HIPAA Compliance Training: Resources for Facilities

Healthcare technology improves the way patients get care. Tools like electronic health record (EHR) systems improve access to care by allowing healthcare providers to obtain important health information wherever they are. However, with improved accessibility to sensitive information comes a greater need to protect patients’ privacy and security.

As a healthcare leader, you can ensure patient privacy is protected at your facility by providing effective HIPAA compliance training for healthcare and administrative staff. Read about the importance of HIPAA compliance and what to include in a training program.

HIPAA Overview

The Health Information Portability and Accountability Act (HIPAA) was enacted in 1996 by Congress to improve efficiency and effectiveness in the U.S. healthcare system. HIPAA is a federal law requiring national standards to protect sensitive health information from being shared without an individual’s consent or knowledge. It’s regulated by the Department of Health and Human Services (HHS), which adopted national standards for unique health identifiers, security, and electronic transactions and code sets.

Advancements in healthcare technology led to HIPAA provisions which mandate the adoption of federal privacy protections for electronic health information. HIPAA Rules were created to set national standards for handling protected health information (PHI) in an electronic format, including the following:

• The Privacy Rule applies to covered entities including healthcare providers, health plans, and healthcare clearinghouses that handle electronic healthcare transactions. This rule sets national standards that protect individually identifiable health information.
• The Security Rule protects the integrity, confidentiality, and availability of PHI.
• The Enforcement Rule includes provisions regarding compliance and investigations, covering topics such as civil penalties and the handling of violations of Administrative Simplification Rules.
• The Omnibus Rule addresses privacy and security protections included in the Health Information Technology for Economic and Clinical Health (HITECH) Act, which gives HHS authority to create programs that improve healthcare quality, safety, and efficiency with healthcare technology. Examples include EHR systems and programs that facilitate the exchange of healthcare information.
• The Breach Notification Rule explains how to handle breaches, or the unauthorized use or disclosure of sensitive information. It includes procedures for analyzing risk and notifying individuals or the public in the event of a security breach that compromises PHI.

What Is HIPAA Compliance?

Being HIPAA compliant means covered entities adhere to the standards and implementation practices of HIPAA Rules. Failure to comply with HIPAA regulations can result in civil monetary penalties with fines ranging from $100 to $50,000 per violation. Criminal offenses, which are handled by the Department of Justice, may result in imprisonment.

HHS’s Office for Civil Rights (OCR) conducts compliance audits and investigates complaints related to patient safety confidentiality laws. All covered entities and business associates may be subject to an OCR audit. During the audit selection process, an OCR representative will reach out to your organization to collect information such as your facility size, how many patients you see a year, and your business associates (persons or entities that use protected health information to perform certain functions on behalf of a covered entity, such as claims processing, billing, and data analysis).

Healthcare employers can prepare for periodic audits by:

• Performing risk assessments
• Providing staff education about HIPAA Privacy and Security Rules
• Being prepared for OCH audits
• Employing a Privacy Officer or Security Officer to create a HIPAA Compliance Checklist for the organization
• Maintaining a record of healthcare employee training completion

Who Needs Compliance Training?

Covered entities — which include healthcare organizations, institutions, or individuals — must comply with HIPAA’s privacy and security rules. Business associates are only required to comply with the security rule. As part of a compliance program, healthcare employers must certify their workforce in the appropriate training. New members at a covered entity must undergo HIPAA training within a reasonable time period of joining the workforce.

What Is HIPAA Compliance Training?

There isn’t one standardized HIPAA compliance training that covers the broad range of healthcare entities that need to comply with HIPAA Rules. To create a program, healthcare facility leaders can gather information from resources such as:

• HHS’s HIPAA training materials
• The free HIPAA compliance checklist
• Health IT privacy and security resources for providers
• Certification courses providing HIPAA compliance training online

As you begin creating staff training, establish course objectives that align with program goals. Consider using the seven elements of a compliance program as a guideline:

1. Having written policies, procedures, and conduct standards
2. Designating a compliance committee with a compliance officer
3. Delivering staff education such as a HIPAA certification for healthcare workers CEU course
4. Having clear lines of communication
5. Performing internal audits
6. Having disciplinary guidelines and enforcing them
7. Taking corrective action and responding promptly to offense

What to Include in Compliance Training

When creating a HIPAA staff training program, remember to keep the course concise and simplified so employees can get a clear understanding of the content. HIPAA rules are complex, so create learning material that covers the basic rules and how they affect your organization. Periodic internal compliance audits help leaders evaluate the program and compliance within your organization.

Consider including the following sections in HIPAA training for employees at your healthcare facility:

• HIPAA overview
• HITECH Act overview
• The basics of HIPAA security and privacy rules
• Consequences of violating the rules
• Social media best practices
• Security awareness and phishing
• How to be a HIPAA-compliant employee

As healthcare technology evolves, HHS may make updates to HIPAA regulations that affect your facility. Employers should provide staff with refresher training to see the updates if there are changes made to HIPAA rules.

Stay Updated on Healthcare Compliance

Providing HIPAA compliance training for healthcare staff is essential to maintaining compliance with federal regulations and protecting patients’ privacy and security. Learn more ways to protect patients at your facility when you sign up for IntelyCare’s free newsletter.