Workforce Security Procedures

2. Training curriculum and delivery (164.308(a)(5)(i), 164.530(b))

1. Maintain a combined security + privacy curriculum in the [learning management system] covering, at minimum: policies and procedures; phishing/social engineering and malware recognition and reporting; PHI/PII handling (minimum necessary, permitted uses/disclosures, clear-desk/clear- screen, secure transmission and disposal); password/authenticator hygiene; incident reporting; the no-retaliation guarantee; and the consequences of non-compliance.
2. Assign role-specific modules where warranted (privileged users, engineers, managers, teleworkers).
3. Deliver onboarding training before ePHI/PHI access is granted (no later than [30 days] after start). For new workforce members it is the hiring manager's responsibility to confirm completion before access to confidential data.
4. Trigger ad hoc / role-change training when a role, system, regulation, or policy changes materially.
5. Run annual refresher training for all workforce members; notify via the [learning management system]'s automated reminders and targeted manager follow-up.
6. Review and update content at least annually and after incidents, audits, or regulatory change; record the revision in change control.

3. Completion tracking and attestation (164.308(a)(5)(i), 164.530(b))

1. The [learning management system] records assignment, completion date, and score for each module and each workforce member.
2. On completion, each member signs an attestation acknowledging they received the training and accept their security and privacy responsibilities; the attestation is captured in the attestation log (see Records produced).
3. The [Privacy Officer] (or delegate) reviews completion status at least [quarterly], follows up on overdue assignments, and escalates persistent non-completion (which may suspend access per the Policy).
4. Training records and attestations are retained six years.

4. Security reminders (164.308(a)(5)(ii)(A))

1. The [Security Official] maintains a reminder calendar with at least [quarterly] touchpoints plus ad hoc alerts for emerging threats.
2. Distribute reminders through the chosen channels ([internal messaging tool], email advisories, login/banner messages, posted notices) and run periodic simulated-phishing exercises with follow-up coaching for those who fall for them.
3. Log each reminder/exercise (date, topic, audience, and phishing-simulation results) as evidence the program operates.

5. Sanction decision guide (164.308(a)(1)(ii)(C), 164.530(e))

When a suspected violation of a security or privacy policy is reported or detected:

1. Document the event: what happened, who was involved, witness accounts, and any supporting evidence (logs, monitoring data), on the sanction record.
2. Confirm it is not protected activity: sanctions are never applied for good-faith reporting, cooperating in a complaint/investigation, or exercising a HIPAA right (see § 6). If it is protected activity, stop and close with no adverse action.
3. Assess severity: actual/potential harm to patients, the organization, and others; legal/ regulatory exposure; data sensitivity involved.
4. Assess culpability and history: intentional vs. negligent; first occurrence vs. repeated or ongoing.
5. Consult HR, the [Security Official] and/or [Privacy Officer], and Legal as needed to understand scope.
6. Select a proportionate sanction from the escalating range: retraining → documented warning → heightened monitoring → suspension of access/duties → termination of employment or contract; refer for civil/criminal action where warranted. Apply comparable sanctions to comparable violations for consistency.
7. Record and retain the decision, rationale, and any action taken on the sanction record for six years. Where access changes result, hand off to the Access Control Procedures.

Suggested severity tiers: Low (negligent, no/low harm, first time) → retraining/warning · Moderate (repeat, or sensitive data exposed) → monitoring/suspension · High (intentional misuse, breach of PHI, or unlawful act) → termination and/or referral.

6. Raising a concern without retaliation (164.530(g))

1. Any workforce member may report a suspected violation to their manager, the [Security Official], or the [Privacy Officer], anonymously where supported. No proof is required, and a good-faith report made in error carries no consequence.
2. If anyone is told to "keep quiet" about a suspected violation, they must report that instruction as part of the concern.
3. The [Privacy Officer] logs the concern, routes investigation per the Security Incident Response Policy, and notifies the reporter of the outcome.
4. No intimidating or retaliatory action is taken against anyone for reporting, cooperating, or exercising a HIPAA right; retaliation is itself handled as a violation under § 5. [Organization] never conditions treatment, payment, enrollment, or eligibility on waiving the right to complain to HHS.

Records produced (evidence)

Role risk designations · background-check consents and adjudication records · signed confidentiality/NDA & acceptable-use agreements · training curriculum & revision history · per-member training-completion records and the attestation log · security-reminder/phishing-simulation logs · sanction records (event, assessment, decision, action) · concern/retaliation reports and outcomes. These are the artifacts an auditor will request to confirm the controls operate. All are retained six years.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official] and [Privacy Officer]. v1.0.