HIPAA regulations are far-reaching and apply to many types of covered entities. From single-doctor practices to enterprise hospital networks and the business associates that each works with, everyone is required to be HIPAA compliant.

Since HIPAA applies to such a broad range of healthcare-related businesses, the training requirements are a bit flexible in their scope. Training is not optional, though. It’s an Administrative Requirement of the HIPAA Privacy Rule and an Administrative Safeguard of the HIPAA Security Rule.

As such, there are no specific training requirements. HIPAA regulations state that all entities provide training “as necessary and appropriate for members of the workforce to carry out their functions” (HIPAA Privacy Rule) and that all entities must “implement a security awareness and training program for all members of the workforce” (HIPAA Security Rule).

How to Meet HIPAA Training Requirements

Business roles and responsibilities will differ throughout each covered entity and their business associates, so training programs will differ on a case-by-case basis. You should refer to your risk assessment, which should define the function of each individual with access to PHI and ePHI, to develop an appropriate program for different groups.

Periodic Training

Neither the Privacy Rule nor the Security Rule provide specific timeframes for training. It is required for “each new member of the workforce within a reasonable period of time after the person joins the covered entity’s workforce” and “when functions are affected by material changes in policies or procedures.”

When HIPAA policies or procedures do change, or when work practices or technologies change, training only needs to be provided to employees whose roles are affected by the changes. It is up to each covered entity to stay on top of such changes and administer training within a reasonable timeframe.

Dos and Don’ts for HIPAA Compliance Training

• Do keep training short and to the point. Training sessions should be no more than 40 minutes and conducted regularly rather than “periodically.”
• Do include the consequences of a HIPAA breach. You should cover not only the financial penalties, but also how the breach will affect employees and those whose PHI has been compromised.
• Do include senior management, even if they have no contact with PHI. HIPAA compliance training should be taken seriously from top to bottom.
• Don’t go over HIPAA’s background. Employees only need to know how to handle and protect PHI and ePHI and how regulations affect their individual roles.
• Don’t simply quote the HIPAA guidebook. Use multimedia presentations that make the material memorable and easily understood and applied to day-to-day work.
• Don’t forget to document your training. If your organization is audited by OCR, you need to show the content of the training, when it was covered, to whom, and how often.

MAXtech Can Help You

We’re a technology company that specializes in helping healthcare professionals remain HIPAA compliant. Schedule a free HIPAA assessment with us to see how we can help you.