How HIPAA Affects Your Practice

If you’re running a medical practice, chances are you know what HIPAA is and why it was created. You may even be able to explain the five HIPAA rules.

However, when it comes to the details of how HIPAA affects medical practices, you probably still have a lot of questions. What are the bounds of a patient’s right of access? How does HIPAA restrict marketing or communication with others? Is it HIPAA-compliant to use AI applications in your office?

In this blog, we’ll try to improve your understanding of HIPAA regulations and the impact of HIPAA on healthcare practices.

Which of Your Employees Are Bound by HIPAA?

There are many entities bound by HIPAA, including healthcare plans and clearinghouses, but for the purposes of protecting your practice, you only need to worry about employees and any business associates you contract with.

Here’s the bottom line: since your medical practice is bound by HIPAA, anyone in your workforce is, too, whether they’re employees, contractors, or volunteers.

Some roles will only need introductory knowledge of HIPAA, but anyone with access to protected health information (PHI) will need to know a great deal more. This includes people who are directly involved in patient care and people with access to PHI through administrative work.

Altogether, this may include:

• Physicians
• Nurses
• Medical assistants
• Technicians
• Therapists
• Social workers
• Psychiatrists
• Psychologists
• Receptionists
• Schedulers
• Billers and coders
• Medical records personnel
• IT staff

Under HIPAA, medical practices are required to train their workforce on the relevant requirements. We’ll explore this further below.

What About Subcontractors?

If any of the work related to PHI is subcontracted out, that party is classified as a Business Associate (BA), not part of your workforce.

Business Associates are people or entities outside your workforce who perform functions/activities/services for you that involve the use of disclosure of PHI.

Relevant services may include:

• Medical billing companies
• Law offices
• Accounting firms
• Shredding services
• IT vendors
• Health insurance companies 
• Medical transcription services

Business associates are responsible for their own compliance and workforce training, but your practice is responsible for obtaining “satisfactory assurances” of HIPAA compliance before you disclose PHI. It’s also wise to periodically audit their policies and risk management plans. Even though you won’t be liable for any violations on their part, it can affect your reputation.

How is My Practice’s Communication Affected by HIPAA?

We live in a world where email and text are the most common and convenient methods of communication, but if you’re beholden to HIPAA, these communication methods get a little more inconvenient.

Whether you’re communicating with patients or other medical professionals, all emails, texts, video calls, and other communications must meet HIPAA’s privacy and security standards. Essentially, this means that any unencrypted communications should be completely stripped of identifying information. Our article on HIPAA-compliant texting explores this further.

In addition to how you communicate, HIPAA affects when and with whom. Staff should be well-versed about HIPAA’s guidance for when information can be shared with friends or family, as well as which communications with other healthcare providers require special permission and which don’t.

Communication with the public, through something like social media, is an area where you need to be particularly controlled and cautious.

What Fines Could You Face for Violating HIPAA?

There are many different types of HIPAA violations, including criminal and civil violations, so the questions of fines, jail time, and potential professional consequences run the gamut.

Depending on the nature of the violation, the intent, and whether the violator is a repeat offender, potential consequences include:

• Civil penalties, for those who violate HIPAA without malicious intent.
• Criminal penalties, for those who deliberately obtain and disclose PHI without authorization.
• Termination of employment.
• Medical license suspension or revocation.
• Civil lawsuits under some circumstances and in some jurisdictions.

Check out past articles on HIPAA violations to learn about common violations, the process of dealing with violations, and the minimum and maximum penalties by type.

Why HIPAA Training for Your Employees Is Important

Training your staff is an important part of HIPAA compliance for healthcare providers.

For one thing, it’s explicitly required by HIPAA. Healthcare providers must train their entire workforce on privacy policies and procedures, and they must provide regular training to anyone with access to PHI.

Training must be provided “within a reasonable amount of time” from when new members enter your workforce and when employees’ functions are affected by material changes in policies and procedures. Most entities repeat training at least once a year to fulfill the “repeated regularly” requirement, but HIPAA doesn’t prescribe any specific timeline.

The regulations also don’t specify particular topics, which means the training requirements are flexible but also confusing for small practices trying to make sure they meet compliance.

The best approach is to train each employee for a practical understanding of HIPAA regulations that apply to their role. One low-effort solution is to look for ready-made HIPAA courses by reputable providers as an effective and efficient means of ensuring HIPAA compliance in your medical practice.

Professionally-designed HIPAA training also helps you make sure that your workforce understands their obligations and exactly what it means to follow the law – which is the other reason HIPAA training is a critical piece of your HIPAA compliance strategy.

Checking off the training requirement is only a small part of the job. The rest is making sure that your staff knows how to comply with HIPAA on a daily basis.

This is the reason you shouldn’t choose just any off-the-shelf HIPAA course. Be wary of free HIPAA training, which may be incomplete, out of date, or have inadequate testing measures to demonstrate learner comprehension.

Get Role-Specific HIPAA Training Online

As a reputable and regulatory-approved compliance training provider for over 20 years, we’ve helped thousands of businesses ensure that their practice not only complies with statutory training requirements but also prepares their employees to follow the law.

Our courses are online, self-paced, and mobile-friendly. This allows your workforce to take their training at the best possible time and place to maximize retention.

Employees directly involved in patient care are best served by the HIPAA for Healthcare Workers course, while office and administrative personnel should take HIPAA for Medical Office Staff.

We also have HIPAA training tailored to dental offices, mental healthcare providers, and more.

To learn about fulfilling your broader training needs, talk to us about our enterprise solutions.

Get started today!