HIPAA administrative duties: training, sanctions and records.
Beyond the rules on what can be shared, HIPAA expects a plan to run like an organization that takes privacy seriously: named people, written policies, trained staff, consequences and records. These are the duties employers most often skip.
What HHS lists.
Written Policies
A covered entity must develop and implement written privacy policies and procedures consistent with the Privacy Rule. For a group health plan, this means the policies should reflect how the plan actually operates and be kept current. Ask counsel or your privacy adviser to confirm what applies to your plan.
Named People
It must designate a privacy official responsible for the policies, and a contact person or office to receive complaints and provide information. Employers sponsoring a plan should record who holds each role, give that person enough time and authority to do the work, and keep the information current when staff change or leave.
Training And Sanctions
It must train all workforce members on its privacy policies as necessary for their functions, and apply appropriate sanctions against those who violate them. Training should match each person’s job, be repeated when policies change or new hires join, and be documented. Sanctions should be applied consistently, which is easier when the policy is written and shared.
Mitigation And Retention
It must mitigate harmful effects it learns of, and retain policies, notices and other required documentation for six years from creation or the last effective date, whichever is later. A simple file that holds policies, notices, training records and incident notes, with dates, makes it much easier to show later what the plan did. Counsel can confirm the retention period that applies.
What the administrative requirements say.
Training
All workforce members must be trained on the privacy policies for their roles. New hires are trained within a reasonable time, and so are staff affected by a material policy change. Completion must be documented. Training for plan staff and any managers who handle health information should be given when they start and refreshed over time, and the date, topic and attendees should be recorded.
Safeguards
Administrative, technical and physical safeguards must protect health information and reasonably limit incidental disclosures. In practice this covers items such as locked files, restricted system access, secure email and clear rules for who may see employee health information. A privacy adviser can help match safeguards to the plan.
Complaints
Individuals must have a process to complain about the privacy policies or compliance, and complaints and their outcomes must be documented. Employees should know how to complain and to whom, the process should be written down, and each complaint and its outcome should be logged. Counsel can help set up a process that fits the plan.
Sanctions
There must be appropriate sanctions for workforce members who violate the policies, and applied sanctions must be documented. The policy should say what happens when a rule is broken, the response should fit the seriousness of the violation, and each case should be recorded, so the plan can show that it follows its own rules.
Mitigation
Known harmful effects of an improper use or disclosure, including one by a business associate, must be reduced as far as practicable. When a problem is found, the plan should fix it where it can, such as by retrieving information or asking a recipient to delete it, and record the steps taken. Counsel can advise on specific incidents.
Documentation And Retention
Policies, required communications and records of required actions must be kept for six years from creation or from the date last in effect, whichever is later. Employers should confirm where these records are stored, who can reach them, and how the retention period is tracked, so nothing is discarded early. Counsel can confirm the period that applies to the plan.
Source: 45 CFR 164.530.
A practical setup.
Name The Roles
Write down who is the privacy official and who handles complaints. They can be the same person in a small organization. Put the names in a short written record with contact details, and update it whenever someone changes roles. It also helps to name a backup in case the main contact is out.
Train The People Who Touch Plan Information
Cover HR, finance and anyone who answers benefits questions. Train new members of the workforce within a reasonable time after they join. Keep an attendance log and a copy of the training materials. A short refresher at open enrollment or when policies change is an easy way to keep everyone current without a long session.
Write A Sanctions Policy
Set out the consequences for violating privacy policies, and apply it consistently. Share the policy with staff who handle plan information, document each discipline decision, and ask counsel to review the policy so that it is consistent with other HR policies and employment practices.
Keep The File For Six Years
Save policies, notices, complaint dispositions and training records together. Store them in one place with clear dates and access limits, and set a calendar reminder to review the file each year so that missing items are found before anyone asks for them.
Three questions to answer.
Who Is Our Privacy Official
If no one comes to mind, that is the first gap. The role can be held by someone already on the team, but it should be written down, communicated and supported. Counsel or a privacy adviser can help you decide who is a good fit.
When Did We Last Train
Training should be repeated when policies change materially. Check the training log for dates and attendees, and schedule a refresher if policies changed or if new people have joined. Keeping a brief written summary of each session is enough for most plans.
Can We Produce The Records
If a regulator asked, could you find the policies, the notice and the training log? Try a quick test by locating the current policy, the notice, the training log and one complaint record. If anything is missing, fix the gap now and note the date in the file.
Common Questions About HIPAA Administrative Duties
Does a small employer need all of this?
HHS notes covered entities range from the smallest to the largest. The requirements are scalable, but they still apply to a plan that is covered.
Does a fully insured plan have to do this?
A fully insured plan that receives only summary health information and enrollment or disenrollment information is exempt from most administrative requirements. Confirm what your plan receives.
What is a sanction?
A consequence applied to a workforce member who violates the policies, for example retraining, a written warning or discipline.
What must be retained?
Policies, notices, complaint dispositions and other required documentation, for six years.
Does the Security Rule add duties?
Yes. It adds its own training, sanctions, incident procedures and documentation requirements for electronic information.
Is this legal advice?
No. For your own plan, involve your counsel. We can help you build the checklist.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
Laws and rules referenced
45 C.F.R. § 164.530 — Administrative requirements: training, sanctions and documentation.
This page is general information, not legal or tax advice. Rules change and facts matter, so confirm your situation with counsel or a qualified advisor.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.