Health Information Compliance Alert

One size does fit all where HIPAA privacy training is concerned.

"You can't say, 'OK, I'm going to train the top three people in my organization and therefore I'm going to be done with my HIPAA privacy training because they're going to understand everything and will be there to answer questions," warned Kristen Baum of Joliet, IL-based Murer Consultants, at an Eli teleconference on HIPAA privacy training. "That's not going to cut it. The rule is very specific about having everyone in your organization trained on privacy."

Co-presenter Michael Murer pointed out that failing to train everyone on your staff comes with a hefty price tag. "[HIPAA training] requires the involvement of everyone who is associated with your institution, because the penalties are harsh," he cautioned.

How harsh? Civil penalties under HIPAA carry fines of $100 per incident, capped at $25,000. However, the cap applies only to violations of the same requirement; if you violate different sections of the rule, you could face multiple civil violations.

Functional. A training program that takes a purely theoretical approach won't work. Instead, it should be built around real-life examples. "Make them interesting," Murer urged. "Give a lot of detail so [trainees] say, 'This is like a case we had. This is like something that we've seen.'"

Analytical. Trainees should be allowed to talk about how to apply the rule in different cases, not only to improve their understanding of the rule, but also to improve your organization's compliance efforts. "You need to be able to find the people who understand what it is that you're trying to teach them, so that they can be the [knowledge] base for that part of the organization," he explained.

Matrixed. Murer pointed out that health care organizations deal with many different kinds of staff, professional and nonprofessional, as well as outside contractors, and that creates a complex matrix of relationships. "Who can have what information, who can't have what information, where are the limits, how is the information transmitted. All of these are concerns of your training program," Murer noted.