Mendrix Medical Associates · Mendrix Care Solutions

HIPAA Privacy & Security Training

Work through the 12 modules, then take the 35-question competency test. Passing requires at least 32/35 and every critical question correct.

The three non-negotiable rules

1
Only access PHI for a documented job-related purpose and through approved, role-limited accounts.
2
Verify the patient, recipient and purpose before every access, communication or transfer.
3
Report mistakes and suspicious activity immediately; never hide or self-investigate.

Objective: Define PHI and ePHI; distinguish covered entity, business associate, workforce member, and patient.

PHI includes identifiable information about health, healthcare, or payment in any form (paper, verbal, electronic); a name next to an appointment, patient room number linked to treatment, or billing account may be PHI.
Mendrix Medical Associates is a medical-practice organization; Mendrix Care Solutions provides management/support services. Whether a particular Mendrix Care Solutions function is a business-associate service and what access is allowed must be established by legal structure, agreements, and delegated duties—not assumed from common leadership.
You are permitted to access only records needed for assigned work in a specifically authorized Mendrix Medical Associates/Mendrix Care Solutions role. A valid login is not blanket permission.
Three HIPAA themes: Privacy Rule (permitted use/disclosure and patient rights); Security Rule (administrative, physical, technical ePHI safeguards); Breach Notification Rule (escalation/notification obligations).
Never discuss patient details out of curiosity, even if you personally know the patient or the person is a colleague.

Start: private workspace; approved device, MFA and assigned task queue; check correct entity.
Before record: business need, right patient, minimal data and authorized access.
Before send/call/fax: verify identity, permission, destination, attachment and secure channel.
After task: document accurately, secure documents, lock screen and close records.
On any concern: report immediately, preserve evidence and follow Privacy Officer direction.

• I will access only information needed for authorized duties and never use another person’s credentials.
• I will protect oral, paper and electronic PHI, follow identity-verification procedures, and use only approved devices, tools, vendors and communication methods.
• I understand that affiliation with multiple Mendrix entities does not itself authorize PHI transfers between them.
• I will not disclose PHI through personal email, messaging apps, social media, public AI tools or other unapproved services.
• I will immediately report suspected privacy/security incidents or misdirected information using designated channels and cooperate in mitigation.
• I understand that violations may lead to corrective action, including termination when appropriate, and other consequences under law or policy.
• I understand patient rights, nonretaliation for good-faith concerns, and my continuing confidentiality duties after departure.
• I have received instructions to locate adopted policies, my authorized scope and Privacy/Security Officer contacts; I will seek clarification before uncertain actions.