Why is HIPAA Training Important?

HIPAA training is important because all members of covered entities’ and business associates’ workforces need to understand what Protected Health Information (PHI) is, why it needs to be protected, and what the consequences are if PHI is impermissibly disclosed due to a lack of knowledge or if the failure to understand HIPAA policies and procedures results in a data breach.

It is difficult to find a “one-size-fits-all” answer to the question why is HIPAA training important because patients, workforces, covered entities, business associates, and regulators each have different perspectives on HIPAA compliance. Furthermore, with HIPAA often being used as the benchmark for reasonable care in data breach lawsuits, courts can also have different answers to the question why is HIPAA training important.

Indeed, if you asked why is HIPAA training important to a selection of individuals from the same group (i.e., patients, workforces, covered entities, etc.), you would likely get a selection of answers due to individuals’ expectations, levels of knowledge, propensity to risk, and experiences. However, by analyzing each group individually, it is possible to come close to an acceptable answer for each group as to why is HIPAA training important.

Why is HIPAA Training Important to Patients?

HIPAA training is important to patients because they are the primary beneficiaries of HIPAA compliance. Although there are many factors that can contribute to patient-physician relationships, when patients believe that healthcare providers comply with HIPAA and keep their confidential information secure, they tend to be more forthcoming about health issues and symptoms, and tend to be more compliant with treatment programs.

Conversely, when there is evidence to suggest their confidential information has been impermissibly disclosed or exposed in a data breach (i.e., via a breach notification), they tend to withhold information. This has the consequence of giving healthcare providers less information with which to make accurate diagnoses and prescribe effective courses of treatments – leading to slower recoveries, readmissions, and adverse patient outcomes.

Why is HIPAA Training Important for Workforces?

HIPAA training is important for workforces because it is necessary not only to understand the covered entity’s or business associate’s HIPAA policies and procedures, but also why they exist. It is also necessary to understand the real consequences of impermissible disclosures – such as patient’s withholding important information and medical identity theft – and the impact the consequences have of the effective delivery of healthcare.

Workforce members also need to be aware that they have  some responsibility for their HIPAA knowledge. Covered entities are required to provide HIPAA policy and procedure training and any further training when the need for further training is identified in a risk analysis. However, workforce members can be sanctioned for any violation of the HIPAA Privacy Rule regardless of whether the violated standard has been covered in HIPAA training.

The HIPAA Training Requirements for Covered Entities

The HIPAA training requirements for covered entities are that covered entities must train “all members of [the] workforce on the policies and procedures with respect to Protected Health Information required by this subpart [the HIPAA Privacy Rule] and subpart D of this part [the HIPAA Breach Notification Rule], as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity”. (§164.530(b))

Covered entities and business associates are also required to “implement a security awareness and training program for all members of [the] workforce (including management)” (§164.308(a)(5)). However, it is important that this HIPAA training requirement is complied with in the context of §164.306(a) which requires covered entities to:

• Ensure the confidentiality, integrity, and availability of electronic PHI,
• Protect against any reasonably anticipated threats or hazards to the security or integrity of electronic PHI, and
• Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required by the HIPAA Privacy Rule.

It is also important for covered entities to be aware of the requirements within HIPAA to review the measures implemented to comply with the HIPAA Security Rule (§164.306(e)) and conduct periodic technical and nontechnical evaluations (§164.308(a)(8)) in order to identify reasonably anticipated threats or hazards – or reasonably anticipated impermissible uses or disclosures – and modify the measures or provide additional HIPAA awareness training when necessary.

HIPAA Compliance Training for Business Associates

In addition to implementing a security awareness and training program, business associates are required to provide HIPAA Privacy Rule compliance training to members of the workforce when a Privacy Rule standard is applicable to the service the business associate is providing for or on behalf of a covered entity (see “Applicability” §160.102). It some circumstances, it is necessary to provide training on the HIPAA Breach Notification Rule as well.

The reason why HIPAA Privacy Rule training is important for business associate’s workforces with access to PHI is that any workforce member with access to an individual’s health, treatment, or payment information could impermissibly disclose the information privately (i.e., via social media). The impermissible disclosure could lead to the cancellation of a Business Associate Agreement and/or sanctions imposed by HHS’ Office for Civil Rights.

HIPAA Enforcement and the Benchmark for Care

In the context of why is HIPAA training important to regulators, when HHS’ Office for Civil Rights conducts a compliance investigation following a privacy compliant or breach notification, the agency will want documentation detailing what HIPAA training has been provided, when it was provided, and who it was provided to. State Attorneys General will also want to see documentation if investigating a data breach.

If HHS’ Office for Civil Rights or a State Attorney General determines that a privacy violation or data breach could have been reasonably anticipated and avoided with the provision of training, the failure to provide HIPAA training will be factored into whatever HIPAA enforcement action is taken. In some cases, the financial settlement for a minor HIPAA violation has been substantially increased due to the failure to comply with the HIPAA training requirements.

Finally, with regards to why is HIPAA training important in data breach lawsuits, HIPAA has become the benchmark for care to protect individually identifiable health information since the 2018 decision in Byrne vs Avery. Covered entities and business associates with concerns that their current HIPAA training may not reach the standards required by regulators and courts are advised to seek independent compliance advice.