# HIPAA Employee Training — Workflows

## Workflow 1: New Hire Training Process

```
New Workforce Member Onboarding
│
├── Step 1: Pre-Access Training Enrollment (Day 1)
│   ├── HR notifies Privacy/Compliance Office of new hire
│   ├── Assign training track based on role classification
│   │   ├── Clinical → Tier 1 (General) + Tier 2 (Clinical)
│   │   ├── Administrative → Tier 1 (General) + Tier 2 (Admin)
│   │   ├── IT/Technical → Tier 1 (General) + Tier 2 (Technical)
│   │   ├── Management → Tier 1 (General) + Tier 2 (Management)
│   │   └── Research → Tier 1 (General) + Tier 2 (Research)
│   └── Set completion deadline (must complete before PHI access granted)
│
├── Step 2: Tier 1 General Training Delivery (Days 1-5)
│   ├── Module 1: What is PHI — 18 identifiers, definition, examples
│   ├── Module 2: Permitted uses and disclosures — TPO, required by law
│   ├── Module 3: Patient rights — access, amendment, accounting
│   ├── Module 4: Minimum necessary standard
│   ├── Module 5: Breach identification and reporting
│   ├── Module 6: Security basics — passwords, workstations, mobile
│   ├── Module 7: Social engineering — phishing, pretexting
│   └── Module 8: Sanctions policy and consequences
│
├── Step 3: Tier 1 Assessment (Day 5-7)
│   ├── Passing score: 80% minimum
│   ├── PASS → Proceed to Tier 2
│   └── FAIL → Remedial training and reassessment within 5 days
│
├── Step 4: Tier 2 Role-Based Training (Days 7-14)
│   ├── Deliver role-specific modules per classification
│   ├── Include department-specific PHI handling scenarios
│   └── Hands-on EHR/system training with PHI access protocols
│
├── Step 5: Training Completion Documentation (Day 14-30)
│   ├── Record: name, role, date, modules completed, scores
│   ├── Obtain signed acknowledgment of policies
│   ├── Obtain signed confidentiality agreement
│   ├── File in training management system (retain 6 years)
│   └── Notify IT to activate PHI system access
│
└── GATE: No PHI access granted until Steps 1-5 complete
```

## Workflow 2: Annual Refresher Training Cycle

```
Annual Training Planning (Q4 for following year)
│
├── Step 1: Training Needs Assessment
│   ├── Review prior year's incident reports for training gaps
│   ├── Review OCR enforcement trends and new guidance
│   ├── Review risk analysis findings relevant to training
│   ├── Review audit findings noting training deficiencies
│   └── Survey department managers on observed knowledge gaps
│
├── Step 2: Content Update
│   ├── Update regulatory changes (new rules, guidance, enforcement)
│   ├── Incorporate lessons from internal incidents
│   ├── Add current threat landscape (phishing trends, ransomware)
│   ├── Refresh scenarios and examples to remain relevant
│   └── Privacy Officer and Security Officer review and approve content
│
├── Step 3: Annual Delivery (Rolling quarterly or single campaign)
│   ├── All workforce members must complete within the compliance window
│   ├── Delivery methods: LMS, instructor-led, or hybrid
│   ├── Assessment required: 80% passing score
│   └── Non-completers escalated to manager after 2 reminders
│
├── Step 4: Compliance Tracking
│   ├── Dashboard: completion rates by department, role, deadline
│   ├── Weekly reports to department managers during training window
│   ├── Escalation: non-completers after deadline → HR and management
│   └── Final completion rate reported to compliance committee
│
└── Step 5: Documentation and Retention
    ├── Archive training materials, attendance, and scores
    ├── Retain for 6 years per §164.530(j)
    └── Feed completion metrics into annual compliance report
```

## Workflow 3: Incident-Triggered Retraining

```
HIPAA Incident or Violation Identified
│
├── Step 1: Incident Assessment for Training Implications
│   ├── Privacy Officer reviews incident details
│   ├── Was the incident caused by or related to a knowledge gap?
│   │   ├── YES → Targeted retraining required
│   │   └── NO → Standard sanction process; no retraining
│   │
│   └── Determine scope: individual, team, department, or organization-wide
│
├── Step 2: Targeted Training Development
│   ├── Develop content addressing the specific knowledge gap
│   ├── Include the incident scenario (anonymized) as a case study
│   ├── Link to applicable HIPAA regulation and organization policy
│   └── Privacy Officer approves retraining content
│
├── Step 3: Delivery and Assessment
│   ├── Individual violation → one-on-one training with manager present
│   ├── Team/department gap → group session within 30 days
│   ├── Organization-wide gap → integrate into next training cycle or ad-hoc
│   └── Assessment to confirm understanding
│
└── Step 4: Documentation
    ├── Record retraining in workforce member's training file
    ├── Link to incident report
    ├── Document corrective action and sanction (if applicable)
    └── Retain for 6 years per §164.530(j)
```

## Workflow 4: Policy Change Retraining

```
Material Change to HIPAA Policy or Procedure
│
├── Step 1: Change Classification
│   ├── Is the change material (affects how workforce handles PHI)?
│   │   ├── YES → Retraining required per §164.530(b)(2)(ii)
│   │   └── NO → Informational communication only
│   │
│   └── Identify affected workforce members/roles
│
├── Step 2: Training Content Development
│   ├── Describe what changed and why
│   ├── Describe new requirements and expectations
│   ├── Provide practical examples of the change in action
│   └── Privacy/Security Officer approval
│
├── Step 3: Delivery
│   ├── Deliver within reasonable period after change takes effect
│   ├── Methods: email notification + LMS module, team meeting, or memo
│   ├── Acknowledgment required from all affected workforce members
│   └── Track completion against affected workforce roster
│
└── Step 4: Documentation
    ├── Record which workforce members received change training
    ├── Document the policy change effective date
    ├── Retain acknowledgments for 6 years
    └── Update training materials for future onboarding
```