I recently created a new resource page for the TeachPrivacy website: Text of HIPAA’s Training Requirements. This page provides excerpts of the training provisions in the HIPAA Privacy Rule and the HIPAA Security Rule.

This page is designed to be a useful companion page to our resource page, HIPAA Training Requirements: FAQ. The FAQ discuss my interpretation of the HIPAA training provisions, but the full text of those provisions is located on the separate new resource page above.

This post was authored by Professor Daniel J. Solove, who through TeachPrivacy develops computer-based privacy training, data security training, HIPAA training, and many other forms of awareness training on privacy and security topics.

You can give case conference as long as the purpose is for education, otherwise it would be nearly impossible to even give a normal case conference, because even the dates of exams / timeline would need to be anonymized as date of service is PHI.

If the people you are sharing this information with are not directly involved in the care of the patient, do not have a quality activity that they are doing which has a defined scope and is supported by hospital administration then posting their info on this forum is a HIPAA violation.

De-identifying patients and posting about them is still problematic. I just recently saw someone re-identify a patient based on a brief, vague description of the sport he played and his recent performance (improving) in the sport. I have been trying to train a machine learning model to de-identify patient notes and it's a nightmare. So much more complex than names, dates, employers, city (roll up to state.)

NetSec.news is dedicated to helping IT professionals protect their networked environments, both from internal and external threats. Our goal is to provide the most comprehensive coverage of healthcare-related news anywhere online, in addition to independent advice about compliance and best practices to adapt to prevent data breaches. More information here HIPAA training