HIPAA training for healthcare workers is a requirement of both the Privacy Rule and the Security Rule. In addition, Covered Entities may need to provide further HIPAA training for healthcare workers if a threat to the confidentiality, integrity, or availability of ePHI that could be mitigated by further training is identified in a risk assessment.
HIPAA is clear about the requirement for Covered Entities to provide HIPAA training for healthcare workers. The Administrative Requirements of the Privacy Rule (45 CFR § 164.530) state Covered Entities must provide training on the policies and procedures developed to prevent unauthorized uses and disclosures of PHI, when members of the workforce start working for the Covered Entity and when there is a material change in the policies and procedures.
Also, the Administrative Safeguards of the Security Rule (45 CFR § 164.308) state Covered Entities and Business Associates must implement a security and awareness training program for all members of its workforce. This requirement applies to every employee, volunteer, student, or other individual under the control of the Covered Entity or Business Associate regardless of whether or not they have access to electronic PHI (ePHI) – so therefore applies to cleaners, porters, and other support staff.
In addition, the Administrative Safeguards require Covered Entities and Business Associates to assess the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. If a risk assessment identifies a threat to ePHI that could be mitigated with further training, it will be necessary to provide further training as “necessary and appropriate”. The failure to reduce threats identified in a risk assessment is a violation of HIPAA under 45 CFR § 164.306.
What Should HIPAA Training for Healthcare Workers Consist of?
In respect of the Privacy Rule training requirements, Covered Entities are required to provide training “as necessary and appropriate for members of the workforce to carry out their functions within the Covered Entity [in compliance with HIPAA]”. Therefore, HIPAA training for healthcare workers should be on the policies and procedures developed to prevent unauthorized uses and disclosures that are relevant to healthcare workers´ functions.
However, depending on the content of the policies and procedures, training healthcare workers exclusively on policies and procedures may be insufficient to prevent foreseeable HIPAA violations. In some situations, it may not be possible to develop a policy or procedure that guides individuals towards a compliant course of action. Consequently, it is recommended to include training on the Privacy and Security Rules to prepare individuals for situations in which no procedure exists.
With regards to the content of a security and awareness training program, this should be determined by online security best practices and the results of a risk assessment. This may mean some less-technically capable members of the workforce require more security and awareness training than others, or that individuals in certain roles need different training than other individuals. Unfortunately, there is no “one-size-fits-all” HIPAA training for healthcare workers.
Overcoming the Challenges of HIPAA Training for Healthcare Workers
Differences in healthcare workers´ functions and technical capabilities are not the only challenges of providing HIPAA training for healthcare workers. In some areas, state laws may pre-empt certain areas of HIPAA due to providing greater privacy protections or expanding the obligations of Covered Entities and/or Business Associates. In states such as Texas, the pre-emption of HIPAA extends across state lines to any Covered Entity maintaining the personal data of a Texas resident.
This means it can be difficult to compile a single HIPAA training course suitable for a Covered Entity´s entire workforce. If too much content is packed into a single course, much of the content will be irrelevant to large groups of trainees and the likelihood is very little of what is relevant will be retained. Conversely, if the content of HIPAA training is scaled down too far, there may be gaps in training which result in foreseeable and preventable HIPAA violations.
The solution is to provide HIPAA training in a modular format that allows Covered Entities to mix modules according to functions, threats, and state laws. This format means Covered Entities can provide basic HIPAA training to all its workforce, and more relevant HIPAA training for healthcare workers. Modular HIPAA training can also easily be adapted when there is a material change in the policies and procedures or when a risk assessment identifies the need for refresher training.
HIPAA Training for Healthcare Workers FAQs
Why might policies and procedures be insufficient to prevent foreseeable HIPAA violations?
Although great care may have gone into developing HIPAA-compliant policies and procedures, it is important for healthcare workers to be familiar with HIPAA principles such as the Minimum Necessary Standard that can impact many areas of their work. There may also be occasions when healthcare workers are unsure whether or not to report incidental uses and disclosures or when PHI can be disclosed without patient consent for public health activities.
Why are employees with no access to ePHI required to have security and awareness training?
Although some employees may not have access to ePHI, if they have access to any online system their login credentials can be used by cybercriminals to infiltrate the system. Once inside the system, cybercriminals can move laterally through it looking for any vulnerability that will give them unauthorized access to ePHI. Consequently, it is important that all members of a Covered Entity´s or Business Associate´s workforce are included in security and awareness training.
How frequently should HIPAA refresher training for healthcare workers be provided?
The frequency of HIPAA refresher training for healthcare workers should be determined by a risk assessment if not required by a material change to policies and procedures or a regulatory update – state or federal. Most compliance organizations recommend refresher training is provided at least annually – which aligns with HHS´ guidance for conducting risk assessments.
How can Covered Entities organize modular training sessions to accommodate workflows?
Modular training sessions do not necessarily have to be conducted in a classroom environment. Because they are typically bite-sized extracts of HIPAA, it can be more convenient to use online training modules which healthcare workers can complete when there is a gap in their schedules. This eliminates the issue of large groups of healthcare workers being absent from their positions while they attend HIPAA training.
What documentation has to be retained to prove HIPAA training for healthcare workers has been provided?
If training is provided to a new intake of healthcare workers, it will be necessary to document the date, the names of the attendees, and the content of the training. If training results from a material change in policies or procedures, it will be necessary to document the training as above, plus retain a copy of the former policy or procedure. In the event training is provided as a consequence of a risk assessment, a copy of the risk assessment should be retained alongside the training documentation.
