45 CFR Parts 160 and 164
HIPAA Privacy and Security training online
Protected health information, when it can be used and shared, patient rights, everyday privacy at the front desk, chairside and bedside, protecting electronic records, phishing and ransomware, and reporting breaches, under the HIPAA Privacy, Security and Breach Notification Rules.
- 8 narrated lessons, 40–60 minutes, self-paced
- Complete the course at your pace; your progress saves automatically
- 20-question test, 80% to pass, unlimited retakes
- Certificate issued on passing, valid 12 months, verifiable online
- For: Dental offices, nurses, CNAs, medical assistants, phlebotomists, pharmacy, lab, radiology and surgical technicians, home health aides, and front desk and billing staff
$12one person
Bundle it: save on 2 to 4 courses
Next year: HIPAA Annual Refresher, 20–30 minutes, $7.
EnrollBuying for staff?
Lessons
1. What HIPAA is and who must follow it6 min
2. Protected health information6 min
3. When protected health information can be used or shared8 min
4. Patient rights under the Privacy Rule7 min
5. Privacy at the front desk, chairside and bedside7 min
6. Protecting electronic PHI7 min
7. Phishing, ransomware and social engineering5 min
8. Breaches, reporting and penalties6 min
What the rules require, and where it is covered
Each row is a requirement from the HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164), in plain English, with the lessons that cover it.
| Citation | Requirement | Covered in |
|---|---|---|
| 160.102 | Applicability of the HIPAA rules to health plans, health care clearinghouses, health care providers who transmit health information electronically in a standard transaction, and, where provided, business associates. | 1. What HIPAA is and who must follow it |
| 160.103 | Definitions of covered entity, health care provider, health plan, health care clearinghouse, business associate (including subcontractors), workforce (employees, volunteers, trainees and others under direct control, paid or not), health information, individually identifiable health information, protected health information in any form and its exclusions, and electronic protected health information. | 1. What HIPAA is and who must follow it; 2. Protected health information |
| 160.203 | Contrary state law is preempted, except state privacy laws that are more stringent, state reporting and public health laws, and the other listed exceptions (general instruction here; the employer supplies how its state's laws apply). | 1. What HIPAA is and who must follow it |
| 160.306 | Complaints to the Secretary of HHS in writing, generally within 180 days of when the complainant knew or should have known of the act or omission. | 4. Patient rights under the Privacy Rule |
| 160.316 | No retaliation for filing a complaint, participating in an investigation, or opposing in good faith a practice believed unlawful. | 8. Breaches, reporting and penalties |
| 160.402(c) | Covered entities and business associates are liable for violations by their agents, including workforce members, acting within the scope of agency. | 8. Breaches, reporting and penalties |
| 160.404 | Four civil money penalty tiers by culpability for violations on or after February 18, 2009, with amounts adjusted annually in 45 CFR part 102; the lesson gives the January 28, 2026 per-violation minimums and calendar-year cap. | 8. Breaches, reporting and penalties |
| 164.104 | The Part 164 standards apply to covered entities and, where provided, to business associates. | 1. What HIPAA is and who must follow it |
| 164.302 | The Security Rule applies to covered entities and business associates with respect to electronic protected health information. | 1. What HIPAA is and who must follow it; 2. Protected health information |
| 164.304 | Definitions of security incident and malicious software, applied to ransomware as described in the HHS ransomware fact sheet. | 7. Phishing, ransomware and social engineering |
| 164.306(a), (b), (d) | Security Rule general rules: ensure confidentiality, integrity and availability of ePHI; flexibility of approach; required versus addressable implementation specifications. | 6. Protecting electronic PHI |
| 164.308(a)(2) | A security official is identified as responsible for the Security Rule policies and procedures; the lesson explains the role (general instruction here; the employer names its own official). | 1. What HIPAA is and who must follow it |
| 164.308(a)(5)(i) | Security awareness and training program for all workforce members, including management; this course is part of that training, with security reminders, malicious software, log-in monitoring and password management taught in later lessons (general instruction here; the employer supplies its own policies). | 1. What HIPAA is and who must follow it |
| 164.308(a)(5)(ii)(A)–(C) | Security awareness and training program with security reminders (periodic security updates), protection from malicious software (guarding against, detecting and reporting it) and log-in monitoring (monitoring log-in attempts and reporting discrepancies); the lesson teaches phishing, smishing and pretexting recognition and the worker's detect-and-report role (general instruction here; the employer supplies its own policies and systems). | 7. Phishing, ransomware and social engineering |
| 164.308(a)(5)(ii)(D) | Password management procedures for creating, changing and safeguarding passwords (addressable) (general instruction here; the employer supplies its own password rules). | 6. Protecting electronic PHI |
| 164.308(a)(6) | Security incident procedures: identify and respond to suspected or known security incidents, mitigate harmful effects, and document incidents and outcomes; the lesson teaches prompt reporting and not attempting fixes alone (general instruction here; the employer supplies its own incident procedure). | 7. Phishing, ransomware and social engineering |
| 164.310(b), (c) | Workstation use policies and physical safeguards restricting workstations that access ePHI to authorized users; the lesson teaches locking screens, screen position and home-health device handling (general instruction here; the employer supplies its own policies). | 6. Protecting electronic PHI |
| 164.310(d)(1), (d)(2)(i)–(ii) | Device and media controls for moving hardware and media; required disposal and media re-use procedures; the lesson covers thumb drives, laptops, shredding and wiping or destroying drives. | 6. Protecting electronic PHI |
| 164.312(a)(2)(i)–(iv) | Access control: unique user identification and emergency access procedure (required); automatic logoff and encryption (addressable). | 6. Protecting electronic PHI |
| 164.312(b) | Audit controls that record and examine activity in systems containing ePHI; the lesson explains how record access is logged by user, time and record. | 5. Privacy at the front desk, chairside and bedside; 6. Protecting electronic PHI |
| 164.312(d), (e) | Person or entity authentication, and transmission security with addressable encryption; the lesson covers multifactor sign-in, email and texting. | 6. Protecting electronic PHI |
| 164.402 | Definitions of breach, its three exceptions, the presumption of breach unless a four-factor risk assessment shows a low probability of compromise, and unsecured PHI; applied to ransomware per HHS guidance. | 7. Phishing, ransomware and social engineering; 8. Breaches, reporting and penalties |
| 164.404 | Notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery; discovery imputed when any workforce member or agent other than the person committing the breach knows or should reasonably have known; plain-language content and first-class mail or agreed email. | 8. Breaches, reporting and penalties |
| 164.406 | Notice to prominent media outlets for a breach involving more than 500 residents of a state or jurisdiction, within the same 60-day limit. | 8. Breaches, reporting and penalties |
| 164.408 | Notice to the Secretary: for 500 or more individuals, contemporaneously with individual notice; for fewer than 500, a log reported within 60 days after the end of each calendar year. | 8. Breaches, reporting and penalties |
| 164.410 | Business associates notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. | 8. Breaches, reporting and penalties |
| 164.412 | Law enforcement delay of notification when an official states notice would impede a criminal investigation or damage national security (mentioned at awareness level). | 8. Breaches, reporting and penalties |
| 164.414(b) | The covered entity or business associate bears the burden of showing that notifications were made or that an impermissible use or disclosure was not a breach; the lesson teaches that the organization assesses and documents the decision. | 8. Breaches, reporting and penalties |
| 164.502(a)(1) | PHI may be used or disclosed only as the Privacy Rule permits or requires; permitted uses and disclosures listed, including to the individual, for treatment, payment and operations, and under an authorization. | 3. When protected health information can be used or shared; 5. Privacy at the front desk, chairside and bedside |
| 164.502(a)(1)(iii) | Incidental uses and disclosures are permitted only when the underlying use or disclosure was permitted and minimum necessary and reasonable safeguards were applied. | 3. When protected health information can be used or shared; 5. Privacy at the front desk, chairside and bedside |
| 164.502(b) | Minimum necessary standard for uses, disclosures and requests, and its exceptions: disclosures to or requests by a provider for treatment, to the individual, under an authorization, and as required by law. | 3. When protected health information can be used or shared; 5. Privacy at the front desk, chairside and bedside |
| 164.502(g) | Personal representatives treated as the individual for relevant PHI: adults, unemancipated minors subject to state law and minor-consent services, deceased individuals; option to decline in abuse, neglect or endangerment situations. | 4. Patient rights under the Privacy Rule |
| 164.506 | Uses and disclosures for treatment, payment and health care operations without authorization, with examples from dental, clinic, hospital and home health settings (general instruction here; the employer supplies its own policies). | 3. When protected health information can be used or shared |
| 164.508 | Written authorization required for uses and disclosures not otherwise permitted, and for psychotherapy notes, marketing and sale of PHI with narrow exceptions; core elements and required statements; revocation in writing; limits on conditioning treatment on signing. | 3. When protected health information can be used or shared; 5. Privacy at the front desk, chairside and bedside |
| 164.510(a) | Facility directory: name, location, general condition and religious affiliation; religion only to clergy; the individual is informed and may object; emergency handling. | 3. When protected health information can be used or shared |
| 164.510(b) | Disclosures to family, friends and others involved in care or payment: directly relevant information only; agreement, opportunity to object or reasonable inference when the individual is present; professional judgment when absent or incapacitated, including pickup of prescriptions. | 3. When protected health information can be used or shared |
| 164.512(a)–(d), (j) | Disclosures without authorization: required by law; public health, including disease and child abuse or neglect reports; adult abuse, neglect or domestic violence reports under set conditions; health oversight; serious and imminent threat to health or safety (general instruction here; the employer designates who makes these disclosures). | 3. When protected health information can be used or shared |
| 164.512(e) | Judicial and administrative proceedings: a court order permits disclosure of only what it expressly authorizes; a subpoena without a court order requires satisfactory assurance of notice to the individual or of a qualified protective order. | 3. When protected health information can be used or shared |
| 164.512(f) | Law enforcement disclosures only under the listed conditions, such as court-ordered warrants, required injury reports, limited identification and location information, and crime on the premises. | 3. When protected health information can be used or shared |
| 164.514(a) | Health information that does not identify an individual, and gives no reasonable basis to identify one, is not individually identifiable; de-identified information is not protected health information. | 2. Protected health information |
| 164.514(b)(1) | Expert determination method of de-identification: a qualified expert finds a very small risk of identification and documents the methods and results. | 2. Protected health information |
| 164.514(b)(2) | Safe Harbor method: removal of the 18 listed identifiers of the individual and of relatives, employers and household members, with no actual knowledge that the remaining information could identify the individual. | 2. Protected health information |
| 164.514(c) | A re-identification code may be kept if it is not derived from information about the individual and is not used or disclosed for any other purpose. | 2. Protected health information |
| 164.514(d) | Minimum necessary implementation: the entity identifies workforce roles and the categories of PHI each needs and limits access to match (general instruction here; the employer supplies its own role-based access policies). | 3. When protected health information can be used or shared; 5. Privacy at the front desk, chairside and bedside |
| 164.514(h) | Verify the identity and authority of a requester not known to the entity before disclosure, including badges and letterhead for public officials (general instruction here; the employer supplies its own verification procedure). | 3. When protected health information can be used or shared; 7. Phishing, ransomware and social engineering |
| 164.520 | Notice of Privacy Practices: content; provided by direct treatment providers no later than first service delivery; good faith effort to obtain written acknowledgment except in emergencies; posting at the site and on the website; updated notice including 42 CFR Part 2 statements required by February 16, 2026. | 4. Patient rights under the Privacy Rule |
| 164.522(a) | Right to request restrictions; the entity generally need not agree but must honor an agreed restriction except for emergency treatment; mandatory restriction on disclosures to a health plan for items or services paid in full out of pocket. | 4. Patient rights under the Privacy Rule |
| 164.522(b) | Confidential communications: providers must accommodate reasonable requests for alternative means or locations without requiring a reason; health plans when the individual states disclosure could endanger them (general instruction here; the employer supplies its own procedure for recording requests). | 4. Patient rights under the Privacy Rule; 5. Privacy at the front desk, chairside and bedside |
| 164.524 | Right of access to the designated record set and its exceptions; written requests if the individual is informed; action within 30 days with one 30-day extension and written reasons; electronic copy in the form requested if readily producible; reasonable, cost-based fee; directing an electronic copy to a third party. | 4. Patient rights under the Privacy Rule |
| 164.526 | Right to request amendment; action within 60 days with one 30-day extension; grounds for denial; statement of disagreement linked to the record and included with later disclosures. | 4. Patient rights under the Privacy Rule |
| 164.528 | Accounting of disclosures for the six years before the request, its main exclusions, action within 60 days, and the first accounting in any 12-month period without charge. | 4. Patient rights under the Privacy Rule |
| 164.530(a) | A privacy official responsible for the privacy policies and a contact person or office for complaints are designated and documented; the lesson explains the roles (general instruction here; the employer names its own official). | 1. What HIPAA is and who must follow it |
| 164.530(b) | Privacy training for all workforce members on the entity's policies and procedures as necessary for their functions; new members within a reasonable period; members affected by a material change; training documented (general instruction here; the employer supplies its own policies). | 1. What HIPAA is and who must follow it |
| 164.530(c) | Administrative, technical and physical safeguards, including safeguards that limit incidental uses and disclosures (general instruction here; the employer supplies its own safeguards). | 3. When protected health information can be used or shared; 5. Privacy at the front desk, chairside and bedside; 6. Protecting electronic PHI |
| 164.530(d) | Process for individuals to complain to the covered entity, with complaints documented. | 4. Patient rights under the Privacy Rule |
| 164.530(e) | Have and apply appropriate sanctions against workforce members who fail to comply with privacy policies or the rules, and document them (general instruction here; the employer supplies its own sanctions policy). | 8. Breaches, reporting and penalties |
| 164.530(f) | Mitigate, to the extent practicable, known harmful effects of an impermissible use or disclosure; the lesson ties prompt reporting to mitigation. | 8. Breaches, reporting and penalties |
| 164.530(g) | No intimidation, threats, coercion, discrimination or retaliation against individuals for exercising Privacy Rule rights or filing a complaint. | 4. Patient rights under the Privacy Rule; 8. Breaches, reporting and penalties |
| 164.530(j) | Required documentation, including training records, is retained for six years from creation or the date last in effect, whichever is later. | 1. What HIPAA is and who must follow it |
| 42 U.S.C. 1320d-5(d) | State attorneys general may bring civil actions on behalf of state residents for HIPAA violations. | 8. Breaches, reporting and penalties |
| 42 U.S.C. 1320d-6 | Criminal penalties for knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA: up to $50,000 and 1 year; $100,000 and 5 years under false pretenses; $250,000 and 10 years with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm. | 8. Breaches, reporting and penalties |
Beyond the minimum
- The four HIPAA rules in brief and the role of the HHS Office for Civil Rights as enforcer.
- Examples of business associates and subcontractors from HHS guidance, and a cleaning service as an example of who is not one.
- That HIPAA sets no fixed retraining interval, while many employers require annual training.
- How this general course relates to the employer's own policy training, with a new-hire scenario.
- Electronic, paper and spoken examples of protected health information from dental, clinic and home health settings.
- Why removing a name alone does not de-identify, and a home health route sheet scenario.
- The difference between a use inside the organization and a disclosure outside it.
- HHS's description of incidental disclosures, with whiteboard and overheard-conversation examples.
- Practice scenario: an attorney's subpoena with no court order arriving at a dental front desk.
- Routing legal, police and public-interest requests to designated staff.
- Which disclosures do and do not appear in an accounting, with public health reports and subpoena responses as examples.
- Practice scenario: a patient who pays for a crown out of pocket and asks that her dental plan not be told.
- HHS FAQ positions on sign-in sheets, calling names, voicemail and appointment messages, overheard conversations, and no requirement for private or soundproof rooms.
- Fax, printer and paper-on-counter practices, and checking a patient's contact preference before calling or mailing.
- Snooping on family, coworkers, neighbors and public figures, and that access to your own record follows employer policy.
- OCR settlements with dental practices that disclosed patient information while replying to online reviews, described in general terms.
- HHS FAQ 570 on email with patients and FAQ 2061 on unencrypted email at the individual's request after a warning.
- Status of the January 2025 Security Rule proposal (not final as of October 2026; current rule in effect) and HHS disposal methods for paper and electronic media.
- Four warning signs of a phishing email: mismatched sender, urgent threat, hidden link destination, unexpected attachment.
- Text-message scams with shortened links, and call-back verification against a number from the organization's own records.
- Why full disk encryption may not prevent a ransomware breach on a running, signed-in computer, per the HHS fact sheet.
- A practice scenario on reporting a credential-harvesting click.
- HHS methods for securing PHI: encryption with the key kept separate, destruction of paper and media, and why redaction does not count.
- A practice scenario on a misdirected email and who decides whether it is a breach.
What your employer provides
Employers remain responsible for training each workforce member on their own privacy and security policies and procedures, systems and privacy officer under 45 CFR 164.530(b)(1), and for keeping training records for six years under 164.530(j).
The certificate
Lists your name, the standard, the completion date, the valid through date, and a verification number with a QR code. Page two lists the training elements covered.
Training staff?
Buy seats, invite people by email, and track completion on a dashboard. Buy seats.