Workforce Training and Organizational Privacy Support
Public safety agencies need clear responsibilities for requesting, receiving, and using health information. Staff training should connect with the organization’s approved procedures, access controls, and contacts for difficult decisions.
Supremus Group offers awareness training for personnel who encounter medical information during investigations, emergency response, custody, and related duties. Separate professional training, policy resources, and security services are available for organizations that need support with applicable HIPAA responsibilities.
The starting point is understanding the work your organization performs and the responsibilities assigned to each team.
Audience:
This page is intended for agency leaders, training coordinators, supervisors, and personnel whose work involves health information. Relevant assignments include investigations, emergency response, communications, custody, records management, and coordination with healthcare providers.
Organizations and Teams
Examples include police and sheriff’s departments, EMS and fire services, detention facilities, public safety communications centers, emergency management offices, and school or campus safety units.
Training needs should reflect each employee’s duties and the information they are authorized to handle.
Where HIPAA Fits Within Your Organization
Receiving information from a hospital does not, by itself, make a police agency a HIPAA covered entity. Some public safety organizations also provide healthcare services that may fall within HIPAA’s scope.
Consider the functions involved:
- Investigative work: Requests need an appropriate basis, a defined purpose, and attention to any restrictions that accompany the information.
- Covered healthcare functions: Qualifying EMS or other healthcare activities must address the HIPAA requirements that apply to them.
- Services performed for a covered healthcare organization: Certain services involving protected health information may create business associate responsibilities and require appropriate agreements.
Organizations should identify these responsibilities before selecting training, adopting policies, or assigning access. Information should follow the approved process even when different teams belong to the same agency.
Give personnel a shared foundation for handling medical information within their assigned responsibilities. This course addresses the decisions that arise when staff request records, coordinate care or transport, communicate safety information, and manage information already received.
The lessons use fictional situations to examine authority, recipient needs, disclosure limits, and appropriate escalation. The course also covers digital records, recordings, AI tools, and information subject to additional confidentiality protections.
Course Overview
- Training format: Online, self-paced learning.
- Course material: 112 slides.
- Course organization: Six modules.
- Course duration: 2 hours 12 minutes.
- Practice activities: 19 fictional cases, including a final integrated case, with reflection pauses and debriefs.
- Assessment: Separate course assessment.
- Exam attempts: Unlimited.
- Completion record: Certificate of Achievement after successful completion of the course requirements.
- Certificate validity: Two years from course completion.
Course Outline
Module 1: Foundations and Roles
Identify the source of information and the responsibilities of the people handling it. Review HIPAA coverage, family involvement, personal representatives, and the five checks: source, purpose, authority, scope, and safeguards.
Module 2: Medical Information Requests
Examine identity verification, authorizations, minimum necessary requirements and exceptions, court orders, court-ordered warrants, subpoenas, and administrative requests. Review directory inquiries, identification requests, crime-victim information, and required reports.
Module 3: Emergencies and Investigations
Consider disclosures involving threats, abuse, suspicious deaths, incidents on healthcare premises, and responder exposure. Review behavioral health information, psychotherapy notes, and the difference between releasing existing results and collecting new biological samples.
Module 4: Custody and Handoffs
Match information to treatment, transport, and custody responsibilities. Review receiving contacts, destination changes, handoff confirmation, and requests for later records after lawful custody ends.
Module 5: Responsible Information Handling
Examine dispatch entries, vendors, business associate relationships, recordings, reports, and public release. Address approved AI use, output accuracy, incident reporting, evidence preservation, accountability, and retention.
Module 6: Additional Protections and Review
Recognize additional protections under Part 2, FERPA, and state confidentiality laws. Review restrictions on using Part 2 records in proceedings against a patient, the use of locally completed and approved guidance, and a final integrated case.
Putting the Training into Agency Practice
Organizations can connect the course to daily responsibilities by:
- Identifying employees whose duties involve medical information requests, receipt, or further sharing.
- Giving learners access to the agency’s approved procedures and relevant local guidance.
- Naming the primary and backup contacts for urgent requests, privacy questions, and suspected incidents.
- Using questions raised during the case exercises to identify procedures that need clarification.
- Recording course completion and identifying further instruction needed for particular assignments.
Supervisors should ensure that staff know where to find current instructions when a situation requires review.
Policy Resources for Applicable HIPAA Responsibilities
For organizations with applicable HIPAA obligations, policy templates can provide a starting point for documenting responsibilities and procedures. The documents should be reviewed and adapted to the organization’s functions, systems, workforce roles, and legal requirements.
Implementation includes approving the policies, putting the procedures into practice, and reviewing whether staff follow them.
A Local Guide for Information Decisions
General training works best when employees can locate approved instructions for their own organization.
A locally reviewed guide should identify:
- The request forms and supporting documents staff should use.
- The people authorized to review routine and urgent questions.
- Approved systems for receiving and transmitting information.
- Contacts and confirmation steps for transfers between facilities.
- Restrictions that must remain with sensitive records.
- Incident-reporting routes and instructions for preserving relevant evidence.
The organization should approve the guide, assign responsibility for maintaining it, and make the current version available to staff.
Security Assessments and Ransomware Preparation
Security assessments help organizations identify weaknesses and prioritize corrective work within an agreed scope. Appropriate safeguards may include access controls, monitoring, software maintenance, tested backups, and incident-response planning.
Ransomware preparation should address prevention, detection, containment, and recovery. Where electronic protected health information is involved, the organization must also consider its applicable HIPAA responsibilities.
Assessment findings should inform practical decisions about safeguards, responsibilities, and follow-up work. Organizations should review their security arrangements as systems, services, and risks change.
Remediation and Ongoing Review
Remediation turns assessment findings into assigned actions, priorities, and target dates. Organizations should document the work completed and evaluate whether the changes address the identified risks.
Reviews may include interviews, examination of records, observation of work practices, and technical testing. Findings should guide further improvements and continued evaluation as operations change.
The review process should connect documented procedures with actual work practices and identify where additional action, resources, or staff guidance are needed.
Law Enforcement and Public Safety Course Features
- Visual comparisons clarify the different responsibilities of healthcare staff, investigators, dispatch personnel, and transport teams.
- Fictional cases give learners time to consider decisions before reviewing the explanations.
- Lessons connect initial information requests with later handling, sharing, and public-release questions.
- Local-procedure prompts help personnel identify the forms, systems, and contacts they should use.
- The self-paced awareness course has a stated duration of 2 hours 12 minutes.
- Unlimited exam attempts give employees the opportunity to review the material and attempt the assessment again.
- Successful completion of the course requirements provides a downloadable Certificate of Achievement.
Expert-Level Professional Certification Courses
CERTIFIED HIPAA PRIVACY SECURITY EXPERT (CHPSE)
To avoid civil money penalties and criminal penalties related to non-compliance with HIPAA and other associated acts, it is essential to have a comprehensive understanding of these acts. With CHPSE, advanced training in the areas of HIPAA Security rule & Privacy rule is imparted. This type of training is critical for compliance officers, consultants, and business associates who work in the healthcare industry.
CERTIFIED HIPAA SECURITY EXPERT (CHSE)
CHSE allows trained individuals to seamlessly implement the HIPAA’s Security rule in their organizations and protect the important health information of their clients. This training also includes elementary knowledge of the Privacy rule so that all the important bases are covered with respect to HIPAA compliance.
CERTIFIED HIPAA PRIVACY EXPERT (CHPE)
This certification is essential to have in-depth compliance knowledge of the HIPAA’s Privacy rule; through this training, you will also get a good understanding of the Security rule as well. CHPE training ensures that your employees are well-versed with the various aspects of the complex Privacy rule.
CERTIFIED HIPAA PRIVACY ASSOCIATE (CHPA)
This is an entry-level certification that provides a basic understanding of HIPAA. CHPA training is targeted towards those individuals (new employees, students, etc.) who are only required to have a fundamental knowledge of HIPAA and not advanced. CHPA Course & exam are now available in Spanish also.
Other Company Versions
Frequently Asked Questions
Works on PCs, Macs, iPads, iPhones, 
Android Tablets, Android Phones,and
more
Complete your training online on any device, anywhere,
anytime 24 x 7.
USER RATING:
Law Enforcement & Public Safety Professionals HIPAA Awareness course is rated 4.9 out of 5 by 42 users.