45 CFR Parts 160 and 164
HIPAA Annual Refresher training online
A shorter yearly review for people who completed our HIPAA course: the core rules, the privacy mistakes that keep happening, current security threats, breach reporting, and what has changed in the rules.
- 4 narrated lessons, 20–30 minutes, self-paced
- Complete the course at your pace; your progress saves automatically
- 15-question test, 80% to pass, unlimited retakes
- Certificate issued on passing, valid 12 months, verifiable online
- For: Healthcare workers who completed the WorkSafe Cert HIPAA Privacy and Security course and are due to retrain
Lessons
1. The rules in brief7 min
2. The mistakes that keep happening6 min
3. Security now6 min
4. Reporting and what has changed6 min
What the rules require, and where it is covered
Each row is a requirement from the HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164), in plain English, with the lessons that cover it.
| Citation | Requirement | Covered in |
|---|---|---|
| 160.103 | Definitions of protected health information, covered entity, business associate and workforce; PHI in any form, electronic PHI, and the exclusion of employment records held by a covered entity as employer. Reviewed with a four-part breakdown of the definition. | 1. The rules in brief |
| 160.404 | Civil money penalty tiers by culpability, with amounts adjusted annually for inflation in 45 CFR 102.3; the lesson gives the per-violation minimums and calendar-year cap in effect after the January 28, 2026 adjustment. | 4. Reporting and what has changed |
| 164.308(a)(5) | Security awareness and training program for all workforce members, including security reminders, protection from malicious software, log-in monitoring and password management. Reviewed through phishing, phone pretexting and ransomware cases (general instruction here; the employer supplies its own policies and reporting route). | 3. Security now |
| 164.310(d) | Device and media controls: receipt and removal of hardware and media containing ePHI, disposal and media re-use. Reviewed with reporting lost or stolen devices and keeping devices secure in home health and remote work (general instruction here; the employer supplies its own policies). | 3. Security now |
| 164.312(a)(2)(i) | Unique user identification for every user. Reviewed with a shared-login scenario and multifactor prompts. | 3. Security now |
| 164.312(a)(2)(iii) | Automatic logoff after a set period of inactivity (addressable). Reviewed as a backstop to locking the screen when stepping away. | 3. Security now |
| 164.312(a)(2)(iv) | Encryption and decryption of ePHI (addressable), with transmission encryption at 164.312(e)(2)(ii). Reviewed with why encrypted lost devices are not unsecured PHI. | 3. Security now |
| 164.402 | Breach definition, its three exceptions, the presumption of breach unless a four-factor risk assessment shows low probability of compromise, and unsecured PHI. Reviewed with misdirected fax, email and mail, ransomware and lost devices. | 2. The mistakes that keep happening; 3. Security now; 4. Reporting and what has changed |
| 164.404 | Notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery; when a breach is treated as discovered. | 4. Reporting and what has changed |
| 164.406 | Notice to prominent media outlets when a breach involves more than 500 residents of a state or jurisdiction. | 4. Reporting and what has changed |
| 164.408 | Notice to the Secretary of HHS: within 60 days for breaches of 500 or more, and within 60 days after the end of the calendar year for smaller breaches. | 4. Reporting and what has changed |
| 164.410 | Business associates notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. | 4. Reporting and what has changed |
| 164.502(a)(1)(iii) | Incidental uses and disclosures are permitted only when the underlying use or disclosure is permitted and minimum necessary and reasonable safeguards are in place. Reviewed with conversations in open bays, semi-private rooms and public spaces. | 1. The rules in brief; 2. The mistakes that keep happening |
| 164.502(b) | Minimum necessary standard and its exceptions, including disclosures to a provider for treatment. Reviewed with role-based access and looking at records without a work reason. | 1. The rules in brief; 2. The mistakes that keep happening |
| 164.506 | Uses and disclosures for treatment, payment and health care operations without authorization. Reviewed with one dental patient's referral, claim and quality review. | 1. The rules in brief |
| 164.508 | Authorization required for marketing, sale of PHI, most uses of psychotherapy notes, and any use or disclosure not otherwise permitted. | 1. The rules in brief |
| 164.510(b) | Disclosures to family, friends and others involved in care: patient present and able (agreement, no objection, reasonable inference) or not present or incapacitated (professional judgment, best interests), limited to directly relevant information. Reviewed with a home-health scenario. | 1. The rules in brief |
| 164.512 | Uses and disclosures required or permitted without authorization, such as public health, abuse or neglect reporting, health oversight, judicial proceedings and certain law enforcement purposes, reviewed in summary (general instruction here; the employer supplies its own release process). | 1. The rules in brief |
| 164.514(d) | Minimum necessary policies, including role-based access for workforce members (general instruction here; the employer supplies its own access policies). | 1. The rules in brief; 2. The mistakes that keep happening |
| 164.514(h) | Verification of the identity and authority of a person requesting PHI before disclosure. | 1. The rules in brief |
| 164.520 | Notice of Privacy Practices, reviewed as a patient right, and its updated content for records subject to 42 CFR Part 2 with a compliance date of February 16, 2026; the NPP provisions 164.520(b)(1)(ii)(F)-(H) vacated by Purl v. HHS (N.D. Tex. June 18, 2025) are identified as no longer in force. | 1. The rules in brief; 4. Reporting and what has changed |
| 164.522(a) | Right to request restrictions, including the required restriction on disclosure to a health plan for an item or service paid in full. | 1. The rules in brief |
| 164.522(b) | Confidential communications by alternative means or locations, reviewed with patient email and texting requests. | 1. The rules in brief; 3. Security now |
| 164.524 | Right of access: action within 30 days with one 30-day extension on written notice, copies in the form requested if readily producible, and a reasonable cost-based fee limited to labor, supplies, postage and an agreed summary. | 1. The rules in brief |
| 164.526 | Right to request amendment, named among patient rights. | 1. The rules in brief |
| 164.528 | Right to an accounting of disclosures, named among patient rights. | 1. The rules in brief |
| 164.530(b) | Privacy training for all workforce members on the entity's policies and procedures as needed for their functions, and after a material change; HIPAA sets no fixed retraining interval, and many employers require annual training (general instruction here; the employer supplies its own policies). | 4. Reporting and what has changed |
| 164.530(c) | Administrative, technical and physical safeguards for PHI, reviewed with sending, printing, conversation and paper disposal practices (general instruction here; the employer supplies its own procedures). | 2. The mistakes that keep happening |
| 164.530(e) | Sanctions applied to workforce members who violate privacy policies or the rules. | 4. Reporting and what has changed |
| 164.530(f) | Mitigation, to the extent practicable, of harmful effects of a known violation. | 4. Reporting and what has changed |
| 164.530(g) | No intimidation or retaliation against a person for exercising rights or reporting in good faith. | 4. Reporting and what has changed |
| 42 U.S.C. 1320d-6 | Criminal penalties for knowingly obtaining or disclosing individually identifiable health information in violation of HIPAA: up to $50,000 and 1 year, $100,000 and 5 years under false pretenses, $250,000 and 10 years with intent to sell or cause malicious harm. | 4. Reporting and what has changed |
Beyond the minimum
- The June 2023 OCR settlement in which 23 hospital security guards viewed 419 patients' records, and how access audits find snooping.
- A social media scenario: patient names readable on a whiteboard behind a staff-party photo in a private group.
- HHS Ransomware Fact Sheet: ransomware encryption of ePHI is presumed a breach unless low probability of compromise is shown.
- HHS FAQ on email with patients: reasonable safeguards, alerting patients to the risk of unencrypted email, and offering alternatives.
- Multifactor prompts a user did not start, and a shared-login scenario during a busy shift.
- What changed: the 2024 Part 2 rule, the 2024 reproductive health care rule and its June 18, 2025 vacatur, the January 2025 Security Rule proposal still unfinalized, and where to read the rules.
What your employer provides
Employers remain responsible for training each workforce member on their own privacy and security policies and procedures under 45 CFR 164.530(b)(1), and for keeping training records for six years under 164.530(j).
The certificate
Lists your name, the standard, the completion date, the valid through date, and a verification number with a QR code. Page two lists the training elements covered.