This course is specific for Medical Office Staff personnel who do not provide medical treatment to patients directly. This course covers the fundamentals of the HIPAA Privacy Rule, the HIPAA Security Rule, and the Enforcement Rule in case of HIPAA violations.

Includes 2021/2022 Updates - ONC 21st Cures Act Final Rule and the CMS Final Rule

The course includes a video and audio component with a stand-alone exam.

Receive HIPAA Certification "Certificate of Completion" with successful completion.

HIPAA for Medical Office Staff FAQs

Who is a Medical Office Staff Member Under HIPAA?

HIPAA Privacy Rule covers: 

• Health plans 
• Health care clearinghouses 
• Healthcare providers who use electronic methods for certain financial and administrative transactions, like payment transfers and billing

These entities, referred to as "covered entities," are subject to privacy rules even if they contract with others as "business associates" to perform some of their critical responsibilities. 

How does the HIPAA Privacy Rule Affect Medical Office Staff?

The Privacy Rule applies to health plans, healthcare clearinghouses, and healthcare providers and controls how a covered entity shares protected health information (PHI) by placing limits and conditions on the uses and disclosures that may be made of such information without an individual's consent. 

The medical office staff is undoubtedly affected by the HIPAA rules applying to them. HIPAA prohibits Doctors, nurses, and healthcare organizations from disclosing PHI without patient consent.

Health organizations are in charge of providing HIPAA compliance training to all staff members that handle and interact with medical records. All staff must receive proper HIPAA training to comply with HIPAA regulations, understand their obligations under HIPAA, and assist their employer in safeguarding the security and privacy of PHI.

Informing, educating, and training medical staff on HIPAA standards prevents them from unintentionally breaking the law. Health organizations should spend the time necessary to keep the team informed of the requirements to make the company and the staff HIPAA compliant.

What steps are necessary to be HIPAA compliant in a medical office? 

According to the U.S. Department of Health & Human Services (HHS), to be HIPAA compliant, covered entities must: 

• Implement written PHI privacy procedures 
• Appoint a privacy officer 
• Require their business associates to sign agreements ensuring the confidentiality of PHI 
• Regularly train all their staff members on privacy and security rule regulations  

Covered entities must also provide patients with the following:  

• A written notice of the covered entities' privacy practices and access to their medical records 
• The chance to request modifications to the records 
• The option to request restrictions on the use or disclosure of their information 
• The opportunity to request an accounting of any use of PHI 
• The chance to ask for alternative methods of communicating information 

Additionally, covered entities must also set up a procedure for handling complaints and for patients to use in filing complaints. Finally, they must take all necessary steps to ensure that PHI is not used for fundraising, marketing, or making decisions regarding benefits or employment. 

Steps that medical office staff should take to avoid HIPAA violations are:  

Enable Firewalls and Encryption

Medical staff members frequently use their cell phones at work. Staff members should keep their cell phones safe and protected from the wrong individuals. But accidents could still occur. Because of this, medical staff should also implement firewalls, encryption, and virus protection on their work devices, especially cell phones. It's also essential to ensure that employees are regularly updating these technologies. 

Ensure Privacy

Staff members could violate HIPAA regulations less severely, such as having patient information on display to those who enter and leave the premises. For this reason, staff members should always keep patients' folders unopened. Every medical staff member must develop a habit of keeping confidential information private.  

Properly Dispose of Paper Documents

Most healthcare organizations use electronic health records. However, paper files are still often handled. Therefore, medical staff members must appropriately dispose of any documents containing patient information that is no longer needed. Never dispose of these documents in the regular trash.

Never Disclose Login Credentials

Each medical staff member should be issued and use a unique login to access private data in the office. To prevent a HIPAA breach, staff must keep their login information confidential and never disclose it to anybody. 

What steps must a covered entity follow when disclosing PHI?

When disclosing PHI, a covered entity must only share the amount of information required to satisfy the needs of the entity requesting the data (what the regulation refers to as the "minimum necessary" information to satisfy the inquiry), regardless of whether the PHI requires authorization or not. 

For more information on HIPAA for medical office staff visit the U.S. Department of Health & Human Services (HHS) website.