Q&A: Who should receive HIPAA training

Q. Is it necessary for organizations to provide HIPAA training for all workforce members, even those who are not involved in patient care? Does that include cafeteria staff, workers employed through a temp or staffing agency, etc.?

A. Yes, all employees, temporaries, interns, students, and volunteers need to be HIPAA trained. Cafeteria workers who are employed by a temp or staffing agency are considered agents of CEs, so they need to be trained. Even staff not involved in patient care still come in contact with patients and their PHI. For example, patients might eat at the cafeteria and may be recognizable to cafeteria workers. Those workers need to understand that it’s not OK to tell their friend who they saw at the hospital. That’s considered PHI, given that the patients are there to receive care and may not want others to know they were in the hospital.

That said, the training for cafeteria workers, temporaries, and volunteers may be abbreviated. Ideally, training should be role based. Direct care providers need training that fits with what they do, HIM staff need training that fits with what they do, and so forth.

Editor’s note: This question was answered by Chris Apgar, CISSP. Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are that of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Editor Nicole Votta at nvotta@hcpro.com.