Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Question: Why do I have to train all my IT Staff on HIPAA?

I hope everyone had a happy and healthy 4th of July! Last week, I received this question from one of our clients. Let’s get to it…

Still not convinced that it is absolutely necessary for my group to be HIPPA certified. We still have no access to social security information or date of birth. I would be open to getting a couple of folks certified that might need to work on computers of HR folks, but I cannot see putting everyone in the group through this when this information should not be resident on any other computers except for HR professionals.

I would also like to see what documentation is driving this requirement. I am not trying to be difficult, but this will be a major undertaking to get everyone certified and to maintain that certification. If we have turnover, I do not want to go down this path, unless it is absolutely a government requirement.

Total HIPAA Response:
I realize this is a difficult position for you to be in, but the reality is that everyone on the IT staff needs to be trained. IT people see everything. I’ve worked in large and small corporations, and if you have an issue, you call the IT department or consultant. They either take over your computer remotely, or send someone up to work on your system. IT staff has access to everyone’s system, and can inadvertently come in contact with PHI at any moment. With the new penalties that have gone into affect with HIPPA, the ramifications if there is an issue are severe!

HIPAA requires that anyone who comes in contact with Protected Health Information is required to be trained. You can find the training requirement here- 45 CFR §164.530(b), (e) and here is the URL for the federal register- http://www.gpo.gov/fdsys/pkg/CFR-2011-title45-vol1/xml/CFR-2011-title45-vol1-sec164-530.xml

PHI is defined by two things:
1. Personal identifier- Address, Social Security Numbers, Name, IP address, Email address, etc.


2. Combined with any Health Information.

In the last few years, Business Associates have been responsible for some of the most serious HIPAA violations. The reason I bring this up is having proper policies and procedures and training could have averted many of these problems for those BAs. All you need is one untrained person to make a mistake and you could have a serious problem on your hands.

In short, HIPAA Training is required by Federal Law, and you have to follow the law.

By Jason Karn

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)