How Do Employees in the Medical Office Have to Be Trained Regarding Privacy Under HIPAA?

HIPAA, the Health Insurance Portability and Accountability Act, affects the way employers and employees handle health information while conducting business in the workplace. With the federal requirements of HIPAA, companies must make sure that employees are properly trained to work within HIPAA’s privacy parameters.

Function

Medical office employees must be trained to understand that HIPAA is designed to protect the privacy of patients and their protected health information (PHI). As such, medical offices are obligated to carry out the privacy provisions of HIPAA.

Types of Rules

Employee training must cover patient privacy and security issues. Since medical offices require staff to handle PHI on a regular basis, staff members must know the many types of privacy rules set by HIPAA, such as keeping medical records confidential, not discussing patient information in public and discarding PHI properly.

Disclosures

Employees must be trained that they can only release and disclose PHI to individuals or entities that the patient allows them. Patient authorization requires the patient’s signature and must be maintained in the patient’s medical record at all times.

Confidentiality

People who work in medical offices may not share information about their patients with their friends or family members, as this becomes a breach of confidentiality. When discussing patients with other staff, the conversation must take place in a private setting, like an office.

Paperwork

Medical office employees must not leave paperwork with patient information on it out where others can see it. All documents containing PHI must either be filed into the patient’s medical record or shredded in a locked shred bin.

References

• U.S. Department of Health and Human Services: Health Information Privacy Statute