← All courses
$20

HIPAA Compliance

Go deep on HIPAA: what the law actually requires, what counts as protected health information (PHI) and who's in scope, the administrative/physical/technical safeguards, the risk analysis OCR looks for, breach notification, and how to run it as a continuous program. The healthcare deep-dive spoke — take it after the Compliance Frameworks hub. Educational, not legal advice.

"We know our PHI, we've done a real risk analysis, our BAAs are in place, and we have a breach plan — HIPAA as a running program"

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

  1. 1

    What HIPAA is, and who has to follow it

    HIPAA is a US law that protects health information. You follow its rules and keep records that show it. There is no government certificate.

  2. 2

    What counts as PHI, and what is in scope

    HIPAA covers protected health information (PHI). Only the systems, people and vendors that touch PHI are in scope.

  3. 3

    The three kinds of safeguard

    The HIPAA Security Rule sorts the protection of ePHI into three kinds of safeguard: administrative, physical and technical. Most of it is the same security core you may already know, sorted into three groups.

  4. 4

    Find your risks, and write it all down

    The risk analysis is the base of the HIPAA Security Rule: a thorough, current look at the risks to your ePHI. Your records are the proof that you did it.

  5. 5

    When an incident is a breach, and who you must tell

    Not every incident is a reportable breach. A risk assessment decides. When it is one, you tell the people affected and HHS, and the media for large breaches, without unreasonable delay.

  6. 6

    Keep your HIPAA program running

    HIPAA is an ongoing program. You keep the safeguards working, the risk analysis current and the records up to date, so you can show you comply at any time.

Skills you'll practise

PHI ScopingBusiness Associate AgreementsSecurity Rule SafeguardsRisk AnalysisBreach NotificationContinuous Compliance

Practice data included

  • Covered entity vs business associate examples
  • PHI / ePHI examples
  • The three safeguard categories
  • Breach decision aid

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

  • You answer 6 short questions, one for each module, in your own words (at least 40 words each).
  • An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
  • To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

  1. Module 1, What HIPAA Actually Is: A correct model: a federal law with three rules, enforced by OCR — not a certificate.
  2. Module 2, PHI and Who's in Scope: A clear line around your PHI and the BAAs that govern who touches it.
  3. Module 3, The Safeguards: The administrative, physical, and technical safeguards mapped to your systems.
  4. Module 4, Risk Analysis & Documentation: The cornerstone risk analysis and the documentation that proves it.
  5. Module 5, Breach Notification: A breach-response plan: assess, then notify individuals/HHS/media as required.
  6. Module 6, Staying Compliant: A continuous HIPAA program that's demonstrable to OCR at any time.

What you walk away with

Shareable portfolio

A public URL showing your module timeline, patterns mastered, and completion status.

Everything you build

Download all your work as a ZIP file. It is yours to keep.

Module walkthrough

Each module documented with deliverables and the production pattern you implemented.

Ready to start HIPAA Compliance?

First course free. $20 per course after that.