HIPAA Training Level Guide & Course List

HIPAA training has moved to LawRoom

To register for any of the HIPAA training listed below, please send a request to hipaatraining@stanford.edu.

HIPAA Certification for Workforce Members Who Do Not Work With PHI

This course is the appropriate level for workforce members who do NOT access, use, maintain, disclose or otherwise interact with Protected Health Information (PHI)* to accomplish tasks in their current job duties. Examples: Animal Care Workers, Administrative Associates with no access to patient or research subject PHI, Custodians, Lab Glassware Washers, ITS/AS employees with no direct access to PHI, and those members of the Office of the General Counsel, Risk Management and Human Resources who do not use, access or disclose PHI. (Please note: health information contained in employee and student records is NOT considered to be PHI.) If an individual can answer "true" to both of the following questions, then this course is the appropriate level of training, otherwise a higher level of training is required:

  • In my role, I would never be expected to interact with patients or human research subjects;

  • In my role, I would never be expected to see, access, or use patients' or human research subjects' data.

HIPAA Certification - Basics

This course is for workforce members who access, use, maintain, disclose or otherwise interact with PHI in a very structured manner. Usually, these workforce members will not have any direct contact with patients and/or research participants, or if they do, it is in a very limited or highly-supervised setting. This program is for people who are not supervising or managing others that work with PHI. Examples: Administrative Associates to a clinician, Data Aides or Research Coordinators assisting in research, Research Post Docs, Admin Services Administrators, Accounting Associates, Visiting Students/Scholars, Undergraduate and Graduate Students (in those situations where students have access to PHI), ITS/AS system administrators of a system containing PHI.

HIPAA Certification - Comprehensive

This course is for workforce members who in the regular course of their work or education, access, use, maintain, disclose or otherwise interact with PHI and who make independent decisions about their interactions with PHI. Usually, these workforce members will have direct and frequent contact with patients and/or research participants. In addition, this program is for people who supervise others who access, use, maintain, disclose or otherwise interact with PHI. Examples: Billing Personnel, Clinical Faculty, Medical Students, Residents, Billing Managers.

HIPAA Certification for Clinical Researchers

This course is required for workforce members who design and/or manage research protocols involving PHI. Examples: Principal Investigators, Study Designers, Study Coordinators, Research Associates.

* Definition of Protected Health Information (PHI):

For the purposes of this guide, PHI means any information in an individual's medical record or designated record set that was created, used, or disclosed in the course of providing a health care service such as treatment, payment or healthcare operations. PHI is anything that can be used to identify an individual such as private information, facial images, fingerprints, and voiceprints. These can be associated with medical records, biological specimens, biometrics, data sets, as well as direct identifiers of the research subjects in clinical trials.