The HIPAA training requirements are that members of a covered entity’s workforce must be provided with training on the covered entity’s HIPAA policies and procedures when they first start working for the covered entity or when there is a material change to the policies and procedures. All employees of covered entities and business associates must also be provided with security awareness training and additional training whenever a risk assessment identifies a need for further training.
HIPAA training is a fundamental and compulsory aspect of any healthcare organization’s operations. As per the HIPAA regulations, all employees, volunteers, interns, and others who have access to Protected Health Information (PHI) are required to receive appropriate training on HIPAA rules and regulations. This includes all new hires who must undergo HIPAA training as part of their onboarding process to ensure they understand the importance of safeguarding patient information and their role in this process. The training typically covers a variety of topics, such as the basics of HIPAA, what constitutes PHI, how to handle PHI, patient rights, what constitutes a breach, and how to report a violation. Given the evolving landscape of healthcare information technology and threats to data security, it’s not enough to conduct training only once. Best practice in the healthcare industry calls for annual HIPAA training for all staff members. This ensures that employees are not only refreshed on the regulations, but also updated on any changes to the law or organization policies and procedures. Regular, comprehensive training plays a critical role in preventing violations, which can lead to hefty fines, damage to the organization’s reputation, and even criminal charges. Hence, HIPAA training is not merely a requirement but an integral part of the commitment to patient privacy and quality care in the healthcare industry.
The legal requirement for HIPAA training applies to many different types of Covered Entities. Each Covered Entity is required under 45 CFR § 164.530 to implement policies and procedures “taking into account the size and the type of activities that relate to protected health information undertaken by a Covered Entity”. The clause also requires Covered Entities to train all members of its workforce on the policies and procedures.
Naturally, a healthcare insurer will have different policies and procedures than a healthcare provider, and the training provided to an employee of a healthcare insurer would be different than the training provided to an employee of a healthcare provider. It may also be the case the nature of the training varies according to the function of the employee. This is because training must be tailored “for the members of the workforce to carry out their functions within the Covered Entity”.
While specific elements of HIPAA that members of the workforce need to be trained on will be determined by a risk assessment, there are some elements of HIPAA that all members of the workforce must be trained on. These are included in the Administrative Safeguards of the HIPAA Security Rule (45 CFR § 164.308) which state a Covered Entity or Business Associate “must implement a security awareness and training program for all members of its workforce (including management)”.
HIPAA Compliance and Training Requirements
Because the provision of training is a requirement of HIPAA, training must be provided in order for a Covered Entity or Business Associate to be in compliance with HIPAA. Should a violation of HIPAA occur due to the failure of workforce member to comply with a HIPAA policy or procedure, and it is found the workforce member was not adequately trained on policies, procedures, and security awareness, the Covered Entity or Business Associate can be fined by the HHS´ Office for Civil Rights (OCR) for failing to comply with the HIPAA training requirements.
For Business Associates in particular, it is important to be aware of all the HIPAA training requirements that apply to the organization. Not only must all members of the workforce be included in the security and awareness training program (even those with no access to PHI), but some may have to be trained on patients´ rights or the Breach Notification Rule depending on their role within the organizations. In addition, Covered Entities should conduct due diligence to ensure the Business Associate complies with the HIPAA training requirements.
Objectives of HIPAA Training
The objectives of HIPAA training should go beyond “ticking a checkbox”. Employees should understand the rules relating to (for example) patients´ rights, allowable uses of PHI/ePHI, and data security in order to support the Covered Entity´s operations. If a Covered Entity is subject to multiple complaints from patients, OCR investigations, and IT security events, it is not going to be able to operate efficiently – notwithstanding the resources required to resolve these issues.
The objectives of HIPAA training should be to empower members of the workforce to perform their functions as efficiently as possible in compliance with the Covered Entity´s policies and procedures. Not only will achieving this objective result in less likelihood of HIPAA violations, but it should also increase awareness of patient well-being, which will contribute to a culture of patient safety and a greater satisfaction score from patients and their families.
HIPAA Employee Training Requirements
The HIPAA employee training requirements are mentioned three times in the text of HIPAA. The first two – training members of the workforce on policies and procedures and implementing a security awareness and training program – have already been mentioned. The third HIPAA employee training requirement concerns when “functions are affected by a material change in policies or procedures” – a standard in the Administrative Requirements of the HIPAA Privacy Rule (45 CFR § 164.530).
The Department of Health and Human Services (HHS) has issued guidance on what constitutes a “material change” – suggesting that periodic retraining should be given whenever environmental or operational changes occur. According to the HHS, this can include new or updated policies, new or upgraded software or hardware, new security technology, or changes to procedures that could impact how PHI is managed – such as CMS´ changes to the Promoting Interoperability program.
HIPAA Training for Healthcare Workers
HIPAA training for healthcare workers will naturally need to be more comprehensive than HIPAA training for other employees. Healthcare workers have more contact with patients and their families, create and collect PHI/ePHI more frequently than other employees, and use PHI/ePHI constantly throughout the working day. There will be many more scenarios in which inadvertent and unauthorized disclosures of PHI/ePHI can occur.
There will also likely be more occasions when material changes to environments and operations occur. In these cases, it is important Covered Entities schedule frequent HIPAA training to keep healthcare workers advised of the most recent changes or – if no relevant material changes have occurred since training was last provided – to provide refresher training on one or more element of HIPAA from the list of “HIPAA Training Modules to Consider” provided later in this article.
HIPAA Training for Employees Other than Healthcare Workers
While HIPAA training for employees other than healthcare workers does not need to be as comprehensive as HIPAA training for healthcare workers, it has to be provided in the context of employees´ functions. For example, it may be necessary to train employees who would not ordinarily encounter PHI in their usual functions (i.e., cleaning and maintenance teams), just in case they do encounter PHI that has inadvertently been left unsecured.
HIPAA training for employees other than healthcare employees needs to cover elements of HIPAA such as “HIPAA Disclosure Rules” and “Preventing HIPAA Violations”. Employees need to be aware of who their “HIPAA Officer” is so they can report inadvertent and unauthorized disclosures of PHI, while HIPAA training for employees that have access to PHI databases needs to focus more on “Computer Safety Rules” and “Cybersecurity Dangers for Healthcare Employees”.
HIPAA Training Modules to Consider
Because there is no “one-size-fits-all” program to fulfill the HIPAA training requirements, training is best done from a selection of mix and match training modules. We have suggested some HIPAA training modules below – most of which will suit most training requirements. These have categorized into “basic” and “advanced”, with additional modules included for student training.
Suggested Basic HIPAA Training Modules
The suggested basic HIPAA training modules contain areas of HIPAA that will be common to all roles. A selection of these modules could be used as a foundation course for new employees – provided they are supplemented with role-relevant HIPAA training – or as refresher training.
HIPAA Overview
An overview of HIPAA is an ideal way to start any HIPAA training session as it ensures employees have an understanding of the Act, its purpose, what its objectives are, and who it applies to in the context of preventing unauthorized access to PHI.
HIPAA Definition and Lexicon
The text of HIPAA uses terminology that many employees may be unfamiliar with. This may result in policies and procedures being misinterpreted. Before further HIPAA training is undertaken, it is a good idea to explain some of the more common terms used in HIPAA.
The HITECH Act
The HITECH Act drove the adoption of technology in the healthcare industry via the Meaningful Use initiative program, which subsequently evolved into the Promoting Interoperability program. This could be a useful module for employees working in IT or with frequent access to IT systems.
The Main HIPAA Regulatory Rules
There are five main HIPAA regulatory rules, and although most employees will not need to have an understanding of the Enforcement Rule and Breach Notification Rule, it is important they are familiar with the content of the HIPAA Omnibus Final Rule, the Privacy Rule, and the Security Rule.
HIPAA Omnibus Final Rule
The HIPAA Omnibus Final Rule implemented provisions of the HITECH Act to strengthen existing privacy and security protections. It also extended the reach of HIPAA to include business associates and subcontractors with whom PHI is shared.
HIPAA Privacy Rule Basics
The Privacy Rule defines PHI and the measures Covered Entities need to take in order to protect it from loss, theft, and unauthorized disclosure. It is especially important healthcare workers are aware of Privacy Rule basics such as patients´ rights and the Minimum Necessary Standard.
HIPAA Security Rule Basics
The technical, administrative, and physical safeguards of the Security Rule will likely impact every employee´s day-to-day routines and this module of HIPAA training should be used as an introduction to more advanced modules in the suggested advanced HIPAA training modules.
HIPAA Patient Rights
Although patients´ rights are covered in the Privacy Rule module, it may be necessary for healthcare workers and administrators to undergo specific training on providing patients with Privacy Notices, handling patient requests for access to PHI, and obtaining consent from patients.
HIPAA Disclosure Rules
The HIPAA disclosure rules apply to all employees regardless of the function they perform. Ideally, this module should be provided alongside the Privacy and Security Rule modules to enforce employee understanding of allowable disclosures and the Minimum Necessary Standard.
HIPAA Violation Consequences
HIPAA violations can have consequences for patients, organizations, and employees. To make this module more relevant for trainees, this is a good opportunity to introduce and explain the organization´s sanction policy and how employees may be impacted by violations of HIPAA.
Preventing HIPAA Violations
As part of a basic HIPAA training course or refresher course, this module should be used as an overview of compliance best practices. Ideally, the module on preventing HIPAA violations should be tailored to be relevant to different groups of employees and their functions.
Being a HIPAA Compliant Employee
Training on being a HIPAA compliant employee can be used in a foundation or refresher course. It can include general do´s and don´ts, focus on specific roles, or explain the procedures for reporting HIPAA violations or when encountering PHI that has inadvertently been left unsecured.
Suggested Advanced HIPAA Training Modules
The basic HIPAA training models provides employees with the fundamentals of HIPAA, but more advanced training is often necessary. The following suggested advanced HIPAA training modules should be used whenever “functions are affected by a material change”.
HIPAA Timeline
This module can help employees better understand the objectives of HIPAA by providing a timeline of HIPAA and the main HIPAA regulatory rules. This module should be updated at least annually to reflect changes to HIPAA, the Promoting Interoperability program, and emerging compliance challenges.
Threats to Patient Data
This advanced module should expand on both the online threats to patient data and the physical threats to authorized disclosures. Physical threats can include leaving mobile devices unattended, failing to safeguard hard copies of patient data, and positioning workstation screens in public view.
Computer Safety Rules
Regardless of HIPAA, Covered Entities and Business Associates will likely have policies in place to govern how computers should be used safely. Employees need to be made aware of these policies to mitigate the threats of malware, ransomware, and phishing.
HIPAA and Social Media
Healthcare professionals have to be particularly careful about what they share on social media platforms because it is very easy to disclose PHI unintentionally. However, all members of the workforce should be trained on how best practices for managing social media accounts safely.
HIPAA and Emergency Situations
During emergency situations, disclosures of PHI beyond what is normally allowed under HIPAA may be permitted for public health reasons. It may also be the case OCR waives certain elements of HIPAA in order to remove obstacles to the flow of healthcare information during these events.
HIPAA Officer
HIPAA Officers are the individuals responsible for HIPAA compliance within a Covered Entity´s workforce. It is a good idea to explain the HIPAA Officer´s roles and have a HIPAA Officer present at the time so employees can put a face to a name.
HIPAA Compliance Checklist
Although this module would be most relevant to HIPAA Officers and IT managers, a HIPAA compliance checklist can also be used towards the end of a HIPAA Training course to measure how well employees have understood and absorbed the information.
Recent HIPAA Updates
HIPAA is constantly evolving, and it is important employees are made aware of recent HIPAA updates and other events that materially change the way in which PHI is managed to ensure ongoing compliance. It is especially important this module is included in refresher training.
Texas Medical Privacy Act and HB 300
The Texas Medical Privacy Act and HB 300 applies to all organizations that create, use, maintain, or transmit the health information of Texas residents – regardless of where the organization is located. This advanced HIPAA training module may apply to Covered Entities outside of Texas.
Cybersecurity Dangers for Healthcare Employees
Healthcare data is highly valued by cybercriminals, and it is vital healthcare employees are aware of cybersecurity dangers and best practices for mitigating the risk of a data breach. Topics covered in this module should be tailored to match employees´ access to IT systems and workstations.
How to Protect PHI from Cyber Threats
This module can be used to educate employees on the dangers of password sharing to encourage good password best practices. The module should also address the threat from phishing, and how it can be mitigated using multi-factor authentication, access controls, and network monitoring.
Suggested HIPAA Training for Healthcare Students
Healthcare students should be provided with HIPAA training before they start working with patients and accessing EHRs. Because it is not always known during their education which functions they will perform once they have graduated, our suggested HIPAA Training for healthcare students should include modules from both the basic and advanced HIPAA training courses – plus additional modules designed to be relevant to a student population. For example:
- HIPAA Timeline
- HIPAA Overview
- Definitions and Lexicon
- The HITECH Act
- The Main HIPAA Regulatory Rules
- HIPAA Omnibus Final Rule
- HIPAA Privacy Rule
- HIPAA Security Rule
- Patients´ Rights
- PHI Disclosure Guidelines
- HIPAA and Social Media
- Threats to Patient Data
- Computer Safety Rules
- HIPAA Violation Consequences
- Preventing HIPAA Violations
- HIPAA in an Emergency
- The HIPAA Officer
- Recent HIPAA Updates
Electronic Health Record Access by Healthcare Students
During training, students are often permitted to access EHRs under supervision. This module should explain what students can and cannot do with the PHI they have access to.
PHI & Student Reports and Projects
Students need to be aware that, when writing reports, giving presentations, or preparing case studies, they are unable to use PHI unless the subject of the PHI has given informed consent.
Being a HIPAA Compliant Student
It is important students understand the Covered Entities policies and procedures apply to them in the same way as if they were already healthcare professionals.
Advice for HIPAA Compliance Training
To help HIPAA compliance officers further with their HIPAA training and security awareness courses, we have listed some best practices to consider when compiling “necessary and appropriate” training programs. Our best practices for HIPAA compliance training are not mandatory but should help.
- Do keep training short and focused. It is recommended that training sessions last no longer than forty minutes and are regular events rather than the annual refresher sessions that are recommended by the Department of Health and Human Services.
- Don’t dwell for too long on the background to HIPAA. Employees may need to know the history of HIPAA’s development and passage, but it is more important they understand their role in protecting PHI and ePHI.
- Do include the consequences of a HIPAA breach in the training – not just the financial implications, but the implications for other employees, other operations, and – of course – the person(s) whose privacy may be violated.
- Don’t quote passages of text from HIPAA. Use multimedia presentations to make the training memorable and relevant. HIPAA compliance training not only has to be absorbed, but it must also be understood and followed in day-to-day roles.
- Do include senior management in the training. Even if senior managers have no contact with PHI, it is essential they are seen to be involved with HIPAA compliance training. Knowing training is being taken seriously at the top will encourage others to take it seriously.
- Don’t forget to document HIPAA training. In the event of an OCR investigation or audit, it is important to be able to produce the content of the training as well as when it was administered, to whom it was provided, and how frequently.
Benefits of HIPAA Training
HIPAA training offers many benefits to healthcare professionals, ranging from enhanced understanding of privacy laws to fostering a culture of compliance within healthcare organizations. HIPAA training provides in-depth knowledge of HIPAA regulations, enabling healthcare professionals to understand the importance of protecting patient health information and the potential consequences of non-compliance. This understanding goes beyond just knowledge of the law—it fosters an awareness of the ethical and practical implications of safeguarding patient data, which is crucial in a field where trust and confidentiality form the bedrock of the caregiver-patient relationship.
HIPAA training can significantly reduce the risk of breaches or violations that can lead to fines, penalties, and damage to the organization’s reputation. Training equips healthcare professionals with the necessary skills and knowledge to handle PHI correctly, identify potential threats or vulnerabilities, and report issues promptly and correctly. This proactive stance can help prevent breaches or minimize their impact when they occur. Given that many violations are the result of employee errors, a well-trained workforce can be an organization’s best defense against breaches.
HIPAA training cultivates a culture of compliance within the organization. By routinely participating in such training, healthcare professionals are reminded of their essential role in preserving patient privacy and the trust patients place in them. The training also promotes transparency and open communication, encouraging employees to ask questions and raise concerns about potential HIPAA-related issues. This atmosphere of compliance and engagement not only reinforces the importance of adhering to HIPAA regulations but also promotes a broader culture of ethical conduct and professionalism.
FAQs
When should initial HIPAA training be provided to new employees?
This depends on what HIPAA training the employee has had prior to being hired. If they have had none, initial HIPAA training should take place before they have access to PHI. If the employee is familiar with HIPAA, you should aim to provide training on your policies and procedures in the first few days or weeks after the new employee joins the organization.
How much detail should be provided in HIPAA training sessions?
HIPAA training is not about ensuring employees have an encyclopedic knowledge of the HIPAA regulations, but employees must be able to identify PHI, be aware of the allowable uses and disclosures, understand the minimum necessary rule, patient rights, and the consequences of HIPAA violations. As much detail as necessary must be provided for the employee to perform their functions in compliance with HIPAA.
What should HIPAA security awareness training involve?
The purpose of security awareness training is to teach employees security best practices and eliminate risky behaviors that could place PHI at risk. Training sessions should explain the most common threats, teach employees how to recognize phishing emails, how to access PHI securely, set strong passwords, and the safe use of computers, hardware, software, and the Internet.
Is it permissible to only provide computer-based HIPAA training?
HIPAA does not state how training should be provided, only that employees must be trained on HIPAA and receive security awareness training. Computer-based training is a good choice. It is easy to administer, track employees’ progress, and document that training has been provided. Computer-based HIPAA training can also be completed at employees’ workstations and is easy to fit into their workflows.
Can fines be imposed for inadequate HIPAA training?
In 2020, the HHS’ Office for Civil Rights fined two healthcare providers for multiple HIPAA violations including the failure to provide training for employees. One fine of $1.5 million was imposed on a provider that had not provided any HIPAA Privacy Rule training and a fine of $25,000 was imposed on another that had not provided any security awareness training.
What is HIPAA training?
HIPAA training is the instruction of employees, contractors, and other third-party personnel (i.e., volunteers) with regards to the policies and procedures put in place by a Covered Entity to be HIPAA compliant. Because each Covered Entity develops their own policies and procedures, there is no “one-size-fits-all” HIPAA training.
How often do you need HIPAA training?
After initial training, further HIPAA training should be provided whenever there is a material change in policies or procedures that affects employees´ functions, or when a need for further training is identified in a risk analysis. There is no set period for when HIPAA training should be provided.
Is HIPAA training required annually?
The is no legal requirement to provide or attend HIPAA training annually. However, if a need for annual training is identified in a risk analysis, the Covered Entity will need to provide the training and document why annual training is considered necessary.
Is HIPAA training required by law?
Yes, the HIPAA training requirements are codified under 45 CFR § 164.308 and 45 CFR § 164.530. If a violation of HIPAA occurs due to a lack of training, the Covered Entity can be issued with a significant fine depending on the scale of the violation and the degree of culpability.
Who needs HIPAA training?
All members of a Covered Entity´s or Business Associate´s workforce have to undergo security awareness training – even if they have no access to systems containing ePHI. Members of a Covered Entity´s workforce must be trained on the HIPAA policies and procedures relevant to their roles. Ideally, all members of the workforce should receive basic HIPAA training to understand permissible uses and disclosures of PHI.
How often is HIPAA training required?
The HIPAA training requirements require that Privacy Rule training is provided “within a reasonable period of time after a person joins the Covered Entities workforce” and whenever “functions are affected in a material change in policies and procedures”. With regards to Security Rule training, the Administrative Safeguards describe security awareness training as a “program”, which implies it should be ongoing.
What are the HIPAA training requirements for new hires?
This is a good question because many new hires arrive from previous roles in which they have already undergone HIPAA training. However, despite any previous experience, new hires must undergo HIPAA training on policies and procedures relevant to their roles. Although this may seem wasteful, each Covered Entity should have developed unique policies and procedures in response to a risk analysis. The policies and procedures of the new employer will likely not be the same as those of the former employer.
Who is responsible for providing HIPAA training?
The responsibility for providing HIPAA training lays with a Covered Entity or Business Associate. The organization should have appointed a HIPAA Privacy Officer and/or a HIPAA Security Officer, and these Officers (which can be the same person in smaller organizations) are responsible for providing HIPAA training – although they do not have to lead the training themselves.
Why might a Privacy Officer not lead privacy training?
A Privacy Officer might not lead HIPAA training if their skills are not suited to presenting training sessions to members of the workforce. Privacy Officers are responsible for much more than training; and, in such cases, it is not unusual for training professionals to be brought in to lead training – although the Privacy Officer should be in attendance to answer specific Privacy Rule questions.
Why might a Security Officer not lead security training?
A Security Officer might not lead security training if – for example – the security training is about a new piece of security software that another member of the IT team is more familiar with. In such circumstances, although the Security Officer is likely a senior member of the IT team, they may take a back seat during the training session while their more knowledgeable colleague takes the lead.
Why is refresher training required when there is a “material change to policies”?
Usually, refresher training is required when there is a material change to policies because the material change affects the way(s) in which the Covered Entity or Business Associate complies with HIPAA. This can be for several reasons, and might only affect one area of operations – such as responding to patient access requests – in which case refresher training will only be necessary for members of the workforce that respond to patient access requests.
What is an example of a “material change to policies”?
An example of a material change to policies is that many healthcare organizations have recently had to amend some HIPAA-related policies and procedures relating to how ePHI is managed to accommodate changes in CMS’ Promoting Interoperability program. As mentioned previously, only members of the workforce that manage ePHI will have to undergo refresher training – although other members of the workforce may need to be aware that there have been changes if the changes affect their workflows.
When should senior managers be involved in HIPAA training?
Senior managers should be involved in HIPAA training as often as possible because it shows trainees a commitment to compliance. Naturally, it is not necessary for all senior managers to be involved in every policy and procedure training session, but it is important that all senior managers are involved in the security and awareness training program as this is stipulated in the Administrative Safeguards of the HIPAA Security Rule.
What is the most important topic to focus on during HIPAA training?
There is no single most important topic to focus on during HIPAA training as the focus of HIPAA training should be determined by a risk assessment and will vary on a case-by-case basis. However, you could point to several topics that are fundamental to HIPAA training – for example, what is HIPAA? Why does HIPAA exist? And what is PHI? Understanding the basics of HIPAA is important in order to provide context to other areas of HIPAA training and compliance.
How long does HIPAA training take?
The answer to the question how long does HIPAA training take is that HIPAA training should be ongoing inasmuch policies and procedures are frequently changing. The requirement for security and awareness training stipulates a program rather than a one-off session. However, in terms of how long each training session should take, the optimum time is around 40 minutes – although this may vary depending on the amount of content, the number of trainees, and the volume of questions asked during and after the session.
How often do you have to do HIPAA training?
How often you have to do HIPAA training can be determined by a number of factors. For example, it may be your employer´s policy to provide refresher training periodically or to provide additional training when necessary to address the findings of a risk assessment. Many Covered Entities also require members of the workforce to undergo training following a HIPAA violation as part of their sanctions policy.
It is mandated in the Privacy Rule that each new member of the workforce must have HIPAA training on the organization’s policies and procedures within a reasonable timeframe of commencing work for the organization. Thereafter, the only mandatory requirement is that refresher training is provided when there is a material change to policies and procedures. However, it is recommended by compliance experts that refresher training is provided at least annually.
With regards to the security and awareness training required by the Security Rule, this should be an ongoing program rather than a one-off event. Security and awareness training should be provided periodically – although it doesn´t necessarily have to focus on HIPAA. Security and awareness training can be used to better educate members of the workforce on general security threats such as malware, ransomware, and phishing.
Why is HIPAA training important?
HIPAA training is important because, as well as it being a legal requirement that HIPAA training is provided, it demonstrates to members of the workforce how Covered Entities and Business Associates protect patient privacy and ensure the confidentiality, integrity, and availability of PHI so members of the workforce can perform their duties without violating HIPAA regulations.
When does HIPAA training expire?
HIPAA training provided by a Covered Entity or Business Associate does not expire unless there is a change in policies or procedures that affects your role – in which case elements of your original HIPAA training may no longer apply. HIPAA training can be considered to have expired if you change employers – but remain in the healthcare industry – as different employers have different HIPAA policies and procedures and you will need training on your new employer´s policies and procedures.
Why might additional HIPAA training be necessary?
Additional HIPAA training might be considered necessary in a number of scenarios. Possibly the need for additional training is identified in a risk analysis, or is provided to you as a sanction for violating a HIPAA policy. You may also have to undergo additional training if the organization you work for is issued with a corrective action order by the Office for Civil Rights that includes workforce training.
Why is documentation of HIPAA training necessary?
The documentation of HIPAA training is necessary for two reasons. First, it demonstrates that an organization is complying with the HIPAA training requirements in the event of an audit or compliance investigation. Secondly, it records what training has been provided in order to determine what additional training may be required following a risk analysis or policy change – or a promotion.
What do you learn during HIPAA training?
What you learn during HIPAA training can vary considerably depending on the reason for the training being provided. HIPAA training for new employees should focus on the basics of HIPAA and the organization´s HIPAA policies and procedures. Security and awareness training will likely be more focused on best practices for accessing, using, and securing ePHI. There may also be times when HIPAA training focuses on specific areas of HIPAA identified in a risk assessment or prompted by a complaint by a patient.
What is a HIPAA training certificate?
A HIPAA training certificate is an accreditation – usually provided by an outside training organization – that is awarded to individuals who pass a HIPAA training course. In such cases, the HIPAA training course is designed to provide a basic knowledge of HIPAA so that subsequent training provided by the individual’s employer (for example, policy and procedure training) is more understandable.
Who is responsible for training medical students about HIPAA?
The organization responsible for training medical students about HIPAA is the Covered Entity students are under the control of when they first have access to PHI. Some teaching institutions do not qualify as Covered Entities and it may be the case that a medical student does not receive any HIPAA training until after they have graduated and started working for a healthcare organization – who then assumes the responsibility for training medical students about HIPAA.
What HIPAA training is required?
The “required” HIPAA training requirements are that Covered Entities (and Business Associates when appropriate) provide training on Privacy Rule policies and procedures when an individual first joins the workforce and provides security and awareness training thereafter. However, this frequency of training is not considered sufficient to prevent most common HIPAA violations, and it is recommended organizations provide annual refresher HIPAA training.
Do state training requirements preempt HIPAA training requirements?
State training requirements preempt HIPAA if the regulation’s training offers more stringent protections for patient privacy or more patient rights than HIPAA. At present, only Texas has introduced a law requiring entities covered by the Medical Records Privacy Act to provide compliance training every two years. However, it is not just state laws that preempt HIPAA with regards to training. Some federal laws do as well. For example, personnel employed by the Defense Health Agency are required to undergo Privacy Act and HIPAA privacy training annually.