To most, HIPAA compliance boils down to a simple concept: the security of patient medical information. Patients expect their medical data to remain private and protected from prying eyes or theft. If your organization works with protected health information (PHI), it is your responsibility to make sure your workforce understands and follows HIPAA-compliant procedures.
A lot goes into designing HIPAA compliance training. Training should reflect your own policies and the jobs your staff perform, but there is plenty about HIPAA that every relevant worker should know. If you're planning a class, NSC's HIPAA Privacy & Security Rules Training program is available as a training program kit with streaming access, a PowerPoint presentation, a quiz, and an attendance log.
What is HIPAA?
The Health Insurance Portability and Accountability Act, or HIPAA, is a federal law that, together with later legislation such as the HITECH Act and HHS regulations, protects the privacy and security of individuals' health information. The rules most relevant to training are the Privacy Rule, the Security Rule, and the Breach Notification Rule, enforced by the HHS Office for Civil Rights (OCR).
Who needs HIPAA training?
HIPAA applies to covered entities and their business associates. Anyone in those organizations who may come in contact with PHI should be trained. That includes obvious healthcare roles like doctors, nurses, medical receptionists, and records staff, but also roles outside direct patient care.
What is a covered entity?
- Health care providers that conduct certain transactions electronically, such as clinics, hospitals, and medical, dental, psychological, and chiropractic practices.
- Health plans, including health insurance companies, HMOs, employer-sponsored group health plans, Medicare, and Medicaid. An employer that sponsors a group health plan is not itself a covered entity, but staff who handle plan information on the plan's behalf, often in human resources, must follow the plan's HIPAA policies.
- Health care clearinghouses.
What is a business associate?
Covered entities often work with vendors or subcontractors that create, receive, maintain, or transmit PHI on their behalf, such as data storage, IT, and networking providers, document shredding services, lawyers, billing companies, translation services, answering services, and consultants. These business associates must sign a business associate agreement and comply with the Security Rule and parts of the Privacy Rule.
What does HIPAA say about training?
Two rules contain training requirements:
- Privacy Rule (45 CFR 164.530(b)). A covered entity must train all members of its workforce on its policies and procedures for PHI, as necessary and appropriate for them to carry out their functions.
- Security Rule (45 CFR 164.308(a)(5)). Covered entities and business associates must implement a security awareness and training program for all members of their workforce.
The Privacy Rule training requirement is mandatory and does not specify content beyond the organization's own policies and procedures. The Security Rule's training standard is also required, but its implementation specifications (security reminders, protection from malicious software, log-in monitoring, and password management) are "addressable." That means the organization must assess whether each is reasonable and appropriate, implement it or an equivalent alternative, and document its decision.
What topics should HIPAA training cover?
HIPAA leaves the details of training to each organization. Ideally, training focuses on your own policies and procedures for complying with HIPAA. Even so, most programs cover these core topics:
Important HIPAA training topics
- The HIPAA Privacy Rule
- The HIPAA Security Rule
- Patients' rights
- Rules on uses and disclosures of PHI, including the minimum necessary standard
- Safeguarding electronic PHI (ePHI)
- Preventing HIPAA violations
- Breach reporting and notification
- Compliance and enforcement
Employees may need training in additional areas depending on their roles. Ultimately, it is up to the covered entity or business associate to determine the topics covered and to make sure its workforce is trained.
When should employees receive HIPAA training?
The Privacy Rule requires training for "each new member of the workforce within a reasonable period of time after the person joins the covered entity's workforce," and for each workforce member whose functions are affected by a material change in policies or procedures, again within a reasonable period after the change takes effect. In practice, that means training new hires before they access PHI, not months later.
How often is HIPAA training required?
HIPAA does not set a fixed refresher interval. The Security Rule calls for periodic security updates as part of the awareness program, and many organizations meet that expectation, and demonstrate ongoing compliance, by holding annual training. Regular refresher training helps ensure employees are:
- Refreshed on HIPAA requirements
- Aware of any policy changes since their last training session
- Knowledgeable about current cybersecurity threats and how to protect against them
Shorter reminders throughout the year, such as phishing alerts or password tips, reinforce knowledge between formal sessions.
Document your training
Covered entities must document that training was provided and keep that documentation for six years. Records should show who was trained, when, and on what. The quiz and attendance log that accompany NSC's training program kit can help with this documentation.
Tips for HIPAA compliance training
An effective HIPAA training program lets employees participate and practice what they learn. Discussions, questions, hands-on examples, and role-playing exercises all help employees retain what they're taught.
Steps you can take to keep employees attentive and engaged:
- Keep training sessions under an hour. Long sessions lose trainees' attention.
- Keep employees engaged. Asking questions and encouraging conversation keeps them involved.
- Keep handouts to a minimum and make the ones you use meaningful.
- Use a mix of media, including video, classroom presentation, quizzes, and discussion.
- Keep the message simple and tied to your own policies.
HIPAA compliance depends on effective training that gives employees the knowledge they need to apply these requirements in their everyday work. The best programs combine video, classroom presentation, and discussion of the organization's own policies and real scenarios.
For a closer look at day-to-day privacy practices for healthcare staff, see our guide to HIPAA privacy training for healthcare staff. For the broader picture, see our complete guide to healthcare facility safety training requirements and our guide to essential bloodborne pathogens training.
Ready to train your employees? NSC's HIPAA Privacy & Security Rules Training program is available in English and Spanish as streaming (30 days or 1 year), DVD, USB, or an MP4 license. Reinforce the training with HIPAA Privacy & Security Awareness Training Booklets and the HIPAA Notice of Privacy Act Poster.