HIPAA Privacy & Security for Healthcare Technology
HIPAA Privacy and Security for Healthcare Technology is a free, CC BY 4.0 course outline of about 60 minutes for healthtech engineers, support and billing staff, and compliance officers. It explains the 18 PHI identifiers, the Privacy, Security and Breach Notification Rules, technical safeguards and the four-factor breach risk assessment. A learner finishes knowing what counts as PHI and what to do when it is exposed. The course is awareness training, not HIPAA compliance.
See pricing (from $1 per active user): the outline is free to copy, and building it in Personal Academy starts on the Free plan.
| Course code | MED-2026-02 |
|---|---|
| Estimated duration | About 60 minutes, self-paced |
| Block types | Built in the Course Studio, which offers 28 lesson block types |
| Delivery channels | Web on every plan; Slack, Microsoft Teams and Google Chat from the Basic plan; WhatsApp on Premium |
| Credential | Completion certificate with a public verification page. Certificates are included from the Basic plan. |
| Licence | CC BY 4.0 (Creative Commons Attribution 4.0 International) |
About this course
Designed specifically for healthcare SaaS providers, digital health startups, and medical operations staff, this syllabus breaks down the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule into clear actionable technical safeguards and administrative controls.
What is inside
- •Two modules and four lessons: the HIPAA rules, and incident response and breach notification
- •Sorting exercises, a branching breach scenario and a process flow of the safeguards
- •Knowledge checks, a final exam and an annual attestation
Who it is for
- •Digital health and healthtech software engineers
- •Healthcare administrative, billing, and customer support staff
- •Compliance and Information Security officers
Learning outcomes
- •Identify all 18 identifiers that constitute Protected Health Information (PHI) under HIPAA.
- •Implement technical safeguards including AES-256 encryption at rest and TLS 1.3 in transit.
- •Carry out due diligence on vendors that handle PHI and keep track of their sub-processors.
- •Follow statutory 60-day HHS breach notification protocols in the event of unauthorized disclosure.
How to use it
- Sign up for a free Personal Academy organisation; no card is needed to start.
- Open the Course Studio and paste this outline into the Brief step, with your audience and any policies of your own.
- Review the Blueprint the studio drafts from the brief, adjust modules and lessons, then Build.
- Review the built lessons, edit anything you want, and Deliver: publish and assign it to your people.
- People take it on the web on any plan; delivery in Slack or Microsoft Teams needs the Basic plan or above.
Syllabus
The modules, lessons and suggested block types in this outline.
Module 1: The HIPAA Regulatory Architecture
Understanding covered entities, the vendors that work for them, and the 18 PHI identifiers.
1.1 De-Mystifying PHI & The Safe Harbor Method
A practical guide to the 18 direct and indirect identifiers that convert regular customer data into strictly regulated Protected Health Information.
1.2 The Security Rule: Administrative, Physical & Technical Safeguards
Mapping technical access controls, audit logging, emergency access procedures, and automatic logoff requirements to modern cloud architectures.
Module 2: Incident Response & Breach Notification
Handling unauthorized PHI disclosures, risk assessments, and HHS statutory timelines.
2.1 The Four-Factor Breach Risk Assessment
Learn how to evaluate the nature and extent of PHI, the unauthorized recipient, whether PHI was actually viewed, and mitigation steps taken.
2.2 Breach Notification Timelines & Electronic Attestation
Walk through the 60-day individual notification rule, media notifications for 500+ records, and sign the annual compliance attestation.
Frequently asked questions
Does taking this course make my organisation HIPAA compliant?
No. A HIPAA awareness course is one part of a compliance programme, not compliance itself. Personal Academy records who completed it and when, with scores, exportable as CSV and JSON.