The Importance of Training and Education

It is essential that your employees and others who interact with your patients’ PHI are trained and updated regularly on your policies and procedures so that they can understand and implement them in their day-to-day responsibilities.

Documenting the training curriculum, who received it, and when it was completed is a necessary and important piece of a Privacy Rule compliance program.

Newsletters and hard copy documentation or email or both can fill an important role in ongoing training as well as nurture your Privacy Rule compliance program. The scope of training depends on the size of the practice or the role of the individual in the healthcare continuum; however, everyone needs to receive initial training at the time of employment and ongoing education on HIPAA compliance as new rules are implemented or as business needs change.

A Word About Enforcement

        You can provide fact sheets, posters, or other visual tools to keep staff engaged and stay up on the current information of what HIPAA compliance is. These communication tools also help to reinforce continuing education by providing a forum in which hypothetical and actual privacy cases can be discussed. -- Angela Dihn, Director of Professional Practice, AHIMA

OCR is serious about HIPAA enforcement. Several recent high-profile cases -- including loss of records from Massachusetts General Hospital, for which it was fined $1 million, and sharing of confidential patient information at the University of California at Los Angeles (UCLA) Health Systems, which resulted in a fine of $865,000 – have put the importance of protecting patients’ health information in the spotlight.

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, modified the HHS Secretary’s authority to impose civil money penalties for violations of HIPAA occurring after February 18, 2009. These HITECH Act revisions significantly increased the penalty amounts the Secretary may impose for violations and encourage prompt corrective action.

The HITECH Act strengthens the civil money penalty scheme for enforcement by establishing tiered ranges of increasing minimum penalty amounts, with a maximum penalty of $1.5 million for all violations of an identical provision. A covered entity can no longer bar the imposition of a civil money penalty for an unknown violation unless it corrects the violation within 30 days of discovery.

In addition, HITECH gives states' attorneys general the authority to bring civil actions on behalf of state residents for violations of the HIPAA Privacy Rule. The HITECH Act permits states' attorneys general to obtain damages on behalf of state residents or to enjoin further violations of the HIPAA Privacy Rule.

Finally, HITECH requires HHS to provide for periodic audits to ensure covered entities and business associates are complying with the HIPAA privacy requirements. To implement this mandate, OCR is piloting a program to perform up to 150 audits of covered entities to assess privacy compliance. Audits conducted during the pilot phase began in November 2011 and will conclude by December 2012.

Conclusion

Protecting your patients’ health information is your legal responsibility. A meaningful HIPAA compliance program is one in which everyone involved in healthcare delivery understands their role in zealously protecting health information. Policies and procedures cannot simply be binders on a shelf; they must be integrated into practice -- from the front office to the back. A sound compliance program includes but is not limited to:

• Internal audits;
• Up-to-date policies and procedures; and
• Training for everyone in your organization, including physicians and other management staff.