HIPAA Training Requirements

August 10, 2021, Crawford and O brein

HIPAA Privacy Rule states, "if necessary and appropriate for the employees to perform their tasks".  And for CEs and BAs HIPAA Security Rule states, "they should have a program of security training and awareness-raising for all members of the workforce". But other than these two statements, no HIPAA training requirement checklist has been put out.

Organizations that deal with PHI should be providing HIPAA training but they don’t know what type of training to provide makes HIPAA compliance difficult. If no training had taken place, the responsible CE or BA could expect a large penalty from the HHS (Human Health Service) Office for Civil Rights. Therefore, organizations that endeavor to provide regular HIPAA training are less known to receive a HIPAA penalty.

Overcoming the flexibility of HIPAA training requirements needs proper risk assessments by the CEs and BAs. The risk estimates must define the role of each person who might have contact with PHI or e-PHI, and from this data, it is easier to design an assured and fit security awareness and training program for the role of each individual.

Depending on the roles of certain employees, managers, volunteers, trainees, or contractors who may have contact with PHIor e-PHI, the HIPAA training program is designed. In several circumstances, it is necessary to put together various security awareness programs and training systems to ensure that their content applies to the learners.

This can exert a lot of time and means to formulate specific training. But for the training to be effective, it has to be adjusted.

How often is HIPAA training needed?

The Privacy and Security Rules provide suggestions without specifying a specific timing for the HIPAA training schedule. According to the guidelines provided by the Privacy Rules, each new employee is required to be trained and all employees should be trained again if new policies and systems are implemented. This means that employees joining the CEs should be trained immediately within weeks.

While the Security Rule claims that HIPAA training is needed regularly or periodically. Therefore, most healthcare providers get training yearly, just to be compliant with HIPAA, because otherwise if the training program takes place every two or three years, that would seem negligent and can be in violation with HIPAA leading to substantial fines by HHS. It's a great custom to refresh HIPAA training annually, but it is better to consider doing frequent revisions to reinforce the need for compliance and lessen the risk of unintended HIPAA violations.

It is always best to keep an eye out to monitor the need for training sessions. Especially when there is a policy change, workforce change, new employment, and technology shift that risks HIPAA violation.

Comments