Health Information Compliance Alert

Compliance officers, providers and others for whom HIPAA training is a concern appear to be greeting the new modifications to the privacy rule warmly. But now that the new rule has been finalized, many are concerned they wont have enough time to meet their compliance deadline.

As for providers, those who have multiple entities need to start with a thorough examination of how their operations are organized, says Robert Markette,an attorney with Indianapolis-based Gilliland & Caudill. They should determine whether they will need to designate themselves as affiliated, hybrid, or an organized health care arrangement, he notes.

He says that there are great benefits for providers who do this, such as reducing the number of privacy notices and the ability to reduce the number of business associates. "Because of the efficiencies this can create, I would advise anybody who is beginning his analysis to start with an evaluation of his association to determine the most efficient way to designate any associated providers or other supporting organizations," he directs.

And Kristen Rosati, an attorney with Coppersmith Gordon Schermer Owens & Nelson in Phoenix echoes a mantra that is broadly applicable to all covered entities struggling with this concern: "Whats most important to realize about HIPAA training is that you dont have to train your employees or your work force members on the HIPAA privacy standards. You have to train them on your policies."

Rosati says covered entities need to focus on what their employees need to know in order to ensure that their hospital or health care organization doesnt violate the privacy rule. To do that, theyll need to create policies that incorporate all the requirements, and then see to it that the employees are aware of the policies that will affect their work.

Training will vary depending on the type of work they do for the health care organization. "Employees who dont handle health information as part of their job certainly wont need as much training as clinical personnel," asserts Rosati, who offers up a janitorial staffer as an example.

"They need to be trained about what to do if they find a medical record in the trash. Or, for example, if someone sees a celebrity in the hospital, their presence there is confidential and you cant tell your friends if some celebrity showed up in the place."

As Rosati avers, "somebody needs to take a really practical approach to make sure that employees know about the policies in [their particular] institution."