Syllabus

1. Getting Into a Security Mindset
   • Relating your existing skillset around security to the HIPAA way of doing security.
   • Emotional norming regarding how you relate to security activities and to security regulations.
   • Relating your existing risk management skills to the way HIPAA uses risk management.
   • Explaining our ethical and legal contexts for engaging in security activities.
2. Grasping the Basics of HIPAA Security Rule Compliance
   • Determining who is subject to HIPAA
   • Learning what the HIPAA Security Rule requires
   • Performing the steps to become compliant with HIPAA’s Security Rule
   • Critically analyzing what it means when a product says it is “HIPAA Compliant”
   • Determining what kind of information is personally identifying
   • Understanding Business Associates and Business Associate Agreements
   • Grasping the scope of HIPAA as it pertains to your practice
   • Learning HIPAA Security’s workforce management standards
3. Understanding Basic Technical Concepts
   • Conceptualizing the difference in HIPAA Security standards for “data in motion” vs. “data at rest”
   • Conceptualizing an Internet transmission and how it impacts HIPAA Security standards
   • Conceptualizing encryption and its application to HIPAA Security Standards
   • Conceptualizing authentication and its application to HIPAA Security Standards
4. Using Email, Text, Phone, and Video in a HIPAA-Compliant Manner
   • Comparing the different types of secure (and nonsecure) email
   • Understanding what is meant by “texting” and how it impacts HIPAA compliance
   • HIPAA and ethical standards of secure communication vs nonsecure communication with clients
   • Comparing the different types of phone service and their relationship to HIPAA Security standards
   • Understanding videoconferencing options and their relationship to HIPAA Security standards
   • Using Communications Policies with clients for ethical and HIPAA-compliance purposes
5. Handling Security Incidents and Breaches
   • Understanding how a security “incident” becomes a security “breach”
   • Qualifying for the safe harbor in HIPAA’s breach notification rule
   • Using HIPAA’s breach notification rule to guide compliance strategy
6. Protecting Your Technological Devices
   • Identifying potential threats to the security of protected health information on your devices
   • Digitally protecting your devices to comply with HIPAA Security standards
   • Using encryption to protect information on your devices and comply with HIPAA Security standards
   • Using secure WiFi to protect information on your devices and comply with HIPAA Security standards
   • Backing up your data to protect information on your devices and comply with HIPAA Security standards
   • Choosing unique logins to protect information on your devices and comply with HIPAA Security standards
   • Physically protecting your devices to protect information on your devices and comply with HIPAA Security standards
7. Using Cloud Services Effectively and Safely
   • Understanding what “the cloud” is
   • Evaluating cloud services for security
   • Using cloud services to help achieve HIPAA Security compliance
   • Doing your part to keep your cloud services secured to HIPAA Security standards
   • Identifying and using (or preventing) “data synchronization” to achieve HIPAA Security standards
   • Learning how financial services in the cloud relate to HIPAA Security and the Business Associate Rule
8. Analyzing Information Risks
   • Tracing where your information is
   • Assessing your technology
   • Engaging in HIPAA Security Rule compliance