In some cases, it can be beneficial to combine Privacy Rule and Security Rule training – for example when discussing device and media controls required by the Physical Safeguards of the Security Rule. However, combining non-related areas of HIPAA can confuse trainees or result in information overload which can limit retention and result in unintentional violations. Therefore, it is a best practice to combine Privacy Rule and Security Rule training only when appropriate.