I am very excited to announce that my HIPAA training programs and short courses have received a complete update and new design.
New Series of HIPAA Privacy Courses
All posts in Training
Strategic Privacy by Design: An Interview with Jason Cronk
Privacy by design — or “Data Protection by Design” as it is referred to in the General Data Protection Regulation (GDPR) — is essential to meaningful privacy protection. Yet, it is often quite thin and incomplete. As I wrote a few years ago about privacy by design, “The ‘privacy’ the designers have in mind might be so focused on one particular dimension of privacy that it might overlook many other dimensions.”
HIPAA Training Overview Page
We recently developed a new overview page that discusses my approach to HIPAA training. The page discusses several dimensions about our training, including:
- different comprehensive annual HIPAA privacy and security modules depending upon whether an entity is a covered entity or business associate
- courses to cover the material at different lengths
- short modules (most 5 minutes or less) designed for on-demand or periodic training
- many humorous cartoon vignettes to reinforce essential points about HIPAA
- HIPAA games
Learn more about our 60+ HIPAA training topics for your workforce.
Did the LabMD Case Weaken the FTC’s Approach to Data Security?
Co-Authored by Prof. Woodrow Hartzog
On Wednesday, the U.S. Court of Appeals for the 11th Circuit issued its long-awaited decision in LabMD’s challenge to an FTC enforcement action: LabMD, Inc. v. Federal Trade Commission (11th Cir. June 6, 2018). While there is some concern that the opinion will undermine the FTC’s power to enforce Section 5 for privacy and security issues, the opinion actually is quite narrow and is far from crippling.
While the LabMD opinion likely does have important implications for how the FTC will go about enforcing reasonable data security requirements, we think the opinion still allows the FTC to continue to build upon a coherent body of privacy and security complaints in an incremental way similar to how the common law develops. See Solove and Hartzog, The FTC and the New Common Law of Privacy, 114 Columbia Law Review 584 (2014).
GDPR Humor: A Collection of GDPR Cartoons and More
Feeling stressed out about GDPR? I can help! Here are all of my GDPR cartoons and attempts at GDPR humor in one post. It’s much better to laugh than to cry . . .
April 26, 2018
/
Category: Cartoons, Cartoons GDPR, GDPR, GDPR Compliance, GDPR Training, Humor, Privacy, Training, Training GDPR
/
/
- Share:
FERPA Whiteboard and FERPA Interactive Whiteboard
Recently, I created two new FERPA training resources.
FERPA Whiteboard
I created a 1-page visual summary of FERPA, which I call the FERPA Whiteboard. The idea was to summarize HIPAA in a concise and visually-engaging way. You can download a PDF handout version here. We’ve been licensing it to many organizations for training and awareness purposes.
FERPA Interactive Whiteboard
I subsequently created a new training module — an interactive version of the FERPA Whiteboard — the FERPA Interactive Whiteboard. When people click on each topic, the program provides brief narrated background information, presented in a very understandable and memorable way. Trainees can learn at their own pace. This program is designed to be very short — it is about 5 minutes long.
It can readily be used on internal websites to raise awareness and teach basic information about FERPA. It can also be used in learning management systems.
GDPR Whiteboard and GDPR Interactive Whiteboard
Recently, I created two new GDPR training resources.
GDPR Whiteboard
I created a 1-page visual summary of the GDPR, which I call the GDPR Whiteboard. The idea was to capture the key points of the General Data Protection Regulation (GDPR) in a succinct and visually-engaging way. It has become quite popular, receiving thousands of downloads. You can download a PDF handout version here. We’ve been licensing it to many organizations for training and awareness purposes.
GDPR Interactive Whiteboard
I subsequently created a new training module — an interactive version of the GDPR Whiteboard – the GDPR Interactive Whiteboard. When people click on each topic, the program provides brief narrated background information, presented in a very understandable and memorable way. Trainees can learn at their own pace. This program is designed to be very short — it is about 5 minutes long.
It can readily be used on internal websites to raise awareness and teach basic information about GDPR. It can also be used in learning management systems.
March 17, 2018
/
Category: European Union Privacy, GDPR, GDPR Compliance, GDPR Training, Privacy, Training, Training GDPR
/
/
- Share:
HIPAA Whiteboard and HIPAA Interactive Whiteboard
Recently, I created two new HIPAA training resources.
HIPAA Whiteboard
I created a 1-page visual summary of HIPAA, which I call the HIPAA Whiteboard. The idea was to summarize HIPAA in a concise and visually-engaging way. You can download a PDF handout version here. We’ve been licensing it to many organizations for training and awareness purposes.
HIPAA Interactive Whiteboard
I subsequently created a new training module — an interactive version of the HIPAA Whiteboard — the HIPAA Interactive Whiteboard. When people click on each topic, the program provides brief narrated background information, presented in a very understandable and memorable way. Trainees can learn at their own pace. This program is designed to be very short — it is about 5 minutes long.
It can readily be used on internal websites to raise awareness and teach basic information about HIPAA. It can also be used in learning management systems.
March 17, 2018
/
Category: Health Privacy, HHS, HHS Office for Civil Rights, HIPAA, HIPAA Business Associates, HIPAA Training, HITECH Act, OCR, Training, Training: HIPAA
/
/
- Share:
HIPAA Enforcement Case – Filefax
This week the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced an agreement to settle HIPAA violations with Filefax, located in Northbrook, Illinois. One aspect was different than their usual settlement process in that Filefax closed the business down during the OCR investigation and was no longer operating when the settlement was reached. OCR announced that Filefax could not avoid their obligations under HIPAA even though they were no longer running the company. The receiver that is liquidating the company’s assets agreed to pay $100,000 to settle the potential HIPAA violations made by the company while open.
Their HIPAA violations stemmed from an anonymous complaint stating that the medical records of approximately 2,150 patients, which contained protected health information (PHI), received by Filefax had been taken to a shredding/recycling facility and sold. The OCR investigation found over a period of several weeks the PHI had been left unsecured outside Filefox and had been removed from the facility by an unauthorized person.
The press release can be viewed here. The Resolution Agreement can be viewed here.
Also of Interest
HIPAA Enforcement 2017: Another Big Year for HIPAA Enforcement
Why Is HIPAA Data Breach Enforcement Increasing? An Insurer’s View from Katherine Keefe
Lessons from 2016, the Biggest HIPAA Enforcement Year on Record
February 14, 2018
/
Category: Enforcement, HHS Office for Civil Rights, HIPAA, OCR, Training, Training: HIPAA
/
/
- Share:
HIPAA Enforcement 2017: Another Big Year for HIPAA Enforcement
At the end of 2017, the OCR logged just under $20 million in fines for HIPAA violations from 10 enforcement actions with monetary penalties. In 2016, the total in penalties was roughly the same amount but from 15 organizations.
Here is an overview of the resolution agreements and enforcement actions with civil monetary penalties from 2017:
Lessons from 2017
Devices, devices, devices . . .
Quite a number of cases involved failure to implement safeguards for PHI on mobile devices. The best fix is to superglue devices to staff. Short of doing that, organizations should recognize that mobile devices frequently get lost or stolen, so there should be heightened security controls when PHI is accessible on these devices.
Act quickly.
Several cases involved failing to provide timely notice or to act promptly after problems were discovered. In politics, it’s often not the scandal, but the coverup that fells politicians. In the world of HIPAA, it’s often not the incident, but the response that leads to organizations being penalized.
January 22, 2018
/
Category: Enforcement, Health Privacy, HHS, HIPAA, HIPAA Audits, HIPAA Business Associates, OCR, Training, Training: HIPAA
/
/
- Share: