HIPAA & HEALTHCARE SMS COMPLIANCE

// Course Guide

Who this course is for

• Privacy and security officers at covered entities
• Pharmacy and laboratory operations managers
• Patient portal and digital health teams
• Business associates providing messaging services

Why texting compliance is different for HIPAA-covered entities

This course goes deepest on the HIPAA side of SMS: mapping the 18 PHI identifiers to message templates, designing messages that work without PHI, authenticating patients before sensitive content is delivered, and preparing for breach notification and OCR investigations. Pharmacies and laboratories get dedicated modules because prescription-ready and results-available messages are common sources of PHI exposure.

What each module covers

1. HIPAA Foundations. Industry and jurisdiction-specific rules that apply on top of the TCPA for HIPAA-covered entities, with practical guidance on how they change message design and consent.
2. HIPAA-TCPA Intersection. Applied guidance on hIPAA-TCPA Intersection for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
3. PHI Identifiers & Data Mapping. Applied guidance on pHI Identifiers & Data Mapping for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
4. SMS PHI-Safe Design. Applied guidance on sMS PHI-Safe Design for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
5. BAA Requirements. Applied guidance on bAA Requirements for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
6. Pharmacy & Rx Compliance. Applied guidance on pharmacy & Rx Compliance for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
7. Laboratory Compliance. Applied guidance on laboratory Compliance for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
8. Patient Portal Authentication. Applied guidance on patient Portal Authentication for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
9. Breach Notification Requirements. Applied guidance on breach Notification Requirements for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
10. PHI Governance Program. For HIPAA-covered entities: building the evidence trail: consent logs, message archives, monitoring dashboards and the records regulators, carriers and plaintiffs request.
11. Audit Readiness. Applied guidance on audit Readiness for HIPAA-covered entities, with templates, checklists and case studies drawn from real programs.
12. OCR Investigation Defense. For HIPAA-covered entities: responding to complaints, demand letters, class actions and regulator inquiries: preserving evidence, common defenses and settlement considerations.
13. Final Certification Exam. A proctored final assessment covering every module, with scenario questions drawn from real HIPAA-covered entities situations. Passing earns the course certificate.

The problem this course prevents

A pharmacy's refill text names the medication, and a lab's results text includes a portal link that does not require authentication. The course covers PHI-safe design, portal authentication and breach assessment for both.

Course FAQ

Is SMS considered secure enough for PHI under HIPAA?

Standard SMS is not encrypted end to end. The course covers when patients can request unencrypted communication and how to design messages that avoid PHI.

Does the course prepare us for an OCR investigation?

Yes. The OCR investigation defense and audit readiness modules cover documentation, risk analysis and response.

Is the course self-paced?

Yes. HIPAA & Healthcare SMS Compliance runs about 20 hours across 13 modules, including the final exam, and you can work through it at your own pace with lifetime access to updates.

Is this course legal advice?

No. It teaches the rules, carrier requirements and operational controls that apply to HIPAA-covered entities, but it is not a substitute for advice from qualified counsel on your specific program.