HIPAA Security & Privacy Awareness Training & Test

Protected Health Information (PHI) is any information that relates to a person's health, health care, or payment for health care, and that can be tied to that person — directly or indirectly.

Because our product is a website intake form and AI assistant for doctor's offices, PHI shows up constantly in our systems: patient names, appointment reasons, symptoms typed into a form, insurance details, or even a phone number tied to a patient record.

• PHI includes obvious things (diagnosis, treatment notes) and less-obvious things (a name plus a date of an appointment, an email address tied to a patient account, or free-text notes typed into an intake field).
• Electronic PHI (ePHI) is PHI in electronic form — which is the only kind we ever handle, since all data lives in our cloud.
• De-identified data (with all 18 HIPAA identifiers removed) is not PHI — but de-identification must follow a specific standard, not just "removing the name."

The minimum necessary standard means you only access, use, or view the PHI required to do your specific job — nothing more, out of nothing more than curiosity.

• Every employee has a unique login. Sharing credentials, even with a coworker, is prohibited.
• Access is role-based: your account can only see the client data your role actually requires.
• Looking up a record you don't need for work — even if you technically have access — is a policy violation. This includes looking up your own family, friends, or anyone out of personal interest.
• Multi-factor authentication (MFA) is required on every account with access to PHI.

Because we have no office, every device you use to access PHI is effectively "the office." That means the same safeguards a clinic would apply to a server room apply to your laptop.

• Full-disk encryption must be enabled on any device used to access PHI.
• Screens must auto-lock after a short idle period, and you must lock your screen manually when stepping away.
• PHI may never be downloaded or stored locally outside the cloud-hosted application — no exporting to a personal spreadsheet, no screenshotting patient data, no copying into email or chat.
• Public Wi-Fi (coffee shops, airports) requires a company-approved VPN before accessing PHI — or should be avoided for that work entirely.
• All data is encrypted in transit (TLS) and at rest (AES-256 via our cloud servers) automatically — you don't configure this, but you should never do anything that routes PHI outside these encrypted channels (e.g., pasting patient data into an unapproved tool).

Our product includes an AI-assisted component, which raises a HIPAA question most software companies never have to answer: can PHI reach a third-party AI model?

• PHI may only be sent to an AI/LLM provider that has signed a Business Associate Agreement (BAA) with us, or must be excluded from reaching the model entirely — check with the Security Officer if you're touching this part of the product.
• The same rule applies to any other vendor that could touch PHI: our cloud servers, email/helpdesk tools, monitoring/logging tools. A signed BAA must exist before PHI reaches any of them.
• Never connect a new tool, plugin, browser extension, or "quick automation" to any system that touches PHI without checking with the Security Officer first — this is the single most common way an untracked subcontractor ends up handling PHI without a BAA.

A security incident is any attempted or actual unauthorized access, use, disclosure, or loss involving our systems or PHI — whether or not anything was ultimately viewed.

• Examples: a lost or stolen laptop, a suspicious login alert, an email sent to the wrong recipient, a phishing attempt that may have captured your credentials, or noticing you can see data you shouldn't.
• Report anything you notice to the Security Officer immediately — even if you're not sure it's serious. Reporting a false alarm has no downside; staying quiet about a real one does.
• Do not try to "fix it quietly" yourself, and do not delete logs, emails, or files related to a possible incident — this can destroy evidence needed for the investigation.
• Once reported, the Security Officer leads containment, investigation, a formal risk assessment, and — if it turns out to be a reportable breach — notifies the affected doctor's office client within the timeframe set in our BAA with them.

HIPAA compliance isn't just a company policy — individuals can face real consequences for violations, separate from what the company faces.

• Violating this policy can result in disciplinary action up to and including termination, regardless of intent — though willful or repeated violations are treated more seriously than one-time accidental mistakes.
• Some violations can also carry personal civil or criminal liability under HIPAA, particularly for willful neglect or knowing misuse of PHI.
• You are required to complete this training annually, and immediately upon being granted access to any system with PHI.
• Documentation of your training (this course) is retained for six years, along with a signed acknowledgment form.