HIPAA Training for Pulmonary Rehabilitation Respiratory Therapists

What HIPAA training must cover for pulmonary rehabilitation staff

HIPAA training should help you recognize protected health information (PHI) in the day-to-day work of pulmonary rehabilitation. This may include a patient’s identity, referral, medical history, spirometry results, oxygen needs, attendance, exercise response, and rehabilitation plan when that information identifies the patient or could reasonably identify them.

Training should explain the HIPAA Privacy Rule, your organization’s privacy policies, who may access or share PHI, and how to protect it in clinical conversations and records. Cover the minimum necessary standard for situations where it applies, while clarifying that HIPAA does not apply that standard to provider-to-provider disclosures for treatment. HHS guidance on the minimum necessary requirement explains both the general rule and its exceptions.

Staff also need practical instruction on the HIPAA Security Rule: using authorized accounts and devices, protecting login credentials, securing workstations, recognizing suspicious messages, and reporting possible security incidents. Training should include your facility’s procedures for discussing patient progress, handling paper and electronic records, and escalating suspected privacy or security problems. HHS’s HIPAA Security Rule summary describes the required administrative, physical, and technical safeguards.

HIPAA requires covered entities to train workforce members on privacy policies and procedures as appropriate to their duties, including new staff within a reasonable period and staff affected by material policy changes within a reasonable period. It also requires a security awareness and training program for the workforce. Federal rules do not set a universal annual renewal schedule; employers may require annual or more frequent training under their own policies. Training must be documented. HHS’s HIPAA audit protocol summarizes the Privacy Rule training requirements.

How respiratory therapists protect PHI during exercise testing and treatment

Before discussing a patient’s test results or treatment, confirm you are speaking with the right patient or an authorized member of the care team. Share information with colleagues involved in treatment when needed to coordinate care, and follow your organization’s access controls and communication policies.

During exercise testing, use reasonable safeguards to reduce the chance that others can see or hear identifying details. For example, position screens away from public view, secure printed worksheets when not in use, and speak quietly when discussing a patient’s condition. Use names or other identifiers only when needed for care, and avoid discussing identifiable patient details in hallways or other areas where the conversation is not appropriate.

A shared rehabilitation area does not automatically prohibit treatment conversations. HIPAA allows disclosures that are part of treatment, including in group treatment settings, and permits some unavoidable incidental disclosures when reasonable safeguards are in place. That does not permit casual or unnecessary discussion: limit the conversation to its clinical purpose and take practical steps to protect privacy. HHS guidance on incidental uses and disclosures explains these safeguards.

When pulmonary rehabilitation disclosures require patient authorization

HIPAA generally permits a covered provider to use or disclose PHI for treatment, payment, and health care operations without the patient’s written authorization. For example, a respiratory therapist may share relevant test findings with another provider involved in the patient’s treatment. HHS guidance on treatment, payment, and health care operations describes these permitted uses and disclosures.

For a caregiver or family member involved in the patient’s care, you may share information directly relevant to that person’s involvement when the patient agrees or has an opportunity to object and does not. If the patient is unavailable or cannot make a decision, a provider may use professional judgment to determine whether a limited disclosure is in the patient’s best interest. A caregiver’s relationship alone does not automatically entitle them to the patient’s full rehabilitation record. HHS guidance on sharing information with family and friends explains the limits.

Written authorization is generally needed for disclosures not otherwise permitted or required by HIPAA—for example, sending records to an employer for a purpose unrelated to treatment, payment, or health care operations. Follow your organization’s process to confirm the purpose, recipient, and scope of any requested disclosure before sending records. HHS’s Summary of the HIPAA Privacy Rule explains when authorization is required.

How to secure spirometry results and rehabilitation records

Spirometry results and rehabilitation notes are PHI when linked to an identifiable patient. Access them only through approved systems and only as needed for your role. Do not share accounts or leave an unlocked workstation where unauthorized people could view a patient’s record.

When documenting exercise response, oxygen use, symptoms, or progress, enter information in the correct patient record and follow your organization’s documentation procedures. Keep paper records and printouts out of public view, return them to designated secure locations, and dispose of them through approved confidential processes.

Use organization-approved methods to send records, and check the recipient and attachments before transmission. Follow local procedures for secure messaging, remote access, portable devices, and any external system used to store or process PHI. Where a technology vendor handles PHI on behalf of a covered entity, the organization may need a business associate agreement (BAA) that sets out permitted uses and safeguards. HHS guidance on business associates and BAAs describes these agreements.

What to do after a suspected HIPAA breach

Report a suspected misdirected record, lost device, unauthorized access, or overheard disclosure promptly through your organization’s privacy or security reporting process. Give the privacy or security officer the facts you know, such as what information was involved, who may have received or viewed it, when it happened, and what steps have already been taken.

If you sent records to the wrong recipient, do not wait to determine on your own whether the event legally qualifies as a breach. Follow your organization’s instructions to contain the disclosure—for example, by contacting the recipient through an approved channel and asking them not to use or share the information and to securely delete or return it. Preserve relevant messages and records, and document your actions as instructed.

The organization—not an individual therapist acting alone—evaluates the incident under its policies and applicable rules. Under the breach notification rule, an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate documents an applicable exception or a risk assessment showing a low probability that the PHI was compromised. Required notifications depend on the assessment and the circumstances. HHS’s Breach Notification Rule guidance describes the assessment and notification framework.

How HIPAA training requirements differ by role and organization

Training should match what you do. Respiratory therapists who conduct testing, document results, or coordinate treatment need instruction on handling clinical records and sharing information for care. Registration staff, supervisors, IT personnel, students, and contractors may need different access and scenario-based guidance. The HIPAA Privacy Rule requires training appropriate to workforce members’ functions, while the Security Rule calls for security awareness training across the workforce.

Whether HIPAA applies to a pulmonary rehabilitation program depends on the organization’s role under the law. Covered health care providers and business associates have different obligations; an outside vendor that creates, receives, maintains, or transmits PHI for a covered entity may need a BAA. Employers can also impose requirements—such as annual refreshers or additional training—that go beyond HIPAA’s specified training timing. State laws and organizational policies may add further obligations.

A course-completion certificate can document that you completed a course, but it does not by itself establish that your organization complies with HIPAA. Your employer’s policies, job-specific training, safeguards, and incident procedures matter too. In short, protect patient information during testing, treatment, documentation, and communication; share it only through an allowed pathway; and report concerns promptly.

FAQs.

How often must pulmonary rehabilitation respiratory therapists complete HIPAA training?

HIPAA does not set a universal annual training requirement. Covered entities must train new workforce members within a reasonable period and provide training within a reasonable period after a material policy change affects their duties; the Security Rule also requires a workforce security awareness and training program. Your employer may require annual or more frequent refreshers under its own policy. HHS’s audit protocol outlines the federal training timing requirements.

What patient information may respiratory therapists share with caregivers?

You may share information directly relevant to a caregiver’s involvement in the patient’s care when the patient agrees or has an opportunity to object and does not. If the patient is unavailable or unable to decide, a provider may use professional judgment to determine whether a limited disclosure is in the patient’s best interest. A caregiver does not automatically have access to the entire record.

Does HIPAA allow discussing a patient’s progress in a shared rehabilitation area?

HIPAA does not categorically prohibit care discussions in shared treatment areas. Disclosures for treatment may be permitted without authorization, and limited incidental disclosures may be permissible when reasonable safeguards are used. Speak discreetly, share only what is relevant to care, and follow your facility’s procedures for protecting privacy.

What should staff do after sending pulmonary rehabilitation records to the wrong recipient?

Report the incident promptly to your privacy or security officer, follow instructions to contain the disclosure, and preserve relevant messages and details. Do not decide on your own whether it must be reported to the patient or regulators; the organization will assess the facts under its breach-response procedures and applicable notification rules.