HIPAA study kit
Cheatsheet, term cards, never-miss list, and a seven-day plan. Original study material.
The rule
Use or disclose the minimum PHI the job needs, on an approved channel, with a documented permission.
If the permission or the identity is missing, stop and route. Do not send the chart to be helpful.
Never miss
- PHI is identifiable health information held by a covered entity or business associate.
- Minimum necessary still applies to payment and operations.
- The Security Rule is about ePHI: administrative, physical, and technical safeguards.
- Unsecured PHI has a breach presumption unless a documented assessment shows low probability of compromise.
- Treatment, payment, and operations do not need an authorization. Most extra disclosures do.
- A business associate agreement must exist before a vendor handles PHI.
Traps
- Curiosity looks in a celebrity or neighbor chart.
- Shared logins and unlocked cafe sessions.
- A later authorization used to erase an earlier disclosure.
- Reading a full lab report onto a voicemail the patient did not request.
Shortcuts
- Ask: who, what, why, which channel, and is there a permission.
- Two identifiers before you open the record.
- Incident: stop, document, follow the sanction path.
Memory hooks
- APT. Administrative, Physical, Technical The three Security Rule safeguard groups.
- WHO-WHAT-WHY. Who is asking, what they want, why they may have it A 10-second Privacy Rule screen before any send.
Agencies ask for a recent training certificate, not a government credential.
- Day 1Privacy Rule and PHIRead the Privacy Rule and PHI terms, then the never-miss lines that touch this domain.
- Day 2Security Rule safeguardsRead the Security Rule safeguards terms, then the never-miss lines that touch this domain.
- Day 3Breach notificationRead the Breach notification terms, then the never-miss lines that touch this domain.
- Day 4Individual rights and authorizationRead the Individual rights and authorization terms, then the never-miss lines that touch this domain.
- Day 5Workforce and business associatesRead the Workforce and business associates terms, then the never-miss lines that touch this domain.
- Day 6Mixed recallRun the term cards, then a short drill. Restate the one-line rule out loud.
- Day 7Full drillSit the 15-question exam and review every miss against this kit.