If you read our most recent blog on HIPAA violations, you know that employee error is one of the five most common HIPAA violations. It could be a lost electronic device or an unintentional error, but either way a breach can drastically effect your organization. Employees that work with patient data are essential to keeping your organization HIPAA compliant. From hold trainings to having a foolproof social media policy, here are 5 tips for helping your employees understand HIPAA compliance.
1. HIPAA Compliance Education
The first step to making sure your organization stays HIPAA compliant is to educate and train your staff on HIPAA policies and procedures. It may seem like a redundant reminder, but it is extremely crucial to preventing HIPAA violations. Organize trainings, not just for new staff, but for all your employees. Make sure they understand the risks and penalties associated with a HIPAA violation. Preparation is the key to prevention. Some terms that might be obvious to one person, for example “unencrypted email,” but might be foreign to another staff member. Giving clear and precise trainings on all HIPAA compliance standards and what they mean, will be crucial to your organization avoiding a breach. Take the time to become familiar with your employees’ learning styles. Digital trainings might benefit one group of employees better, while hands on training could work for another. You don’t want to overload your staff with information, you really want them to soak the information up.
2. Continuous Updates
A HIPAA training once a year just doesn’t cut it. You want to ensure that your staff are continuously updated on any changes to HIPAA policy. Hold refresher training courses. Test employees throughout the year. Do whatever you need to do to keep them informed, it can only benefit your organization. For example Mayo Clinic “tries to get out to employees multiple times per year for education sessions, whether that be through grand rounds, via online, email or even via the CEO.” Make sure your staff understand how they can do their jobs while still complying with HIPAA regulations and changes.
3. Device Regulation
HIPAA breaches via The Profitable Practice
Theft of laptops and other electronic devices make up for about 48% of HIPAA breaches. Stress the importance of keeping personal mobile devices free of PHI. Make sure your staff are constantly reminded how to access and store electronic devices that hold PHI. The Pharmaceutical Compliance Monitor suggests that “your organization’s portable device policy should clearly explain where devices can be transported and what to do if a device is lost or stolen. You should also make sure they are protected with secure passwords that are regularly changed.” Portable device policy refreshers also never hurt.
4. Social Media Training
Social media is often considered a double edged sword. It has some extremely rewarding qualities, but it can also cause great damage. Create a foolproof social media policy and ensure strict adherence. As we mentioned in our earlier blog, social media is often overlooked when it comes to HIPAA. But say a staff members Instagrams a photo of their lunch with patient records on the table or they post a video to Facebook that contains audio from the patient room next door. These are major HIPAA violations and could be ones your staff are committing unwittingly. The best way to ensure compliance is to make sure your Social Media Policy is just as strong as your HIPAA policy.
5. Identify Risks
Have your HIPAA Privacy or Security Officer conduct an internal audit to see how your staff are doing with their HIPAA compliance. Do they know where to go with concerns? Do they understand the ways they could be violating HIPAA without even knowing? Identify any risks or problems in your polices early with help prevent future disaster. Have an external HIPAA officer audit a training to make sure that your are relaying all the information correctly. An outdated law or miscommunication when it comes to HIPAA can be drastic.
