Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

7 Reasons You Need Annual HIPAA Retraining

The HIPAA Law states that Covered Entities, Business Associates and Business Associate Subcontractors must train all its workforce members on HIPAA.1 The Law doesn’t give us guidance on the frequency of HIPAA Training, so is one time training enough?

I DON’T THINK SO! Do you remember all the training from when you started your job? Of course you don’t, and nobody reasonably expects you to retain ALL that information. That’s why we take periodic refresher training on many different subjects.

Onto the Top 7 Reasons for Annual HIPAA Retraining:

  1. HIPAA Interpretations Are Changing – There are things we’ve seen clarified as the year has progressed. One of the big changes, clients and patients can sue using HIPAA as a Standard of Care.
  2. We All Make Mistakes – Were you speaking too loudly in public about a client or patient; sent an errant fax with PHI; have you lost an unencrypted device… it doesn’t have to be this serious, but we all make mistakes, and training can help head that off.
  3. HIPAA is a Security Standard – HIPAA can protect your Practice, Company or Agency from more than a HIPAA violation. These security standards are good business practices for ALL companies. Read more about it here
  4. New Employees – New employees start at random times during the year, and sometimes their HIPAA training falls through the cracks. If you put your company on a schedule of annual retraining, this means those employees get picked up.
  5. Best Business Practice (CYA) – We’re a family blog here, so I’m not going to spell this out for you, but everyone needs to cover their a$$ when it comes down to it. Annual retraining and maintaining good records goes a long way to covering you.
  6. You’re Regulated By Gramm–Leach–Bliley – If you are a health insurance agency, you are also regulated by Gramm-Leach-Bliley. You are required by law to annually retrain your employees.
  7. HHS Makes It a Part of Their Corrective Actions – In a recent fine this week, Anchorage Community Mental Health Services (ACMHS) is required to review and retrain their workforce annually and retain this information as part of their compliance program.
1. § 164.530 Administrative requirements.
(b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)