HIPAA and Privacy Act Training
HIPAA and Privacy Act training is necessary for employees of federal agencies – or departments within federal agencies – that qualify as HIPAA covered entities. It is also necessary for employees of contractors that provide services for or on behalf of qualifying federal agencies – or qualifying federal departments – as HIPAA business associates.
Although there are many similarities between HIPAA and the Privacy Act of 1974, differences exist that make it difficult to provide HIPAA and Privacy Act training simultaneously. The differences are complicated by the Privacy Act permitting federal agencies to develop their own privacy policies according to each agency’s mission and privacy program requirements.
In addition, HIPAA training consists of separate privacy training and security awareness training designed to protect data classified as Protected Health Information (PHI). Privacy Act training combines privacy and security into one set of policies designed to protect data classified as Personally Identifiable Information (PII). Federal agencies that qualify as HIPAA covered entities are likely to maintain both PHI and PII in different data sets.
The Difference between PHI and PII
In the context of HIPAA and Privacy Act training, it is important to understand the difference between PHI and PII so policies designed to protect PHI are not applied to PII and vice versa. PHI under HIPAA is any information relating to an individual’s health condition, treatment for the health condition, or payment for the treatment. PHI is maintained in “designated record sets” which can consist of a single record or groups of records.
PII is defined as “any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means”. Some federal agencies distinguish sensitive PII (biometric data, credit card number, etc.) from non-sensitive PII (name, email address, phone number, etc.) depending on the service being provided and the need to allocate different permission levels to different user roles.
However – under HIPAA – when PII is maintained in the same designated record set as health, treatment, or payment information, it assumes the same protections as PHI. This means that – for example – the same email address maintained by the same agency is PHI when it is maintained in a designated record set with PHI, and at the same time PII when it maintained in a different data set that does not contain health, treatment, or payment information.
Dividing HIPAA and Privacy Act Training
Many government agencies develop Privacy Act policies based on the Fair Information Practice Principles (FIPPs), and although the objectives of FIPPs generally mirror the objectives of the HIPAA Privacy Rule, there are areas in which it is impossible to comply with both. For example, FIPPs does not accommodate requests for privacy protections or confidential communications via non-compliant channels as required by §164.522 of the HIPAA Privacy Rule.
Consequently, it is necessary to divide HIPAA and Privacy Act training so members of the workforce with access to PHI receive HIPAA training, while members of the workforce with access to PII receive Privacy Act training. In some circumstances, it may be necessary to provide workforce members with both types of training – and explain the procedures for safeguarding PHI/PII when differences exist between HIPAA compliance and Privacy Act compliance.
Dividing HIPAA and Privacy Act training should not be complicated for well-resourced federal agencies with designated Privacy Officers. Smaller contractors and subcontractors tend to have fewer resources to dedicate to compliance and may find creating separate HIPAA and Privacy Act training programs challenging. However, it is possible to acquire online HIPAA awareness training courses and tailor them to meet organizations’ Privacy Act compliance requirements.
Important Note about the HIPAA Training Requirements
If following the above course of action, it is important to be aware that HIPAA awareness training courses do not fulfil the HIPAA training requirements to train members of the workforce on policies and procedures implemented to comply with the HIPAA Privacy Rule. However, a contractor or subcontractor that provide a service to a federal agency as a HIPAA business associate is unlikely to have as many HIPAA policies and procedures as a federal agency.
Therefore, it should be relatively simple to adjust a HIPAA awareness training course to fulfil the HIPAA and Privacy Act training requirements when an organization provides a service for or on behalf of a qualifying federal agency as a HIPAA business associate. Organizations with questions about dividing HIPAA and Privacy Act training or tailoring an awareness training course to meet their compliance requirements are advised to seek professional advice.
