HIPAA Training for Functional Capacity Evaluation Company Staff

Functional capacity evaluation (FCE) companies may handle sensitive health information during assessments, report writing, scheduling, and billing. The HIPAA training your staff need depends on the company’s role in each relationship: an FCE company may be a covered entity, a business associate, or neither under HIPAA.

Is a functional capacity evaluation company a covered entity or business associate?

An FCE company is not automatically subject to HIPAA just because it performs physical assessments or receives health information. A health care provider is generally a covered entity if it electronically conducts a transaction for which HHS has adopted a standard, such as certain claims or payment transactions. See HHS guidance on covered entities and business associates.

A company may instead be a business associate when it performs a service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting protected health information (PHI). For example, an FCE company engaged by a health plan or provider to conduct evaluations and prepare reports using PHI may meet that definition. The specific contract and workflow matter; the federal definition of business associate describes the relevant relationships.

If the company is neither a covered entity nor a business associate, HIPAA may not govern its records, although other laws, contracts, and privacy obligations may apply. Employment records held by an employer in its capacity as an employer are generally not HIPAA-protected health records. When a covered entity hires an FCE company as a business associate, the parties generally need a written business associate agreement (BAA) that describes permitted uses and disclosures and requires appropriate safeguards. See HHS guidance on BAA provisions.

What HIPAA training obligations apply to company staff?

A covered entity must train its workforce on its PHI policies and procedures as necessary and appropriate for staff to perform their duties. New workforce members must receive training within a reasonable period after joining, and affected staff must be trained within a reasonable period after a material policy or procedure change. The covered entity must document the training. These requirements appear in 45 CFR § 164.530.

Covered entities and business associates must also implement a HIPAA Security Rule security awareness and training program for their workforce. Training should address the organization’s security procedures and the risks staff encounter in their work. The Security Rule also includes addressable implementation specifications such as periodic security updates, password management, and procedures for detecting and reporting malicious software. See 45 CFR § 164.308.

The current federal Privacy Rule does not set a universal annual retraining interval. Organizations may set annual refreshers based on risk, internal policy, state law, payer or client contracts, or a BAA. HHS has proposed Security Rule changes, but its current Security Rule rulemaking page states that the current rule remains in effect while the rulemaking is underway. A course completion certificate can document participation; it does not by itself establish that the company is HIPAA-compliant or replace employer-specific policy training.

What should role-based training cover for FCE staff?

Build training around each person’s actual duties, the PHI they handle, and the company’s policies and BAA terms. Explain how staff should verify that a request or disclosure is permitted, use approved systems, and ask a supervisor or privacy contact when the purpose or authority is unclear.

• Evaluators and clinicians: Protect intake forms, medical histories, test observations, and reports. Discuss findings privately and share them only with authorized recipients for permitted purposes.
• Scheduling and reception staff: Limit what they say about a person’s appointment or evaluation, verify identity before sharing details, and keep paper schedules and screens away from visitors.
• Report writers and records staff: Confirm the intended recipient and transmission method, check attachments before sending, and follow procedures for corrections, retention, and secure disposal.
• Billing, IT, and managers: Follow Role-based access controls, protect credentials, recognize phishing and malware, and know how to report suspicious activity or inappropriate access.

Keep records of completed training and update the materials when roles, systems, contracts, or relevant procedures change. Staff should know whom to contact with a privacy question or suspected incident.

How should staff protect PHI during functional capacity evaluations?

Apply safeguards before, during, and after the evaluation. Confirm identity and the basis for receiving or sharing information under company procedures; use a private area for discussions; and position screens, forms, and reports so that patients, visitors, or other clients cannot see them. Do not discuss a person’s evaluation where others can overhear.

Use only approved devices, accounts, storage, and communication channels for PHI. Secure paper notes and forms when unattended, dispose of them using approved procedures, and avoid recording or photographing an evaluation unless the activity is permitted by applicable policy and the required authority has been confirmed. The Privacy Rule requires reasonable safeguards against impermissible uses and disclosures, while the Security Rule requires appropriate administrative safeguards, physical safeguards, and technical safeguards for electronic protected health information (ePHI). See 45 CFR § 164.530 and HHS’s Security Rule summary.

How does the minimum necessary standard apply to FCE records?

When the minimum necessary standard applies, a covered entity must take reasonable steps to limit PHI uses, disclosures, and requests to what is needed for the purpose. For FCE work, that may mean requesting records relevant to the evaluation rather than routinely requesting an entire medical chart, and limiting a report to information appropriate for its intended recipient and purpose. HHS describes the standard and its exceptions in its minimum necessary guidance.

The standard does not apply to disclosures to or requests by a health care provider for treatment purposes. But an FCE may also be conducted for claims, payment, or another purpose, so staff should not assume every request or report qualifies as treatment. Follow the applicable role, purpose, BAA, authorization, and company procedures; when uncertain, ask the privacy contact before sending records. Role-based access controls help ensure employees can access the records they need without granting broader access by default.

What steps should staff take after a suspected PHI breach?

Report a suspected exposure, misdirected report, lost device, unauthorized access, or suspicious system activity promptly through the company’s incident process. Do not wait to decide whether the event legally qualifies as a breach. Preserve relevant messages and records, note what happened and when, and follow directions from the privacy or security lead. The Security Rule requires regulated entities to identify and respond to suspected or known security incidents and document their outcomes; see 45 CFR § 164.308.

The privacy or security lead should contain the incident, assess what PHI was involved and who may have received or accessed it, and determine whether the event triggers unsecured PHI breach notification. An impermissible use or disclosure is generally presumed to be a breach unless the organization establishes a low probability that the PHI was compromised or another exception applies. Staff should not independently notify patients, clients, or the media unless authorized to do so.

If an FCE company is a business associate, it must notify the covered entity after discovering a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. A BAA may require faster reporting, and employees should follow the company’s internal reporting deadline rather than treating 60 days as permission to wait. The covered entity is generally responsible for required notices to affected individuals. See 45 CFR § 164.410 and HHS’s Breach Notification Rule guidance.

In short, effective FCE privacy practices start with identifying the company’s HIPAA role, training staff for their actual responsibilities, limiting access to appropriate records, and promptly escalating suspected incidents.

FAQs

How often must functional capacity evaluation company staff receive HIPAA training?

HIPAA does not set a universal annual interval for Privacy Rule workforce training. Covered entities must train new workforce members within a reasonable period after they join and retrain affected members within a reasonable period after a material policy or procedure change. The Security Rule requires a security awareness and training program and includes periodic security updates, but it does not establish one fixed annual interval for every organization. Company policies, contracts, state law, risk assessments, or a BAA may require more frequent training.

Does every FCE company need a business associate agreement?

No. A BAA is generally needed when an FCE company is a business associate handling PHI on behalf of a covered entity. Whether that relationship exists depends on the services and information involved. An FCE company that is neither a covered entity nor a business associate does not need a BAA solely because it conducts evaluations, though other legal or contractual duties may apply.

Which staff members count as part of the HIPAA workforce?

The HIPAA workforce includes employees, volunteers, trainees, and other people whose conduct is under the direct control of a covered entity or business associate, whether or not they are paid. An independent contractor is not automatically a workforce member; the company should assess the person’s relationship and responsibilities, including whether the person or their organization may instead be a business associate or subcontractor. See the federal workforce definition.

How quickly must a company report a breach of unsecured PHI?

Staff should report a suspected incident internally as soon as possible under company policy. A business associate must notify the covered entity of a discovered breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery, unless the BAA sets a shorter deadline. The covered entity generally has its own notification duties, including notifying affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach.