HIPAA training is an specific requirement of HIPAA. HIPAA requires that covered entities (CEs) and business associates (BAs) provide HIPAA training to members of their workforce who handle protected health information (PHI).  This means administrative and clinical personnel need to be trained.  Business associates — and any of their subcontractors — must have training.  Basically, anyone who comes into contact with PHI must be trained.

HIPAA’s Privacy Rule and HIPAA’s Security Rule both have separate training requirements.  Generally, HIPAA’s training requirements in both rules are rather sparse — not a lot of guidance is provided.

The HIPAA Privacy Rule, at 45 CFR § 164.530(b)(1), says that training must be “as necessary and appropriate for the members of the workforce to carry out their functions.” HIPAA thus doesn’t require that everyone be trained in the same way.  It is also important to note that HIPAA training doesn’t mean training to make trainees experts on HIPAA. In fact, HIPAA doesn’t even state that trainees learn about HIPAA itself; instead, they must learn about how to carry out their organization’s obligations under HIPAA.

The Privacy Rule doesn’t provide much further guidance on the specific topics that should be covered.

Continue Reading