The HIPAA training requirements are that “a covered entity must train all members of its workforce on policies and procedures […] as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity” (§164.530(b)(1) of the HIPAA Privacy Rule). In addition, a covered entity or business associate must “implement a security awareness and training program for all members of its workforce including management”. (§164.308(a)(5) of the HIPAA Security Rule).

What are the HIPAA Training Requirements?

The first thing to be aware of with respect to the HIPAA training requirements is that not only HIPAA-Covered Entities are required to comply with the HIPAA Privacy Rule training standard. The Applicability standard at the beginning of the HIPAA Administrative Simplification Regulations (§160.102) states “Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate”.

This means that if a HIPAA Business Associate provides a service for or on behalf of a covered entity that requires compliance with a HIPAA Privacy Rule standard, the business associate must also comply with the HIPAA Privacy Rule training standard. Both covered entities and business associates are required to comply with the HIPAA Security Rule training standard,  which applies to all members of the workforce regardless of whether they have access to PHI or not.

The HIPAA Privacy Rule Training Standard

To best explain the HIPAA Privacy Rule training standard, it is necessary to start with the “Policies and Procedures” standard of the HIPAA Privacy Rule’s Administrative Requirements. This standard states:

“A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart [the HIPAA Privacy Rule] and subpart D of this part [the Breach Notification Rule]. The policies and procedures must be reasonably designed, taking into account the size and the type of activities that relate to protected health information undertaken by a covered entity, to ensure such compliance.”

This standard requires HIPAA-Covered Entities (and HIPAA Business Associates “where provided”) to develop and implement policies and procedures for every area of their operations which may involve uses and disclosures of PHI – including how to react to unauthorized uses and disclosures. Thereafter, with the above standard in mind, the Training standard of Administrative Requirements states:

“A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.”

The HIPAA Security Rule Training Standard

Compared to the HIPAA Privacy Rule training standards, the HIPAA Security Rule training standard appears straightforward. It states:

“Implement a security awareness and training program for all members of its workforce (including management).”

To guide covered entities and business associates with what should be included in HIPAA security awareness training, the standard has four addressable implementation specifications:

1. Periodic security updates.
2. Procedures for guarding against, detecting, and reporting malware.
3. Procedures for monitoring login attempts and reporting discrepancies.
4. Procedures for creating, changing, and safeguarding passwords.

However, the section of the HIPAA Security Rule in which the training standard appears (the Administrative Safeguards §160.308) commences with the line “A covered entity or business associate must, in accordance with §164.306”. Section §164.306 contains the General Requirements for the HIPAA Security Rule, which state state covered entities and business associates must protect against any reasonably anticipated uses or disclosures not permitted under the HIPAA Privacy Rule. This implies organizations should incorporate HIPAA Privacy Rule training into HIPAA security awareness training, but it is left to organizations to make this connection themselves. Many don’t.

Therefore, although the HIPAA Security Rule training standard appears more straightforward, it potentially has more issues than the HIPAA Privacy Rule training standard inasmuch as there are many more opportunities for gaps in HIPAA knowledge and avoidable HIPAA violations. For example, training business associate workforces on detecting malware, reporting discrepancies, and safeguarding passwords, does not explain why it is a violation of HIPAA to copy and paste PHI databases and email them to yourself. HIPAA Security Rule training that only focusses on the cybersecurity aspects of HIPAA security will therefore have the wrong focus. The focus on HIPAA security awareness training should be the use and protection of PHI, and any technical aspects of cybersecurity are in the context of PHI.

Organizations that do incorporate HIPAA Privacy Rule training into HIPAA security awareness training can benefit from delivering HIPAA Security Rule training in the correct context. But, to combine training in this way, organizations have to develop multiple training courses to accommodate (for example) members of a covered entity’s workforce with different functions, and members of a business associate’s workforce with no access to PHI who have to undergo security training to “tick the box”.

How Often is HIPAA Training Required?

According to the HIPAA Administrative Requirements, HIPAA training is required for “each new member of the workforce within a reasonable period of time after the person joins the covered entity’s workforce” and also when “functions are affected by a material change in policies or procedures”, again within a reasonable period of time. As well as providing HIPAA training to new staff as soon as possible, the best practice in the healthcare sector is to provide healthcare staff with annual HIPAA training.

The HIPAA Security Rule training standard implies that security and awareness training programs should be ongoing. HIPAA training should also be provided whenever there is a change in working practices or technology, whenever a risk assessment identifies a need for further training, or whenever new rules or guidelines are issued by the Department of Health and Human Services (HHS). In order to assess whether HIPAA training is required, HIPAA Privacy and HIPAA Security Officers should:

• Monitor HHS and state publications for advance notice of rule changes. Ideally, this should involve subscribing to a news feed or other official communication channel.
• When new rules or guidelines are issued, conduct a risk assessment to determine how they will affect the organization’s operations and if HIPAA training is required.
• Liaise with HR and Practice Managers to receive advance notice of proposed changes in order to determine their impact on compliance with the HIPAA Privacy Rule.
• Liaise with IT managers to receive advance notice of hardware or software upgrades that may have an impact on compliance with the HIPAA Security Rule.
• Conduct regular risk assessments to identify how material changes in policies or procedures may increase or decrease the risk of HIPAA violations.
• Compile a training program that addresses how any changes will affect employees’ compliance with HIPAA – not only the changes themselves.
• Develop a HIPAA refresher training program that can be conducted at least annually if training is not provided for any other purpose.

Naturally, in the event of changes in working practices and technology, HIPAA training only needs to be provided to workforce members whose roles will be affected by the changes. As mentioned in our “Best Practices” section below, it is also advisable to include at least one member of senior management in the training sessions,  even if they are not affected by the new policies or procedures – as it shows the whole organization is taking its HIPAA training requirements seriously.

A potential issue with the frequency of training is that, if there are no material changes to policies and procedures, working practices, or technology, if no new rules or guidelines are issued by HHS, or if HIPAA security awareness training is only provided “periodically”, it can be a long time between training sessions, during which time members of the workforce may take shortcuts with compliance to “get the job done”. This is why the best practice in the healthcare sector is to provide healthcare staff with annual HIPAA training.

What Should be Included in a HIPAA Training Course?

The basic elements that should be included in a HIPAA training course are suitable as an introduction to HIPAA or can be used as the basis for am annual refresher course.

Recommended Content for HIPAA Compliance Training

The Role of the HIPAA Officers
This training should cover the roles of HIPAA Compliance Officer, HIPAA Privacy Officer, and HIPAA Security Officers, when to contact them, and how to use official reporting channels.

Definitions and Lexicons
This training should include clear definitions of PHI, ePHI, Minimum Necessary, Covered Entity, Business Associate, and Designated Record Set, with role-based examples.

The Main HIPAA Regulatory Rules
This training should cover the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule and how each maps to day-to-day tasks.

HIPAA Compliance for Staff
This training should include core obligations for handling PHI/ePHI, documentation standards, and step-by-step incident reporting.

Why HIPAA Compliance is Important
This training should cover benefits to patients, the organization, and employees, emphasizing confidentiality as part of care quality.

The Consequences of HIPAA Violations and Breaches
This training should include personal and organizational impacts, the difference between violations and breaches, and why prompt reporting matters.

Preventing HIPAA Violations
This training should cover common error patterns and practical habits to avoid them, including mindful, permitted disclosures.

PHI Disclosure Guidelines
This training should include required vs. permitted disclosures, exceptions, professional discretion, identity verification, and escalation triggers.

HIPAA Rights for Patients
This training should cover patient rights (access, amendments, restrictions, confidential communications, accounting of disclosures) and routing requests correctly.

HIPAA Security Rule: Threats to Patient Data
This training should cover accidental, internal, external, and environmental threats—and the importance of quick reporting.

HIPAA Security Rule: Protecting Electronic PHI
This training should include shared responsibilities for ePHI safeguards (devices, credentials, email) and when to alert Security about insider risks.

HIPAA and Emergency Situations
This training should cover permitted disclosures during medical, manmade, and physical emergencies and conditions for OCR enforcement discretion.

Recent HIPAA Updates
This training should include summaries of recent and proposed changes, workflow impacts, and practical cautions to avoid impermissible or missed disclosures.

Additional HIPAA Training Required for New Technologies

Several important technologies emerged after the passing of the HIPAA law and the subsequence introduction of the HIPAA rules.

HIPAA Training for Email, Messaging, and Texting
This training for staff must cover using only approved, secure channels for PHI; applying the Minimum Necessary standard; verifying identity before sending; and documenting disclosures per policy. It must teach employees how to craft message content (no diagnoses in subject lines, limited details in voicemails/texts), handle misdirected messages (immediate recall/notification and escalation), and use safeguards such as encryption, access controls, and auto-lock on mobile devices.

HIPAA Training for Social Media
This training for employees must explain how casual posts, photos, or “anonymous” case descriptions can disclose PHI and trigger sanctions. It must teach employees that once content is online they lose control of further disclosure or manipulation, and that work stories, images from clinical areas, and patient details—even without names—are risky. It should reinforce a culture of caution: follow organizational policy, avoid posting about patients or workplaces, and ask questions to the HIPAA Privacy and HIPAA Compliance Officers.

HIPAA Training for Artificial Intelligence (AI) Tools
This training must teach employees what AI tools are used in healthcare, when they are approved, and how unapproved or untrained AI can cause impermissible disclosures or exceed HIPAA Minimum Necessary Rule. It must cover best practices: never paste PHI into non-approved AI tools, validate AI outputs before use, log interactions as required, and report anomalies or inaccurate results. It must also explain that employees should not use AI to answer HIPAA compliance questions because these tools are often inaccurate or out of date.

Best Practices for HIPAA Compliance Training

Because no detailed HIPAA training requirements listed in the legislation, we have put together a short series of best practices that HIPAA compliance managers may want to consider when compiling “necessary and appropriate” security awareness training, HIPAA training for employees at onboarding, and HIPAA refresher training programs. Our best practices for HIPAA compliance training are not set in stone and can be selected from as best suits each training program.

• Do test trainees during the training because self-attestation does not work because staff will only pay attention if they know they are going to be tested.
• Do cover everything required. While it might be tempting to omit some elements of HIPAA to reduce the number of work hours required for an organization, it is a false economy that will almost certainly cost more in the longer term with regard to HIPAA violations or HIPAA breaches.
• Do include the consequences of a HIPAA breach in the training, not just the financial implications for the organization, but also the personal career implications for trainees and their colleagues, and of course the person(s) whose PHI has been exposed.
• Do provide Continuing Education Units (CEUs) during HIPAA training because they provide motivation for staff to complete the training. Only use HIPAA training that provides CEUs.
• Don’t quote long passages of text from the HIPAA guidebooks or the regulations. HIPAA compliance training not only has to be absorbed, but it also has to be understood and followed in day-to-day life.
• Do include senior management in the training. Even if senior managers have no contact with PHI, it is essential they are seen to be involved with HIPAA compliance training. Knowing that the training is being taken seriously at the top will encourage others to take it seriously.
• Don’t forget to document your training. In the event of an OCR investigation or audit, it is important to be able to produce the content of the training as well as when it was conducted, to whom, and how frequently. Trainees should sign attestations to confirm they have received training if progress is not monitored by a learning management system.
• Do provide comprehensive security awareness training that combines HIPAA compliance training and general online security training to cover best practices such as using a password manager, reducing phishing susceptibility, and backing up data. This will help to build a security culture in your organization and reduce the risk of data breaches.  The HIPAA security training must be targeted at PHI and medical records, not generic IT security training.

Additional State Medical Privacy Law Training

State medical privacy laws often supplement and sometimes preempt HIPAA by imposing stricter or additional obligations on workforce members that require additional training in these states. Staff must follow HIPAA plus any stricter state rule, for example, tighter consent, shorter response timelines, expanded breach notice content, or added safeguards for automated tools. It is therefore important that in some states, the HIPAA training also includes the related and relevant additional privacy training.

Texas Medical Privacy and Data Security Laws

In Texas, requirements can exceed HIPAA under the Texas Medical Records Privacy Act (as amended by HB 300), with further duties shaped by the Texas Identity Theft Enforcement and Protection Act, the Texas Data Privacy and Security Act, and AI-related measures such as the Texas Responsible AI Governance Act and SB 1188 on AI and electronic health records.

California Medical and Data Privacy Laws

California likewise layers additional protections above HIPAA through the Confidentiality of Medical Information Act, the Patient Access to Health Records Act, Medi-Cal rules, and the California Consumer Privacy Act/Privacy Rights Act (including automated decision-making provisions), along with new Health and Safety Code provisions added by SB 81 (Patient Access and Protection).

Additional Federal Laws

HIPAA is a federal statute that applies to covered entities and business associates, but it is not the only legislation covering the privacy and security of healthcare data. HIPAA sets minimum standards for health information privacy and security, but there are circumstances in which other federal and state health information privacy laws preempt HIPAA. For example, federal agencies also have to comply with the Privacy Act, while teaching institutions have to comply with FERPA.

States may also implement more stringent privacy requirements that preempt HIPAA. When more stringent requirements exist, in addition to providing HIPAA training, training must also be provided to comply with state laws where the state laws – or areas of the state laws – preempt HIPAA. For instance, organizations in Texas and those serving Texas residents are required to provide training on Texas HB 300 and the requirements of the Texas Medical Records Privacy Act, which go further than the minimum standards of HIPAA.

Targeted HIPAA Training

HIPAA Training Requirements for Employers

In most cases, the HIPAA training requirements for employers only apply to employers that are HIPAA-Covered Entities or business associates. Qualifying employers must provide HIPAA training to all members of the workforce regardless of their role within the organization as per the Administrative Safeguards of the HIPAA Security Rule.

If an employer is not a covered entity or a business associate but engages in HIPAA-covered transactions (for example, the employer administers a self-insured health plan), HIPAA training only needs to be provided to employees with access to PHI or ePHI. Further information about HIPAA training requirements for employers in these circumstances can be found in this article.

HIPAA Training for Employees

In addition to providing “necessary and appropriate” HIPAA training for employees, it is advisable to provide additional training that gives context to the training each employee receives. For example, when training employees on the HIPAA rules for PHI disclosures, it is recommended to also discuss the consequences of HIPAA violations.

Documenting the training provided to employees is a requirement of HIPAA. However, this has advantages inasmuch as, if material changes to policies or procedures occur and they impact only a specific area of HIPAA compliance, a record exists of who has been trained in that specific area of HIPAA compliance and who now needs refresher training.

HIPAA Training for Business Associate Staff

The HIPAA training requirements for business associates are often misunderstood because – notwithstanding the Applicability standard §160.102 – nowhere in the HIPAA Privacy Rule does it state HIPAA training for Business Associates is mandatory. However, the Administrative Safeguards of the HIPAA Security Rule (45 CFR § 164.308) state:

“A covered entity or business associate must … … implement a security awareness and training program for all members of its workforce (including management).”

While this could be interpreted as a general security awareness and training program rather than HIPAA awareness training for business associates, it makes sense for training to be HIPAA-related because if a violation of HIPAA occurs, and there is no evidence of appropriate HIPAA Business Associate training being provided, it will likely result in heavier sanctions for willful neglect.

Consequently, while Business Associates must comply with the HIPAA security standards relating to a security and awareness training program, it is advisable to train workforces on whichever elements of the Administrative Requirements, HIPAA Privacy Rule, and/or Breach Notification Rule are appropriate to individuals’ roles or which are stipulated in a Business Associate Agreement.

Business associate staff need HIPAA training because the Privacy Rule can apply to their roles in addition to standard security awareness. This training explains who is who (covered entities, business associates, subcontractors) and how PHI moves along the chain of custody, so employees understand their part of the workflow. It clarifies responsibilities under the HIPAA Security Rule, why safeguards exist, what a Business Associate Agreement (BAA) permits, and when to alert Security or Privacy if confidentiality, integrity, or availability could be at risk. Employees learn the limits on uses and disclosures tied to the BAA and the service provided, the Minimum Necessary principle for access, and the exact steps to take if a mistake exposes PHI. The program also sets expectations about consequences, sanctions, patient harm, and organizational costs, using case studies to keep compliance top of mind.

HIPAA Compliance Training for Students

The HIPAA Privacy Rule states that HIPAA compliance training should be provided to new employees “within a reasonable period of time of a new employee joining a covered entity’s workforce”; and while there may be justifiable reasons not to provide training before a new employee accesses PHI (for example, they have transferred from another healthcare facility and already have an understanding of HIPAA), that is not the case for healthcare students. The HIPAA training for healthcare students is different than regular HIPAA training because the students require extra training on some topics that are not relevant to regular healthcare professionals, such as using PHI in student assignments.

Healthcare students should be provided with HIPAA compliance training before they access PHI so they are aware of PHI disclosure guidelines when they start working with patients or when they use healthcare data to support reports and projects. With this in mind, an appropriate HIPAA compliance training course for healthcare students would consist of the elements listed above, plus further elements relevant to their education.

Electronic Health Record Access by Healthcare Students

During their training, healthcare students may be permitted to access EHRs under supervision. It is important students know what they can and cannot do with patient PHI under HIPAA, and also that it is a violation of HIPAA to use another person’s EHR login credentials to access patient PHI.

PHI & Student Reports and Projects

Students need to be aware that, when writing reports, preparing case studies, or giving presentations, they are unable to use PHI unless the patient has given their informed consent, or unless PHI is de-identified by removing any identifiers that make the health information “protected”.

Being a HIPAA Compliant Student

It is a student’s responsibility to understand the covered entity’s HIPAA policies and procedures and comply with them just as if they were a healthcare professional. They also need to know how to identify a violation of HIPAA and who to report the violation to.

HIPAA Training for Small Medical Practice Employees

Small medical practices have some unique circumstances that are different than, for example, hospitals. HIPAA training for small medical practice staff should prepare employees for real-world constraints: tight spaces, multitasking at a busy front desk, unfamiliar software, and working in close-knit communities where people ask about neighbors’ health. This training must teach employees to control the physical environment (screen privacy, clean desks, locked bins), manage interruptions without over-sharing, and use only approved systems for PHI, no personal email, texting, or ad-hoc tools. It should explain why copying shortcuts from others is risky, provide simple tech steps (strong passwords, MFA, logouts), and offer scripts to resist community pressure (“I can’t discuss patient information”). Employees must learn the difference between a violation and a breach, how to report incidents quickly, and what sanctions or external penalties can follow.

HIPAA Training for IT Professionals

While it is natural to assume HIPAA training for IT professionals should focus on IT security and protecting networks against unauthorized access, it is also important IT professionals receive training about the challenges experienced by frontline healthcare professionals operating in compliance with HIPAA.

This is so IT professionals design systems and develop procedures that streamline with healthcare professionals’ needs. If systems and procedures are too complicated or appear irrelevant to individuals’ roles, ways will be found to circumnavigate the systems – potentially placing ePHI at the risk of exposure, loss, or theft.

HIPAA Training for Medical Office Staff

Depending on the size of a medical office and the variety of roles filled by staff, HIPAA training for medical office staff is likely to be more comprehensive than for any other category of healthcare employee. This is because medical office teams can often deal with patients, their families, inquiries from third parties, suppliers, payment processors, and health care plans.

The range of scenarios medical office staff are likely to experience is one of the reasons HIPAA training needs to be memorable so it is applied in day-to-day life. With regards to HIPAA training for medical office staff, the more contextual it is the better, as it will help employees better understand the significance of HIPAA and why safeguarding ePHI is important.

 

 

HIPAA Refresher Training

In addition to being provided regularly to prevent the development of cultural norms, HIPAA refresher training should be provided to staff whenever new threats to patient data are discovered. It is important employees know how to identify the threats and respond to them and delaying training of this nature until an annual refresher training day could result in an avoidable data breach.

As well as covering changes to policies and procedures, HIPAA refresher training also needs to go over old ground periodically in order to remind employees why HIPAA is important and what patients’ rights are – especially as changes to the HIPAA Privacy Rule have recently been proposed that will improve data sharing and interoperability, and prohibit information blocking.

 

HIPAA Training Requirements FAQ

What is HIPAA training?

HIPAA training is part of the training new members of a covered entity’s workforce receive when they start working for a covered health plan, healthcare clearinghouse, healthcare provider, or pharmacy. The training should include an explanation of terms such as Protected Health Information and why it is necessary to protect the privacy of individually identifiable health information.

Additionally, HIPAA training should consist of security awareness training such as password management and phishing awareness. This element of training should not only be provided for members of a covered entity’s workforce, but also to members of a business associate’s workforce regardless of the access to electronic Protected Health Information.

How long is HIPAA training good for?

HIPAA training is good for one year because best practice in the healthcare sector is to provide annual HIPAA training.

There are circumstances where additional HIPAA training is required, such as when the HSS issues new guidelines,  when members of the workforce are required to undergo HIPAA refresher training due to an internal company policy, when an empolyee receives a sanction for a non-compliant event, or when there is a Corrective Action Plan imposed by HHS.

As well as policy and procedure training, the HIPAA Security Rule stipulates that all members of the workforce are required to participate in a security awareness and training program. As the use of the term “program” implies security and awareness training is ongoing, HIPAA training of this nature has no specific expiry date. It is necessary to continue improving the workforce’s resilience against online threats.

How can you get HIPAA training?

In most cases, you get HIPAA training from your employer when you start working for a business required to comply with the HIPAA Privacy, Security, and/or Breach Notification Rules. However, if you have no previous knowledge of HIPAA, it can be beneficial to invest in an online HIPAA training course to better understand the basics of HIPAA before moving onto policy and procedure training.

When must new employees complete their HIPAA training?

New employees must complete their HIPAA training “within a reasonable period of time” according to the HIPAA Privacy Rule. However, some states and some organizations have fixed time limits. For example, new employees in Texas must complete their HIPAA training within 90 days, while personnel attached to the Defense Health Agency must complete their training within 30 days.

How often should HIPAA training be completed?

HIPAA training should be completed as often as is necessary to mitigate the risk of a HIPAA violation or data breach. For some members of the workforce, this may mean completing HIPAA training monthly or quarterly; while, for other members of the workforce, annual refresher training is often sufficient to maintain a compliant organization.

Is there a difference between HIPAA compliance training and other types of HIPAA training?

Although there is no official difference between HIPAA compliance training and other types of HIPAA training, some organizations refer to policy and procedure training as HIPAA compliance training while HIPAA rules and regulations training (i.e., security and awareness training) is referred to as HIPAA training.  The HIPAA Journal has designed its HIPAA training to provide comprehensive training on HIPAA rules and regulations.

How often do healthcare workers need to have HIPAA training?

Healthcare workers need to have HIPAA training as often as required to perform their roles in compliance with the HIPAA Privacy, Security, and Breach Notification Rules. Many healthcare workers only have HIPAA training when they start working for a new employer and when there is a material change to policies and procedures – and this is often not enough to ensure compliance.

How long must HIPAA security awareness training documents be maintained?

HIPAA security awareness training documents must be maintained for as long as policies or procedures related to the training (including sanctions policies) are in force plus six years. This is because documentation relating to policies and procedures have to be maintained for six years from the date they are last in force and, if training is based around the policies and procedures, the documents relating to the training must also be maintained for the same period of time.

How often does CMS require HIPAA training?

Although the Centers for Medicare and Medicaid Services (CMS) regulates compliance with Part 162 of HIPAA (relating to the operating rules for transactions, code sets, identifiers, etc.), CMS does not require HIPAA training. However, the agency does provide a series of web-based training courses on the Medicare Learning Network which cover a broad range of topics related to Part 162 compliance.

Who is in charge of HIPAA training?

The individual in charge of HIPAA training is the Privacy Officer or the Security Officer depending on whether the training relates to HIPAA policies and procedures or security and awareness training. Although in charge of training, neither Officer has to be present during a training session if – for example – a member of the IT team is demonstrating how a software solution works.

HIPAA requires specific training on what?

HIPAA requires specific training on the policies and procedures developed by the organization to protect the privacy of individually identifiable health information. Members of the workforce do not have to receive training on every policy and procedure – just those that are relevant to their roles (although it is also a good idea to provide general HIPAA training to all members of the workforce).

Where do I take HIPAA training for the army?

HIPAA training for the army is required for all Defense Health Agency military, civilian, and contractor personnel within 30 days of onboarding and annually thereafter. HIPAA training and Privacy Act training (also a requirement for Defense Health Agency personnel) is accessible via the Joint Training System on the Joint Chiefs of Staff website.

Are the training requirements under HB 300 any different from the HIPAA training requirements?

The training requirements under HB 300 are different from the HIPAA training requirements inasmuch as new members of a workforce subject to the Texas Medical Records Privacy Act must be trained on policies and procedures within 90 days. The HIPAA training requirements are that new members of the workforce are trained “within a reasonable period of time”, so the difference is that HIPAA does not stipulate a timeframe whereas HB 300 does.

It is worth noting that HIPA-Covered Entities are exempted from complying with the Texas Medical Records Privacy Act, but business associates are not. As a result, HB 300 applies to more types of organizations than HIPAA; and, while the training “requirements” do not differ a great deal, the number of organizations required to provide training is much higher.

Can Covered Entities be fined for not providing HIPAA training?

Covered entities can be fined for not providing HIPAA training if it transpires that a violation investigated by HHS’ Office for Civil Rights is attributable to a lack of training. Most often, rather than fine a covered entity, HHS’ Office for Civil Rights will require the covered entity to follow a Corrective Action Plan which includes monitored and documented training.

Is it necessary to have HIPAA refresher training whenever new technology is implemented?

It is necessary to have HIPAA refresher training whenever new technology is implemented if the new technology is being implemented to address a vulnerability or threat to the privacy and security of Protected Health Information. In most cases, the HIPAA element of the training will be incorporated into the technology element of the training to make both elements more understandable.

If a material change to a policy occurs, but it only affects a few people, is it necessary for everyone to undergo refresher training?

If a material change to a policy occurs, but it only affects a few people, it is not necessary for everyone to undergo refresher training unless the material change has a knock-on effect for other members of the workforce. For example, if a covered entity changes its policy for responding to PHI access requests, only those who respond to PHI access requests need to undergo refresher training, but public-facing members of the workforce will also need to know the policy has changed.

How much is the fine for failing to comply with the HIPAA training requirements?

The fine for failing to comply with the HIPAA training requirements – if a fine is imposed – varies according to the nature of a subsequent violation attributable to the training failure. Fines for failing to comply with the HIPAA training requirements can also be imposed when no subsequent violation has occurred if the training failure is identified during a compliance audit.

How does HHS’ Office for Civil Rights find out about HIPAA training violations?

HHS’ Office for Civil Rights can find out about HIPAA training violations in a number of ways. The agency can discover a training violation when investigating a complaint from a patient, when investigating a data breach, when investigating a tip-off from a member of the workforce, or when conducting a compliance audit.

Is it a requirement to provide HIPAA refresher training to the entire workforce when there is a material change to a policy or procedure?

It is not a requirement to provide HIPAA refresher training to the entire workforce when there is a material change to a policy or procedure unless the material change affects the entire workforce. For example, if there is a change to the content of Business Associate Agreements, only those members of the workforce that handle Business Associate Agreements will have to undergo HIPAA refresher training. However, if there is a material change to the organization’s HIPAA sanctions policy, all members of the workforce need to be trained on the implications of the change.

Why do all members of the workforce have to have HIPAA security and awareness training?

All members of the workforce have to have HIPAA security and awareness training because it is important that all members of the workforce are aware of cyber risks. Cybercriminals do not necessarily know who has access to PHI stored on a network, so will target every member of the workforce to try to infiltrate the network and move laterally until they find unprotected PHI.

Is there a benefit of HIPAA training packages offered by third-party compliance companies?

There is a benefit of HIPAA training packages offered by third-party compliance companies inasmuch as the packages provide a foundation of HIPAA knowledge. Trainees learn about the basics of HIPAA, why it exists, and what it protects to better prepare them for when they undergo policy and procedure training – which is subsequently more understandable.

For covered entities and business associates, the benefit of HIPAA training packages offered by third-party compliance companies is three-fold. The packages prepare new members of the workforce for more advanced policy and procedure training, put security and awareness training into context, and can also be used as the basis for periodic refresher training.

Who is responsible for organizing HIPAA training?

HIPAA compliance officers should be responsible for organizing HIPAA training for members of the workforce – although they don’t necessarily have to conduct the training themselves. If, for example, HIPAA security and awareness training involves how to compliantly use a new piece of software, it may be better for a member of the IT team to present the training – although the compliance officer should be in attendance at the presentation.

Should a Privacy Officer provide privacy training and a Security Officer provide security training?

While it would appear to make sense that a Privacy Officer provides privacy training and a Security Officer provides security training – as each Officer should be a specialist in their own field to answer questions – it is not necessary to divide training responsibilities. A lot of crossover exists between privacy and security in HIPAA, so both topics can often be covered together in a training session unless the session is about a specific privacy or security topic.

What is an example of a “material change to policies”?

An example of a material change to policies is when hospitals had to amend policies and procedures to accommodate the change from CMS’ Meaningful Use program to the Promoting Interoperability program. If the policy changes affect the way in which ePHI is managed, the personnel involved in managing data for the Promoting Interoperability program should undergo training to avoid there being gaps in their knowledge.

Which senior managers should be involved in HIPAA training?

All senior managers must be involved in HIPAA training – particularly security and awareness training. Additionally, while it is important all senior managers are aware of the impact HIPAA compliance has on operations, it is more practical to involve (for example) CIOs and CISOs in technology training, and CFOs in training that concerns interactions between healthcare organizations and health insurance companies.

What is the most important element of HIPAA training?

The most important element of HIPAA training should be determined by a risk assessment. Thereafter, the “most important element” of HIPAA training will vary on a case-by-case basis and likely vary according to workforce roles. However, it is important for personnel to understand why HIPAA is important and why they are undergoing training in a particular aspect of HIPAA compliance.

How long does HIPAA training take?

How long HIPAA training takes is subject to the amount of content included in the session, the number of people attending the session, and the volume of questions asked during and after the session. Online training modules generally take around five minutes each, so it would take around two hours to complete an online training course, but probably longer in a classroom environment.

How often do you have to do HIPAA training?

How often you have to do HIPAA training depends on factors such as material changes to policies and procedures, risk assessments, and OCR corrective action plans. In addition, as well as maintaining an ongoing security and awareness training program, it is recommended covered entities and business associates provide HIPAA Privacy Rule refresher training at least annually.

Why is HIPAA training important?

HIPAA training is important because – beyond the legal requirement to provide/undergo HIPAA training – it demonstrates to members of the workforce how covered entities and business associates protect patient privacy and ensure the confidentiality, integrity, and availability of PHI so members of the workforce can perform their duties without violating HIPAA regulations.

Who needs HIPAA training?

Everybody needs HIPAA training if they are a member of a covered entity’s or business associate’s workforce. This not only means employees have to be trained on HIPAA policies, but also volunteers, students, and contractors who may encounter Protected Health Information in visual, verbal, written, or electronic form. It is also a requirement of the HIPAA Security Rule that all members of the workforce – including senior managers – participate in a security and awareness training program.

When does HIPAA training expire?

HIPAA training does not expire – even though some training organizations issue time-limited certificates of compliance. No training provided in compliance with the HIPAA Privacy and Security Rules has an expiry date unless changes are made to policies and procedures, a risk analysis identifies a need for further training or an individual moves from one covered entity to another where different policies and procedures apply and the new employer has a legal obligation to provide HIPAA training on the different policies and procedures.

What kind of HIPAA training do I need to provide to new hires for HIPAA and HITECH?

The kind of HIPAA training you need to provide to new hires for HIPAA and HITECH depends on whether your organization is a covered entity or business associate.

If your organization is a HIPAA covered entity, you must train new hires on policies and procedures with respect to Protected Health Information and the Breach Notification Rule, and provide security and awareness training.

If your organization is a business associate for a covered entity, the training you need to provide for new hires varies according to the service provided to the covered entity. Breach notification training and security and awareness training are mandatory. However, it may be a condition of a Business Associate Agreement that your organization also provides HIPAA Privacy Rule training to new hires.

Why is documentation of HIPAA training necessary?

The documentation of HIPAA training is necessary for two reasons. First, it demonstrates a covered entity or business associate is complying with the HIPAA training requirements in the event of an audit, inspection, or investigation. Secondly, it records what training has been received by individuals to determine if additional training is required as a consequence of a risk analysis, a policy change, or a promotion.

What do you learn during HIPAA training?

What you learn during HIPAA training depends on the reason for the training being provided. HIPAA training for new employees will likely focus on the basics of HIPAA, policies, and procedures relating to PHI in the workplace, and how to respond to a breach of PHI. Security and awareness training will likely be more focused on best practices for accessing, using, and sharing ePHI online. There may also be occasions when HIPAA training focuses on specific issues identified in a risk assessment or prompted by a patient complaint.

What is a HIPAA training certificate?

A HIPAA training certificate is a third-party accreditation awarded to individuals who pass a HIPAA training course. Often the courses are designed to provide individuals with a basic knowledge of HIPAA so that subsequent training on (for example) policies and procedures or security and awareness is more understandable. HIPAA training certificates can also demonstrate to potential employers that a job candidate has an understanding of the HIPAA rules and regulations.

Who is responsible for training students about HIPAA?

The organization responsible for training students about HIPAA is the covered entity they are under the control of when first exposed to Protected Health Information. However, teaching institutions that do not provide medical services to the general public are not considered to be covered entities. Because of this, it may be the case a student does not receive any HIPAA training until after they have graduated and start working as an employee for a healthcare organization.

What HIPAA training is required?

What HIPAA training is required depends on the reason for the training. The basic HIPAA training requirements are that covered entities train members of the workforce on HIPAA-related policies and procedures relevant to their roles and that both covered entities and business associates provide a security awareness and training program. These requirements are not sufficient to prevent the most common types of HIPAA violations, and it is recommended all businesses supplement the minimum requirements with frequent refresher training.

The post HIPAA Training Requirements appeared first on The HIPAA Journal.