The Basics of HIPAA Compliance: A Training Manual for Employees

Training, in some form, is required under HIPAA regulations, but the rules are vague as to what form that training should take. Training should be provided "as necessary and appropriate for members of the workforce to carry out their functions" (HIPAA Privacy Rule) and covered entities and business associates should "implement a security awareness and training program for all members of the workforce" (HIPAA Security Rule). There is no requirement that calls for video sessions, exams or certificates.

Jump-start your HIPAA training program and quickly get to the all-important "good faith effort" benchmark by distributing this manual to employees who handle patient records, scheduling a question-and-answer meeting after they've read the manual, and having them sign and submit the training acknowledgement form included at the back of the book. Retain the acknowledgement forms and a record of the meeting to document your training, as required by HIPAA.

If you do not have a comprehensive HIPAA compliance program in place, getting your people through a basic training program and documenting that fact should not be delayed while you develop your policies, procedures and advanced training programs. This manual should not be substituted for a comprehensive ongoing training program where advanced training is provided for company-specific procedures or specific job responsibilities.

Please be advised, however, that NO training program, no matter how expensive or extensive, can guaratee that any individual auditor or investigator will approve. your efforts. The regulatory authorities do not license, accredit or certify any trainers or training.