About this course
This course teaches Privacy Officers and Compliance Managers how to build, organize, and maintain the documentation that the HIPAA Privacy and Security Rules actually require — and that HHS's Office for Civil Rights (OCR) looks for in an audit or breach investigation. It moves past the general "know the rules" level of training into the operational question compliance teams face every day: what has to be written down, in what form, for how long, and who has to be able to produce it on request.
The regulatory driver is explicit. Under 45 CFR §164.316, covered entities and business associates must implement, and document in writing, the policies and procedures required by the Security Rule, and must retain that documentation — along with prior versions no longer in effect — for six years from the date of creation or the date it was last in effect, whichever is later. The Privacy Rule imposes a parallel documentation duty for privacy policies and practices. Separately, 45 CFR §164.308(a)(1)(ii)(A) requires an accurate and thorough risk analysis of threats and vulnerabilities to electronic PHI. OCR's own enforcement history consistently shows missing, outdated, or incomplete risk analyses and policy documentation as leading findings in audits and resolution agreements — often the deciding factor between a clean review and a costly settlement, independent of whether a breach actually occurred.
Learners work through what a complete HIPAA documentation set looks like in practice: the current risk analysis and risk management plan, written policies and procedures for administrative, physical, and technical safeguards, workforce training records showing who was trained and when, signed Business Associate Agreements with every vendor that touches PHI, sanction records for policy violations, and a breach notification log capturing each incident assessed — whether or not it met the threshold for a reportable breach. The course also covers the mechanics of the Breach Notification Rule itself (45 CFR §§164.400–414), including the 60-calendar-day outer limit for notifying affected individuals and the different HHS reporting timelines for breaches affecting 500 or more individuals versus smaller incidents.
This course is built for people who own compliance documentation, not just compliance awareness — Privacy Officers, Security Officers, Compliance Managers, and anyone preparing an organization for a HIPAA audit, a payer credentialing review, or a cyber-insurance questionnaire. After completing it, learners will be able to build a documentation inventory against the six-year retention standard, identify gaps before an auditor does, and organize records so they can be produced quickly and completely when requested.
Topics covered
- What 45 CFR §164.316 requires: written policies, version history, and the six-year retention clock
- Conducting and documenting a Security Rule risk analysis under §164.308(a)(1)(ii)(A)
- Business Associate Agreements: what they must contain and when they're required
- Workforce training records and sanction documentation
- Breach assessment logs and Breach Notification Rule timelines (§§164.400–414)
- Preparing a documentation package for an OCR audit or investigation
Want this tailored to your organization's policies? Build your own with AI or book a demo.