HIPAA Compliance

Privacy & Security Training Program for HIPAA Compliance

The privacy and security training program consists of individual courses that University employees, students, and volunteers complete online. Individuals assigned training receive an e-mail notification containing details about accessing the assigned training. In brief, assigned courses are available for completion at any time through the University’s myU portal (www.myu.umn.edu) using WebCT Vista, an online curriculum delivery software program commonly used by University departments. Assigned and completed courses are listed in the To Do list of the “my Toolkit” section of the myU portal.

Tips about using the myU portal to take privacy and security training

 *The portal only updates the information about privacy and security training once a day. Accordingly, it can take up to 48 hours for newly assigned training or completion of a course to be listed in an individual’s To Do list.

*Students or instructors who have a WebCT Vista section in their To Do list will have each assigned training course listed twice, once under WebCT Vista and once under a privacy or security training heading. This does not indicate an error.

*The Introduction to HIPAA Privacy and Security videotape requires the use of Real Player, not QuickTime, software for viewing online. Individuals requiring assistance with downloading QuickTime software can contact their local information technology support staff or the Technology Helpline at (612) 301-HELP.

Training requirements

There are security courses that are required of all individuals, and privacy and security training courses that are appropriate only for some individuals. The particular training that each individual must complete depends in large part on job duties and responsibilities. The privacy and security training courses offered at the University of Minnesota are listed in the table on the next page.

Privacy training requirements:

*All employees, student workers, and health science students and volunteers in the AHC (with the exception of those in College of Veterinary Medicine programs) and other University health care components are required to complete the primary Introduction to HIPAA Privacy and Security videotape course.

*All employees, students, and volunteers with research-related duties are required to complete the Privacy and Confidentiality in Research core course.

*All employees, students, and volunteers with clinical responsibilities are required to complete the Privacy and Confidentiality in Clinical Settings core course.

Security training requirements:

*All employees, students, and volunteers are required to complete the three primary security courses: Data Security in Your Job, Securing Your Computer Workstation, and Using University Data.

*All employees, students, and volunteers in the AHC (with the exception of those in College of Veterinary Medicine programs) are required to complete the Managing Health Data Securely topical course.

Table III-1. Privacy and Security Training Courses Offered by the University of Minnesota

¹Only the first security course, Data Security in Your Job, is initially assigned by either the Tracking system automatically or by a privacy coordinator. Two weeks later, the second security course, Securing Your Computer Workstation, is automatically assigned (with the person that training was assigned to receiving an e-mail notification about training), whether or not the first course has been completed. Two weeks after the second security primary course is assigned, the third course, Using University Data, is assigned (whether or not the first or second course has been completed), with an e-mail sent to the person assigned training.

²The third security course, Using University Data, contains an assessment module at the end. The assessment is a required component of security training. If a person who finishes the third security course does not complete the assessment, he or she will still receive a completion e-mail notification. However, the course will be treated as incomplete until the assessment is completed. A person who completes the course but not the assessment receives one reminder e-mail with a link to the assessment.

³The assessment that follows the Using University Data course is listed as a separate course in the Tracking system that privacy coordinators use. It is also listed in the myU portal as a separate course to highlight its importance as a tool for determining and delivering additional curricula.

⁴The course length times listed are approximate. Each course contains additional resources that, if reviewed by the person taking training, will lengthen the time spent completing the course.

Stopping and resuming a course

With the exception of the Introduction to HIPAA Privacy and Security videotape, privacy and security courses can be stopped partway through and resumed at a later date. However, the WebCT Vista software does not jump the person taking training to the screen where he or she suspended the course. A person who wants to resume and complete a course needs to remember (or record) where he or she stopped and then use the Table of Contents on the left side of the course screen to navigate to the point where he or she left off, then continue the training.

Notification of course completion

When a person completes a course, she or she receives an e-mail within 24 hours (but not immediately) that the course has been completed. Within 48 hours, the completed status for a particular course is reflected in that person’s To Do list in the myU portal.

Evaluating courses

The end of each course provides an evaluation that the person taking the course can complete. The person taking the course receives a second opportunity to evaluate the course in the e-mail that he or she receives as notification that a particular course has been completed. For the three security primary courses, the evaluation is offered at the end of the third online course, and is available through a link included in the e-mail notification that the third course has been completed.