• This course is a requirement for all medical training professions.  Should the student wish to obtain a certification in HIPAA, this course will prepare them.
• Covered entities: providers, health plans, clearinghouses
• Business associates must also comply
• Five major components: Privacy Rule, Security Rule, Breach Notification, Omnibus, Enforcement
• Civil penalties: $100 – $50,000 per violation
• Criminal penalties: up to 10 years prison, $250,000 fine
• PHI = 18 identifiers + health information

Must Remember:

• Discovery = when breach is known or should have been known
• Violations accrue per record, per day
• Minimum necessary standard applies to most uses
• HIPAA protects deceased for 50 years

**MODULE 2 RECAP: THE PRIVACY RULE**

 

Key Concepts:

• Protects ALL PHI (paper, electronic, verbal)
• TPO = Treatment, Payment, Operations (no authorization needed)
• Patient rights: notice, access, amendment, accounting, restrictions, confidential communications
• Authorization required for marketing, sale of PHI, psychotherapy notes
• Minimum necessary standard (except for treatment, patient access, required disclosures)
• Incidental disclosures permitted IF reasonable safeguards in place

Must Remember:

• Patients MUST get access to records within 30 days (extend 30 more)
• ONE restriction you must honor: no disclosure to health plan if paid out-of-pocket
• Accounting excludes TPO, patient access, authorizations
• Minors: parents are representatives unless state law says otherwise

**MODULE 3 RECAP: THE SECURITY RULE**

 

Key Concepts:

• Applies ONLY to ePHI (electronic PHI)
• Three safeguards: Administrative, Physical, Technical
• Required vs. Addressable (addressable ¹ optional!)
• Encryption strongly recommended for portable devices
• Unique user IDs required – no sharing credentials
• Audit controls must record system activity
• Contingency plan: backup, disaster recovery, emergency operations

Must Remember:

•  Automatic logoff is addressable but important
• Workstations must be positioned to prevent unauthorized viewing
• Devices must be properly disposed (physical destruction or DOD wiping)
• Risk analysis is REQUIRED
• Business associate agreements must address security

**MODULE 4 RECAP: BREACH NOTIFICATION RULE**

 

Key Concepts:

• Breach presumed unless proven otherwise via risk assessment
• Four-factor test: nature/extent, unauthorized person, actually viewed, mitigation
• 60 days from discovery to notify
• Must notify: individuals, HHS, possibly media
• 500+ individuals = media notification + HHS “Wall of Shame”
• <500 individuals = annual HHS report
• Documentation for 6 years

Must Remember:

• Discovery = date known by entity or any employee/agent
• Three narrow exceptions rarely apply
• Law enforcement can request delay
• Failure to notify is separate violation

**MODULE 5-9 RECAP: ADDITIONAL KEY CONCEPTS**

 

Business Associates:

• Written BAA required before sharing PHI
• BA must report breaches to covered entity
• BA liable for their violations
• Subcontractors need BAAs too Patient Rights:
• Notice of Privacy Practices
• Access within 30 days
• Request amendments
• Accounting of disclosures
• Request restrictions
• Confidential communications

Digital Age Compliance:

• Email encryption
• Secure patient portals
• Telemedicine compliance
• Social media dangers
• Mobile device security Common Violations:
• Unauthorized access (snooping)
• Improper disposal
• Gossiping
• Unencrypted email
• Lost/stolen devices
• Weak passwords
• Not logging out
• Social media posts Compliance Culture:
• Written policies
• Designated officials
• Comprehensive training
• Access management
• BA management
• Monitoring & auditing
• Incident response
• Sanctions

NATIONAL CERTIFICATION EXAMS

 

AMCA (American Medical Certification Association) HIPAA Compliance Officer Certification:

• Format: 100 multiple-choice questions

• Time: 2 hours
• Passing: 70%
• Topics: Privacy, Security, Breach Notification, Compliance Programs

– Cost: ~$125

Content Areas:

• HIPAA regulations and requirements (40%)
• Privacy and security compliance (30%)
• Breach response and notification (15%)
• Training and program management (15%)

NHA (National Healthcareer Association)

 

HIPAA Training for Covered Entities & Business Associates

• Format: Online training with assessment
• Topics: All HIPAA rules
• Certification upon completion

– Cost: ~$99

AAPC (American Academy of Professional Coders) CPMA (Certified Professional Medical Auditor):

• Includes HIPAA compliance components
• Format: 150 questions, 4 hours
• Passing: 70%
• Cost: ~$399 (members), $499 (non-members)

While not HIPAA-only, includes:

 

• Privacy requirements
• Compliance programs
• Documentation standards
• Regulatory requirements

—

NCCT (National Center for Competency Testing) Compliance Officer Certification:

• Includes HIPAA as major component
• Format: Varies
• Topics: Healthcare compliance including HIPAA

– Cost: ~$90

HCCA (Health Care Compliance Association) CHC (Certified in Healthcare Compliance):

• Premium compliance certification
• Includes HIPAA as core area
• Format: 125 questions, 2.5 hours
• Passing: Scaled score
• Cost: ~$395 (members), $495 (non-members)
• Requires: 2+ years compliance experience

Content:

 

• Federal healthcare regulations including HIPAA (35%)
• Compliance program management (25%)
• Risk assessment and auditing (25%)
• Other areas (15%)

Common Question Formats:

Example:

“A patient calls requesting their medical records be sent to their attorney. The medical records clerk should:

1. Immediately fax the records

1. Request a signed patient authorization before releasing

1. Refuse – cannot release to attorneys

1. Only release a summary, not full records”

Strategy:

 

• Read entire scenario carefully
• Identify what HIPAA rule applies
• Look for key words (authorization, TPO, patient rights)
• Eliminate clearly wrong answers
• Choose most complete/compliant answer

**Answer: B** (Authorization required for attorney disclosure unless subpoena/court order)

—

Example:

“Protected Health Information (PHI) includes:

1. Only electronic medical records

1. Only information with Social Security numbers

1. Any individually identifiable health information

1. Only diagnosis and treatment information”

Strategy:

 

• Know precise definitions
• Watch for “all,” “only,” “never,” “always” – often indicate wrong answer
• Think about exceptions

Answer: C

 

—

Example:

“The BEST way to protect ePHI on portable devices is to:

1. Keep devices locked in car

1. Use strong passwords only

1. Encrypt devices and use strong passwords

1. Avoid putting ePHI on portable devices”

Strategy:

 

• “Best” means most comprehensive/effective
• May have multiple “correct” answers – choose MOST correct
• Consider real-world application

**Answer: C** (Most comprehensive protection)

—

Example:

“All of the following are patient rights under HIPAA EXCEPT:

1. Right to access medical records

1. Right to request amendments

1. Right to refuse treatment

1. Right to accounting of disclosures”

Strategy:

 

• “Except” or “Not” questions – find the wrong one
• Mark the question so you remember format
• Know what IS and ISN’T included in categories

**Answer: C** (Right to refuse treatment is not a HIPAA right – it’s a patient care right)

—

Example:

“Covered entities must notify affected individuals of a breach no later than:

1. 30 days from discovery

1. 60 days from discovery

1. 90 days from discovery

1. Immediately”

Strategy:

 

• Memorize key deadlines
• Discovery vs. occurrence
• Different timelines for different requirements

Answer: B

 

—

Example:

“What is the maximum annual penalty for Tier 4 violations?

1. $500,000

 

1. $1 million

1. $1.5 million

1. $2 million”

Strategy:

 

• Know the penalty structure
• Understand tiers
• Per violation vs. annual maximum

Answer: C

 

TEST-TAKING STRATEGIES

 

Before the Exam:

 

1 Week Before:

 

• Review all modules
• Take practice quizzes
• Identify weak areas
• Review those areas intensively
• Get good sleep

Day Before:

 

• Light review only
• Organize materials
• Prepare for test day
• Relax – you’ve prepared!
• Early to bed

Day Of:

 

• Good breakfast
• Arrive early
• Bring required materials
• Use restroom before
• Deep breaths

—

During the Exam:

 

Time Management:

 

• Note time allowed
• Calculate time per question
• Don’t spend too long on one question
• Mark difficult questions, return later

For 100 questions in 120 minutes:

 

• ~1 minute per question
• Save 20 minutes for review
• Mark and move on if stuck

Reading Questions:

 

DO:

• Read entire question carefully
• Identify what they’re really asking
• Note key words (EXCEPT, NOT, BEST, ALWAYS)
• Read ALL answer options
• Eliminate clearly wrong answers

DON’T:

 

? Skim questions quickly

? Stop reading after first “right” answer

? Add information not in question

? Overcomplicate simple questions

Answer Selection:

 

Process of Elimination:

 

1. Cross out clearly wrong answers

2. Between remaining, choose most complete/accurate

3. Trust your preparation

4. Don’t second-guess excessively

When Unsure:

 

• Use what you know to eliminate options
• Make educated guess
• Mark for review
• Come back if time permits

Common Traps:

 

[!] Answers that are “sort of” right

[!] Answers with absolute words (always, never, all, none) [!] Answers that sound good but aren’t HIPAA-specific

[!] Overthinking simple questions

[!] Choosing based on what “should be” vs. what the rule actually says

—

After Each Section:

 

If exam has breaks:

• Stand and stretch
• Drink water
• Clear your mind
• Return focused

Final Review:

 

Last 15-20 minutes:

• Review marked questions
• Check you answered all questions
• Verify no accidental double-marks
• DON’T change answers unless you’re certain
• Trust your first instinct

AREAS TO MASTER

 

Critical Knowledge Areas:

 

**MUST KNOW COLD:**

 

Definitions:

• PHI vs. ePHI
• Covered entity
• Business associate
• Breach
• Minimum necessary
• De-identified Rules & Requirements:
• Privacy Rule basics
• Security Rule three safeguards
• Breach notification timeline & process
• Patient rights (all 6)

– TPO

 

Numbers & Deadlines:

—

• 18 identifiers
• 60 days (breach notification)
• 30 days (patient access)
• 6 years (documentation retention)
• 50 years (protection after death)
• Penalty amounts (all tiers)

**COMMONLY TESTED SCENARIOS:**

 

1. **Unauthorized Access:**

• Employee snooping
• Accessing own records
• Family member access

2. **Disposal:**

• What needs shredding
• Device destruction
• Improper disposal

3. **Breaches:**

• Risk assessment
• Notification requirements
• Encrypted vs. unencrypted

4. **Patient Rights:**

• Access requests
• Amendment requests
• Restrictions

5. **Communications:**

• Email security
• Verbal disclosures
• Fax procedures

6. **Business Associates:**

• When BAA needed
• BAA requirements
• BA breach response

Question 1:

 

A nurse accidentally sends a patient’s lab results to the wrong patient via the patient portal. This is:

1. Not a breach – it was an accident

1. Not a breach – both are patients

1. Presumed to be a breach unless risk assessment shows low probability

1. Only a breach if the wrong patient reads it

**ANSWER: C**

 

—

Question 2:

 

Which of the following is NOT considered PHI if it stands alone?

1. Patient’s name

1. Diagnosis of diabetes

1. Medical record number

1. Email address

ANSWER: B (Diagnosis alone without identifier is not PHI)

 

—

Question 3:

 

An organization must conduct Security Rule risk analysis:

1. Only when required by HHS

1. After each breach

1. At least annually

1. When implementing new systems only

ANSWER: C (And when environment changes significantly)

 

—

Question 4:

 

The minimum necessary standard does NOT apply to:

1. Routine billing disclosures

1. Disclosures for treatment purposes

1. Internal uses within organization

1. Requests from other covered entities

**ANSWER: B**

 

—

Question 5:

 

A patient requests their medical records be sent to their insurance company. You should:

1. Refuse – this requires authorization

1. Send the records – this is a permitted disclosure for payment

1. Only send a summary

1. Require a court order

ANSWER: B (Payment is part of TPO)

 

—

Question 6:

 

Encryption of ePHI on mobile devices is:

1. Required

1. Addressable

1. Recommended but not in the Security Rule

1. Only required for devices with 500+ patient records

ANSWER: B (Addressable, but considered standard of care)

 

—

Question 7:

 

Which patient right allows them to receive bills at their work address instead of home?

1. Right to access

1. Right to request restrictions

1. Right to request confidential communications

1. Right to accounting

**ANSWER: C**

 

—

Question 8:

 

A business associate has a breach. Who notifies affected individuals?

1. The business associate

1. The covered entity

1. Either one

1. HHS notifies them

ANSWER: B (BA notifies CE, CE notifies individuals)

 

—

Question 9:

 

Documentation of a breach must be maintained for:

1. 2 years

1. 3 years

1. 6 years

1. Permanently

**ANSWER: C**

 

—

Question 10:

 

The Privacy Officer role can be held by:

1. Only physicians

1. Only attorneys

1. Only IT professionals

1. Any appropriately trained individual

YOUR CERTIFICATION & CAREER

 

Certification Benefits:

 

Professional:

• Demonstrates expertise
• Career advancement
• Higher salary potential
• Competitive advantage
• Professional credibility Personal:

—

• Confidence in your knowledge
• Reduced risk of violations
• Better job performance
• Continuing education

Career Paths with HIPAA Expertise:

 

Entry Level:

• Privacy Coordinator
• Compliance Assistant
• HIPAA Trainer
• Security Analyst Mid-Level:
• Privacy Officer
• Security Officer

• Compliance Specialist
• Risk Manager Advanced:
• Chief Privacy Officer
• Chief Compliance Officer
• Healthcare Consultant
• Compliance Director Specialized:

—

• Healthcare IT Security
• EHR Implementation Specialist
• Business Associate Consultant
• Healthcare Attorney (with JD)

Salary Ranges (2025 estimates): Privacy Coordinator: $45,000 – $65,000 Privacy Officer: $70,000 – $110,000

Chief Privacy Officer: $110,000 – $180,000+ Compliance Consultant: $80,000 – $150,000 Factors affecting salary:

 

 

 

 

 

 

 

 

 

 

 

—

• Organization size
• Geographic location
• Years of experience
• Additional certifications
• Education level
• Scope of responsibilities

Continuing Education:

 

Stay Current:

• HHS guidance updates
• Court cases and interpretations
• Industry best practices
• Technology changes
• Emerging threats Resources:
• HHS Office for Civil Rights website
• Professional associations (AHIMA, HCCA)
• Healthcare privacy conferences
• Webinars and online courses
• Industry publications Certifications Maintenance:
• Most require CEUs
• Annual renewal fees
• Ongoing education
• Ethics requirements

FINAL EXAM PREP CHECKLIST

 

30 Days Before:

 

• Review all 10 modules

• Take all module quizzes again

• Create summary notes

• Identify weak areas

• Schedule focused study time

2 Weeks Before:

 

• Intensive review of weak areas

• Take practice exams

• Review penalty structures

• Memorize key numbers/deadlines

• Study definitions

1 Week Before:

 

• Final comprehensive review

• Practice scenario questions

• Review test-taking strategies

• Organize test day materials

• Confirm test location/time

Day Before:

 

• Light review only

• Prepare materials

• Get good sleep

• Stay hydrated

• Relax!

Test Day:

 

• Arrive early

• Bring required ID

• Bring confirmation

• Use restroom

• Take deep breaths

• Trust your preparation!

MOTIVATIONAL CLOSING

 

You’ve Got This!

 

You’ve completed comprehensive training covering:

• HIPAA foundations and history
• Privacy Rule requirements
• Security Rule safeguards
• Breach notification processes
• Business associate management
• Patient rights
• Digital age compliance
• Common violations and prevention
• Compliance culture
• Exam strategies

You’re prepared to:

 

• Pass your certification exam
• Work confidently in healthcare
• Protect patient privacy
• Advance your career
• Be a compliance champion

Remember:

 

HIPAA isn’t just about avoiding penalties. It’s about:

• Honoring patient trust
• Protecting vulnerable people
• Maintaining professional integrity
• Doing the right thing
• Being part of the solution

Your Next Steps:

 

1. Review this material

2. Take practice exams

3. Schedule your certification

4. Pass your exam

5. Start your compliance career!

You’re not just learning rules – you’re joining a profession dedicated to protecting what matters most: patient privacy and dignity.

Good luck on your exam! You’re going to do great!