Information Privacy & Security (IPS)

The Information Privacy and Security courses address legal-regulatory requirements for data protection by subject area. The Information Security course discusses the protection of information in any context, regardless of the subject matter. FERPA-related content focuses on educational records.

Note: For HIPAA-related requirements for health data, refer to the HIPAA series.

The Information Security course is organized to provide a basic foundation of data and device security techniques, supplemented by more detailed information relevant to the particular activities and context of the learner.

The Family Educational Rights and Privacy Act (FERPA) course includes content on the basics of federal FERPA requirements, which also touches on state and local requirements. An introductory module is complemented by audience-specific modules.

The Information Security track is organized to provide a basic foundation of data and device security techniques, supplemented by more detailed information relevant to the particular activities and context of the learner. Learn more.

For a basic Information Security course, we recommend that the two “Basics” modules be required as a foundation. A subset of the remaining modules could be used as electives, or as purely supplemental (optional) modules.

For a basic course in Family Educational Rights and Privacy Act (FERPA), we recommend that the “FERPA: An Introduction” module be required as a foundation, along with at least one of the role-specific modules, depending on the type of learner.

The regulations nor the federal agencies offer specific guidance on the frequency of information security or FERPA-related training. It is up to each organization to determine when a “refresher” is appropriate. Sometimes state laws or organizational policies may provide a standard. Absent other considerations, we recommend retraining of some kind at least every three to four years.

Standards for the frequency of information security training are also elusive. Generally, it is up to each organization to determine when a “refresher” is appropriate, except where a controlling law or regulation provides a standard. Absent such a standard, or a requirement from the organization’s own policies, we recommend some kind of retraining at least every three to four years.

Effective April 1, 2023, the Health Privacy (HIPAA) modules that were included in the Information Privacy and Security (IPS) series are no longer part of the IPS series.

A new HIPAA series includes the Health Privacy (HIPAA) modules as well as a new HIPAA Basics for Healthcare Professionals course. Organizations that have Health Privacy (HIPAA) modules in their gradebooks will have the new HIPAA series added to their renewal invoices (for an additional fee).

The IPS series will continue to include Information Security and FERPA courses. The series will also be expanded to include five topic-focused webinars. Organizations that subscribe to IPS will have access to these five webinars for no additional charge.

The added webinars include:

• Data Management and Security for Student Researchers: An Overview
• FERPA and Online Learning in the Time of COVID-19
• Bring Your Own Device (BYOD) Studies
• Partnering with Technology Companies
• Leveraging IT Insight in IRB Review

The HIPAA series will have three courses:

• HIPAA for Education and Research 
• HIPAA for Marketing and Fundraising Professionals
• HIPAA Basics for Healthcare Professionals

We are also retiring the Health Privacy Issues for Clinicians module (ID 1418), which was previously part of the Health Privacy (HIPAA) (retirement effective April 1, 2023).