HIPAA Training for Business Associates
The nature of HIPAA training for business associates can vary significantly depending on the service(s) being provided for, or on behalf of, covered entities. Nonetheless, it is advisable for all members of business associates’ workforces to understand what HIPAA is, what is considered Protected Health Information under HIPAA, and why it must be protected.
When a person or organization provides a service for or on behalf of a covered entity that involves the creation, receipt, storage, or transmission of Protected Health Information, they are considered to be a business associate of the covered entity. Business associates are required by §160.102 to comply with all applicable HIPAA Administrative Simplification Regulations. The same applies to subcontractors who provide a service for or on behalf of a business associate.
In order to comply with all applicable HIPAA Administrative Simplification Regulations, business associates must first determine which regulations apply to them. This can vary significantly depending on the service(s) being provided. For example, an organization that provides “no view” electronic data storage services for a covered entity (or business associate) will only have to comply with the regulations in the HIPAA Security Rule and HIPAA Breach Notification Rule.
However, an individual or organization that processes healthcare claims on behalf of a covered entity, performs utilization reviews, or provides cloud-hosted scheduling software will need to comply with some regulations in the HIPAA Privacy Rule (i.e., the General Rules for uses and disclosures) and – where applicable – Part 162 Administrative Requirements (i.e., the Transactions and Code Set Rules). The Preemption provisions of Part 160 may also apply.
How this Impacts HIPAA Training for Business Associates
The range of HIPAA Administrative Simplification Regulations that may be applicable to the services provided for or on behalf of a covered entity means there is no “one size fits all” HIPAA training for business associates. Even when organizations only have to comply with the training requirements of the HIPAA Security Rule (§164.308(a)(5)), the content of a HIPAA security and awareness training program must factor in the requirements of the General Rules (§164.306(a)).
This means that when a business associate “implement[s] a security awareness and training program for all members of its workforce (including management),” the security awareness and training program must:
(1) Ensure the confidentiality, integrity, and availability of all electronic Protected Health Information the business associate creates, receives, maintains, or transmits,
(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information, and
(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part (the HIPAA Privacy Rule).
Generic security and awareness training does not fulfil the General Rules’ requirements because it fails to explain what is considered Protected Health Information under HIPAA and why certain measures have been implemented by the organization to protect it. Therefore, even when a business associate has “no view” access to Protected Health Information, security and awareness training must be relevant to the service being provided by the business associate.
HIPAA Compliance Training for Business Associates
Business associates required to comply with some or all of the HIPAA Privacy Rule must develop and implement policies and procedures “with respect to Protected Health Information” that relate to the activities of the business associate and the services being provided (§164.530(i)). Thereafter, they must provide training on the policies and procedures “as necessary and appropriate for the members of the workforce to carry out their functions” (§164.530(b)).
The training standard implies only members of the workforce whose functions involve uses and disclosures of Protected Health Information should receive HIPAA compliance training for business associates. However, any member of a business associate’s workforce could see (or hear about) an individual’s health, treatment, or payment information, and impermissibly share the information with family and friends – or with a wider audience via social media.
For this reason, when a business associate provides a service to which HIPAA privacy standards apply, it is important all members of the workforce receive HIPAA compliance training for business associates. The training should explain the consequences of impermissible violations (i.e., medical identity theft) and that the HIPAA sanctions standard (§164.530(e)) applies to all workforce members when a business associate is required to comply with some or all of the HIPAA Privacy Rule.
Simplifying the HIPAA Training Requirements for Business Associates
A common challenge when providing HIPAA business associate training is that some/many/all of the workforce may have no understanding of HIPAA prior to receiving security awareness and policy and procedure training. This can result in misunderstandings about (for example) the purpose of HIPAA, what information is protected by HIPAA, when it can be permissibly used or disclosed, and why certain software solutions are configured in the way that they are.
Providing all HIPAA training for business associate workforces “from scratch” can give new members of the workforce too much information to absorb in one go. For example, explaining the purpose of HIPAA while providing HIPAA security and awareness training is likely to create confusion about what information is protected, whether the information can be transmitted via specific apps and online services, and who Protected Health Information can be shared with.
The solution to the challenge with HIPAA training requirements for business associates is to provide all members of the workforce with HIPAA awareness training when they start working for the business associate. The training course ideally should have a test at the conclusion of the course so it is possible to assess the level of HIPAA knowledge and determine whether further HIPAA compliance training for business associates’ workforces is required.
Summary: HIPAA Training for Business Associates’ Workforces
All business associates must comply with the HIPAA security standards and implement a security awareness and training program for all members of the workforce (including management) that is relevant to the service being provided.
Most business associates must comply with the HIPAA privacy standards that are applicable to the service being provided. When required to comply with some or all of the HIPAA Privacy Rule, HIPAA compliance training for business associates should be provided for all members of the workforce.
When a business associate is required to comply with some or all of the HIPAA Privacy Rule, any member of the workforce can be sanctioned for violations of the HIPAA privacy standards – even when the standard has not been covered in HIPAA business associate training.
Business associates can reduce the risk of a HIPAA violation due to a lack of workforce knowledge by investing in a foundation HIPAA training course for organizations that gives all members of the workforce a basic understanding of the HIPAA Rules.
Workforce members can reduce the risk of a sanction for unintentionally violating HIPAA due to a lack of knowledge by investing in a foundation HIPAA training course for individuals that is accredited by a recognized training assessor.
Investing in a foundation HIPAA training course does not exempt a business associate from providing security and awareness training and HIPAA business associate compliance training (when applicable), but it will ensure the training is better understood by workforce members – reducing the likelihood of avoidable HIPAA violations.
