HIPAA Implementation Training for Covered Entities and Business Associates

Starts with a question: if patient data leaked from your billing vendor, who would tell the patients and who would answer to the regulator? After a self-rating on the Privacy, Security and Breach Notification Rules, three recent enforcement cases follow, including the May 2025 HHS Office for Civil Rights settlement with Comstar, a billing company in Massachusetts, and the December 2025 settlement with Concentra in Texas: a missing risk analysis, a vendor answering to the regulator itself, and a patient who waited thirteen months for records. You then meet MNO Health Group in Chicago, the covered entity, and VWX Medical Billing in Manila, its business associate, plus firms in New York, Mumbai and Toronto. It ends with the seven-step module pattern, the fourteen modules and a recap.

What you will be able to do

• Explain why HIPAA duties fall on both covered entities and vendors
• Recognise the gaps behind three recent HIPAA enforcement cases
• Describe the two companies the course follows and their roles

Why it matters

Seeing what enforcement cases found shows why both your organisation and its vendors must be able to show their HIPAA work.

Practice: Practice: Welcome, and why HIPAA implementation matters · 3 questions

Opens with two files on a server at VWX Medical Billing in Manila, including a recorded call about a patient's bill that holds a name, a visit date and a balance, and asks whether it is health information. You then learn who HIPAA applies to: health plans, health care clearinghouses and providers that bill electronically, plus business associates and their subcontractors, with a health insurer in New York as an example. The module explains protected health information in any form, electronic PHI protected by the Security Rule, and where PHI lives at MNO: the cloud health record, the patient portal, the billing system and every claim. It covers the Privacy, Security, Breach Notification and Enforcement Rules, the duty to cooperate with the regulator, and penalties that grow with neglect. It ends with a recap.

What you will be able to do

• Identify protected health information in calls, claims and invoices
• Explain who counts as a covered entity or business associate
• Describe the four HIPAA rules and how penalties are set

Why it matters

Recognising PHI in everyday records like billing calls tells you exactly which data your safeguards must cover.

Practice: Practice: HIPAA foundations · 3 questions

Starts with a telehealth software company in Toronto that thought HIPAA was only the clinics' problem, so it signed no business associate agreements and never ran a risk analysis. You then work through four questions that decide your role, and see that one company can hold more than one. The module explains what applies to each role: a covered entity like MNO carries every rule, including Privacy Rule duties such as training, sanctions and complaints, while a business associate like VWX carries direct duties by law and more by contract. A health plan in New York with a Medicare Advantage line and an outsourcer in Mumbai show offshore work, including CMS reporting from 2008. It ends with a register of agreements in both directions and a recap.

What you will be able to do

• Apply the four questions that decide your HIPAA role
• Explain the duties of a covered entity versus a business associate
• Check client contracts for conditions on offshore work

Why it matters

Deciding your role correctly stops a vendor assuming HIPAA does not reach it until the regulator says otherwise.

Practice: Practice: Covered entity, business associate, or both · 3 questions

Opens at one of MNO's clinics, where a denied claim needs appealing and, in one version, a manager exports the patient's full record with years of notes to VWX in Manila. You then learn when PHI may be used and disclosed: to the individual, for treatment, payment and operations, with agreement or authorisation, or for set public purposes. The module explains when an authorisation is needed: psychotherapy notes, marketing, sales of PHI and anything not otherwise permitted. It covers the minimum necessary standard: access by role, protocols for routine sharing and review for the rest, and the firm line on whole records. You see an access table by role, with categories of PHI and conditions, built into system roles with planned cover. It ends with a recap.

What you will be able to do

• Explain when PHI may be used or disclosed without authorisation
• Identify uses of PHI that need a written authorisation
• Build a role-based access table under the minimum necessary standard

Why it matters

Sharing only what each purpose needs keeps PHI out of systems and countries where it has no reason to be.

Practice: Practice: The Privacy Rule: uses, disclosures, minimum necessary · 3 questions

Starts with an e-mail at VWX's billing helpdesk in Manila, where a patient of MNO asks for a copy of her records and, in one version, the ticket sits unnoticed for weeks, while MNO owes her the answer. You then learn the notice of privacy practices, given by the first service or at enrolment, posted and kept current, as a health plan in New York does. The module covers individuals' rights: access within thirty days, amendment and accounting of disclosures within sixty, each with one extension, plus restrictions, including services paid in full out of pocket, and confidential channels. It explains the privacy official and contact person, training, complaints, sanctions and mitigation, with VWX supporting through its agreement and a request log as evidence. It ends with a recap.

What you will be able to do

• Explain the deadlines for access, amendment and accounting requests
• Describe what a notice of privacy practices must cover
• Set up a request log owned by the privacy official

Why it matters

Owning the clock on every patient request avoids the long delays that have led to enforcement action.

Practice: Practice: Notice, individuals' rights and privacy roles · 3 questions

Opens at VWX in Manila, where twenty agents move to home working and, in one version, the IT lead reads encryption as addressable, takes it to mean optional and sends laptops out unencrypted with nothing written down. You then learn how the Security Rule protects the confidentiality, integrity and availability of electronic PHI, with flexible measures across eighteen safeguard standards, including nine administrative standards. The module explains that required means implement, while addressable means assess, then implement, or document why not and use an alternative. You see extracts from MNO's and VWX's decision records, including an imaging console that cannot log off automatically, and a telehealth company in Toronto reading the integrity specification. It covers NIST SP 800-66 Revision 2 and written records, and ends with a recap.

What you will be able to do

• Explain what required and addressable specifications mean
• Write a documented decision for an addressable specification
• Use NIST SP 800-66 Revision 2 to plan Security Rule work

Why it matters

Treating addressable as a documented decision, not as optional, avoids one of the costliest misunderstandings in HIPAA.

Practice: Practice: The Security Rule and NIST SP 800-66 Revision 2 · 3 questions

Starts with VWX's first risk analysis two years ago, which covered servers and desks on two floors in Manila but left out home workers, the telephony subcontractor and remote access into clients' billing systems. You then learn that the risk analysis is required for covered entities and business associates alike, and must be accurate and thorough, as both business associate cases in module one showed. The module walks NIST's seven steps: prepare, identify threats and vulnerabilities, rate likelihood and impact, set the level of risk and document it. You see extracts from VWX's map of electronic PHI and MNO's map in Chicago covering nine clinics, then both risk registers with every threat and vulnerability pair rated. A revenue cycle outsourcer in Mumbai shows the same duty. It ends with a recap.

What you will be able to do

• Scope a risk analysis to cover every place ePHI goes
• Rate each threat and vulnerability pair for likelihood and impact
• Keep a risk register current and shared with leadership

Why it matters

A fully scoped, honest risk analysis is the document regulators ask for first, and the one most often missing.

Practice: Practice: The security risk analysis, step by step · 3 questions

Opens with VWX's register, where phishing with no multi-factor authentication on remote sessions into clients' systems was rated high and, in one version, sat for a year with no action, owner or date. You then learn that risk management is required: risks above tolerance get an action, an owner and a date, and are re-rated once the action is done. You see VWX's plan and MNO's plan in Chicago. The module covers the people safeguards: assigned security responsibility with a named security official, workforce security, and access management from joining to leaving, with unique user identification required so shared logins break it. It explains a security awareness and training programme for the whole workforce, training records, and sanctions when policies are broken. It ends with a recap.

What you will be able to do

• Turn each risk above tolerance into an owned, dated action
• Apply workforce security and access management from join to leave
• Run security awareness training with records and sanctions

Why it matters

A plan with owners and dates turns a list of risks into real protection, instead of describing the danger year after year.

Practice: Practice: Risk management and administrative safeguards · 3 questions

Starts with a VWX agent working from a shared flat in Manila where, in one version, the laptop faces the room, account numbers go on a notepad and the notes end up in household rubbish. You then learn the facility access controls: limiting who gets in, controlling visitors, planning for emergencies and recording repairs, with a facility security plan, access lists and visitor logs. The module covers workstation use and security at the office and at home, including the surroundings, and MNO's clinic practices for intake forms, faxes and locked shredding bins. It explains device and media controls, with disposal and reuse required for laptops, phones, drives, copier hard drives and call recording storage, and a telehealth company in Toronto replacing old servers. It ends with a recap.

What you will be able to do

• Apply facility access controls with visitor logs and repair records
• Set workstation rules for home working and shared spaces
• Control the disposal and reuse of every device that stores ePHI

Why it matters

Safeguards that follow ePHI to the kitchen table and the old server stop leaks that office controls alone miss.

Practice: Practice: Physical safeguards and remote work · 3 questions

Opens with a claim for an MNO patient resubmitted by VWX with the wrong amount, where six agents share one health plan portal account to save on licences and the log cannot show who changed it. You then learn the five technical standards. Access control: unique user identification and emergency access are required, while automatic logoff and encryption are addressable, shown with logoff at ten minutes and the imaging console alternative. Audit controls and integrity: record activity, review it regularly and show data was not changed improperly. Authentication and transmission security: a second factor and encryption do most of the work. The module covers an encryption register with its addressable decisions, and how encryption can keep a lost device from becoming a reportable breach. It ends with a recap.

What you will be able to do

• Explain why unique user IDs are required and shared logins break them
• Review audit logs to show who changed a record
• Keep an encryption register with each addressable decision

Why it matters

One person, one ID and recorded actions let you answer who changed a patient's record, and encryption can prevent a breach report.

Practice: Practice: Technical safeguards · 3 questions

Starts on a Monday morning in Chicago, when ransomware locks MNO's billing system and, in one version, backups were never tested, nobody knows who decides and VWX in Manila finds out days later. You then learn security incident procedures: identify, respond, mitigate and document, with the business associate agreement requiring VWX to report security incidents to MNO, and an incident log clients often ask to see. The module covers the contingency plan: data backup, disaster recovery and emergency mode operation are required, and testing and criticality analysis make them real, with MNO's health record and scheduling restored first. It includes VWX's dependencies on its telephony firm, internet providers and power supply. It ends with periodic technical and non-technical evaluation, the records produced and a recap.

What you will be able to do

• Apply security incident procedures from detection to documentation
• Plan and test backup, disaster recovery and emergency mode operation
• Run a periodic technical and non-technical Security Rule evaluation

Why it matters

Planning for the bad day, and rehearsing it with your vendor, keeps patient care and billing running when systems fail.

Practice: Practice: Contingency planning, incidents and evaluation · 3 questions

Opens with VWX deciding to use a scanning firm for patients' paper letters and, in one version, signing the firm's standard service contract before the first box is sent. You then learn what a business associate agreement must contain, such as reporting disallowed uses, breaches and security incidents, plus terms your work needs, such as reporting times and locations. The module explains the chain: every subcontractor signs with the business associate above it on the same restrictions, so a telephony firm cannot keep recordings longer than MNO allows. It covers a telehealth company in Toronto hosting on a US cloud provider, VWX's offshore working rules, recording each client's limits on where work is done, and vendor evidence reviewed yearly. It ends with a recap.

What you will be able to do

• Check that a business associate agreement has the required terms
• Flow HIPAA restrictions down to every subcontractor
• Record each client's offshore and data location conditions

Why it matters

Agreeing terms clearly, flowing them down and checking every year shows how a vendor really protects your patients' data.

Practice: Practice: Business associate agreements and offshore delivery · 3 questions

Starts on an ordinary afternoon at VWX, when an agent e-mails a spreadsheet of eight hundred MNO patients' names and balances to the wrong clinic group and, in one version, asks for deletion and tells nobody. You then learn that an impermissible use or disclosure is presumed to be a breach, unless an exception fits or a four-factor assessment shows a low probability of compromise. The module covers the business associate notifying the covered entity without unreasonable delay and within sixty days at most, then the covered entity notifying individuals, HHS, and the media for more than five hundred residents of a State. A health plan in New York losing an unencrypted laptop shows the smaller-breach log and the yearly report to HHS. It ends with the records and a recap.

What you will be able to do

• Apply the four-factor risk assessment to a possible breach
• Explain who must notify whom, and by when, after a breach
• Keep a log of smaller breaches for the yearly report to HHS

Why it matters

Reporting fast and assessing honestly lets both vendor and covered entity meet notification deadlines they cannot miss.

Practice: Practice: Breach notification · 3 questions

Opens with a regulator's letter after a patient complaint, asking MNO for its policies, risk analysis and training records, and two versions: records kept as you go, or weeks of searching. You then learn the documentation rules: records in writing, kept for six years, available and reviewed as things change. The module sets out a review rhythm, daily, monthly, quarterly and yearly, and tracking proposed rule changes in the Federal Register and on the HHS website without treating them as law. You follow a case from start to finish at MNO and VWX, ending with yearly evaluations and VWX's evidence pack of training records, incident log and restore tests. It gives a road map from your role to review, a five-record spot check, and the final exam.

What you will be able to do

• Keep HIPAA documentation in writing for six years and current
• Set a review rhythm and track proposed rule changes
• Apply the road map from role and PHI to safeguards and review

Why it matters

Records kept as you go let you answer a regulator's request in days, which itself tells them a great deal.

Practice: Practice: Records, the case, your road map and the exam · 3 questions