Health Information Compliance Alert

Question: When an employee changes jobs within your facility--say, from temp to permanent--what responsibility do you have as far as HIPAA training requirements are concerned? Is retraining necessary?


Arkansas Subscriber

Answer: If an employee went from a temporary position within your facility to a permanent full-time status but they're doing the same job within the organization, that wouldn't necessitate any additional training on your part, says Brian Gradle with DC-based Hogan & Hartson.

That's because the employee should've received whatever training was appropriate for that role already. For example, "if someone is brought in who's an IT consultant, if they have access to PHI, they should receive appropriate training for whatever information they're going to be receiving, and consequently, if they're made a permanent employee, it really shouldn't necessitate [more training]."

Follow-up question: But what if an employee moved from, say, a front line role to a more administrative role? Is re-training required in that situation?

Answer: Remember: "[Training] depends on whatever role that person serves in the facility," says Gradle, and the employee should have training that's consistent with whatever role he or she performs. That means you'll have to re-train an employee if he takes on a more complicated role, for instance. Now, keep in mind that it's not always the privacy officer's role to ensure that HIPAA training is performed, and the privacy rule doesn't require only privacy officers to ensure workforce training.

"If a department manager is responsible for training his staff and a new person comes in, the manager should ensure that that person understands what the particular idiosyncrasies of that department are." And that includes any necessary training, says Gradle.

The bottom line: The scope and depth of any HIPAA training should be commensurate with the position to which the staff member has moved.