Courses that provide HIPAA certification for students can be valuable assets for Covered Entities attempting to cultivate a HIPAA-compliant workforce as they resolve issues with the training requirements of the HIPAA Privacy and Security Rules and maintain students´ knowledge of HIPAA as they progress towards becoming healthcare professionals.
When students are studying to become healthcare professionals, there is a lot to absorb. Not only do they have to learn the technical skills and adopt the values of the medical profession, but they also have to become good communicators, considerate listeners, and enthusiastic team players – all while carrying out their functions in compliance with state and federal regulations.
One of the most important federal regulations students are required to comply with is the Healthcare Insurance Portability and Accountability Act (HIPAA). HIPAA has the objective of ensuring individuals´ health information is properly protected while allowing the flow of health information needed to provide high quality healthcare in order to protect the public´s health and well-being.
To achieve its objective, the HIPAA Privacy and Security Rules stipulate what training should be provided to members of the workforce – defining workforces as “employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a Covered Entity, is under the direct control of such Covered Entity, whether or not they are paid by the Covered Entity”.
Consequently, students should receive HIPAA training at the earliest opportunity after joining a Covered Entity´s workforce to prevent avoidable HIPAA violations due to a lack of knowledge. Thereafter, they should also receive refresher training – at least annually – to ensure the training they have received is not forgotten due to the volume of other information they have to absorb.
Issues with the HIPAA Training Requirements
Due to HIPAA being written in a way that accommodates the different working practices of Covered Entities and Business Associates, there are issues with the HIPAA training requirements. For example, under the HIPAA Privacy Rule, Covered Entities are required to “train all members of its workforce on policies and procedures with respect to PHI […] as necessary and appropriate for members of the workforce to carry out their functions within the Covered Entity”.
In the context of HIPAA training for students, this requirement (45 CFR § 164.530) assumes students are already aware of what PHI is, why it should be protected, when it can be used or disclosed, and how it should be disclosed (i.e., the minimum necessary). There may also be assumptions students are aware of patients´ rights, the threats to patient data (and why the threats exist), and the consequences of unauthorized disclosures in addition to those included in the sanctions policy.
Similarly, the training requirements of the HIPAA Security Rule (45 CFR § 164.308) state Covered Entities must implement a security awareness and training program to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI). Again, the requirement assumes students already have an understanding of what ePHI is and why it should be protected when they receive training on the technology implemented to safeguard ePHI and how to use it.
Consequently, gaps can exist in students´ knowledge due to a lack of understanding at the time they receive mandated HIPAA training. These gaps can manifest as avoidable HIPAA violations despite students being supervised during clinical rotations and at other times when they have access to PHI. For example, a student might not realize it is a violation of HIPAA to share their work experiences via social media when they mention a patient´s name or the treatment the patient is receiving.
Avoiding Avoidable HIPAA Violations
There are multiple scenarios in which students can avoidably violate HIPAA. These can be attributable to a lack of initial knowledge, the difficulty of having too many procedures to remember after they have received initial training, and the environment in which they work. It is also difficult for Covered Entities to know how much each student knows about HIPAA when they join the workforce and how much information from their initial Privacy Rule training they have retained.
Courses that provide HIPAA certification for students can overcome these issues by providing basic training on HIPAA before students embark on “policy and procedure” training and security awareness training. The courses can also be used to provide refresher training to ensure HIPAA best practices are maintained throughout students´ educations; and – because the courses provide HIPAA certification for students – Covered Entities stay up to date with each student´s level of knowledge.
HIPAA certification for students also help Covered Entities more easily document training (a requirement of the Privacy Rule). Certificates are issued as each course is completed for the modules covered in that course, and these certificates can be used to demonstrate that students have been provided with training if a Covered Entity is investigated by HHS´ Office for Civil Rights after a HIPAA violation, data breach, or patient compliant.
HIPAA Certification for Students: Not Just for Students
Although courses that provide HIPAA certification for students do not replace the requirement to train members of the workforce on policies and procedures or implement a security and awareness training program, they can be valuable assets for Covered Entities attempting to cultivate a HIPAA-compliant workforce in order to avoid avoidable HIPAA violations, mitigate the likelihood of a data breach, and reduce the number of patient complaints.
Furthermore, courses that provide HIPAA certification for students do not have to be used exclusively for students – they can also be used to provide refresher training for all members of the workforce. On our HIPAA Student Training page, we list twenty-one modules in our student training course – many of which can be used to refresh the HIPAA knowledge of existing members of the workforce. Alternatively, Covered Entities can adopt other training packages to their needs.
One of the advantages of providing HIPAA training via online modules is that modules can be completed when time allows in busy schedules. There is no need for workplaces to be disrupted by classroom-style training sessions; and, in the same way as students receive a certificate for completing each course, all members of the workforce can also be certified as having received HIPAA refresher training – further demonstrating compliance with the HIPAA training requirements.
