HIPAA Privacy and Patient Confidentiality

What you will learn

• Identify covered entities, business associates and workforce members, and determine whether information is PHI or de-identified.
• Apply the TPO permission and the minimum necessary standard, including its exceptions, to everyday disclosures.
• Decide when and how to involve family members, friends and personal representatives, including parents of minors, under 164.510(b) and 164.502(g).
• Recognize when a valid authorization is required and identify its core elements, including for psychotherapy notes and marketing.
• Analyze requests from law enforcement, attorneys and courts using 164.512(e) and (f), and respond with a documented legal basis.
• Apply 164.512(j) and your state's duty-to-protect rules to a patient's threat of violence, and document a defensible decision.
• Explain HIPAA preemption, give examples of more stringent state laws, and describe the 2024 changes to 42 CFR Part 2.
• Respond correctly to patient requests for access, amendment, accounting, restrictions and confidential communications.
• Use safe practices for conversations, EHR access, messaging, telehealth, AI tools, social media and online reviews.
• Apply the Breach Notification Rule, describe OCR and board enforcement, and plan a credible response that demonstrates accountability and remediation.

Course facts

CPD value

Approximately 3 CPD hours (estimated learning time including knowledge checks, reflection and assessment)

Audience

U.S. licensed health professionals: physicians (MD/DO), nurses and APRNs, PAs, pharmacists, dentists and dental hygienists, psychologists, counselors, social workers and other licensees

Standards covered

HIPAA Privacy, Security, Breach Notification and Enforcement Rules (45 CFR Parts 160 and 164, including 164.502, 164.506, 164.508, 164.510, 164.512, 164.514, 164.520 to 164.530); 42 CFR Part 2 (2024 final rule); 42 U.S.C. 1320d-6; 45 CFR Part 171 (information blocking); state law examples (California Civil Code 43.92 and CMIA, Texas Health and Safety Code chapter 181, New York Regents Rules Part 29)

Format

Self-paced, gated lessons with knowledge checks, case studies and reflection

Assessment

20 scenario-based questions, 80% to pass (16 of 20)

Outcome

Certificate of completion and a written reflection for your CPD record

Alignment

Mapped to HHS OCR requirements and to confidentiality standards in the AMA Code of Medical Ethics, ANA Code of Ethics for Nurses (2025), APhA Code of Ethics, ADA Principles of Ethics and Code of Professional Conduct, AAPA Guidelines, FSMB and NCSBN social media guidance, and state practice acts. Not board-approved.

Syllabus

10 sections, 3 CPD hours, 20-question final assessment

1. 1Foundations of confidentiality and HIPAA3 lessons

   • Confidentiality, privacy and trust in U.S. health care
   • The HIPAA framework: who and what it covers
   • Protected health information and de-identification
2. 2Permitted uses and disclosures3 lessons

   • Treatment, payment and health care operations, and the minimum necessary standard
   • Family, friends and personal representatives
   • Authorizations, psychotherapy notes and marketing
3. 3Disclosures without authorization and the duty to protect3 lessons

   • Public interest disclosures under 45 CFR 164.512
   • Law enforcement, subpoenas and court orders
   • Serious threats and the duty to warn or protect
4. 4State law and specially protected information3 lessons

   • State law, preemption and your license
   • Substance use disorder records: 42 CFR Part 2 after the 2024 final rule
   • Reproductive health information and other sensitive data
5. 5Patient rights over their information2 lessons

   • The Notice of Privacy Practices and the right of access
   • Amendment, accounting, restrictions and confidential communications
6. 6Confidentiality in everyday and digital practice3 lessons

   • Conversations, workspaces and snooping
   • Electronic PHI: Security Rule basics, messaging, telehealth and AI tools
   • Social media, the media and online reviews
7. 7Breaches, enforcement and professional accountability3 lessons

   • The Breach Notification Rule
   • OCR enforcement and penalties
   • Board discipline, employer action and showing insight and remediation
8. 8Conclusion and key points1 lesson

   • Conclusion and key points
9. 9References and further reading1 lesson

   • References and further reading
10. 10Your reflective account1 lesson

    • Your reflective account

Who this course is for

U.S. licensed health professionals: physicians (MD/DO), nurses and APRNs, PAs, pharmacists, dentists and dental hygienists, psychologists, counselors, social workers and other licensees.