Before you get access to any system, there's one thing to finish: HIPAA privacy and security training. Read it once, carefully. You'll be tested on it, and everything in it is something you'll use in your first week.
Your name and today's date carry through to the attestation at the end.
Enter your first name, last name, and date before checking your score.
You are being trained because federal law requires it, and because you will handle information that can seriously harm people if it is mishandled.
HIPAA protects patient health information. Two rules matter to you: the Privacy Rule, which governs who may see and share health information, and the Security Rule, which governs how electronic health information is protected. Training is required by 45 C.F.R. § 164.530(b) and § 164.308(a)(5), before you receive access to any system and every year after.
The practical reason matters more than the legal one. A patient whose information is mishandled loses trust in their care. Some stop seeking treatment. Some are harmed by disclosure to an employer, a family member, or an ex-partner. These rules exist because those outcomes are real.
You are a workforce member of AMS. Under 45 C.F.R. § 160.103, workforce means employees, contractors, volunteers, and anyone else whose work for AMS is under AMS's direct control, whether or not they are paid as employees.
If you are paid as a 1099 independent contractor, you are still a workforce member. Your tax classification has nothing to do with your HIPAA obligations. Every rule here applies to you exactly as it applies to a W-2 employee.
AMS provides non-clinical management and administrative services to treating medical practices. AMS does not practice medicine. The practices own the patient records and make all clinical decisions.
Because AMS handles patient information on their behalf, AMS is a business associate. AMS has signed agreements with each practice promising to protect their patients' information. When you follow these rules, you are keeping promises AMS made on your behalf.
PHI is health information that identifies someone, or could reasonably be used to identify them. Health information includes past, present, or future health conditions, care provided, and payment for care.
Health information combined with any one of these identifiers is PHI:
A phone number in GHL belonging to someone who contacted a medical practice is PHI. The fact that a person is a patient, or is asking about becoming one, is itself health information. You do not need to see a diagnosis for something to be protected.
You may access, use, and share only the smallest amount of PHI needed for the task in front of you.
Correct. A patient asks about their appointment. You open the record, confirm the appointment, close it.
Violation. Same patient, same question. While you are in the record you read their medication list because you were curious. Nothing about that was necessary. That is a violation even though you were authorized to open the record.
The rule also governs sharing. When you escalate to clinical staff, include what they need to act, not the entire history.
This is the most common cause of HIPAA terminations across the industry, and the fastest way to lose your position at AMS.
Your own record. A spouse, partner, parent, child, or any family member. A friend, neighbor, or acquaintance. A coworker. A public figure. Anyone you recognize. Anyone whose record you have no assigned reason to open.
This applies even if the person gives you permission. Their consent does not create a business need and does not authorize the access. To get your own records, request them the way any patient would.
Every access is logged with your name, the record, and the timestamp. Snooping is not caught by suspicion. It is caught by log review, and it is unambiguous when found.
Slack is for internal coordination only. Never a patient name, phone number, or detail, in a channel or a DM. Your personal phone or text messages. Personal email. WhatsApp, Messenger, Instagram, or any personal messaging app. Dropbox, iCloud, personal Google Drive. Anything not on the approved list.
Do not forward, copy, screenshot, photograph, print, export, or download PHI to any personal device or account.
Taking a screenshot to ask a quick question or remember something later puts PHI in your phone's photo roll, which is almost always syncing to a personal cloud account. That is an unauthorized disclosure and may be a reportable breach. If you need to share something internally, share it inside the approved system.
Do not enter PHI or patient details into ChatGPT, Claude, Gemini, Copilot, or any AI assistant, chatbot, transcription service, note-taking app, or browser extension that has not been approved in writing by the Privacy Officer.
This applies even when you are only asking for help wording a reply. Once patient information goes into an unapproved tool, AMS has disclosed it to a company with no agreement to protect it. That is a violation regardless of your intent.
You may use AI tools for general work such as drafting non-patient content or learning a process, as long as no patient information goes into them.
Your device must have full-disk encryption, automatic screen lock, current operating system updates, active security software, and multi-factor authentication on every AMS account.
Never work on a shared or family computer, let anyone else use your login, use AMS systems on open public Wi-Fi, leave your screen visible to others, or leave a device unattended in public or in a car.
Working from home: position your screen so household members cannot read it, use headphones for calls involving patients, and lock your screen every time you step away, even briefly.
Passwords must be unique to AMS, never reused from personal accounts, never shared, never written where others can see. Change immediately if you suspect compromise.
Report any of the following within 24 hours:
Linda Rhodes, Privacy Officer
[email protected] · 941-354-5544
Do not try to fix, delete, undo, or investigate it yourself. Preserve everything and report.
Report your own mistakes. Prompt self-reporting is treated as a mitigating factor. Hiding a mistake is treated as an aggravating factor and is far more likely to end your engagement than the mistake itself.
Patients have legal rights regarding their information: to see it, get a copy, request corrections, request restrictions, and receive an accounting of disclosures. You do not handle these requests.
Forward to the Privacy Officer the same business day: any request to see, copy, or correct records; any privacy complaint; any request from an attorney, law enforcement, a government agency, or the media; any request from a family member for another person's information.
These carry legal deadlines. Delay creates liability.
AMS applies a written Workforce Sanctions Policy with three levels.
Level 1, unintentional. An honest mistake, promptly reported. Counseling and retraining.
Level 2, careless or repeated. Sharing a password, using personal channels for PHI, failing to report on time. Written warning, access restriction, suspension.
Level 3, intentional or reckless. Snooping, disclosing information, using PHI for personal purposes, concealing a violation. Immediate termination and possible referral to authorities.
Beyond AMS sanctions, HIPAA carries civil penalties tiered by culpability, with amounts adjusted annually. Criminal penalties under 42 U.S.C. § 1320d-6 reach up to one year imprisonment for knowing misuse, five years where false pretenses are involved, and ten years where information is used for personal gain or malicious harm.
You will never be retaliated against for reporting a concern in good faith, or for contacting the HHS Office for Civil Rights.
A patient texts your personal cell because they found your number online.
Do not respond from your personal phone. Move the conversation into GHL and reply there. Tell the Privacy Officer.
Your sister mentions she is a patient and asks you to check whether her results are back.
Refuse. Her permission does not authorize your access. Tell her to log into her portal or call the practice.
You send an appointment reminder and immediately realize it went to the wrong contact.
Report within 24 hours. Do not delete anything. This may be a reportable breach and the Privacy Officer decides that.
A caller says they are from a pharmacy and needs a patient's date of birth to complete a fill.
Verify before disclosing. If anything feels off, escalate. Pretexting calls are common.
A patient's message is confusing and you want AI help drafting a reply.
Do not paste it into any AI tool. Ask a colleague inside the approved system.
You notice a coworker's name in the patient list.
Do not open it. Do not mention it to them. If it was assigned to you in error, tell the Privacy Officer.
A patient describes symptoms and asks if they should be worried.
Do not answer. You are non-clinical. Escalate immediately to clinical staff.
Your laptop is stolen from your car with AMS systems open in the browser.
Report immediately so credentials can be revoked and sessions terminated.
Twenty questions. You need 16 correct to pass. Answer every question, then check your score.
Review the details below, then submit your attestation. Your access is provisioned once it's on file.
By submitting, you confirm you completed this training and understood it; that you may access only the minimum information your work requires; that you may never access records of yourself, family, friends, or coworkers; that patient information may exist only in HealthAide, GHL, and the AMSDoc Google Drive, and never in Slack, personal channels, screenshots, or unapproved AI tools; that your access is logged and audited; and that you must report any suspected incident within 24 hours. Violations are subject to the AMS Workforce Sanctions Policy up to immediate termination.