HIPAA and bloodborne pathogens the pair, in one sitting

The bloodborne pathogens standard is one section of federal workplace safety law: 29 CFR 1910.1030. It applies to employers, and what it requires of them is triggered by one phrase — occupational exposure. The standard defines that as "reasonably anticipated skin, eye, mucous membrane, or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties" (paragraph (b)). Reasonably anticipated: not exposure that has happened, exposure the job could produce.

That definition is why the standard reaches further than hospitals. A nursing assistant, a phlebotomist, a medical assistant, a paramedic — obviously. But also a tattoo artist, a body piercer, a housekeeper who handles waste, a school nurse, a police officer, a courier carrying specimens, and anyone whose job description includes responding to an injury. The test is the task, not the job title.

The standard also defines what counts as infectious. Blood means human blood, its components and products made from it. Other potentially infectious materials — OPIM, and the pages here use the abbreviation the way the standard does — is a listed set: semen, vaginal secretions, cerebrospinal, synovial, pleural, pericardial, peritoneal and amniotic fluid, saliva in dental procedures, any body fluid visibly contaminated with blood, and all body fluids in a situation where you cannot tell one from another. It also covers unfixed human tissue or organs other than intact skin, and HIV- or HBV-containing cultures.

One consequence of that list is worth stating plainly because it is the most common misunderstanding in this subject: urine, faeces, vomit, sweat, tears, nasal secretions and saliva outside dental work are NOT covered by this standard unless they are visibly contaminated with blood. They may well be covered by other infection control rules where you work. They are not what 1910.1030 is about.

The standard names hepatitis B virus (HBV) and human immunodeficiency virus (HIV) explicitly and then says "including, but not limited to" — the definition of bloodborne pathogens is open, and in practice hepatitis C virus (HCV) is the third one every exposure control plan addresses.

Hepatitis B attacks the liver. CDC describes acute hepatitis B as a short-term illness in the first six months after exposure, which may produce no symptoms at all or an illness severe enough to need hospital care, and which can become a lifelong chronic infection that causes liver damage, cirrhosis, liver cancer and death. Where symptoms do appear in acute infection they often begin around 90 days after exposure: dark urine or clay-coloured stools, tiredness, fever, joint pain, loss of appetite, nausea and stomach pain, and jaundice. Most people with chronic infection have no symptoms until much later in life. The sentence to carry out of this module is CDC's own: you can have hepatitis B without any symptoms.

Hepatitis C also attacks the liver, and most people who are infected develop a chronic, lifelong infection. CDC calls chronic hepatitis C a leading cause of liver cancer and the leading cause of liver transplants in the United States. Symptoms, when they appear at all, show up two to twelve weeks after infection and look like the hepatitis B list. Being cured of hepatitis C does not stop you being infected again.

HIV attacks the immune system and, untreated, can lead to AIDS. There is no cure; treatment controls it, and people on effective treatment live long lives and do not transmit the virus to partners. Most people have flu-like symptoms two to four weeks after infection, some have none, and the only way to know is a test.

Now transmission, which is where workplace training earns its hour. All three move by blood-to-blood contact: infected blood or another listed fluid has to reach your bloodstream, a mucous membrane — eye, nose, mouth — or broken skin. At work that means a needlestick or other sharps injury, a splash to the face, or contact with non-intact skin. It does not mean sharing a workspace, a phone, a lift, a meal or a handshake. CDC states there is no evidence hepatitis C spreads through sharing eating utensils, hugging, kissing, holding hands, coughing, sneezing, or through food or water.

The quantity involved is small. CDC describes hepatitis B and hepatitis C as spreading when blood "even in microscopic amounts" enters the body of someone not infected. That is the reason for the next module's rule, and the reason a dried spot of blood on a countertop is treated as a hazard rather than as dirt.

Every employer with an exposed employee must have a written Exposure Control Plan, and paragraph (c)(1) says what it contains: the exposure determination, the schedule and method for implementing the rest of the standard, and the procedure for evaluating what happened around an exposure incident.

The exposure determination is the part that names you. Paragraph (c)(2) requires a list of job classifications where all employees have occupational exposure, a list of classifications where some do, and a list of the tasks in which exposure occurs — and it must be made "without regard to the use of personal protective equipment". Your gloves do not take you off the list; the list describes the hazard, not what you wear against it.

The plan is reviewed and updated at least annually and whenever tasks change, and the annual review must document that the employer considered and put in place appropriate, commercially available safer medical devices. There is also a requirement that will matter to you if you do direct patient care: paragraph (c)(1)(v) makes the employer solicit input from non-managerial employees who are exposed to sharps injuries when choosing those devices, and document that they asked.

How you get your copy: paragraph (c)(1)(iii) requires the employer to ensure the plan is accessible to employees, on the terms of the records-access rule. In practice you ask your supervisor, your infection control officer or whoever your workplace names as responsible for the plan, and they must make it available. This course cannot give it to you — it is a document about your building, your tasks and your equipment, and no online course has ever seen it.

The standard requires training on how to recognise tasks and activities that may involve exposure. The recognition habit is easier to build than the list is to memorise, because the list changes with the job and the habit does not: before a task, ask whether blood or a listed fluid could reach your skin, your eyes, your nose or your mouth if this goes wrong rather than if it goes right.

Tasks that reliably answer yes include drawing blood or starting a line; handling, transporting or processing specimens; handling contaminated sharps or emptying a sharps container; cleaning a spill; handling contaminated laundry; wound care and dressing changes; assisting with a procedure where splashing or spraying is possible; giving first aid or CPR; and cleaning instruments or equipment that has been in contact with blood.

Two categories catch people out. The first is other people’s work: a housekeeper who empties a bin, a maintenance worker who services a piece of equipment, a laundry worker who handles a bag. The standard covers them where exposure is reasonably anticipated, and paragraph (d)(2)(xiv) makes equipment be examined and decontaminated before servicing or shipping, with a label saying which parts are still contaminated when that is not feasible.

The second is the unplanned event. A colleague collapses, a client is injured, a needle turns up where it should not be. That is exactly the situation in which people reach in without gloves, and it is why the standard treats first aid and emergency response as covered work rather than as good citizenship.

Paragraph (d)(1) states the rule the whole standard rests on: universal precautions shall be observed to prevent contact with blood or OPIM, and where it is difficult or impossible to tell body fluid types apart, all of them are treated as infectious. Universal precautions is an approach, defined in paragraph (b), in which all human blood and certain human body fluids are treated as if known to be infectious for HIV, HBV and other bloodborne pathogens. You do not decide who is a risk. There is no test you can run by looking at somebody.

The standard then sets an order of protection. Engineering and work practice controls come first and must be used to eliminate or minimise exposure; personal protective equipment is what you add where exposure remains after those controls (paragraph (d)(2)(i)). Engineering controls are the ones built into the equipment — sharps disposal containers, self-sheathing needles, needleless systems, sharps with engineered injury protections — and they have to be examined and maintained or replaced on a regular schedule.

Work practice controls change how the task is done. The specific ones the standard names: wash your hands immediately or as soon as feasible after removing gloves or other PPE, and wash skin or flush mucous membranes with water immediately after contact with blood or OPIM. Do not bend, recap or remove contaminated needles — if an employer can demonstrate no alternative is feasible or a specific procedure requires it, it must be done with a mechanical device or a one-handed technique. Shearing or breaking contaminated needles is prohibited outright. No eating, drinking, smoking, applying cosmetics or lip balm, or handling contact lenses in areas where exposure is reasonably likely; no food or drink in refrigerators, on shelves, countertops or benchtops where blood or OPIM are present. No mouth pipetting. Perform procedures so as to minimise splashing, spraying, spattering and droplets.

The limits are the part the standard names as a training element, and they are worth saying out loud. A control you have to remember is weaker than one built into the device. A safety needle only protects you if the mechanism is activated. A sharps container placed across the room is an engineering control in the purchase order and a hazard on the floor — the standard requires it to be as close as feasible to where sharps are used, kept upright, and replaced routinely rather than allowed to overfill. And no control at all removes the need for the next module: gloves fail, splashes reach faces, and the standard puts PPE second precisely because it is the last barrier rather than the first.

PPE under this standard is specialised clothing or equipment worn for protection against a hazard. Paragraph (b) is explicit that ordinary work clothes — uniforms, pants, shirts — are not PPE. The employer provides PPE at no cost to the employee, in appropriate sizes, readily accessible at the worksite or issued to you, and provides hypoallergenic gloves, glove liners or powderless gloves to employees allergic to the ones normally supplied. The employer also cleans, launders, disposes of, repairs and replaces it, all at no cost.

What makes PPE "appropriate" is a performance test rather than a category: paragraph (d)(3)(i) says it counts as appropriate only if it does not permit blood or OPIM to pass through to your work clothes, street clothes, undergarments, skin, eyes, mouth or other mucous membranes under normal conditions of use, for the length of time it will be used. That sentence is the whole basis for selection. You are choosing against a route and a duration, not filling a category.

Gloves: worn whenever you can reasonably anticipate hand contact with blood, OPIM, mucous membranes or non-intact skin, when performing vascular access procedures, and when handling or touching contaminated items or surfaces. Single-use gloves are replaced as soon as practical when contaminated, or as soon as feasible when torn, punctured or otherwise no longer a barrier, and they are never washed or decontaminated for re-use. Utility gloves may be decontaminated and re-used unless they are cracked, peeling, torn, punctured or deteriorating.

Face and body: masks combined with eye protection — goggles, glasses with solid side shields, or a chin-length face shield — whenever splashes, spray, spatter or droplets may be generated and contamination of eye, nose or mouth can be reasonably anticipated. Gowns, aprons, lab coats or similar, with the type chosen for the task and the degree of exposure expected. Surgical caps or hoods and shoe covers or boots where gross contamination can reasonably be anticipated.

Removal is where PPE most often fails, and the standard is specific: if a garment is penetrated by blood or OPIM it comes off immediately or as soon as feasible; all PPE is removed before leaving the work area; and when removed it goes in a designated area or container for storage, washing, decontamination or disposal. Then hands are washed. The order matters — every one of those clauses describes a way contamination gets carried out of the room on somebody.

One narrow exception exists and is worth knowing because it is often misquoted: paragraph (d)(3)(ix)(D) allows an employer in a VOLUNTEER BLOOD DONATION CENTRE to judge that routine gloving for all phlebotomies is not necessary — and even then it must re-evaluate that policy periodically, make gloves available, not discourage their use, and require them where the employee has broken skin, where hand contamination may occur, or where the employee is being trained in phlebotomy. It is not a general permission to draw blood without gloves.

It costs you nothing. Paragraph (f)(1)(ii) requires the hepatitis B vaccine and the vaccination series to be made available at no cost to the employee, at a reasonable time and place, performed by or under the supervision of a licensed physician or other licensed healthcare professional, and provided according to current U.S. Public Health Service recommendations. Any laboratory tests are done by an accredited laboratory, also at no cost.

Timing: the vaccine is made available AFTER you have had the training required by (g)(2)(vii)(I) — this module — and within 10 working days of initial assignment, unless you have already had the complete series, antibody testing has shown you are immune, or it is contraindicated for you medically. The employer cannot require you to be pre-screened for antibodies as a condition of getting it.

Declining, and changing your mind: if you decline, you sign the declination statement in Appendix A of the standard, and paragraph (f)(2)(iii) says that if you later decide you want the vaccination while still covered by the standard, the employer must make it available then. Declining once does not close the door.

About the vaccine itself, from CDC: it is a series of two or three shots depending on the brand — a three-shot series given over six months, or a two-dose one about a month apart — and you need all the doses to be fully protected. CDC states the vaccine is safe and effective and gives long-term protection against illness from acute and chronic infection, that most healthy people do not need a booster dose, that it is safe in pregnancy, and that soreness at the injection site is the most common side effect. If a routine booster is recommended by the U.S. Public Health Service in future, paragraph (f)(2)(v) requires the employer to make that available too.

This course does not give medical advice and cannot tell you whether the vaccine is right for you. That conversation belongs with the licensed healthcare professional your employer sends you to, which is exactly the person the standard puts in the loop.

An exposure incident has a definition, and it is narrower than "something went wrong": paragraph (b) defines it as specific eye, mouth, other mucous membrane, non-intact skin, or parenteral contact with blood or OPIM resulting from the performance of your duties. A splash on an intact forearm is not one. A splash in an eye is.

First, the immediate actions. The standard requires washing hands and any other skin with soap and running water, or flushing mucous membranes with water, immediately or as soon as feasible after contact (paragraph (d)(2)(vi)). Then report it — to the person your workplace names in its exposure control plan, which is usually a supervisor, an occupational health office or an infection control officer. Your employer must have told you who that is; if you do not know the name, that is a question to ask before you need the answer, and this module is the moment to go and find it out.

Reporting is what starts the clock on everything the employer owes you. Paragraph (f)(3) says that following a report, the employer must make immediately available a confidential medical evaluation and follow-up that includes, at minimum: documentation of the route of exposure and the circumstances; identification and documentation of the source individual unless that is infeasible or prohibited by law; testing of the source individual's blood for HBV and HIV infectivity as soon as feasible after consent, with the results made available to you; collection and testing of your own blood for HBV and HIV serological status after your consent; post-exposure prophylaxis when medically indicated, as recommended by the U.S. Public Health Service; counselling; and evaluation of reported illnesses.

Two details in that paragraph protect you specifically. If you consent to a baseline blood draw but do not want HIV testing at that moment, paragraph (f)(3)(iii)(B) requires the sample to be preserved for at least 90 days, and if you decide within those 90 days that you want it tested, it is tested as soon as feasible. And the healthcare professional's written opinion that your employer receives is limited by paragraph (f)(5)(ii) to two things: that you were informed of the results, and that you were told about any condition resulting from the exposure that needs further evaluation or treatment. All other findings and diagnoses stay confidential and are not in that report. Your employer does not learn your test results.

You must be given a copy of that written opinion within 15 days of the evaluation being completed (paragraph (f)(5)). The evaluation, testing, prophylaxis and follow-up are all at no cost to you.

The reason to report an incident you think is minor: the timing of post-exposure prophylaxis matters clinically, the baseline draw only means something if it happens near the event, and an unreported exposure leaves you with no record when it matters later. The standard also requires most employers to keep a sharps injury log — a needlestick that nobody reports is one that never gets designed out of the job.

Warning labels go on containers of regulated waste, on refrigerators and freezers holding blood or OPIM, and on other containers used to store, transport or ship them. Paragraph (g)(1)(i)(C) fixes the appearance: labels are fluorescent orange or orange-red, or predominantly so, with lettering and symbols in a contrasting colour, and they carry the biohazard legend. They are affixed by string, wire, adhesive or another method that stops them being lost or removed by accident. Red bags or red containers may be substituted for labels — which is why, in most workplaces, colour is the signal you actually see.

The exemptions are narrow and worth knowing so that an unlabelled container does not read as safe. Containers of blood or blood components that are labelled as to their contents and have been released for transfusion or other clinical use are exempt; individual containers placed inside a labelled container during storage, transport, shipment or disposal are exempt; and where a facility applies universal precautions to all specimens, specimen containers need not be labelled while they stay inside the facility — but must be labelled or colour-coded when they leave it. Signs, with the same colour rule, mark the entrance to HIV and HBV research laboratories and production facilities.

Regulated waste is a defined term, not a synonym for anything bloody: liquid or semi-liquid blood or OPIM; contaminated items that would release blood or OPIM in a liquid or semi-liquid state if compressed; items caked with dried blood or OPIM and capable of releasing it during handling; contaminated sharps; and pathological and microbiological wastes containing blood or OPIM. A lightly soiled dressing that will not release anything is not regulated waste under this definition, though your employer's policy may still route it that way.

Sharps containers are closable, puncture resistant, leakproof on sides and bottom, and labelled or colour-coded. In use they are easily accessible and as close as feasible to where sharps are used, kept upright, and replaced routinely rather than allowed to overfill. They are closed before being moved, and a second container is used if leakage is possible. Reusable containers are never opened, emptied or cleaned in any way that would expose someone to a puncture — the phrase in paragraph (d)(4)(ii)(E) is that reusable sharps must not be stored or processed so as to require reaching by hand into the container.

Two housekeeping rules complete the picture. Contaminated work surfaces are decontaminated with an appropriate disinfectant after procedures, immediately when overtly contaminated or after a spill, and at the end of a shift if the surface may have been contaminated since the last cleaning. And broken glassware that may be contaminated is never picked up directly with the hands — it is cleaned up mechanically, with a brush and dust pan, tongs or forceps.

The training element list in paragraph (g)(2)(vii) ends with (N): "An opportunity for interactive questions and answers with the person conducting the training session." A written course is not an opportunity to ask a person questions, and no honest reading of that paragraph turns it into one. Paragraph (g)(2)(viii) adds that the person conducting the training must be knowledgeable in the subject matter as it relates to the workplace the training will address — your building, your tasks, your exposure control plan.

So this course covers (A) through (M). Closing (N) takes a short exchange with someone at your workplace who knows the subject and the place: your supervisor, infection control officer, occupational health nurse or safety officer. Ten minutes with your questions written down is enough, and the module list above is a workable agenda for it. The certificate this course issues has a line for that session to be recorded, rather than quietly implying it already happened.

The second thing your employer owes is a record, and it is a specific one. Paragraph (h)(2)(i) requires the training record to include the dates of the training sessions, the contents or a summary of them, the names and qualifications of the persons conducting the training, and the names and job titles of everyone who attended. Paragraph (h)(2)(ii) requires those records to be kept for three years from the date the training occurred, and (h)(3)(ii) entitles you and your representative to see and copy them on request.

The certificate issued at the end of this course prints those four fields, filled in for the part this course provided, so that your employer can file it as it stands and add the session that closes (N). That is the whole design of this product: not a decoration, a record with the fields the standard names.

And the timing. Paragraph (g)(2)(ii) requires training at the time of initial assignment to tasks where occupational exposure may take place, and at least annually thereafter; paragraph (g)(2)(iv) says annual training is provided within one year of the previous training. Paragraph (g)(2)(v) requires additional training when tasks or procedures change in a way that affects your exposure, and that additional training may be limited to the new exposures. Your certificate is dated for that reason, and it prints the date a year on.

HIPAA protects a defined category of information, and the definition is worth reading slowly because most mistakes at work are mistakes about its edges. Individually identifiable health information, defined at 45 CFR 160.103, is health information — including demographic information collected from a person — that is created or received by a health care provider, health plan, employer or health care clearinghouse; relates to a person's past, present or future physical or mental health, to the health care provided to them, or to payment for that care; AND either identifies the person or gives a reasonable basis to believe they could be identified from it.

Protected health information (PHI) is that information in any form: transmitted electronically, held electronically, or in any other form or medium. Paper, a screen, a whiteboard, a conversation. The rule does not have a paper exemption.

Notice what makes information identifiable. It is not only a name. "A reasonable basis to believe the information can be used to identify the individual" catches the room number, the rare diagnosis in a small town, the appointment time posted on a shared calendar, the photograph with a wristband in it. This is the single most useful sentence in HIPAA training, because it converts a rule about records into a rule about how you talk in a corridor.

PHI has four listed exclusions: education records covered by FERPA, certain treatment records described in the same statute, EMPLOYMENT RECORDS held by a covered entity in its role as employer, and information about a person who has been dead more than 50 years. The employment-records exclusion surprises people: your own occupational health file, held by your employer as your employer, is not PHI under HIPAA — which does not mean it is unprotected, only that a different law protects it.

Who is bound. Covered entities are health plans, health care clearinghouses and health care providers who transmit health information electronically in connection with covered transactions. Business associates are people and organisations that create, receive, maintain or transmit PHI on a covered entity's behalf — the billing company, the shredding service, the software vendor, and a business associate's own subcontractors. If you work for a business associate, most of these rules reach you directly.

And you. "Workforce" is defined at 160.103 as employees, volunteers, trainees and other persons whose conduct in performing work for a covered entity or business associate is under its direct control, whether or not they are paid. A student on placement and an unpaid volunteer are workforce. The training requirement in 164.530(b)(1) is about "all members of its workforce", which is why a placement student is asked for this certificate at all.

The general rule at 45 CFR 164.502(a) is a prohibition with exceptions: a covered entity or business associate may not use or disclose protected health information except as permitted or required by the Privacy Rule. The default is no. Everything you do lawfully with PHI sits inside a listed permission.

The permissions that cover ordinary work: to the individual themselves; for treatment, payment or health care operations under 164.506; incidental to another permitted use, provided the minimum necessary and safeguard requirements have been met; and under an authorisation the individual has signed. Treatment, payment and operations — TPO — is the one that covers most of a clinical day, and 164.506(a) permits it without a signed authorisation, subject to the rest of the subpart.

Then the standard that does most of the real work: minimum necessary, at 164.502(b). When using or disclosing PHI, or requesting it from another covered entity or business associate, you must make reasonable efforts to limit it to the minimum necessary to accomplish the intended purpose. In practice this is a rule about scope: the whole chart when the question is one lab value, the whole department on an email thread when the question concerns one nurse, a full record faxed when a date of birth was asked for.

Minimum necessary has listed exceptions, and knowing them stops the rule being applied where it does harm. It does not apply to disclosures to or requests by a health care provider FOR TREATMENT; to uses or disclosures made to the individual; to uses or disclosures made under an authorisation; to disclosures to the Secretary for enforcement; or to uses and disclosures required by law. The treatment exception exists so that nobody withholds clinically relevant history from the clinician in front of the patient.

The practical translation of this module: before you look, ask whether this record is yours to look at for a job you are actually doing. Curiosity is not a permitted purpose, and access logs are the most commonly cited evidence in enforcement actions about workforce members. A relative, a colleague, a neighbour, a public figure — the rule is the same and the audit trail is the same.

The right of access, at 45 CFR 164.524(a)(1), lets a person inspect and obtain a copy of PHI about them in a designated record set, for as long as it is kept, with two carve-outs: psychotherapy notes, and information compiled in reasonable anticipation of a legal proceeding.

It comes with a clock. Under 164.524(b)(2)(i) the covered entity must act on a request no later than 30 days after receiving it — granting it and providing access, or denying it in writing. One extension of up to 30 more days is allowed, and only one, and it requires a written statement of the reason and the date by which the entity will act.

Format matters too: access must be given in the form and format the individual asks for if it is readily producible; if the record is held electronically and an electronic copy is requested, an electronic copy is what must be provided. If the individual asks in writing, signed, for the copy to go directly to a person they name, it goes to that person. A fee may be charged, but 164.524(c)(4) limits it to a reasonable cost-based fee covering labour for copying, supplies, postage where the copy is mailed, and preparing an agreed summary or explanation.

Two more rights complete the set most workforce members meet. Section 164.526 gives the individual the right to request an amendment to PHI in a designated record set — a request the entity may accept or deny on stated grounds, but must answer. Section 164.528 gives the right to an accounting of certain disclosures — a list of where their information went outside the routine permissions.

What this means at your level: you are usually not the person who fulfils these requests, and you are almost always the person who first hears one. "How do I get my records?" is a request the moment it is said to somebody in the workforce, and a 30-day clock does not pause because it was said to the wrong person. The right response is to route it, immediately, to whoever your workplace names — and that name is in the policies your employer trains you on, not in this course.

The Privacy Rule's safeguard standard, 45 CFR 164.530(c), requires appropriate administrative, technical and physical safeguards to protect the privacy of PHI — and specifically that a covered entity reasonably safeguard PHI from any intentional or unintentional use or disclosure in violation of the rule, and reasonably safeguard it to limit incidental disclosures made in the course of something otherwise permitted.

That word incidental is the reason this module exists. The rule accepts that a conversation at a bedside can be overheard; it does not accept that nothing was done about it. Lowering your voice, closing a curtain, turning a monitor, covering a chart, not reading a name aloud in a full waiting room — these are the safeguards the standard means, and they are the whole of most people's daily HIPAA compliance.

The Security Rule adds a training standard of its own for electronic PHI. Section 164.308(a)(5)(i) requires a security awareness and training programme for all members of the workforce, including management, with four addressable implementation specifications: periodic security reminders; procedures for guarding against, detecting and reporting malicious software; log-in monitoring, meaning procedures for monitoring log-in attempts and reporting discrepancies; and password management — procedures for creating, changing and safeguarding passwords.

Read that list as a job description rather than a policy list. Reporting discrepancies means telling somebody when a log-in attempt you did not make shows up. Password management includes not sharing a log-in, which is also the single fastest way to make an audit trail meaningless — the log shows who was signed in, not who was typing.

Section 164.308(a)(6)(ii) requires the entity to identify and respond to suspected or known security incidents, mitigate their harmful effects so far as practicable, and document them. Note "suspected". The obligation starts before anybody is sure, which is why the honest response to "I think I sent that to the wrong address" is to say so within the minute rather than to check first.

A breach is defined at 45 CFR 164.402 as the acquisition, access, use or disclosure of protected health information in a manner not permitted by the Privacy Rule which compromises the security or privacy of that information.

The definition then excludes three things, and the exclusions are as important as the rule because they describe honest mistakes made inside the system. First: unintentional acquisition, access or use by a workforce member or a person acting under the covered entity's or business associate's authority, if it was in good faith, within the scope of authority, and does not lead to further impermissible use or disclosure. Second: inadvertent disclosure by one authorised person to another authorised person at the same entity or organised health care arrangement, where the information is not further used or disclosed impermissibly. Third — the remainder of the definition — a disclosure where the entity has a good faith belief the unauthorised recipient could not reasonably have retained the information.

What those exclusions have in common is containment. The mistake stops with the person who made it. That is the difference between an incident that is not a breach and one that is, and it is decided largely by what happens in the minutes after — which is the argument for reporting immediately rather than quietly fixing it.

The clock. Under 164.404(a)(1) a covered entity must notify each affected individual following discovery of a breach of unsecured PHI, and 164.404(b) sets the outer limit: without unreasonable delay and in no case later than 60 calendar days after discovery. Discovery is defined broadly at 164.404(a)(2) — a breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to any workforce member or agent other than the person who committed it.

Read that last sentence again from your own position. The moment YOU know, the entity is treated as knowing. A breach sat on for a fortnight because somebody hoped it would not matter has spent a quarter of the notification period, and the person who knew is the reason the clock started.

What to do is short: report it to the privacy officer or the person your workplace names, immediately, in whatever form gets there fastest, and write down what you did and when. You are not the person who decides whether it is a breach. You are the person whose report makes that decision possible.

The training requirement is 45 CFR 164.530(b)(1), and here it is in full: "A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity."

On the policies and procedures. The rule requires training on a document your employer wrote — its privacy policies, its designated record set, the name of its privacy official, its complaint process, its sanctions policy. No course sold to the public has seen that document. What you have just read is the shared half: the vocabulary, the permissions, the rights, the breach clock. It is what makes the employer-specific session short and useful instead of being the entire training.

The timing the rule sets: training for each workforce member by the compliance date; for each new member within a reasonable period after they join; and for each member whose functions are affected by a material change to the policies, within a reasonable time after the change takes effect (164.530(b)(2)(i)).

The record: under 164.530(b)(2)(ii) the covered entity must document that the training was provided, and under 164.530(j)(2) that documentation is retained for six years from the date it was created or the date it was last in effect, whichever is later. The certificate this course issues carries the date, the content summary and the holder's name for exactly that file, with a line for the employer-specific session to be added beside it.

One last thing, said plainly because the market it sits in mostly does not say it: HIPAA does not certify people. There is no federal HIPAA certification, no register of certified individuals, and no accreditation behind any HIPAA certificate anybody sells you — including this one. What a certificate is, and all it is, is a dated record that training content was delivered and understood. Anyone selling you the other thing is selling something that does not exist.