HIPAA Security and Cybersecurity

Who should take it

All workforce members of a HIPAA covered entity or business associate who use computers, phones, email, the electronic record or telehealth.

National course on the HIPAA Security Rule and everyday cybersecurity. Your organization's security policies and approved tools control what you may use. The proposed 2025 Security Rule update is not in effect as of this version.

What employees will learn

• ✓Explain what ePHI is and the three types of Security Rule safeguards.
• ✓Create strong passphrases and use multifactor authentication correctly.
• ✓Recognize phishing, phone scams and other social engineering.
• ✓Protect laptops, phones and removable media, and send PHI only through approved channels.
• ✓Work securely from home and during telehealth sessions.
• ✓Use AI tools without exposing client information.
• ✓Recognize and promptly report security incidents.

Topics covered

• •Electronic protected health information
• •Administrative, physical, and technical safeguards
• •Password security and multifactor authentication
• •Phishing and social engineering
• •Device security
• •Secure messaging
• •Email and text communications
• •Remote work and telehealth
• •Artificial intelligence and PHI
• •Security incident reporting

Sources this course is based on

• Administrative safeguards, including security awareness and training (45 CFR 164.308(a)(5), (a)(6)) · eCFR
• Security Rule definitions, including security incident (45 CFR 164.304) · eCFR
• Technical safeguards (45 CFR 164.312) · eCFR
• Security Rule guidance and resources · HHS OCR
• CISA: healthcare cybersecurity best practices · Other