Solo private practices and small group practices are subject to the same HIPAA regulations as nationwide health care systems, and therefore HIPAA training for small medical practices has to cover the same range of subjects as much larger organizations – with fewer resources.
Even though small medical practices may have fewer patients than nationwide health care systems – and may specialize in just a handful of disciplines – it does not exempt them from complying with any of the HIPAA regulations. Consequently, small medical practices are required to provide the same Privacy Rule and Security Rule training as other Covered Entities.
This means members of the workforce with access to PHI must receive training on the medical practice´s policies and procedures in respect to PHI “as necessary and appropriate for the members of the workforce to carry out their functions”. These individuals will also require further training “when functions are affected by a material change in policies and procedures”.
Furthermore, all members of a medical practice´s workforce have to undergo awareness and security training – even those who do not have access to ePHI. This is because systems can be crippled by malware regardless of the point at which malware enters the system, so it is important all members of the workforce receive training about online security to mitigate cyberthreats to ePHI.
When Else Might HIPAA Training for Small Medical Practices be Necessary?
In addition to the above, HIPAA training for small medical practices has to be provided when a risk analysis identifies a potential risk or vulnerability that could be reduced to a reasonable and appropriate level with further training. Even if a technology measure is implemented to mitigate the risk, it may still be necessary to train individuals on how the measure should be used compliantly.
It can also be the case that HHS´ Office for Civil Rights (OCR) determines further training is necessary as part of a corrective action plan. Corrective action plans are the OCR´s preferred course of action following an investigation into a patient compliant or self-reported HIPAA violation – provided the violation was not attributable to “willful neglect” and efforts were made to correct the cause of the violation within 30 days. Corrective action plans can also be the result of OCR audits and inspections.
While enforced additional training due to a risk assessment or corrective action plan is a better outcome than a data breach, the provision of additional training requires resources that could be better used elsewhere. Enforced additional training also means members of the workforce will have to interrupt their duties to attend training – disrupting the operations of a small medical practice.
Refresher Training Can Fill Knowledge Gaps and Prevent Additional Training
Many compliance experts recommend Covered Entities conduct refresher HIPAA training at least annually in order to help members of the workforce comply with the HIPAA regulations in their day-to-day roles. While refresher HIPAA training for small medical practices can certainly help with retention and compliance, the same issues exist with a lack of resources and operational disruptions.
The way to overcome these issues is with HIPAA training packages from third party companies that offer training in a modular online format. The modular nature of the training enables members of the workforce to undergo HIPAA training when they have time, while the fact that the training is provided online means trainees do not have to leave their desks while training.
Although online modular training cannot replace training on policies and procedures – because each Covered Entity has unique policies and procedures – it has the advantages of being cost-effective, convenient, and scalable, and can help fill knowledge gaps that might otherwise lead to enforced additional training attributable to the results of a risk analysis or corrective action plan.
HIPAA Training for Small Medical Practices FAQs
Whose responsibility is it to organize HIPAA training for small medical practices?
Covered Entities are required to appoint a HIPAA Privacy Officer and HIPAA Security Officer or – in a small medical practice – assign these roles to an existing member of the workforce. It is this individual´s responsibility to organize, monitor, and document training.
If small medical practices do not provide the same range of services as large health systems, why are the HIPAA training requirements the same?
The objectives of HIPAA training are to protect the privacy of PHI and ensure the confidentiality, integrity, and availability of ePHI. These objectives still have to be met whether the Covered Entity has one patient or one million patients.
If a member of the workforce doesn´t have access to the practice´s system at all, do they still have to undergo security and awareness training?
Even if an individual has no access to systems (via login credentials), it is still important they undergo security and awareness training in case a situation occurs in which the confidentiality, integrity, or availability of ePHI is placed at risk – for example, a natural disaster or fire.
What sort of additional HIPAA training is usually required in a corrective action plan?
The OCR receives more than 20,000 complaints each year, many of which are attributable to unauthorized uses and disclosures or patient access rights. Therefore, a Covered Entity may be required to provide additional training on these subjects to prevent further complaints.
How can you monitor and document the completion of modular HIPAA training?
Each HIPAA training module has a questionnaire at the conclusion of the module. Each member of the workforce has to complete the questionnaire successfully for the module to be recorded on the individual´s training record. In many cases, the completion of each module is recorded automatically on a Learning Management System to reduce the administrative overhead of documentation.
