HIPAA & Patient Data in the Age of AI
Most AI privacy incidents in health care start with a good intention and a quick paste into the wrong tool. This course shows clinical, administrative, and billing staff exactly what counts as protected health information, why a public chatbot can never receive it, and how breaches actually happen with AI. You'll learn the four-question test before any paste, the five-part checklist for approving a tool, verify-before-release for urgent requests, and the first hour of breach response. You'll finish with a one-page set of PHI and AI rules to keep by the keyboard.
Course details
Duration
1h 23m 41s
Lectures
15
Video
1.5 hours
Quizzes
1
Level
Beginner
Course Description
The health-privacy rules were written about information, not technology, so they still apply when the tool is an AI chatbot, a browser extension, or a meeting notetaker. What changed is how easily patient data now leaves the building. This course turns the rules you already know into habits at the keyboard.
What you'll learn
- What counts as PHI, including the identifiers people forget, and why every copy is PHI
- Permitted uses, minimum necessary, and safeguards applied to AI tools
- Public versus covered tools, business associate agreements, and the limits of de-identification
- How copy-paste breaches, shadow AI, vendor features, and cloned-voice calls expose patient data
- A five-part checklist for evaluating an AI tool and workflows that design the paste out of the job
- The first hour of breach response and a reporting culture that makes people speak up
Who it's for
Clinicians, nurses, medical assistants, front-desk and scheduling staff, billing and health-plan teams, managers, and privacy leads who handle patient information and work alongside AI tools.
15 short video lessons in three modules: The Rules; How Breaches Happen; and Doing It Right.
This course is educational and is not legal, compliance, or medical advice. Your privacy officer, organization policies, and applicable law govern.
Module 1: The Rules
-
1.1 PHI, RefreshedWhat counts as protected health information, including the identifiers people forget, and how to recognize PHI inside an AI prompt.
In this lesson:
- Define protected health information at a working level
- Recognize the identifiers that people forget are identifiers
- Apply a four-question test to any text before it enters a tool
-
1.2 Privacy and Security Rules in an AI Context
Permitted uses, minimum necessary, and safeguards — the core principles, applied to AI tools.
In this lesson:
- Apply the permitted-use principle to an AI-assisted task
- Practice minimum necessary when building a prompt
- Map administrative, technical, and physical safeguards onto AI tools
-
1.3 Public Tools vs. Covered Tools
Why a consumer chatbot is not a place for PHI, and business associate agreements at a working level.
In this lesson:
- Explain why a public AI tool cannot receive PHI
- Describe what a business associate agreement does, as a practice
- Tell a public tool from a covered tool by its signals
-
1.4 De-identification and Its Limits
What makes data safe to use, and how re-identification happens.
In this lesson:
- Describe the two recognized approaches to de-identification as practices
- Recognize the common ways de-identified data becomes identifiable again
- Judge whether a 'de-identified' text is actually safe for an AI tool
-
1.5 Patient Rights and AI
Access, amendment, and the accounting of disclosures — and what each means when AI has touched the record.
In this lesson:
- Explain how AI-generated content fits within a patient's right of access
- Handle an amendment request that involves an AI-drafted error
- Connect the accounting of disclosures to AI tool logging
Module 2: How Breaches Happen
-
2.1 The Copy-Paste Breach
The most common AI-related incident — how it happens, why it's a breach, and how to prevent it.
In this lesson:
- Trace the four steps of a copy-paste breach
- Explain why a paste into a public tool is a disclosure, whatever the intent
- Apply the habits and controls that prevent it
-
2.2 Shadow AI in the Practice
Personal accounts, browser extensions, and phone apps — where unapproved AI hides and how to bring it into the light.
In this lesson:
- Identify the places unapproved AI hides in a health-care setting
- Recognize how a helpful extension becomes a data flow
- Follow a path for bringing shadow AI into approved use
-
2.3 Vendors and Integrations
Data flows nobody mapped, and the questions to ask.
In this lesson:
- Recognize the vendor and integration paths where PHI flows unnoticed
- Ask the six questions that expose a vendor's data handling
- Tell a reassuring vendor answer from an acceptable one
-
2.4 Social Engineering and Deepfakes
The phone call that sounds like the physician — how AI sharpens old attacks, and how to verify before you release.
In this lesson:
- Recognize an AI-enabled social-engineering attempt in a health-care setting
- Explain how cloned voices and tailored messages change old attacks
- Apply a verify-before-release routine to every inbound request for PHI
-
2.5 Breach Response Basics
Recognize, report, contain — and the timelines at principle level.
In this lesson:
- Recognize a possible breach, including the AI-specific kinds
- Follow the report-and-contain steps in the first hour
- Describe what happens after a report, and the timelines at principle level
Module 3: Doing It Right
-
3.1 Evaluating a Compliant AI Tool
The checklist — agreement, data handling, retention, training use, access — and the path from request to approval.
In this lesson:
- Run the five-part checklist on any proposed AI tool
- Follow the evaluation path from request to scoped approval
- Distinguish acceptable answers from unacceptable ones on each checklist item
-
3.2 Workflows That Keep PHI Safe
Templates, redaction habits, and approved paths — making the safe way the easy way.
In this lesson:
- Use templates so AI drafting never needs a chart pasted in
- Practice a redaction routine that removes the whole identifier list
- Follow the approved path for a common PHI-adjacent task end to end
-
3.3 Training and Culture
Making reporting safe and rules memorable.
In this lesson:
- Describe what makes an incident report safe to file
- Tell rules that stick from rules that don't
- Set up a training rhythm that keeps AI privacy habits alive
-
3.4 Composite Cases
Three anonymized scenarios and the control that would have prevented each.
In this lesson:
- Analyze three composite PHI-and-AI incidents from cause to consequence
- Identify the single control that would have prevented each
- Recognize the pattern shared by all three
-
3.5 Your PHI and AI Checklist
The one-page rules and your next tool decision; the finale.
In this lesson:
- Carry the one-page PHI and AI rules into daily work
- Run a tool decision from question to approved use or decline
- Complete HIPAA & Patient Data in the Age of AI
HIPAA & Patient Data in the Age of AI — Final Exam
Learn at your own pace
Study the materials at your convenience, you can always return to them to repeat
Certificate of completion
Complete every lesson and pass the final exam to earn a RiseCert certificate of completion you can download and share.
Your Name
HIPAA & Patient Data in the Age of AI
RISECERT
CERTIFICATE
For demonstrated knowledge and successful completion of all course requirements for:
MM.DD.YYYY
Certificate Date
Ready to get started?
Enroll in HIPAA & Patient Data in the Age of AI and earn your RiseCert certificate of completion.
Got Questions? We've Got Answers!
Answers to the most common questions about this course.
What is the HIPAA & Patient Data in the Age of AI course?
HIPAA & Patient Data in the Age of AI is a RiseCert online course that teaches health-care staff what protected health information can never enter a public AI tool, how to judge compliant alternatives, and how AI-related breaches actually happen. It includes 15 video lessons (about 1 hour 25 minutes) and a final exam.
Who should take a HIPAA and AI training course?
Anyone who handles patient information in a clinic, hospital, billing office, long-term care organization, or health plan: clinicians, nurses, medical assistants, front-desk and scheduling staff, billing teams, social workers, managers, and privacy leads. The course is written for everyday staff, not technologists, and one lesson speaks directly to people who manage teams.
Can I put patient information into ChatGPT or another public AI chatbot?
No. The course explains that a public AI tool cannot receive PHI: there is no agreement with your organization, retention is outside your control, nothing is logged, and you can't say where the data went. Pasting PHI there is a disclosure, likely reportable, however good the output. Use only tools your organization has approved for that use.
Is removing the patient's name enough to de-identify a note before using AI?
No. Dates more specific than the year, small places, record numbers, rare conditions, voices, and free-text details can identify a person in combination. The course covers the two recognized de-identification approaches, identifier removal and expert judgment, and the common ways supposedly de-identified data becomes identifiable again, including free-text leaks, linkage, and insiders.
What is a business associate agreement, and why does it matter for AI tools?
A business associate agreement is a written contract that makes a vendor handling PHI accountable: it must protect the information, use it only for the service, report incidents, flow duties to subcontractors, and return or destroy data. The course treats it as the entry ticket, not the whole evaluation. No agreement means no PHI.
What is shadow AI in health care?
Shadow AI is any AI tool doing work with an organization's information without the organization knowing. In this course that includes personal chatbot accounts, browser extensions that read open pages, phone dictation apps, meeting notetakers, and AI features that switch on inside trusted software. The course gives a path for bringing these tools into approved use.
How does the course help evaluate whether an AI tool is safe for PHI?
It teaches a five-part checklist: a signed agreement, documented data handling, retention stated in numbers, no training use of your data, and access controls with audit logs. All five must be satisfied in writing. It also walks through the path from a use-case request to a privacy review, a limited pilot, and scoped approval.
What will I be able to do after completing the course?
You'll be able to run a four-question PHI test before any paste, tell a public tool from a covered one, spot shadow AI and risky vendor features, verify an urgent request before releasing PHI, take the right first-hour steps after a slip, and route a new tool request. You'll leave with a one-page PHI and AI rule set.
Do I need technical or prior HIPAA training to take this course?
No. The course explains every concept in plain language with health-care examples. The first lesson refreshes what counts as protected health information, and the next lessons apply permitted uses, minimum necessary, and safeguards to AI tools. Prior privacy training helps, but it isn't required to follow along.
Is the course content current?
Yes. The lessons reflect AI tools and privacy practice as of September 2026, including shadow AI, vendor AI features, ambient transcription, and cloned-voice social engineering. Because tools change quickly, the course emphasizes durable practices, such as the approved list, minimum necessary, written vendor answers, and same-day reporting, that hold up as technology changes.
How long does the course take to complete?
The course has about 1 hour 25 minutes of video across 15 lessons, roughly five to six minutes each, plus a final exam. Lessons are organized into three modules: The Rules; How Breaches Happen; and Doing It Right. Most learners finish in two or three sittings.
Is the course online and self-paced?
Yes. The course is 100% online and self-paced, and your access does not expire. You can start, pause, and resume whenever you like on a computer, tablet, or phone with a modern web browser. There is nothing to install.
Is there a final exam?
Yes. The course ends with a 30-question multiple-choice final exam covering all three modules. You need 80% or higher (24 of 30) to pass, and you can retake the exam as many times as you need. Finish all 15 lessons and pass the exam to complete the course.
Will I receive a certificate of completion?
Yes. After you complete all 15 lessons and pass the final exam, you can download a RiseCert certificate of completion. It is a course completion certificate, not a license, a professional certification, or a continuing education (CE) certificate, and it does not certify your organization's HIPAA compliance.
Does this course count for CME, CE, or CEU credit?
No. The course is not currently approved or accredited for continuing medical education (CME), continuing education (CE), or CEU credit by any accrediting body or licensing board. If you need credit hours for licensure, take a course approved by the relevant body. This course complements that training with practical AI privacy habits.
Will this course satisfy my organization's annual HIPAA training requirement?
Not on its own, unless your organization decides it does. RiseCert does not certify that the course meets any employer's or regulator's training requirement. Ask your privacy officer or compliance team whether it can be counted. Many organizations use it alongside their own HIPAA program to cover AI-specific risks.
Is this course legal, compliance, or medical advice?
No. The course is educational and is not legal, compliance, clinical, or medical advice. It teaches practices that reduce privacy risk when using AI, but your privacy officer, your organization's policies, and applicable law, including HIPAA, govern. For a specific tool, incident, or situation, ask your privacy officer or counsel.
Does the course recommend specific AI tools or vendors?
No. The course is vendor-neutral and endorses no product. It covers categories of tools health-care staff encounter, including public chatbots, approved drafting tools, browser extensions, dictation and translation apps, AI notetakers, portal chat assistants, and vendor features, and teaches how to judge any of them against the same checklist.
How much does the course cost, and can I enroll my team?
The course costs $99 per learner as a one-time purchase, with no subscription or recurring fees. To enroll a team, practice, or department, contact RiseCert through the Contact Us page at risecert.org to discuss group access.
What is the refund policy?
All sales are final and no refunds are issued, as stated in the RiseCert Terms of Use. Please review the course description, lesson list, and these FAQs before purchasing, and contact RiseCert with any questions before you buy.