HIPAA Training Requirements: Who Needs It and How Often

HIPAA is the Health Insurance Portability and Accountability Act of 1996. Its Administrative Simplification rules, written by the US Department of Health and Human Services (HHS), protect the privacy and security of health information. Three rules matter most for training:

• Privacy Rule: when PHI may be used or disclosed, the minimum necessary standard, and patients’ rights, such as getting copies of their records.
• Security Rule: administrative, physical and technical safeguards for electronic PHI (ePHI).
• Breach Notification Rule: what to do when unsecured PHI is breached, including notifying affected individuals without unreasonable delay and no later than 60 days after discovery.

Protected health information is individually identifiable health information held or sent by a covered entity or business associate, in any form: paper, electronic or spoken. Names, addresses, dates of birth, Social Security numbers, medical record numbers and diagnoses are all examples when linked to health information.

HIPAA applies to covered entities and their business associates:

• Covered entities: health care providers who conduct certain transactions electronically (such as billing insurance), health plans, and health care clearinghouses.
• Business associates: vendors that create, receive, maintain or transmit PHI on behalf of a covered entity, such as billing companies, IT and cloud providers, transcription services, law and accounting firms, and shredding companies.

The Privacy Rule requires training for all members of the workforce, which includes employees, volunteers, trainees and others whose work is under the organization’s direct control, whether or not they are paid. In practice that means:

The Privacy Rule says each new workforce member must be trained within a reasonable period of time after joining, and affected workers must be retrained within a reasonable time after a material change in policies or procedures. The Security Rule requires an ongoing security awareness and training program for all workforce members, including management, with periodic security reminders.

HIPAA does not set a fixed annual deadline, but annual HIPAA training is the widely accepted best practice. OCR looks for evidence of ongoing training when it investigates a complaint or breach, and many organizations, payers and accreditation bodies require it every year.

Training must be documented, and that documentation must be kept for 6 years from the date it was created or last in effect (45 CFR 164.530(j)).

1. What PHI and ePHI are, and why they are protected.
2. Permitted uses and disclosures, including treatment, payment and health care operations.
3. The minimum necessary standard: use or share only the PHI needed for the task.
4. Patient rights: access, amendment, accounting of disclosures, restrictions and confidential communications.
5. Security safeguards: passwords, locking screens, encryption, secure email and texting, mobile devices and remote work.
6. Recognizing phishing, malware and social engineering.
7. Physical safeguards: clean desks, secure printing, disposal of paper records and devices.
8. How to recognize and report a privacy or security incident or breach, and who the privacy and security officers are.
9. Sanctions for workers who violate policies.

Common real-world violations are surprisingly simple: looking up records of a family member, friend or celebrity out of curiosity, discussing patients where others can hear, emailing PHI to the wrong person, and losing an unencrypted laptop or phone.

No. HHS does not approve, certify or endorse any HIPAA training provider, and there is no government-issued HIPAA certification for individuals. A “HIPAA certificate” is a certificate of completion from a training provider, showing that you finished a course and passed its test. That is useful proof for an employer, but it does not replace your organization’s duty to train you on its own policies and procedures, such as how it handles records requests or reports incidents.

Gama Safety’s HIPAA course covers the general rules above. You pass the exam with 80% or better (unlimited free retakes) and download your certificate and printable wallet card right away. Clinics and practices can use team accounts from 2 seats to track annual training for the whole staff.

OCR can impose civil money penalties in four tiers, from violations the organization did not know about up to willful neglect that was not corrected, and the amounts are adjusted for inflation every year. Many investigations end with a resolution agreement and a corrective action plan that requires workforce training. Knowingly obtaining or disclosing PHI in violation of HIPAA can also be a federal crime, with penalties of up to $250,000 and 10 years in prison when done for commercial advantage, personal gain or malicious harm. Individual workers can also lose their jobs under their employer’s sanctions policy.