Compliance: HIPAA deep dive
This course covers HIPAA for Rails teams handling health data. It starts with the two-part test for applicability: covered entities, business associates and protected health information. It then covers permitted uses and the minimum necessary standard, the business associate agreement and its subcontractor chain, and the Security Rule's administrative, physical and technical safeguards. Later lessons cover breach notification and de-identification through Safe Harbor or Expert Determination. The final lesson combines them into an access model, audit log, de-identification pipeline and vendor register.
What you'll learn
- ✓Deciding whether HIPAA applies: covered entities, business associates and PHI
- ✓Permitted uses and the minimum necessary standard, scoped by role and purpose
- ✓Business associate agreements and the subcontractor chain
- ✓Security Rule safeguards and the required versus addressable split
- ✓Breach notification: the presumption, the four-factor assessment and the 60-day deadline
- ✓De-identification with Safe Harbor and Expert Determination
HIPAA is not GDPR with a US accent
The senior courses "Compliance: GDPR deep dive" and "Compliance: LGPD deep dive" both cover omnibus laws. They bind almost any company that touches the personal data of the right people and hand those people a set of individual rights. They apply the same way whether you sell insurance or shoes.…
Read the full lesson free →Curriculum
7 lessonsHIPAA is not GDPR with a US accent
Explains HIPAA's two-part test: whether you are a covered entity or business associate, and whether data is PHI.
Permitted uses and minimum necessary
Covers treatment, payment and operations as permitted uses, and the minimum necessary standard for scoping access by role and purpose.
The business associate agreement
Describes the business associate agreement, the chain of subcontractor agreements, and a register tracking vendors, services and BAA status.
The Security Rule: safeguards in flux
Covers the Security Rule's three safeguard categories, required versus addressable specifications, and the pending 2025 proposal to revise them.
Breach notification: a different clock
Explains the breach presumption, the four-factor risk assessment, the 60-day deadline and the 500-individual reporting threshold.
De-identification: a checklist, not a judgement call
Compares Safe Harbor's 18 identifier categories with Expert Determination, and shows why a checklist suits a testable pipeline.
Putting it together: the Rails shape of HIPAA
Combines an access model, audit log, de-identification pipeline and BAA register into one system for handling PHI.