HIPAA Training Policy and Procedure

Title

University of North Carolina at Chapel Hill HIPAA Training Policy and Procedure

Policy

UNC-Chapel Hill provides an education program ("HIPAA training") relating to the requirements of the Health Insurance Portability and Accountability Act of 1996, as modified by the Health Information Technology for Economic and Clinical Health Act of 2009 ("HIPAA"). This HIPAA training is updated annually to reflect changes any changes in the law, and/or changes in UNC-Chapel Hill policies and procedures as these relate to HIPAA compliance. Each covered University unit has a designated Privacy Liaison and designated Security Liaison who work with the University's Privacy Officer and Security Officer to ensure that all employees, students, and volunteers in covered University units, and Business Associates complete HIPAA training in accordance with this policy. The University's Privacy and Security Officers may consider and recommend training for additional individuals. Completion of HIPAA training is documented and maintained by the Research Compliance Program and UNC-Chapel Hill.

Procedure

1. Initial Training

New UNC-Chapel Hill employees, students, and volunteers who work or train with covered University units must complete HIPAA training within thirty (30) days of initial employment, enrollment, or placement.

1. Business Associates who participate on site in UNC-Chapel Hill sponsored work are required to complete HIPAA training.

2. Annual Training

1. UNC-Chapel Hill employees, students, and volunteers in covered University units must complete HIPAA training annually. Additional training may be required as necessary for some or all listed individuals, as determined by the University Privacy Officer and/or Security Officer.
2. Business Associates who participate on site in UNC-Chapel Hill sponsored work are required to complete HIPAA training.

3. Ongoing Awareness Training

1. UNC-Chapel Hill employees, students, and volunteers will receive periodic awareness privacy/security training. This training may include any/all of the following:
   • Overall privacy/security awareness
   • Periodic HIPAA regulation reminders
   • Virus awareness
   • Password management
   • Security Incident Reporting
   • User-specific topics necessary for individual workstation security
2. Ongoing training may include (without limitation) meetings, University or departmental newsletters or memoranda, e-mail communications, and posters.