Back to Blog

Who Should Receive HIPAA Compliance Training?

Parker Byrd

Health Insurance and Probability Act (HIPAA) 1996 is a federal law. HIPAA compliance training is required to ensure the privacy and security of patient’s health data. It is ideally required for everyone who has access to protected health information (PHI). 

Who needs HIPAA compliance training?

HIPAA training is required for the individuals and organizations on which HIPAA regulations are applicable. These organizations are called in legislative terms as Covered Entities and Business Associates.

Covered Entities (CEs)

Covered Entities are the organizations that provide treatment to the patients, receive payments from them, and work for the provision of healthcare. Covered Entities are directly in contact with protected health information (PHI). Covered Entities may include; doctors, clinics, psychologists, hospitals, healthcare agencies, health insurance companies, healthcare clearinghouses. According to the Department of Health and Human Services (HHS), there are three categories of Covered Entities.

Healthcare providers

Healthcare providers are the individuals that transmit a patient's health information electronically. According to HIPAA, healthcare providers include; hospitals, clinics, doctors, nurses, psychologists, dentists, chiropractors, pharmacies, home healthcare agencies, nursing homes, and any other healthcare workers who have access to PHI. Healthcare providers are the covered entities who should receive HIPAA compliance training to maintain the privacy and security of protected healthcare information.

Healthcare clearinghouses

Healthcare clearinghouses work as a bridge between healthcare providers and insurance companies or payers. They check the medical insurance claims and ensure that they are correctly processed by the payers. These include; billing services, repricing companies, community health information systems, health management systems, etc. As these companies receive and transmit electronically protected healthcare information (ePHI) so they should be trained for HIPAA compliance.

Health insurance plans

These include health insurance companies, health maintenance organizations (HMO), Government health programs (Medicare, Medicaid, etc.). These companies are directly dealing with patient's financial information and their insurance plans so they should be HIPAA compliant and provide their staff regular training to prevent any PHI breach.

Business Associates (BAs)

Business associates help the covered entities to help them in carrying out their activities and functions for example; transcriptionists, cloud service providers, physical and electronic data storage companies, claim processors, pharmacy benefit managers, information technology companies, etc. Therefore, it’s the responsibility of covered entities to have a written agreement or contract with their BAs to comply with the provisions of HIPAA and its rules. To get HIPAA compliant the business associates should provide HIPAA compliance training to their staff on regular basis. 

According to the law, all the covered entities and their business associates should provide HIPAA compliance training to their staff at regular intervals, and perform a risk analysis to check the effectiveness and gaps in compliance. They are required to get HIPAA compliant to prevent any PHI breach or HIPAA violation. HIPAA violation can result in monetary to criminal penalties and may cost the loss of trust and credibility of the organization. 


Share on social media: 

More from the Blog

Introducing Hook Heroes!

‍The Hook Security Team is excited to announce that you can now become a Hook Hero. Simply put, you can now get rewarded for sharing the love for and referring your friends to Hook Security!

Read Story

How to Set up a Training Campaign

In this video, we will review how to set up a training campaign. From picking out a template to sending it out in the Campaign Wizard, you’ll have the tools you need! ‍

Read Story

Why Security Awareness Doesn't Work Without Executive Buy-in

One of the most common challenges that organizations face when trying to implement security awareness training is getting executive buy-in. without the support of executives, security awareness programs can quickly become ineffective and compliance-focused rather than user-centric. In this blog post, we will examine some of the reasons why security awareness training requires executive buy-in and provide tips on how to get your executives on board.

Read Story

Never miss a post.

Enter your email below to be added to our blog newsletter and stay informed, educated, and entertained!
We will never share your email address with third parties.