Health Information Privacy and Security
The regulatory frame
Know HIPAA at a high level: the Privacy Rule governs use and disclosure of protected health information (PHI); the Security Rule governs safeguards for electronic PHI (ePHI); the Breach Notification Rule governs reporting. Understand the minimum necessary standard - access only what the task requires. Understand treatment, payment, and operations (TPO) as the core permitted uses without authorization. Know that psychotherapy notes and certain other categories carry stricter rules.
Safeguards
Security safeguards come in three families: administrative (policies, training, risk analysis, workforce access management), physical (facility access, workstation placement, device disposal), and technical (access controls, audit logs, encryption, authentication). A common trap is classifying a control in the wrong family: encryption is technical; a locked server room is physical; a sanction policy is administrative.
Access, authorization, and breach
Patients generally have a right to access their records and to request amendment. Authorization is required for uses outside TPO, with specific required elements. A breach is presumed unless a risk assessment shows low probability of compromise; encryption can support a safe-harbor argument. Know that audit trails support both security and compliance investigations.
Worked rule of thumb
When a scenario asks "may this employee look?", apply the minimum necessary plus job-role test: does the person need this information to do their assigned work? Curiosity, personal relationships, and convenience are not permitted purposes. If no, it is a privacy violation even if the person has system access.
Expect questions that confuse "has access" with "is authorized," or that mix up which rule (Privacy vs. Security) applies.