What are the HIPAA Training Requirements?
Published
December 22, 2021
Author
Share
HIPAA training requirements don’t often cross the average person’s mind when going to a medical professional. You just expect that all the details you tell them and any future test results will be kept confidential, shared only with others on a “need to know” basis. How well this happens depends on how well your medical professional performed during the HIPAA training requirements.
What is HIPAA?
HIPAA stands for Health Insurance Portability and Accountability Act of 1996 and all its later amendments. It is often misspelled as HIPPA. As defined by the U.S. Centers for Disease Control and Prevention (CDC), HIPAA is a federal law. Legally, that means it applies only to the United States. Basically, HIPAA legislates that “sensitive patient health information” (PHI) will not be “disclosed without the patient’s consent or knowledge”. However, there is also the HIPAA Privacy Rule.
As the CDC describes it, the Privacy Rule “strikes a balance that permits important uses of information while protecting the privacy of people who seek care and healing”. In other words, even without your specific consent, a group of entities (organizations such as healthcare providers, health plans, business associates, etc.) can receive and disclose (publicize) your health information for specific purposes and when required by other laws.
Why is a U.S. federal law relevant overseas?
The simple reason is the global nature of today’s healthcare. If your organization wants to do business with U.S. healthcare organizations, you need to show them to their satisfaction that you and your employees can safeguard the PHI of the clients you will be working with. Thus, the need for overseas organizations to be HIPAA compliant.
HIPAA training requirements
The amount of HIPAA tools, guidance documents, and educational materials is vast. Taking a look at the HealthIT.gov page, “Health IT Privacy and Security Resources for Providers”, we are informed that the information was gathered and prepared by a team of people from “the Office of the National Coordinator for Health Information Technology (ONC), the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), and other HHS agencies”. It makes sense that such a large amount of contributors would be needed to create such a huge body of information.
It also points out the challenges of identifying the HIPAA training requirements. Which are the items, out of this incredibly large set of knowledge and skills, that will best serve the goal of HIPAA? (That is why, as we mentioned earlier, HIPAA compliance will only be as good as the training given.)
Despite the challenges, there is governmental guidance. Let’s take a look at the basic HIPAA training requirements in the order presented by the U.S. government.
Requirement #1: The HIPAA Act
Knowing the purpose of the act, later implications, requirements, standards, timetables, and penalties. Especially important is the protection of ePHI (electronic patient health information).
Requirement #2: The Privacy Rule
An understanding of the national protection in place to safeguard people’s health information, including how such information can be used and disclosed. This rule also covers the patient’s rights in this regard.
Requirement #3: The Security Rule
Familiarity with the national standards which keep safe ePHI (electronic personal health information).
Requirement #4: The Enforcement Rule
Knowing the compliance responsibilities, including the right of investigations into possible non-compliance, and what will happen if non-compliance is found.
Requirement #5: The Final Omnibus Rule
One in 2009 and then another in 2013, these rules further strengthen both privacy and security protections for personal health information as established by the 1996 Act, especially with regard to digital privacy.
Requirement #6: The Breach Notification Rule
A recognition that breaches may happen and what the procedures are in such cases.
HIPAA training for free
Yup. Not only has someone else put in the resources to develop these HIPAA training courses, but they are also offering them to you at no cost. Each course covers the basics. Then, depending on their creator(s), they add additional information such as examples and tips, not to mention knowledge checks (quizzes, tests, etc.).
One example is HIPAA Compliance Training offered on the SC Training (formerly EdApp) platform. To read more about it (it’s the first one on the list) and another 14 free HIPAA training courses.
Additionally, the availability of free HIPAA compliance software helps manage regulatory compliance more efficiently, eliminating the burden of dealing with grunt work while also cutting costs on traditional compliance training.
Increasing the importance of adequate HIPAA training
When our healthcare information was written on paper and stored in Manila folders in metal filing cabinets (anyone remembers those?), there was a very low risk of a breach. Today, however, most of our data is ePHI. As we know, electronic information is subject to hacking and other IT incidents. That is why it is important for healthcare professionals not only to be up to speed with regulations, but also to use tools like an HIPAA compliant eFax when transmitting sensitive data. Additionally, healthcare professionals and organizations can consider the benefits of cyber liability insurance to mitigate the risks associated with healthcare data breaches and protect sensitive information.
According to a September 2021 HIPAA Journal article, the average number of healthcare data breaches for the past 12 months is 55.5 per month. Causes of breaches include hacking, phishing, ransomware, malware, theft of electronic devices containing PHI, and PHI accessed by an employee after termination. If we sum up the figures for just the 16 largest healthcare data breaches reported in the month of September alone, we find that over 1 million individuals were affected. That’s a lot of privacy lost!
Obviously, better HIPAA training will help. However, it is also an excellent idea to make sure your organization’s cyber security training is up-to-date and compulsory for all your employees. Check out this article for free cybersecurity training options.
HIPAA Future Forward
August 21, 2021 was the 25th anniversary of the HIPAA Act of 1996. An article reflecting on how well the Act has performed judges it as “a great success which has survived the test of time”. This, indeed, appears to be the general consensus among reliable sources on the Internet.
However, all agree that there is room for improvement. One area is the Privacy Rule. At the moment, proposals of new HIPAA regulations are being examined. It is not yet clear whether they will improve the situation and should be adopted or will cause privacy issues and should be discarded. Also, since HIPAA does not apply to animals, some states have actually implemented laws that address the same concerns for pets, giving a focused approach to dog and cat health insurance.
What we do know is that HIPAA is currently our best bet to safeguard the privacy of our healthcare data. Thus, it is the responsibility of all concerned to make sure they do not skimp on HIPAA training requirements.
Outside sources
https://www.cdc.gov/phlp/publications/topic/hipaa.html
https://www.accountablehq.com/post/overseas-hipaa-compliance
https://www.hhs.gov/hipaa/for-professionals/training/index.html
https://www.hhs.gov/hipaa/for-professionals/index.html
https://www.hipaajournal.com/september-2021-healthcare-data-breach-report/
https://www.hipaajournal.com/future-of-hipaa/
Author