I am very excited to announce that my HIPAA training programs and short courses have received a complete update and new design.
New Series of HIPAA Privacy Courses
- SHARE:
-
-
-
-
Tag: HIPAA Security Training
Archive of posts about HIPAA security training by Daniel J. Solove for his blog at TeachPrivacy, a privacy awareness and security training company.
HIPAA Training Overview Page
We recently developed a new overview page that discusses my approach to HIPAA training. The page discusses several dimensions about our training, including:
- different comprehensive annual HIPAA privacy and security modules depending upon whether an entity is a covered entity or business associate
- courses to cover the material at different lengths
- short modules (most 5 minutes or less) designed for on-demand or periodic training
- many humorous cartoon vignettes to reinforce essential points about HIPAA
- HIPAA games
Learn more about our 60+ HIPAA training topics for your workforce.
- SHARE:
-
-
-
-
HIPAA Whiteboard and HIPAA Interactive Whiteboard
Recently, I created two new HIPAA training resources.
HIPAA Whiteboard
I created a 1-page visual summary of HIPAA, which I call the HIPAA Whiteboard. The idea was to summarize HIPAA in a concise and visually-engaging way. You can download a PDF handout version here. We’ve been licensing it to many organizations for training and awareness purposes.
HIPAA Interactive Whiteboard
I subsequently created a new training module — an interactive version of the HIPAA Whiteboard — the HIPAA Interactive Whiteboard. When people click on each topic, the program provides brief narrated background information, presented in a very understandable and memorable way. Trainees can learn at their own pace. This program is designed to be very short — it is about 5 minutes long.
It can readily be used on internal websites to raise awareness and teach basic information about HIPAA. It can also be used in learning management systems.
- SHARE:
-
-
-
-
HIPAA Enforcement Case – Filefax
This week the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced an agreement to settle HIPAA violations with Filefax, located in Northbrook, Illinois. One aspect was different than their usual settlement process in that Filefax closed the business down during the OCR investigation and was no longer operating when the settlement was reached. OCR announced that Filefax could not avoid their obligations under HIPAA even though they were no longer running the company. The receiver that is liquidating the company’s assets agreed to pay $100,000 to settle the potential HIPAA violations made by the company while open.
Their HIPAA violations stemmed from an anonymous complaint stating that the medical records of approximately 2,150 patients, which contained protected health information (PHI), received by Filefax had been taken to a shredding/recycling facility and sold. The OCR investigation found over a period of several weeks the PHI had been left unsecured outside Filefox and had been removed from the facility by an unauthorized person.
The press release can be viewed here. The Resolution Agreement can be viewed here.
Also of Interest
HIPAA Enforcement 2017: Another Big Year for HIPAA Enforcement
Why Is HIPAA Data Breach Enforcement Increasing? An Insurer’s View from Katherine Keefe
Lessons from 2016, the Biggest HIPAA Enforcement Year on Record
- SHARE:
-
-
-
-
HIPAA Enforcement 2017: Another Big Year for HIPAA Enforcement
At the end of 2017, the OCR logged just under $20 million in fines for HIPAA violations from 10 enforcement actions with monetary penalties. In 2016, the total in penalties was roughly the same amount but from 15 organizations.
Here is an overview of the resolution agreements and enforcement actions with civil monetary penalties from 2017:
Lessons from 2017
Devices, devices, devices . . .
Quite a number of cases involved failure to implement safeguards for PHI on mobile devices. The best fix is to superglue devices to staff. Short of doing that, organizations should recognize that mobile devices frequently get lost or stolen, so there should be heightened security controls when PHI is accessible on these devices.
Act quickly.
Several cases involved failing to provide timely notice or to act promptly after problems were discovered. In politics, it’s often not the scandal, but the coverup that fells politicians. In the world of HIPAA, it’s often not the incident, but the response that leads to organizations being penalized.
- SHARE:
-
-
-
-