Course Outline for HIPAA Online Training with Instructor for level 1 and 2

• HIPAA Basics: An overview of the Health Insurance Portability and Accountability Act of 1996 (all provisions)
• HIPAA’s Administrative Simplification Title: Review of the provisions of the Administrative Simplification Title. This includes transaction and code set standards (administrative transactions), national identifiers, privacy requirements, and security requirements.
• HIPAA Penalties: Review of the HIPAA enforcement rule including informal and formal remedies, requirements of Covered Entities, the role of business Associates as agents and enforcement bodies.
• HIPAA-Related Organizations: Discussion of entities/organizations specifically designated as standard maintenance organizations and statutorily defined advisory bodies.
• HIPAA Terminology and Definitions Covered Entity: Review of definitions included in the
  Administrative Simplification Title-related rules.

1. 1. Covered Entity
   2. Health Plan
   3. Clearinghouse
   4. Health Care Provider
   5. Business Associates
   6. Trading Partner Agreement
   7. Workforce
   8. Organized Health Care Arrangement

HIPAA Transactions, Code Sets and Identifiers

• Transactions
• Impacted Health Care Transactions
• Target Entities
• Scope
• Penalties
• ASCA

ANSI ASC X12 Standard

• Transaction Type 270
• Transaction Type 271
• Transaction Type 276
• Transaction Type 277
• Transaction Type 278 Request and Response
• Transaction Type 820
• Transaction Type 834
• Transaction Type 835
• Transaction Type 837 – Professional
• Transaction Type 837 – Institute
• Transaction Type 837 – Dental

HIPAA Code Sets

• ICD-9-CM Volumes 1 and 2
• CPT-4
• CDT
• ICD-9-CM Volume 3
• NDC
• HCPC

• Introduction: Overview of the HIPAA Privacy Rule

1. 1. Who is Impacted (e.g., the definition of covered entities, business associates)?
   2. Scope (Activities covered by the rule)
   3. Exceptions (Specifically included or referenced exceptions that allow use and disclosure of patient/health plan member protected health information (PHI))
   4. Timeline (Effective date of the rule, timelines related to certain requirements identified in the privacy rule such as accounting of disclosures, document retention requirements, etc.)

• Key Definitions: Review of key definitions associated with the privacy rule and how they apply to rule application and compliance.

1. 1. IIHI
   2. PHI
   3. Deidentified Information
   4. Use
   5. Disclosure
   6. Treatment
   7. Payment
   8. Health Care Operations

• Notice Requirement: Review of the requirements to draft and make available a notice of privacy practices, the content of such notice, revision requirements, and availability requirements.

1. 1. Core Elements
   2. Changes to a Notice
   3. First Interaction

• Authorization versus Consent Requirement: Review the legal definitions of consent and authorization and what they would be used for. Review of the legal requirements related to obtaining authorization, the form of such authorization, and content requirements.

1. 1. Definition of “consent”
   2. Definition of “authorization”
   3. Legal differences between “consent” and “authorization”
   4. Core Data Elements and Required Statements
   5. Defective Authorizations
   6. Revocations

• Key Parties Impacted: A discussion of all entities or individuals directly or indirectly impacted by the rule and why.

• Minimum Necessary: Discussion of the definition of the minimum necessary and when it applies to the use and disclosure of PHI (internally and externally)

• Oral and Other Non-electronic Communications: A discussion of what constitutes PHI pursuant to the rule and the related requirements to protect non-electronic PHI, including oral PHI.

• Health-Related Communications, Fund Raising, and Marketing: Review of the requirements related to the use of PHI for communications other than treatment, payment, and health care operations. Also, a review of the strict requirements relating to the use of PHI for marketing and fundraising.

• Research: A review of the requirements related to the use of PHI for research including what processes must be followed prior to allowing the use of PHI in research without the patient/health plan member’s authorization.

HIPAA Privacy Rule Part 2

• Policy & Training Requirements: A review of the implied and explicit requirements to develop, implement and maintain privacy policies and procedures and the requirement to provide initial and ongoing staff training.
• Preemption Requirements: A review of state law preemption. This includes a discussion regarding when state law may preempt the rule without specific authorization from the US Department of Health and Human Services (HHS) and when authorization is required prior to state law preemption of HIPAA.
• State Privacy Laws: A general review of state privacy laws that preempt HIPAA (categorized as specially protected health information) with specific reference to select California state laws.
• Federal Privacy Law – 42 CFR Pt. 2: A discussion of the more stringent requirements found in 42 CFR Pt. 2 relating to alcohol and chemical dependency
• Statutory/Rule Conflict Resolution: Discussion of how to respond when federal and/or state law conflicts.
• Case Law: A review of general case law that has impacted the application of HIPAA, state privacy laws, and impacts legal risks.

• General:
• Threats: General review of threats (real and perceived) prompting Congress to include security requirements in the HIPAA Administrative Simplification Title.
• Definition and Terminology: Review of general definitions of security and specifically how those definitions apply to the rule and what data must be protected by the implementation of appropriate security measures.

1. 1. Security
   2. Security Services
   3. Security Mechanisms

HIPAA Security Rule Part 2

• Red Flag Rule Overview
• Definition of “red flags” and how to spot them
• State Identity Theft Protection Laws & ARRA Breach Notification Requirements
• Identity Theft Protection Program Requirements
• Implementation Tips

HIPAA Solutions – Parts 1 & 2

One of the cornerstones of a successful HIPAA security program is the performance of risk analysis and the creation of a risk management program. These two chapters will walk you through a program of risk analysis and show you how to perform one that focuses on the specific areas that HIPAA requires. You will learn techniques to set a severity scale that is specific to your organization; evaluate and compare risk elements against it; identify and quantify your assets; clarify threats and vulnerabilities that can compromise those assets; develop a strategy to protect against those threats that are both operationally effective and economically efficient. When you complete this section, you will be ready to help get your organization compliant now, and keep it that way into the future.

Meaningful Use

Meaningful Use is one of the hottest current topics in Healthcare. In stages, the Meaningful Use program lays out a series of accomplishments and metrics that over time lead to achieving the objective of securely automating healthcare institutions and providers. In addition to having a program of steps over the years of 2011-2016, the US Government has outlined a financial incentive program to further encourage participation and compliance, and reduce the impact of this pervasive change. This module covers: