HIPAA has been in our offices and Privacy policies and procedures in place for over 10 years now, but have you also instituted a formal, ongoing practice training program?  When HIPAA came into being, we all did training, training, and more training, but are you still training your staff? You should be doing an annual review of your Privacy policies and procedures as well as proof of an annual re-training of your staff.  A one-time education of your Privacy implementation is not sufficient; for example, your training program must be adaptable enough to ensure that newly-hired staff and transferred or promoted employees receive Privacy training that relates to their new or changed job roles. In addition, as new regulations are published or internal policies amended, continuing training must be supplied to all staff.

The HIPAA Privacy Rule stipulates that all staff members of your practice receive training that is appropriate to their roles. This includes employees, volunteers, trainees, and other persons who work for a covered entity, whether or not they are paid. Some staff members will need to be trained in applying specific policies and procedures, such as provision of the notice of information and privacy practices or obtaining authorizations. Others, such as those who rarely have access to PHI, may require only an overview of HIPAA's background, objectives, principles, and general regulatory requirements.

New employees who join the practice must receive training within a reasonable period of time. It is recommended to include HIPAA privacy training in new employee orientation programs. Practice staff who change jobs or receive new responsibilities must receive additional training if their new job duties include new patient privacy-related responsibilities. Also, the Privacy Rule requires retraining for each member of the covered entity's staff whose functions are affected by a change in the policies or procedures. Covered entities also must document that privacy training has been provided. Though there is no requirement that members of the practice sign a certificate following training, it is useful to document training completion by each worker for future verification purposes; to accomplish this, I had them sign-in on an attendance sheet for the training.