HIPPA
Implementor and Auditor

• Evolution of HIPAA, the HITECH Act, and the Omnibus Rule
• Understanding the HIPAA regulatory framework
• Covered Entities (CE) and Business Associates (BA)
• Protected Health Information (PHI) vs. Electronic PHI (ePHI)
• Privacy Rule vs. Security Rule – understanding the scope and relationship
• Roles, responsibilities, and accountability under HIPAA

• Structure of the Security Rule
• Standards vs. Implementation Specifications
• Understanding Required vs. Addressable safeguards
• Flexibility of implementation based on organizational size, complexity, and risk
• Office for Civil Rights (OCR) enforcement process
• Common causes of HIPAA violations and regulatory penalties
  

• Identifying Covered Entity and Business Associate responsibilities 
• Mapping PHI and ePHI across healthcare environments 
• Case study on healthcare data flow 
• Practice questions and discussion

• Security Risk Analysis and Risk Management
• Roles and responsibilities of the HIPAA Security Officer
• Workforce security and role-based access management
• Workforce onboarding, termination, and access reviews
• Information access management
• Security awareness and training programs
• Security incident procedures
• Contingency planning and emergency preparedness
  

• Facility access controls
• Visitor management
• Workstation security
• Device and media controls
• Secure disposal and media sanitization
• Asset accountability and tracking
• Backup media protection

• Evaluating administrative safeguard implementation
• Documenting "Addressable" safeguard decisions
• Group discussion on implementation challenges
• Practice questions

• Access control mechanisms
• Unique user identification
• Emergency access ("Break Glass") procedures
• Audit controls and log monitoring
• Integrity controls
• Authentication mechanisms
• Encryption of data at rest and in transit
• Multi-Factor Authentication (MFA)
• Secure transmission of ePHI

• Developing a Risk Register