I hope everyone had a happy and healthy 4th of July! Last week, I received this question from one of our clients. Let’s get to it…
Question:
Still not convinced that it is absolutely necessary for my group to be HIPPA certified. We still have no access to social security information or date of birth. I would be open to getting a couple of folks certified that might need to work on computers of HR folks, but I cannot see putting everyone in the group through this when this information should not be resident on any other computers except for HR professionals.
I would also like to see what documentation is driving this requirement. I am not trying to be difficult, but this will be a major undertaking to get everyone certified and to maintain that certification. If we have turnover, I do not want to go down this path, unless it is absolutely a government requirement.
Total HIPAA Response:
I realize this is a difficult position for you to be in, but the reality is that everyone on the IT staff needs to be trained. IT people see everything. I’ve worked in large and small corporations, and if you have an issue, you call the IT department or consultant. They either take over your computer remotely, or send someone up to work on your system. IT staff has access to everyone’s system, and can inadvertently come in contact with PHI at any moment. With the new penalties that have gone into affect with HIPPA, the ramifications if there is an issue are severe!
HIPAA requires that anyone who comes in contact with Protected Health Information is required to be trained. You can find the training requirement here- 45 CFR §164.530(b), (e) and here is the URL for the federal register- http://www.gpo.gov/fdsys/pkg/CFR-2011-title45-vol1/xml/CFR-2011-title45-vol1-sec164-530.xml
PHI is defined by two things:
1. Personal identifier- Address, Social Security Numbers, Name, IP address, Email address, etc.
-AND-
2. Combined with any Health Information.
In the last few years, Business Associates have been responsible for some of the most serious HIPAA violations. The reason I bring this up is having proper policies and procedures and training could have averted many of these problems for those BAs. All you need is one untrained person to make a mistake and you could have a serious problem on your hands.
In short, HIPAA Training is required by Federal Law, and you have to follow the law.
