The Health Insurance Portability and Accountability Act requires that all covered entities (CEs) train their employees in HIPAA compliance. However, many covered entities and their business associates find the guidance given in HIPAA’s text quite vague. There are no stipulations given as to how employees must be trained, or exactly what information must be provided to them. This vagueness can be attributed to the variety of organisations which HIPAA covers. The legislation must be flexible enough to apply to a range of circumstances. HIPAA would run the risk of omitting certain entities if its wording was more specific.
There should be no doubt over the compulsory nature of HIPAA training, however. The HIPAA Privacy Rule (45 CFR §164.530) state training is an Administrative Requirement, and that training should be provided “as necessary and appropriate for members of the workforce to carry out their functions”. Training is an Administrative Safeguard of the HIPAA Security Rule (45 CFR §164.308), which requires that CEs and BAs “implement a security awareness and training program for all members of the workforce”.
HIPAA Compliance and Training Requirements
HIPAA training is an essential aspect of HIPAA compliance. If an organisation were to experience a data breach and the subsequent investigation found that no training had been provided to employees, the HHS’ Office for Civil Rights could levy a substantial fine against the CE or BA responsible.
Many CEs and BAs struggle with implementing effective HIPAA training due to the vagueness of the text. It is recommended that these organisations refer to any risk assessments that they have performed as a starting point for designing a training program. The risk assessments should have defined the function of everyone who may have contact with PHI or ePHI and, from this data, it should be possible to compile a “necessary and appropriate” security awareness and training program to suit each employee’s role.
Objectives of HIPAA Training
Employees should tailor security awareness and training program to complement functions or role of each employee, manager, volunteer, trainee or contractor who may have contact with PHI or ePHI. Organisations may need to run multiple security awareness and training programs to ensure the content is focused and relevant to trainees in question. Training programs are expensive and time-consuming to run, especially if multiple small-group sessions must be carried out.
However, as these training sessions mitigate the risk of a data breach occurring, organisations benefit from proper employee training in the long-term. HIPAA is a complex piece of legislation, and if employees try to run long, generic training sessions to get it “over with”, employees will have too much information to absorb what is relevant to their function and the objectives of the HIPAA training will be unsuccessful.
Advice for HIPAA Compliance Training
With there being no specific HIPAA training requirements, we have put together a handful of best practices HIPAA compliance managers may want to consider when compiling “necessary and appropriate” security awareness and training programs. Our best practices for HIPAA compliance training are not set in stone and can be selected from at will.
- Run regular, short, and focused training sessions. Forty minutes is a reasonable length of time for each session. Although the Department of Health and Human Services mandates annual training sessions, running regular sessions is result in more effective employee training.
- Inform employees of the consequences of HIPAA data breaches, not just the financial implications for the CE or BA, but the implications for trainees, their colleagues, and victims of the breach.
- Show that senior management takes HIPAA compliance seriously by having several high-up individuals in the company appear at training sessions.
- Keep the information concise and relevant; instead of going through all of HIPAA’s legislation, provide employees with the information relevant to protecting PHI and ePHI in their specific roles.
- Instead of using a lecture-style training session, make the training sessions engaging by using multimedia and encouraging audience participation.
- Document your training; the event of an OCR investigation or audit, it is essential to be able to produce the content of the training as well as when it occurred, to whom, and how frequently.
More Information on HIPAA Training Requirements
We have outlined some of the most critical aspects of HIPAA that any employee training course should cover. All employees at an organisation which handles the sensitive healthcare information of patients should be familiar with at least the basic requirements of data security outlined in HIPAA. Individual employees may require further training due to their roles in the organisation or how they interact with patient data. Proper employee training is one of the most effective ways of mitigating the risks of a data breach, so although the initial costs are high, the importance of training cannot be understated.
