What counts as protected health information, who needs to know, safe talk and screens, phones and social media, and reporting mistakes.
ForNursing home, Home health, Hospice staff
TimeAbout 66–75 minutes
Lessons9, each with a quick check
FinishA quiz (80% to pass) and a printable certificate of completion
What you will learn
Explain what HIPAA protects.
Define protected health information (PHI) in plain words.
Explain the main reasons PHI may be used: treatment, payment and operations.
Know when health information may be shared with family and friends.
Use simple safeguards when you talk, carry papers, or use screens.
Never take or post photos, videos or stories about patients on your own phone or accounts.
Protect paperwork and devices when you work in homes and in your car.
Name the main HIPAA rights patients have.
Know what a privacy breach is.
Written by Pact Compliance from federal rules and CDC, CMS, OSHA and NIH guidance (sources under each lesson), checked October 2026. Where your facility's policy is different, follow your facility's policy.
Lesson 1: HIPAA and You: Why the Privacy Rules Apply to Aides
In this lesson you will:
Explain what HIPAA protects.
Know that HIPAA rules apply to every workforce member, including aides.
Know who your privacy officer is and why privacy never stops an abuse report.
HIPAA
Privacy rules
HIPAA is a federal law. Its Privacy, Security, and Breach Notification Rules protect health information. They also give patients rights over their own health information. The rules apply to health plans and to health care providers who do certain business electronically, like billing. Nursing homes, home health agencies, and hospices that do this must follow them. Your employer's privacy policies tell you how.
Workforce
That means you
The rules use the word workforce. Workforce means employees, volunteers, trainees, and others whose work the employer directs. It does not matter if they are paid. So HIPAA is not just for doctors and nurses. It covers aides, cooks, housekeepers, drivers, and students. If you work for the facility or agency, the privacy rules apply to you.
Show the answer
The whole workforce, including aides, volunteers, and trainees. Workforce means employees, volunteers, trainees, and others the employer directs, paid or not.
Training
Written policies
Your employer must have written privacy policies. It must train every workforce member on those policies. New staff must be trained soon after they start. Staff must be trained again when a policy changes in a way that affects their work. The employer must keep a record of the training. This course is part of that training. Your employer adds its own rules.
Privacy officer
Who to ask
Every covered employer must name a privacy official. This person is in charge of the privacy policies. The employer must also name a person or office to take privacy complaints. Learn who your privacy officer is, and how to reach them. When you are not sure what to do, ask your nurse, your supervisor, or the privacy officer.
Every setting
Confidential records
Other federal rules point the same way. Nursing home residents have a right to secure and confidential personal and medical records. Home health and hospice patients have a right to a confidential clinical record. For home health and hospice, the rules say patient records may be seen or released only as the HIPAA rules allow.
Still report abuse
Privacy is no excuse
Privacy is never a reason to keep quiet about abuse or neglect. HIPAA allows reports about abuse, neglect, or domestic violence to a government agency that is allowed by law to take them. That includes reports the law requires. If you think a patient is being abused or neglected, follow your abuse reporting steps right away.
Sanctions
Real consequences
Your employer must have sanctions for workforce members who break its privacy policies. It must use them, and write them down. Sanctions can mean a warning, more training, or losing your job, based on your employer's policy. CMS says HIPAA violations can also lead to government fines. In some cases, criminal penalties can apply.
On your shift
Ask first
Here is how this looks on a real shift. A new volunteer asks you, 'Do privacy rules apply to me? I'm not staff.' You say, 'Yes. Volunteers are part of the workforce too.' Then you show her where the privacy policy is kept, and you tell her who the privacy officer is. Simple. Now she knows where to go with questions.
Quick review
HIPAA covers you
Let's review. HIPAA protects health information and gives patients rights. The rules cover the whole workforce, paid or not, including aides and volunteers. Your employer must have policies, train you on them, name a privacy officer, and use sanctions. And privacy never stops you from reporting abuse or neglect.
Lesson 2: What Counts as Protected Health Information
In this lesson you will:
Define protected health information (PHI) in plain words.
Know that PHI can be spoken, written, electronic, or a picture.
Know that a person can be identified even without a name.
Health information
Any form
Health information is any information about a person's past, present, or future physical or mental health. It also covers the care they get, and how that care is paid for. It can be spoken or recorded, in any form. That includes a diagnosis, a medicine list, a fall, a mood change, or the fact that someone gets hospice care.
Points to a person
That makes it PHI
Health information becomes individually identifiable when it names the person. It also counts when there is a reasonable chance someone could figure out who it is about. Protected health information, or PHI, is that kind of information, kept or sent in any form. CMS says PHI can be electronic, paper, or spoken.
Spoken words
Paper and screens
Think about where PHI shows up in your day. It is in shift report and in what you say in the hall. It is on your assignment sheet, the care plan, the bath schedule, and the food intake log. It is on the tablet, in a text, and in a voicemail. All of it is protected, in every form.
Show the answer
Saying out loud in the hall that the man in room 4 has a new infection. PHI can be spoken. A room number points to a person.
Identifiers
More than names
HIPAA lists details that can identify a person. They include names, street addresses, and dates like birth, admission, discharge, or death. They include phone numbers, email, Social Security numbers, and medical record numbers. They also include voice prints, full face photos, and similar images. Any of these, joined with health information, can point to a person.
Photos count
Even without names
A photo can be PHI. A full face photo is an identifier. So are images like it. So is any other unique feature, like a tattoo, a room number, or a special quilt on the bed. A photo of a wound, a room, or a meal tray can still show who the person is. Leaving out the name does not make it safe.
Small details
Add up
Details can add up. 'The lady on Elm Street with the new cancer' has no name. But people who know Elm Street may know who it is. If you know the details could point to someone, they are not anonymous. In a small town or a small facility, it does not take much.
After death
Still private
Privacy does not end when a person dies. HIPAA protects a person's health information for 50 years after their death. This matters a lot in hospice and in nursing homes. Do not share stories about a patient's last days with friends, on social media, or with other families.
On your shift
No name, still PHI
Here is a real example. At the store, a friend asks how work is going. You start to say, 'One of my patients on Elm Street just found out she has dementia.' You stop. No name, but the street and the diagnosis could point right to her. Instead you say, 'Work's busy. I can't talk about the people I care for.'
Quick review
Any form
Let's review. PHI is health information that could point to a person. It can be spoken, on paper, on a screen, or in a picture. Names are not the only identifiers. Addresses, dates, phone numbers, faces, and unique features count. Leaving out a name does not make it safe. And privacy lasts 50 years after death.
Lesson 3: Need to Know: Treatment and the Minimum Necessary
In this lesson you will:
Explain the main reasons PHI may be used: treatment, payment and operations.
Use only the PHI you need for your job.
Share fully with the care team when it helps the patient's care.
Only for a reason
Allowed uses
HIPAA starts with a simple rule. PHI may be used or shared only in ways the rules allow. Some allowed reasons are giving it to the patient, treatment, payment, and running the business. Others need the patient's written permission, or the chance to agree or object. If there is no allowed reason, the answer is no.
Treatment
The care team
Treatment means giving, coordinating, or managing a person's health care. It includes providers talking with each other about the patient, and sending a patient to another provider. Your employer may use PHI for its own treatment. That is why you can give report to the nurse and the next shift. CMS says providers can share for treatment even without a signed consent form.
Payment, operations
Behind the scenes
Payment means billing and getting paid for care. Health care operations means running the business. That includes quality improvement, training, checking staff skills, audits, and compliance programs. So the billing office, the quality team, and your trainer may see some PHI. They are allowed to, for those jobs.
The patient
Their own facts
PHI may always be shared with the patient it is about. The minimum necessary rule does not apply there. So you can tell Mr. Cole his weight today, or remind Mrs. Gray what time her bath is. Just make sure others can't hear when it is private. If the patient asks about test results or a diagnosis, get the nurse.
Show the answer
Reading only the parts of the care plan you need to give today's care. Limit PHI to what you need for the job at hand.
Minimum necessary
Only what's needed
When PHI is used or shared, your employer must make reasonable efforts to limit it to the minimum necessary. That means only what is needed for the job at hand. Your employer must decide which staff need which kinds of PHI, and limit access to match. Your job sets what you see.
For care
Tell the nurse
Minimum necessary does not mean holding back from the care team. The rule does not apply when information goes to a health care provider for treatment. If a patient has a new bruise, is not eating, or seems confused, tell your nurse everything you saw. Keeping care facts from the nurse is not privacy. It can cause harm.
No snooping
Curiosity isn't need
Do not look up anyone you do not need to care for. That includes a neighbor, a coworker, a family member, a famous person, or a patient on another unit. Do not read a chart just because you are curious. CMS lists using or sharing more than the minimum necessary as a common HIPAA violation.
On your shift
Your assignment
Here is a real example. Your best friend's dad was just admitted to another unit. You want to check his chart to see how he is doing. You stop. He is not your patient, and you have no job reason to look. Instead you text your friend, 'Thinking of you and your dad.' That shows you care, without breaking his privacy.
Quick review
Need to know
Let's review. PHI may be used only for allowed reasons. Treatment, payment, and running the business are the main ones. Use only the minimum necessary for your job. But share fully with your nurse and care team when it helps the patient's care. And never look up records out of curiosity.
Lesson 4: Talking With Families, Friends and Visitors
In this lesson you will:
Know when health information may be shared with family and friends.
Respect the patient's choice to agree or object.
Send questions to the nurse when you are not sure.
Family helps
The rules allow it
Families and friends are often part of care. HIPAA allows sharing with a family member, a relative, a close friend, or anyone the patient names. But only the information that is directly relevant to that person's part in the care, or in paying for it. CMS says you can share with family and friends involved in care, unless the patient objects.
Patient decides
Agree or object
If the patient is there and able to decide, it can be shared if the patient agrees. It can also be shared if the patient had a chance to object and did not. Or if it is reasonable to see from the situation that the patient does not object. For example, the patient asks her daughter to stay in the room during your visit.
Show the answer
You may tell him about her appetite. She chose to have him there. When the patient is present and agrees, relevant information may be shared.
Not able
Nurse's judgment
Sometimes the patient is not there, or can't decide because of illness or an emergency. Then a professional decides what is in the patient's best interest. Only information directly relevant to that person's role may be shared. That takes professional judgment. In your workplace, it is usually your nurse's call. Follow your policy.
Representatives
Check the record
Some people have legal power to make health care decisions for a patient. That might be a health care agent or a guardian. HIPAA treats that personal representative like the patient, for those decisions. Not every relative is a representative. The record, the care plan, or your nurse can tell you who is.
'Don't tell him'
Honor the request
Patients can ask that some people not be told. Patients can ask the provider to limit what is shared with family. If the provider agrees, it must follow that limit. Nursing home residents can refuse to have their records released, except as the law allows. If a patient says, 'Don't tell my son,' tell your nurse. Then follow the plan.
Directory
Facility only
Facilities may keep a directory. It can list a patient's name, location, general condition, and religion. It can be given to people who ask for the patient by name, and religion to clergy. Patients must be told, and they can limit or say no to the listing. If someone asks which room a resident is in, follow your directory policy.
On your shift
Hallway question
Here is a real example. A man stops you in the hall. He says, 'I'm Mr. Lee's neighbor. How did his hospital trip go?' You don't know if Mr. Lee wants him to know. You say, 'I'm glad you came to visit. I can't share health details, but let me get the nurse.' Kind, and safe.
Quick review
Patient decides
Let's review. Family and friends involved in care may get the information that relates to their role. The patient can agree or object. If the patient can't decide, a professional decides, usually your nurse. Personal representatives are treated like the patient. Honor 'don't tell' requests. When you are not sure, get the nurse.
Your facility's policy (ask your supervisor):
How staff check a caller's identity (for example, a code word or a callback)
Where staff see who a patient's personal representative is
Use simple safeguards when you talk, carry papers, or use screens.
Know what an incidental disclosure is.
Keep clinical details off signs and public boards.
Safeguards
Required
Your employer must have safeguards to protect PHI. Some are rules, some are technology, and some are physical, like locks. PHI must be protected from use or sharing that is not allowed, on purpose or by accident. CMS says to secure records so they are not easy to see for people who do not need them.
Incidental
Not a violation
You can't guarantee perfect privacy. Some small slips can't reasonably be avoided. CMS gives an example. A visitor overhears a private talk between a doctor and a nurse. Or sees a name on a sign-in sheet. That is called incidental. It is not a violation if reasonable safeguards and the minimum necessary rule were followed.
Show the answer
Incidental. It is not a violation if you used reasonable safeguards. CMS says overheard talk is not a violation when reasonable safeguards are used.
Talk low
Pick the place
Halls, elevators, dining rooms, and break rooms are not private. Before you talk about a patient, look around. Lower your voice. Step into a quiet spot, or close the door. Give report away from visitors. Never talk about patients in the parking lot, on the bus, or at home.
Papers
Face down, shred
Your assignment sheet and report notes are PHI. Keep them in a pocket or a folder, not on a table or a cart. Turn papers face down. Do not take them home. When you are done, put them in the shred bin, or wherever your policy says. Never toss them in the regular trash.
Screens
Log out, lock
The Security Rule protects electronic PHI. Employers must protect it, and make sure staff follow the rules. Lock or log out of the tablet or computer every time you walk away. Never share your password, or use someone else's login. Turn screens away from visitors.
Signs and boards
Nothing clinical
In nursing homes, CMS says signs with clinical or personal details, in view of others, could break privacy. So could lists of residents with conditions, like incontinence, where visitors can see or hear. A resident may ask for a bedside sign. Names on doors are fine. Isolation signs are fine if they don't name the infection. In any setting, keep care notes out of public view.
Fax, email, phone
Use safeguards
CMS says staff may use email, phone, and fax with other providers and patients, with safeguards. Check the fax number or email address before you send. Follow your policy for voicemail. Leave only what is allowed, like your name and a callback number. If something goes to the wrong place, tell your nurse right away.
On your shift
Left on the table
Here is a real example. You find a coworker's report sheet on a dining room table. It lists residents' names, diagnoses, and who needs a brief. You pick it up right away, fold it, and hand it back to her. Then you tell your nurse, so they can decide if anything else needs to happen.
Quick review
Simple safeguards
Let's review. Use safeguards every day. Talk low, in a private spot. Keep papers covered, and shred them the right way. Lock or log out of screens, and never share passwords. Keep clinical details off signs and boards. Small, incidental slips are not violations if you used reasonable safeguards.
Lesson 6: Phones, Photos, Texting and Social Media
In this lesson you will:
Never take or post photos, videos or stories about patients on your own phone or accounts.
Know that a photo or post can identify someone even without a name.
Use only the texting and device tools your employer approves.
Written permission
Most other uses
Treatment, payment, and running the business are allowed reasons to use PHI. For most other uses, HIPAA requires the patient's written authorization. Marketing usually needs one too. Posting a patient's photo or story on your own social media is not care. It is never your decision to make.
Photos are PHI
Faces and more
Full face photos, and images like them, are identifiers. So are voice prints, and unique features like tattoos. A recorded voice can point to a person too. A video of a patient singing, a photo of a birthday cake with a name on it, or a picture of a patient's room can all show who it is. And they show that the person gets care from your employer.
Show the answer
It is still PHI. Her face and the setting can identify her. Faces and similar images are identifiers. No name does not make it safe.
No name
Still identifies
Leaving out the name does not fix it. If there is a reasonable chance someone could figure out who it is, it is still PHI. Coworkers, family, and neighbors may know the room, the voice, or the house. Posts spread fast and can't be taken back. The safest rule: never post anything about a patient.
Nursing homes
Written consent
In nursing homes, CMS says photos or recordings of a resident without written consent break the resident's privacy. That includes photos of the resident's room, a resident eating in the dining room, or a resident at an activity. Taking pictures of residents dressed or undressed, and sending them by text or social media, also breaks privacy.
Shaming photos
This is abuse
Some photos are more than a privacy problem. CMS lists taking or sharing photos or recordings that demean or humiliate residents with abuse. If you see a photo or video like that, or someone shows you one, report it right away. Follow your abuse reporting steps. In home health and hospice, report it to your agency at once.
Texting
Approved tools only
Texts are electronic PHI, and the Security Rule protects them. That includes use on phones and other mobile devices. Use only the texting or messaging tools your employer approves for patient information. Do not put patient details in a personal group chat with coworkers. Follow your policy.
Your own phone
Put it away
CMS says photos or recordings taken on smart phones or other devices, without consent, break a resident's privacy. So keep your own phone put away during care. Never record care, a patient's voice, or a patient's room on it. If your employer lets you use your phone for work, follow that policy exactly.
On your shift
Funny video
Here is a real example. A resident with dementia is dancing to music in the dayroom. A coworker says, 'This is so cute. I'm putting it on my story.' You say, 'Please don't. We can't film residents without consent.' If she has already posted it, tell your nurse or supervisor right away.
Quick review
Never post
Let's review. Posting patient photos or stories on your own accounts is never allowed. Photos, videos, and voices can identify someone, even with no name. In nursing homes, photos need written consent through the facility. Shaming photos are abuse, so report them right away. Use only approved tools for texting about patients.
Protect paperwork and devices when you work in homes and in your car.
Know who in the home may get information.
Answer neighbors and friends without sharing PHI.
Their home
Same rules
Home health and hospice patients have a right to a confidential clinical record. The record may be seen or released only as the HIPAA rules allow. Working in someone's home does not change the rules. The home is private, but other people may be there: family, friends, neighbors, and other workers.
Paperwork
Closed and close
Carry only the papers you need for today's visits. That is minimum necessary. Keep them in a closed folder or bag. Do not leave visit papers on the car seat, where people can see them. If your agency keeps a folder in the home, follow the policy for where it goes. Bring papers back the way your agency says.
Devices
Lock and keep
Agency phones and tablets hold electronic PHI. CMS says the Security Rule covers remote and mobile use. Keep your device locked with a passcode. Do not let family members or children use it. Do not leave it in the car where it can be seen. If it is lost or stolen, tell your supervisor right away.
Show the answer
Keep it locked with a passcode, out of sight or with you. Mobile devices hold electronic PHI and must be safeguarded.
Family in the home
Who is involved
Family who help with care may get the information that relates to their part in the care, if the patient agrees or does not object. But not everyone in the house is involved. A visiting cousin may not be. Ask the patient in private when you can. If you are not sure who may know what, ask your nurse.
Neighbors
Kind, not specific
Neighbors and friends may stop you on the porch. 'How is she doing? Is she dying?' Even saying someone gets home health or hospice care is health information. Be kind, and say, 'I'm sorry, I can't talk about the people I visit.' Do not share news about one patient with another patient, either.
Calls in the car
Who can hear
You often call the nurse from the car or a parking lot. Close the windows. Don't use the speaker when other people are nearby. Do not make patient calls from a busy coffee shop or a store line. If a call can be overheard, step away first. Your agency must reasonably limit what others overhear.
After a death
Still private
In hospice, privacy lasts after the patient dies. Protection lasts 50 years. The hospice may share relevant information with family who were part of the care, unless the patient did not want that. Send family questions to the nurse. At the funeral or in the community, do not share details about the patient's last days.
On your shift
Porch question
Here is a real example. You leave Mr. Hall's house. His neighbor waves you over. 'I saw the hospice car. Is it cancer? How long does he have?' You smile and say, 'I can't talk about anyone I visit. Mr. Hall is lucky to have a caring neighbor.' Then you get in the car with your folder closed.
Quick review
Home privacy
Let's review. The HIPAA rules apply in the home. Carry only what you need, keep papers closed, and keep devices locked. Share with family involved in care only as the patient wishes. Ask your nurse when you are not sure. Do not confirm care to neighbors. Make calls where you can't be overheard. Privacy lasts after death.
Your facility's policy (ask your supervisor):
Your agency's home folder policy (if any)
How to report a lost or stolen device or papers, including after hours
Lesson 8: Patients' Privacy Rights: Know Them and Pass Requests On
In this lesson you will:
Name the main HIPAA rights patients have.
Know that a spoken request counts.
Pass every records or privacy request to your nurse or privacy officer the same shift.
Notice
How info is used
Patients have a right to a notice of privacy practices. It explains how their health information may be used and shared. It also explains their rights, and the provider's duties. A provider must give it no later than the first time it gives care. If a patient asks for a copy, tell your nurse.
See and copy
Their own record
Patients have a right to see and get a copy of their own health records. That includes an electronic copy. A provider may ask for requests in writing, if it tells patients that. It must act on the request within 30 days. CMS lists not giving patients access as a common HIPAA violation.
Nursing homes
24 hours
Nursing home rules are faster. A resident can ask out loud or in writing to see their records. The facility must give access within 24 hours, not counting weekends and holidays. Copies must be given after 2 working days' notice. So a spoken request to you can start the clock.
Show the answer
A spoken request counts. Tell your nurse right away. Residents can ask orally or in writing, and access is due within 24 hours, not counting weekends and holidays.
Corrections
Ask to amend
Patients can ask the provider to correct their health records. The provider may ask for the request in writing, with a reason. It must act within 60 days. You don't change the record because a patient asks. Pass the request on, and let the right staff handle it.
Limits and contact
Their choices
Patients can ask the provider to limit how their information is used or shared. They can also ask to be contacted in a different way or place. For example, 'Call my cell, not my home phone.' Providers must agree to reasonable requests like that. Tell your nurse, so the record shows it.
Complaints
No retaliation
Patients can make a privacy complaint. Your employer must have a way to take it. No one may punish or threaten a patient for using a privacy right or making a complaint. A patient can't be made to give up these rights to get care. Treat a patient who complains the same as always.
Your part
Same shift
You don't decide these requests, and you don't hand over records. But don't brush them off, either. When a patient asks to see records, fix a record, limit sharing, or complain, tell your nurse or the privacy officer that same shift. Write down what they asked, and when, if your policy says to.
On your shift
'What do you write?'
Here is a real example. While you help Mrs. Ruiz dress, she says, 'I want to see what you all write about me.' You say, 'You have a right to see your records. I'll tell the nurse right now so she can help you.' Then you tell the nurse before you go to your next resident.
Quick review
Pass it on
Let's review. Patients have a right to a privacy notice. They can see and copy their records, ask for corrections, ask for limits, and choose how to be contacted. They can complain without retaliation. A spoken request counts. Your part is to pass every request to your nurse or privacy officer the same shift.
Your facility's policy (ask your supervisor):
Who handles records requests, and how staff pass them on
Lesson 9: Mistakes and Breaches: Report Right Away
In this lesson you will:
Know what a privacy breach is.
Report any privacy mistake or loss to your supervisor or privacy officer right away.
Know you can speak up without retaliation.
Breach
What it means
A breach is when PHI is seen, taken, used, or shared in a way the rules do not allow, and that puts its privacy at risk. CMS says any use or sharing that is not allowed counts as a breach, unless there is a low chance the PHI was put at risk. That is decided by a risk review.
Examples
It happens
Here are mistakes that can happen to anyone. Handing one patient's papers to another family. Faxing to the wrong number. Losing an agency phone, or leaving papers in a public place. Posting a photo. Looking at a chart with no job reason. CMS lists sharing that is not allowed, and weak safeguards, as common violations.
Not your call
Report it all
Some slips are not breaches. For example, a worker opens the wrong chart by accident, in good faith, and shares nothing. But you do not decide which is which. Your employer does a risk review. It looks at what was shared, who got it, and if it was seen. Your job is to report every slip.
Show the answer
When any staff member, other than the one who caused it, knows. A breach is treated as discovered on the first day any workforce member, other than the person who caused it, knows of it, or should have known.
Your knowledge
Starts the clock
This part matters. A breach counts as discovered on the first day any workforce member knows about it, other than the person who caused it. It also counts from the day the employer should have known, with reasonable care. Then the employer must tell the patients without unreasonable delay, and no later than 60 days. If you know about a coworker's slip and sit on it, the clock is already running.
Report fast
Limit the harm
Your employer must try to reduce any harm from a privacy mistake. A fast report helps. Papers can be gotten back. A lost phone can be locked. A post can be taken down. Tell your supervisor or privacy officer right away. Say what happened, what PHI was involved, who may have seen it, and when.
Your mistake
Still report it
If you made the mistake, report it anyway. Everyone slips sometimes. Hiding it is a choice. Your employer must use sanctions when staff break privacy policies. But hiding a mistake keeps your employer from limiting the harm to the patient. Your policy tells you how to report. Telling the truth fast is the right thing to do.
Speak up
No retaliation
Your employer may not threaten or punish anyone for filing a privacy complaint. It may not punish anyone for helping with an investigation. Or for speaking up, in good faith and in a reasonable way, against a practice they believe breaks the rules. If you see a privacy problem, say so.
On your shift
Wrong papers
Here is a real example. After a visit, you see that the papers you left with Mrs. Kim's daughter were Mr. Park's. You call your supervisor right away. You tell her what was on the papers and when you left them. She tells you the next steps. You don't wait, and you don't try to hide it.
Quick review
Report right away
Let's review. A breach is PHI used or shared in a way the rules don't allow. You don't decide if it is a breach. Report every slip. The clock starts when any staff member knows. Report right away to your supervisor or privacy officer, even if it was your mistake. You can speak up without retaliation.
Your facility's policy (ask your supervisor):
Privacy officer name and 24/7 way to report a privacy incident or lost device
Answer every question. You need 80% to pass. You can try again as many times as you like.
Your quiz covers the lessons for: Nursing home ( questions). Change your setting
Please read
This free course gives you a certificate of completion from Pact Compliance. It is not continuing education (CE) credit and is not approved by any state.
Your employer decides whether it counts toward required in-service hours. Home health and hospice aide training must be given or supervised by the agency's registered nurse.
California: it does not count toward CNA or HHA renewal hours.
Your name and quiz answers stay in your browser and are never sent to Pact.
Pact Compliance LLC, Cordova, TN
Certificate of Completion
This certifies that
completed the online in-service course
Privacy and HIPAA Basics for Aides
Setting
Completed
Seat time
Quiz score
Certificate ID
This free course gives you a certificate of completion from Pact Compliance. It is not continuing education (CE) credit and is not approved by any state. Your employer decides whether it counts toward required in-service hours. Home health and hospice aide training must be given or supervised by the agency's registered nurse. California: it does not count toward CNA or HHA renewal hours.
Part of this topic needs a hands-on check with your supervisor; this online course does not cover that part.
Pact does not keep a record of this certificate. Print it or save it as a PDF and give a copy to your supervisor. pactcompliance.com/free-training/hipaa-privacy/
For owners, administrators and staff development coordinators
Track every staff member's training and licenses in one place. Try the 30-day demo.