• E-mail
• Print
• RSS

Employee HIPAA training

HIPAA Weekly Advisor, December 28, 2001

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Q: My facility is looking to provide HIPAA training for all employees. Do you have any suggestions?

A: HIPAA requires providers to train all employees, but the amount and level of training needed to comply with the requirement is one of the gray areas, since the privacy standard does not offer any specifics.

This is best covered under the "reasonableness" test. The training must include all members of the workforce who have contact with protected health information (PHI).

Obviously, the training required of a large hospital differs from what's required of a small physician practice. In general, most covered entities have small budgets allocated for HIPAA training, so examining the most cost-effective method is of utmost importance.

In a small physician practice, reviewing the federal rules and the facility's privacy and security policies with all employees would probably suffice, assuming the policies are documented and available for review. The policies should be periodically reviewed and updated as the need arises. Facilities should document that employees have read and understand the updated policies.

For a larger health care organization with many dispersed employees, live classroom instruction may be feasible. Duke University Health System is providing training to the 364 managers who are involved with HIPAA compliant-operations and need to communicate the requirements to staff. The four-hour training classes for 30-40 students are held in a lecture-style classroom setting.

For other organizations, a blended approach of computer-based learning or other distance learning supplemented with live instruction has proven to be most effective.

Distance learning can include a number of technologies including videoconferencing or videos, computer-based training (CBT) which includes e-learning, and other Web-based or CD-based training.

One benefit to CBT is that it is self-paced; the learner goes over the educational material at his or her own rate. Another benefit is that it can be provided 24 hours a day, seven days a week.

As important as providing training is assessing whether employees understood the material presented-usually by giving them a quiz. After that, the material must be reiterated by supervisors during the work day. Most studies indicate that distance learning is only effective if it is reinforced in employees' work routines. Finally, facilities should document that the training was provided.

Generally, training responsibilities tend to be dealt with by the Human Resources (HR) department, but for HIPAA, the privacy officer or other centralized department responsible for HIPAA compliance may need to own the project.

Editor's note: Answered by Jon Bogen, president of HealthCIO Inc. in Duxbury, MA. If you have a question for our experts, write to BOH, P.O. Box 1168, Marblehead, MA 01945, or send an e-mail to HIPAA Weekly Advisor editor Brian Driscoll at bdriscoll@hcpro.com.

Go to http://www.hcprofessor.com for information on HCPro's online HIPAA training courses.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive