Privacy and PII/PHI Protection Awareness Course
IDCYSE7005

Module 1

• Foundations of Federal Privacy Law: purpose, scope, and history of the Privacy Act of 1974
• The key terms record, system of records, individual, and routine use
• Individual rights of access, amendment, and accounting of disclosures
• The Fair Information Practice Principles
• System of Records Notices and Privacy Impact Assessments
• How the Privacy Act relates to FOIA

Module 2

• Identifying and Categorizing Personally Identifiable Information: defining PII
• Standalone versus linked and linkable PII
• Sensitive PII requiring enhanced safeguards
• PII confidentiality impact levels
• Where PII shows up in HR, travel, payroll, case management, email, and shared drives

Module 3

• Protected Health Information in the Federal Workplace: defining PHI and how it differs from general PII
• The federal health privacy regulatory framework
• The HIPAA identifiers and how they combine with health data
• Where non-clinical federal staff encounter PHI
• The minimum necessary standard and need-to-know access

Module 4

• Safeguarding Information and Responding to Privacy Incidents: administrative, physical, and technical safeguards
• Safe storage, transmission, printing, and disposal
• Removable media and telework precautions
• What counts as an incident versus a breach
• The federal breach-response lifecycle from discovery through remediation
• Why prompt reporting matters even for minor or accidental incidents

Module 5

• Roles, Responsibilities, and Privacy in Practice: the Senior Agency Official for Privacy, Privacy Officer, Information System Security Officer, supervisors, and individual employees
• Everyday responsibilities
• Remote work and mobile device considerations
• Consequences of noncompliance
• Where to go for help