This foundational course is designed for frontline supervisors, workers, trainees, and volunteers employed by organizations that operate as business associates under HIPAA. Business associates — including billing companies, transcription services, consulting firms, accounting firms, health information companies, patient safety organizations, data transmission providers, and subcontractors — share the same HIPAA responsibilities as covered entities when it comes to protecting and disclosing patient health information.
 
 The course provides a comprehensive foundation for understanding and complying with the HIPAA Privacy and Security Rules, with a specific focus on the unique responsibilities of business associates operating under a Business Associate Agreement (BAA). Learners will explore the proper use and disclosure of protected health information (PHI), individual rights of access to PHI, organizational and personal security best practices, breach notification requirements, and HIPAA penalty and enforcement provisions. Upon completion, employees will have the working knowledge needed to handle patient information appropriately and support their organization's compliance obligations under HIPAA.
 
 This course has been updated to reflect the 2024 HHS Final Rule, which strengthens PHI protections related to reproductive health care. Following the Supreme Court's decision in Dobbs v. Jackson Women's Health Organization, HHS modified the Privacy Rule to limit the circumstances under which PHI related to reproductive health care may be used or disclosed for non-healthcare purposes — an update that applies equally to business associates handling such information.