protected health information is compromised, civil monetary penalties or settlement payments, and, for certain knowing misconduct, criminal prosecution with fines and imprisonment. A report of a potential violation can come from a complaint, a … Read more

The HIPAA Privacy Rule is the federal regulation at 45 CFR Part 160 and Subparts A and E of 45 CFR Part 164 that establishes national standards for how HIPAA Covered Entities, and in certain cases Business Associates, may use and disclose protected health information and what rights individuals have over their protected health information. … Read more

The HIPAA Security Rule is a federal regulation that requires HIPAA Covered Entities and Business Associates to protect electronic protected health information through administrative, physical, and technical safeguards designed to preserve confidentiality, integrity, and availability. The HIPAA Security Rule applies to electronic protected health information that a regulated entity creates, receives, maintains, or transmits in … Read more

Avoiding HIPAA violations requires implementing and maintaining written HIPAA Privacy Rule and HIPAA Security Rule policies and procedures, limiting uses and disclosures of protected health information to permitted purposes, applying the HIPAA Minimum Necessary Rule when required, training the workforce to follow role-based rules, securing electronic protected health information with administrative, physical, and technical safeguards, … Read more

In the United States healthcare sector, best practice is to receive HIPAA training every year, so you should treat your HIPAA certification as something that needs to be renewed annually. HIPAA itself does not specify an exact expiration date for training or certificates, but it does require ongoing training that is “as necessary and appropriate” … Read more

If a nurse violates HIPAA, the nurse may face employer discipline up to termination, mandatory retraining, loss of access privileges, reporting to a licensing board, and in some cases civil or criminal enforcement, while the nurse’s employer may also have breach assessment and notification duties under the HIPAA Breach Notification Rule and may face regulatory … Read more

In a medical billing company, everyone needs HIPAA security awareness training and almost every member of the workforce needs HIPAA training, with only a few narrow exceptions. Medical billing companies function as HIPAA Business Associates because they create, receive, maintain, and transmit Protected Health Information (PHI) and Electronic PHI (ePHI) on behalf of HIPAA Covered … Read more

HIPAA is a federal law enacted by the United States Congress and signed by the President in 1996, and it is implemented through federal regulations issued by the U.S. Department of Health and Human Services that establish nationwide requirements for protecting and managing protected health information. HIPAA is the Health Insurance Portability and Accountability Act … Read more

HIPAA complaints within a HIPAA Covered Entity should be directed to the designated contact identified in the organization’s Notice of Privacy Practices for privacy complaints, which is typically the Privacy Officer or another workforce member assigned to receive and document complaints under the HIPAA Privacy Rule complaint process. The HIPAA Privacy Rule requires covered entities … Read more

HIPAA covers HIPAA Covered Entities, their Business Associates, and Business Associate subcontractors that create, receive, maintain, or transmit protected health information for regulated functions, while most individuals and organizations outside those roles are not directly subject to the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule. HIPAA Covered Entities fall into three … Read more

Reporting timeframes under HIPAA depend on the type of event, with breach notifications under the HIPAA Breach Notification Rule due without unreasonable delay and no later than 60 calendar days from discovery in most cases, and complaints to the U.S. Department of Health and Human Services Office for Civil Rights required within 180 days of … Read more

In most cases you will pay between 25 and 40 dollars to get HIPAA certified, and at that price point it is much smarter to choose a highly reputable training provider than to chase the lowest possible fee. Price Is Low, So Quality Matters More Than Dollars Because individual HIPAA training and certification is usually … Read more

HIPAA compliant cloud storage is cloud-based data storage used by a HIPAA Covered Entity or Business Associate to create, receive, maintain, or transmit electronic protected health information under a configuration and contractual framework that meets HIPAA Privacy Rule and HIPAA Security Rule requirements, including a Business Associate Agreement when the cloud provider handles protected health … Read more

HIPAA awareness should be promoted at onboarding, at least annually, and whenever organizational, legal, or operational changes affect how the workforce uses, discloses, accesses, stores, or transmits protected health information or electronic protected health information under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule. Onboarding is a required awareness point because … Read more

Cyber threat information sharing best practices are governance and technical controls that enable healthcare organizations to exchange threat indicators and defensive measures with internal teams, vendors, and trusted external partners while limiting protected health information to permitted disclosures under the HIPAA Privacy Rule and protecting electronic protected health information through HIPAA Security Rule safeguards for … Read more

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996, a federal United States law enacted on August 21, 1996 that established statutory requirements for health insurance portability and for Administrative Simplification standards that support electronic healthcare transactions and the protection of health information through later federal regulations. The term is commonly used … Read more

HIPAA was passed on August 21, 1996, when the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, was enacted after congressional approval and presidential signature, establishing federal statutory authority for health insurance portability provisions and for Administrative Simplification requirements that later produced the HIPAA Privacy Rule, HIPAA Security Rule, and related enforcement … Read more

New employees must receive HIPAA training within their first three months of joining an organization, and best practice in the healthcare sector is for all staff to receive HIPAA refresher training on at least an annual basis. For new hires, HIPAA training should be part of the early onboarding process, not something postponed until later. … Read more

HIPAA matters to patients because it sets enforceable national standards that limit when protected health information can be used or disclosed, requires safeguards for electronic protected health information, mandates breach notifications after certain compromises of unsecured protected health information, and grants individuals defined rights over their health records and related communications. The HIPAA Privacy Rule … Read more

HIPAA civil penalties are civil money penalties assessed by the U.S. Department of Health and Human Services Office for Civil Rights against HIPAA Covered Entities and Business Associates for violations of the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, with penalty ranges set by a four-tier culpability structure, inflation-adjusted amounts, and … Read more

HIPAA certification is a training completion credential issued by a private training provider that documents an individual has completed a HIPAA education program covering role relevant requirements under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, is commonly delivered through online HIPAA training as the best solution for standardized instruction and … Read more

Technology can be used in a HIPAA compliant manner by selecting systems that support the administrative, physical, and technical safeguards required by the HIPAA Security Rule, limiting uses and disclosures of protected health information under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, executing business associate agreements when vendors handle protected health information, … Read more

Protected health information under HIPAA is individually identifiable health information that relates to a person’s past, present, or future physical or mental health or condition, the provision of healthcare to the person, or payment for that care, and that is created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate in any … Read more

HIPAA regulations for SMS require HIPAA Covered Entities and Business Associates to treat any text message that contains protected health information as a regulated disclosure and to apply HIPAA Privacy Rule permissions and safeguards, HIPAA Security Rule safeguards for electronic protected health information, and HIPAA Breach Notification Rule response and notification duties when unsecured protected … Read more

The purpose of HIPAA training is to ensure every workforce member knows how to protect Protected Health Information (PHI), follow the organization’s HIPAA policies and procedures, and avoid actions that could lead to privacy or security violations. Training turns the legal requirements of the HIPAA Privacy Rule and HIPAA Security Rule into clear expectations that … Read more

What HIPAA compliance officer duties include oversight of HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule compliance through policy management, risk governance, online HIPAA training administration, incident response coordination, and documentation practices that support lawful use and disclosure of protected health information by a HIPAA Covered Entity or Business Associate. A HIPAA … Read more

Penalties for violating the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule can include civil monetary penalties assessed by the HHS Office for Civil Rights under a four tier structure based on culpability, criminal prosecution by the U.S. Department of Justice for certain wrongful uses and disclosures of protected health information, and … Read more

SharePoint supports HIPAA compliance for maintaining and sharing Protected Health Information when it is used as part of an Office 365 or Microsoft 365 Enterprise plan that supports HIPAA compliance, a Business Associate Agreement is in place with Microsoft, and the service is configured and used to meet HIPAA access control and monitoring requirements. SharePoint … Read more

The most frequent failures in HIPAA Business Associate Agreements involve missing or incomplete agreements, agreements that are executed after PHI has already been disclosed, inadequate security obligation clauses, and workforce training provisions that are either absent or too vague to be enforceable. A HIPAA Business Associate Agreement must be in place before any Protected Health … Read more

HIPAA training should take place at onboarding for new workforce members, again within a reasonable period when a workforce member’s job functions change or when a material change to HIPAA policies or procedures affects the workforce member’s duties, and on a recurring schedule that most organizations set at least annually as an industry best practice … Read more

A HIPAA release form is a written authorization that permits a HIPAA Covered Entity to use or disclose specified protected health information to a named recipient or class of recipients for a stated purpose and within a defined timeframe when the HIPAA Privacy Rule does not otherwise permit or require the use or disclosure. The … Read more

HIPAA rules for information sharing permit a HIPAA Covered Entity or Business Associate to use and disclose protected health information without patient authorization for treatment, payment, and health care operations and for specific public interest purposes, require patient authorization for uses and disclosures outside those permissions, require a Business Associate Agreement when a vendor handles … Read more

HITECH in healthcare refers to the Health Information Technology for Economic and Clinical Health Act, a 2009 federal law that promoted adoption and meaningful use of certified electronic health record technology and strengthened HIPAA compliance by expanding obligations for Business Associates, establishing federal breach notification requirements, increasing enforcement funding and oversight, and enhancing civil and … Read more

HIPAA Authorization is a written permission signed by an individual or the individual’s personal representative that allows a HIPAA Covered Entity or Business Associate to use or disclose the individual’s protected health information for a stated purpose that is not otherwise permitted or required by the HIPAA Privacy Rule, and it must meet the content … Read more

Hospital workers can help prevent HIPAA violations by completing role based HIPAA training and consistently applying the hospital’s HIPAA Privacy Rule and HIPAA Security Rule policies in daily workflows, including limiting access and disclosures to authorized purposes, using approved communication channels, protecting electronic protected health information through secure authentication and device practices, and reporting suspected … Read more

HIPAA training establishes role based workforce competency for handling protected health information by teaching permitted uses and disclosures under the HIPAA Privacy Rule, safeguards and user behavior requirements under the HIPAA Security Rule, and incident recognition and escalation steps that support timely action under the HIPAA Breach Notification Rule, with annual HIPAA training used as … Read more

Whether accidental or intentional, what happens if HIPAA is violated? Can employees be fired for violating HIPAA? What penalties are there for covered entities? These will all be explored in more detail below.  The consequences for HIPAA violations will usually depend on the severity of the violation, whether it was accidental or intentional, and what … Read more