Tag Archives: online ce

A Short Course on Encryption and Cloud Storage

Course excerpt from Ethics & Risk Management: Expert Tips 8

Encryption and cloud storage is a complicated area because it requires an analysis of the interplay of several variables, including confidentiality, encryption, cloud storage and HIPAA. Each of these variables is complex, but there are ways to make the situation more manageable.

Cloud storageEncryption and cloud storage. Let’s consider a few common questions:

“For the purposes of HIPAA, if you have adequately encrypted your data, does your cloud storage provider need to sign a Business Associate Agreement (BAA)?”

The bottom line is that there is no crystal-clear answer to this question. The Department of Health and Human Services (HHS) hasn’t specifically addressed this issue, so we are faced with the question of how to interpret the security rule.

There are two basic interpretations: “no,” and “yes.” Both have some support, and if you proceed with one interpretation you should consider the countervailing position.

First, the basics: HIPAA Covered Entities (CEs) who work with vendors are required to have their vendors sign BAAs. This is required because it allows the federal government to enforce the provisions of HIPAA on these third-party vendors.

The public policy at work is that CEs shouldn’t be allowed to offload their legal responsibilities to a third party that isn’t subject to regulatory oversight. BAAs are required whenever a third-party vendor has access to Protected Health Information (PHI).

Here’s where it gets complicated. PHI is identifiable data, but if the data are encrypted they are not identifiable. In such a case, why is a BAA necessary?

The interpretation against requiring a BAA for encrypted data finds some support in one of HIPAA’s safe harbor provisions, which states that losses of encrypted data do not trigger a breach notification (the letter CEs send out that apologetically admits to the disclosure of protected health information).

The reason why breach notifications is not required for encrypted data are that the data remain inaccessible if encrypted. The covered entity has essentially lost gibberish.

Thus, this interpretation goes, BAAs are also not required because the vendor does not have access to protected health information. That makes sense. However, it should be noted that this is a fairly permissive interpretation and HHS has declined to endorse this position.

The competing interpretation, which appears to be strongly supported by the official commentary on related regulations (especially the 2013 HITECH amendments to the HIPAA Privacy and Security Rules), is that BAAs are required even when the data are encrypted.

Support for this position includes: HHS has not made the criteria for breach notifications the same as the criteria for needing a BAA.

The statutory exceptions for BAAs, such as those with incidental access (e.g., a janitor or electrician) or those who are mere “conduits,” do not apply to cloud storage providers. HHS has indicated that a data storage company is not a conduit because of the “persistent nature” of its contact with the data. Thus, it is persistency, and not the degree of access, that HHS has specifically indicated warrants consideration for the purposes of BAAs.

Commentary prior to the adoption of the security rule asked whether or not BAAs could be something that CEs could address, and thus render unnecessary. In other words, the question was asked, “if we as CEs take adequate security measures to ensure the protection of PHI, can we make BAAs unnecessary?” HHS specifically declined to make BAAs an “addressable” requirement.

Besides the issue of protecting PHI, BAs have additional responsibilities. These responsibilities include accessibility, data integrity, etc. If encryption enabled vendors to escape “business associate” (BA) status, HHS would have no jurisdiction. (From a risk management perspective, the execution of a BAA is something that many CEs do to “distribute” the risk.)

The definition of BA isn’t explicitly restricted to those who have access to PHI. The definition also includes those who perform “any other function or activity regulated by this subchapter.” (See 45 CFR 160.103(1)(i)(B)) The amount of functions and activities that are regulated under HIPAA is huge.

I want to emphasize that I understand the argument that where vendors have absolutely no access to PHI because the data are encrypted, the vendor doesn’t have encryption keys, etc., then HIPAA is (theoretically) a non-issue. It makes a lot of sense. However, we just don’t know at this time if HHS agrees with that position and we have some strong evidence that casts this position as too narrow.

However, the ambiguity also applies to the other interpretation: We don’t know if HHS agrees with the position that the storage of encrypted PHI (where the vendor has zero access to the PHI) still requires a BAA.

I hope this helps or at least provides some things to consider.

By Adam Alban, PhD, JD

Adam Alban, PhD, JD, hosts a website of general information for mental health professionals in California. He has an M.A. and PhD in clinical psychology from Michigan State University and a JD from American University in Washington, D.C. He operates a law practice specializing in legal assistance to mental health practitioners and also has a clinical psychology practice, the Alban Psychology Group. He may be reached at:

Ethics & Risk Management: Expert Tips 8 is a 3-hour online continuing education (CE) course that addresses a wide variety of ethics and risk management topics, written by experts in the field.

This online course provides instant access to the course materials (PDF download) and CE test. After enrolling, click on My Account and scroll down to My Active Courses. From here you’ll see links to download/print the course materials and take the CE test (you can print the test to mark your answers on it while reading the course document). Successful completion of the online CE test (80% required to pass, 3 chances to take) and course evaluation are required to earn a certificate of completion.

Professional Development Resources is approved to sponsor continuing education by the American Psychological Association (APA); the National Board of Certified Counselors (NBCC ACEP #5590); the Association of Social Work Boards (ASWB Provider #1046, ACE Program); the American Occupational Therapy Association (AOTA Provider #3159); the Commission on Dietetic Registration (CDR Provider #PR001); the Alabama State Board of Occupational Therapy; the Florida Boards of Social Work, Mental Health Counseling and Marriage and Family Therapy (#BAP346), Psychology & School Psychology (#50-1635), Dietetics & Nutrition (#50-1635), and Occupational Therapy Practice (#34); the Ohio Counselor, Social Worker & MFT Board (#RCST100501); the South Carolina Board of Professional Counselors & MFTs (#193); and the Texas Board of Examiners of Marriage & Family Therapists (#114) and State Board of Social Worker Examiners (#5678).


Tags: , , , , , , , , , , , , ,

APA Task Force Reports on Girls and Women – New Online CE Course

CE Credit: 3 Hours (0.3 CEUs)
Target Audience: Psychology Counseling Social-Work Marriage-and-Family
Learning Level: Intermediate

Course Abstract:

APA Task Force Reports on Girls & WomenThis course is based on a collection of free, public-access task force reports from the American Psychological Association on issues pertaining to women. The course instructions included with this course will provide direct links to the online documents. The first report describes guidelines for psychological practice with girls and women, the second addresses the behavioral healthcare needs of rural women, and the third pertains to the sexualization of girls in the media. These reports were based on thorough reviews of the research literature, and include implications and recommendations for action. This course is appropriate for any mental health professional who works with women or girls. Course #30-51 | 2010 | 39 posttest questions

Learning Objectives:

  1. Identify issues relevant to mental health practice with women and girls.
  2. Describe and apply practice guidelines for mental health treatment of women and girls.
  3. Identify mental health concerns relevant to rural women.
  4. Describe the sexualization of girls in the media, the impacts of these practices, and methods for counteracting the effects.

About the Author(s):

The American Psychological Association (APA), located in Washington, D.C., is a professional organization with more than 150,000 members, including researchers, educators, clinicians, consultants, and students. All four documents on which this course is based were compiled and written by members of the American Psychological Association. Full lists of authors are available in the documents.

Accreditation Statement:

Professional Development Resources is recognized as a provider of continuing education by the following:
APA: American Psychological Association
ASWB: Association of Social Work Boards (#1046)
NBCC: National Board for Certified Counselors (#5590)
NAADAC: National Association of Alcohol & Drug Abuse Counselors (#00279)
California: Board of Behavioral Sciences (#PCE1625)
Florida: Boards of SW, MFT & MHC (#BAP346); Psychology & School Psychology (#50-1635); Dietetics & Nutrition (#50-1635); Occupational Therapy Practice (#34). PDResources is CE Broker compliant.
Illinois: DPR for Social Work (#159-00531)
Ohio: Counselor, Social Worker & MFT Board (#RCST100501)
South Carolina: Board of Professional Counselors & MFTs (#193)
Texas: Board of Examiners of Marriage & Family Therapists (#114) & State Board of Social Worker Examiners (#5678)
Leave a comment

Posted by on September 21, 2010 in General


Tags: , , , , , , , , , ,

Continuing Education for Psychologists

Professional Development Resources is approved by the American Psychological Association (APA) to sponsor continuing education for psychologists. Professional Development Resources maintains responsibility for all programs and content. Professional Development Resources is also approved by the Florida Board of Psychology and Office of School Psychology (CE Broker Provider #50-1635).

Professional Development Resources
provides home study continuing education (CE) courses in online, mail order, and test only learning formats for ultimate convenience. All courses require successful completion of an online posttest (80% or better required to pass, 3 chances to take test) to earn a certificate of completion.
The following states currently accept APA-approval of home study continuing education courses
Alabama, Alaska, Arizona, Arkansas, California, Delaware, Florida, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming & Washington DC

The amount of hours allowed from home study continuing education varies by state by board. You can view continuing education requirements by state by profession on Professional Development Resources’ website at:

Many state psychology boards require continuing education on Ethics each licensing period. Professional Development Resources offers a variety of Ethics courses in their curriculum of over 150 CE courses for psychologists.
Leave a comment

Posted by on August 11, 2010 in General


Tags: , , , , , , , , , , , , , , , , ,

Ohio Social Workers/MFTs Can Now Earn All 30 CE Hours Through Distance Learning!

Effective July 3, 2010: Ohio-licensed Social Workers and Marriage & Family Therapists (MFTs) can now earn all 30 of their required continuing education hours through distance learning courses. This was previously limited to 15 hours (Counselors are still limited to 15 hours). “Distance Learning means a formal education process, in which instruction occurs when the students and instructor(s) are not located in the same place.” Distance learning refers to all non traditional methods of presentation (home study, online courses, etc.) except video conferencing.

Social Workers: Any course that is accredited by the ASWB will be accepted by the Ohio Counselor, Social Worker & MFT Board for continuing social work education. If the course materials say “ACE approved” or “approved as a provider for continuing education by the ASWB,” it is acceptable.

Professional Development Resources is approved as a provider of continuing education for social workers by the Association of Social Work Boards (ASWB Provider #1046, ACE Program).

Counselors & MFTs: Courses must be approved by the CSWMFT Board as designated by the provider approval code. The provider approval code will begin with a prefix of a variation of these letters RCSTX followed by numbers. A (C ) in the prefix shows the program is approved for counselors, an (S ) for social workers and (T) for Marriage & Family Therapists.

Professional Development Resources is approved as a provider of continuing education for Social Workers, Counselors & MFTs by the Ohio Counselor, Social Worker and Marriage & Family Therapist Board (Provider #RCST100501). Courses that are approved by the Ohio CSWMFT Board have the provider code listed in the accreditation statement on the course details page.

All licensees are required to earn 3 hours of continuing education in ethics each renewal period. Professional Development Resources offers a variety of ethics courses for Social Workers, Counselors & MFTs.

Counselors holding the supervising counselor designation must complete 6 hours of supervisory training per renewal cycle.

Social Workers holding the supervising designation must complete 3 hours of supervisory training per renewal cycle.

Leave a comment

Posted by on August 10, 2010 in General


Tags: , , , , , , , , , , , , , , , , , , , , , ,

Maryland Social Workers Can Now Earn up to 20 Hours of CE from Home Study!

The Maryland Board of Social Work Examiners revised their rules and regulations regarding continuing education (CE) this year. Maryland-licensed Social Workers are now allowed to earn up to 20 hours of CE via online and home study coursework under Category II credit (previously limited to 10 hours per 2-year renewal period).

Maryland-licensed Social Workers are required to renew their licenses biennially on October 31st. 40 hours of continuing education are required each renewal to show an on-going commitment to life-long learning. 20 of the 40 required hours must come from Category 1 (live) courses, including 3 hours in ethics. The remaining 20 hours can now come from online and home study courses offered by approved-providers.

The Board recognizes and accepts the continuing education approval process conducted by the Association of Social Work Boards (ASWB) and automatically accepts courses offered by ASWB-approved providers.

Professional Development Resources is approved as a provider of continuing education for social workers by the Association of Social Work Boards (ASWB Provider #1046, ACE Program) and offers over 150 continuing education courses in online and home study format for social workers throughout the United States.

Leave a comment

Posted by on August 6, 2010 in General


Tags: , , , , , , , , , , , , , ,

%d bloggers like this: