Is Certification a Surrogate for HIPAA Privacy and Security Training?

The burden on a covered entity or business associate is to conduct and periodically review its risk assessment, implement policies and procedures to safeguard protected health information, conduct ‘awareness’ training for all workforce members based on those policies and procedures, update that training if policies and procedures change or HIPAA privacy and security regulations are initiated or modified, and document in writing those activities. Certification is not a requirement in that process.

Three Key Properties of HIPAA Privacy and Security of Protected Health Information

HIPAA.com has received from its readers requests for information on topics related to HIPAA Administrative Simplification Privacy and Security Rules and to updates to those rules reflected in the HITECH Act provisions of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009. Recently, HIPAA.com answered the question of particular interest to several readers: what exactly is protected health information (PHI)? In this posting, we answer the question: what are the fundamental properties that underlie privacy and security of protected health information?

HIPAA ‘Protected Health Information’: What Does PHI Include?

HIPAA.com has received from its readers requests for information on topics related to HIPAA Administrative Simplification Privacy and Security Rules and to updates to those rules reflected in the HITECH Act provisions of the American Recovery and Reinvestment Act of 2009, signed by President Obama on February 17, 2009. Of particular interest to readers is: what exactly is protected health information (PHI)?