7 Reasons You Need Annual HIPAA Retraining

The HIPAA Law states that Covered Entities, Business Associates and Business Associate Subcontractors must train all its workforce members on HIPAA.¹ The Law doesn’t give us guidance on the frequency of HIPAA Training, so is one time training enough?

I DON’T THINK SO! Do you remember all the training from when you started your job? Of course you don’t, and nobody reasonably expects you to retain ALL that information. That’s why we take periodic refresher training on many different subjects.

Onto the Top 7 Reasons for Annual HIPAA Retraining:

1. HIPAA Interpretations Are Changing – There are things we’ve seen clarified as the year has progressed. One of the big changes, clients and patients can sue using HIPAA as a Standard of Care.
2. We All Make Mistakes – Were you speaking too loudly in public about a client or patient; sent an errant fax with PHI; have you lost an unencrypted device… it doesn’t have to be this serious, but we all make mistakes, and training can help head that off.
3. HIPAA is a Security Standard – HIPAA can protect your Practice, Company or Agency from more than a HIPAA violation. These security standards are good business practices for ALL companies. Read more about it here
4. New Employees – New employees start at random times during the year, and sometimes their HIPAA training falls through the cracks. If you put your company on a schedule of annual retraining, this means those employees get picked up.
5. Best Business Practice (CYA) – We’re a family blog here, so I’m not going to spell this out for you, but everyone needs to cover their a$$ when it comes down to it. Annual retraining and maintaining good records goes a long way to covering you.
6. You’re Regulated By Gramm–Leach–Bliley – If you are a health insurance agency, you are also regulated by Gramm-Leach-Bliley. You are required by law to annually retrain your employees.
7. HHS Makes It a Part of Their Corrective Actions – In a recent fine this week, Anchorage Community Mental Health Services (ACMHS) is required to review and retrain their workforce annually and retain this information as part of their compliance program.

1. § 164.530 Administrative requirements.
(b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.
http://www.gpo.gov/fdsys/pkg/CFR-2011-title45-vol1/xml/CFR-2011-title45-vol1-sec164-530.xml

Sharing is caring!