HIPAA training for new employees — and the rest of onboarding

HIPAA treats training as part of the job, not a one-time event. The Privacy Rule requires training each new member of the workforce within a reasonable period of time after they join, and again when a material change in your policies affects their role (164.530(b)). The Security Rule adds a security awareness and training program for all workforce members (164.308(a)(5)). See HIPAA workforce training.

Access follows the same logic. The Security Rule asks for procedures to authorize and supervise workforce access, a workforce clearance procedure and termination procedures — these are “addressable”, meaning you implement them where reasonable and appropriate or document an equivalent (164.308(a)(3)). Unique user identification is required (164.312(a)(2)(i)). See access control.

What HIPAA training for new employees has to cover

• Your privacy policies, as they apply to the job — required for covered entities (164.530(b)(1)). The role sets the depth: the front desk needs the rules for callers and sign-in, a clinician the rules for sharing with other providers and family members, billing the rules for payers.
• Security awareness — every workforce member, including managers, is part of the security awareness and training program (164.308(a)(5)(i)). Its four parts — security reminders, protection from malicious software, log-in monitoring and password management — are addressable: put each in place where reasonable and appropriate, or document why not and any equivalent alternative (164.306(d)).
• What to do when something goes wrong — who to tell at once about a lost phone, a misdirected email or a suspicious message. HIPAA requires security incident procedures (164.308(a)(6)); teaching them on day one is our recommendation.

A first-week plan (our recommendation)

1. Before day one: set up access from the role (minimum necessary), with a personal login for every system.
2. Day one, before working with patient information: a 30–45 minute session on your core policies and security basics, and who to call when something goes wrong.
3. During the first week: a walk-through of the policies for their role, a short quiz, and a signed acknowledgment of the policies and the sanctions policy.
4. After 30 days: check their access against what the job actually needs, and answer the questions that came up.

HIPAA sets none of these timings — it says “within a reasonable period” (164.530(b)(2)(i)(B)). The plan is how we would make “reasonable” provable.

How to document it

HIPAA requires covered entities to document that the training was provided (164.530(b)(2)(ii)) and to keep that documentation for six years from when it was created or last in effect, whichever is later (164.530(j)). Record the date, the person, the topics or materials, and who delivered it. A signature and a quiz score are good evidence — our recommendation, not a HIPAA requirement.

An online course or your own session?

A general online course teaches the rule; HIPAA asks you to train people on your policies and procedures. Many practices combine a course with a short walk-through of their own policies. Compare courses in online HIPAA training, and see HIPAA training for building a program for everyone, not only new hires.

To try the decisions a new front-desk worker faces, our free interactive scenario 8:47 a.m. — one shift, seven decisions takes about seven minutes, with no sign-up. It’s practice, not a replacement for training on your own policies.

Temporary staff, students and volunteers

HIPAA’s workforce includes employees, volunteers, trainees and others whose work is under your direct control, whether or not you pay them (160.103). An agency temp or a student on placement working under your direction is workforce: own login, training and a record, like any new hire.

Business associates

The Privacy Rule’s training standard (164.530(b)) applies to covered entities. A business associate has the same Security Rule duties for its own staff, including the security awareness and training program (164.308(a)(5)).