HIPAA Essentials: Who Needs HIPAA Training?
Protecting patient privacy is a cornerstone of healthcare, and the Health Insurance Portability and Accountability Act (HIPAA) plays an important role in achieving this goal. To ensure organizations that handle protected health information (PHI) remain compliant, these employers are required to provide HIPAA training to employees.
But who exactly needs to be trained on HIPAA regulations?
This blog post will serve as your guide to understanding HIPAA training requirements and how to get trained to stay compliant.
What Industries or Businesses Need to Comply with HIPAA Training Requirements?
HIPAA applies to “covered entities” and their “business associates.”
The regulations specify that covered entities include:
- Healthcare Providers, including hospitals, clinics, physician practices, dentists, mental/behavioral health facilities, pharmacies, nursing homes, and more.
- Healthcare Plans, including health insurance companies, group health plans, health maintenance organizations, and government-funded health plans.
- Healthcare Clearinghouses that convert PHI into a uniform format for electronic transmission.
Under HIPAA, business associates include any organization or individual who performs a service for a covered entity that involves handling PHI. Common examples of business associates include:
- Billing and/or coding services
- Transcription services
- IT services
- Accounting firms
- Law offices
- Shredding services
If you qualify as a covered entity or business associate, you’re obligated by HIPAA rules to provide some kind of HIPAA training to each employee in your workforce.
HIPAA Training Responsibilities for Employers
The training required by HIPAA’s rules will depend on your status (covered entity vs business associate), as well as whether entities require PHI. There are three relevant requirements in the regulatory code:
- The Privacy Rule requires covered entities to train their entire workforce on privacy policies and procedures as appropriate.
- The Security Rule requires business associates to train their entire workforce on security awareness.
- The Privacy rule also requires both types of businesses to provide regular training to any employee with potential access to PHI.
Training is required “within a reasonable amount of time” from when:
- New members enter a covered entity’s workforce and
- Employees’ functions are affected by a material change in policies and procedures, AND
- To be repeated regularly.
Beyond that, HIPAA stays vague about the specifics of required training. That provides flexibility but also confusion about compliance. Most companies err on the side of training at least annually.
As for topics, training doesn’t need to be comprehensive for everyone. It’s a good idea to consider which topics are necessary for which roles and take a customized approach.
There are courses available that have already done this calculation for you based on broad sets of responsibilities, which can be helpful. More on this later.
Consequences of Non-Compliance with HIPAA Training Requirements
Why does it matter whether you comply with HIPAA training regulations?
Non-compliance may be discovered by HHS’s Office for Civil Rights (OCR) in two ways, either during:
- Routine compliance reviews of covered entities, or
- Investigations into complaints that have been filed.
OCR’s first step when non-compliance is discovered will be to resolve the case through voluntary compliance, corrective action, or a resolution agreement.
However, if they find that you’ve violated one of HIPAA’s criminal provisions, they may refer the complaint to the Department of Justice (DOJ), bringing a whole new layer of complications.
You have at least 30 days to resolve civil violations without a fine unless they determine there’s willful neglect. When an entity doesn’t resolve a civil violation to the OCR’s satisfaction by the given deadline, they’re empowered to impose civil money penalties. These are discretionary and vary widely based on whether each violation is ruled as unknowing ($100-$50,000 per violation, reasonable cause ($1,000-$50,000 per violation), or willful neglect ($10,000-$50,000 per violation.
The consequences for criminal violations are harsher but also tiered. They can include fines but also jail time.
Which Jobs Require HIPAA Training?
The short answer is that anyone whose organization has access to PHI will need some degree of HIPAA training to comply with regulations. More extensive training will be required for individuals with potential access to PHI. This is the case whether the individual is an employee, a contractor, or a volunteer.
People who are directly involved in patient care need a HIPAA course geared toward healthcare workers. This includes jobs like:
- Physicians
- Nurses
- Medical assistants
- Technicians
- Therapists
- Social workers
- Psychiatrists
- Psychologists
Anyone with access to PHI through office work needs a HIPAA course designed for administrative staff instead. This includes jobs like:
- Receptionists
- Schedulers
- Billers and coders
- Medical records personnel
- IT staff
We offer online HIPAA courses that are self-paced and available from any device with an internet connection. That allows everyone to study where, when, and how it suits them best.
Enroll today to stay compliant!
