HIPAA requires covered entities and business associates to train all workforce members on their privacy and security policies and procedures. But when an investigator, an auditor or an insurer asks you to show it, a good intention is not enough. You need records.
This article summarizes what to document, how to organize it and common pitfalls. It is general information, not legal advice.
The Privacy Rule requires training for all workforce members on policies and procedures related to PHI, as necessary and appropriate for their functions, and that new workforce members be trained within a reasonable time after joining. When policies change materially, affected workforce members must be retrained within a reasonable period. The covered entity must document that training has been provided.
The Security Rule requires a security awareness and training program for all members of the workforce, including management. Implementation specifications include security reminders, protection from malicious software, log-in monitoring and password management.
Under the HIPAA documentation requirements, policies, procedures and required records generally must be retained for six years from the date of creation or the date they were last in effect, whichever is later.
Keep a copy of each version of the training content, such as slides, videos, handouts and quizzes, with the date it was used. If content changes, retain prior versions so you can show what was taught at a given time.
For each person, record:
Name and role or department
Date of training
Topic or course title
Method, such as in-person, video or online module
Trainer or platform
Score or confirmation, if applicable
Signature or electronic acknowledgment
Keep signed acknowledgments that staff received and understood key policies, such as acceptable use, confidentiality and mobile device policies.
Keep evidence of ongoing reminders such as newsletters, posters, huddle topics, email alerts and phishing exercise results.
Show that new hires were trained within a defined period, and track agency or contract staff too.
Document when and why retraining occurred, including training required as part of corrective action after an incident.
HIPAA requires a sanctions policy. Keep documentation of any sanctions applied, consistent with legal advice.
A spreadsheet can work for a small organization. A learning management system is better for larger ones, as it automates assignment, reminders and reporting. Whatever you choose:
Maintain a current roster tied to HR records
Define deadlines, for example completion within 30 days of hire
Run a monthly report of overdue training
Escalate to managers when people fall behind
Save reports regularly as evidence
Nurses, billing staff, maintenance workers, IT personnel and executives face different risks. Document role-based content, such as extra material for those with administrator privileges or who handle records requests.
Workforce includes employees, volunteers, trainees and others under your direct control, whether or not they are paid. Contractors who are business associates typically have their own obligations, but ask vendors with extensive access to confirm their staff are trained.
Records that show attendance but no content, so you cannot prove what was taught
Training completed by one shared login
No tracking of agency or part-time staff
Training materials copied from an old source that no longer match current policy
Records kept by one manager who then leaves, taking the files with them
Training only at hire and never again
A program that exists only on paper does little for resident privacy. Combine documentation with short, practical sessions, real examples and open channels for questions. Review results after incidents and adjust.
UnityCare IT can help set up a training and tracking approach for the security side of your program, including short awareness content and reporting. For legal interpretation of HIPAA obligations, please consult your attorney or compliance advisor.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172