HIPAA Training for Victim Advocates and Staff

When HIPAA Applies to Victim Advocacy Programs

HIPAA applies to covered entities and business associates—not automatically to every organization that supports survivors. Covered entities include health plans, health care clearinghouses, and certain health care providers that conduct specified electronic transactions. A victim advocacy program may be a business associate if it performs certain functions or services on behalf of a covered entity and handles protected health information (PHI) as part of that work. HHS guidance on covered entities and business associates

Receiving information from a health care provider does not, by itself, establish that an advocacy program is a business associate. The relationship and the services performed matter. If a program is a business associate, the covered entity generally must have a written business associate agreement (BAA) with it that sets out permitted uses and disclosures, safeguards, and reporting responsibilities. HHS guidance on business associate agreements

Even when HIPAA does not directly apply to a program, confidentiality obligations may come from state law, other federal rules, contracts, funding conditions, professional duties, or the program’s own policies. Staff should not assume that information is unrestricted simply because HIPAA does not cover their organization. Seek qualified legal guidance when the program’s status or disclosure duties are uncertain.

What HIPAA Training Should Cover

For a covered entity, HIPAA training should explain the organization’s privacy policies and procedures in a way that fits each person’s role. A covered entity must train workforce members as necessary and appropriate for their duties, including new workforce members within a reasonable period and when relevant policies materially change. HIPAA does not set one identical course for every role. 45 CFR § 164.530, administrative requirements

For advocates and staff who handle survivor information, training should cover:

• What counts as PHI, including identifiable health information in conversations, paper records, and electronic records.
• Which information staff are authorized to access, use, or share, and how to follow the program’s privacy policies.
• When a valid HIPAA authorization is needed and when the Privacy Rule may permit a disclosure without one.
• How to limit information to what is appropriate for the purpose, while recognizing that HIPAA’s minimum necessary standard has exceptions, including certain disclosures for treatment and disclosures made under a valid authorization.
• Practical administrative safeguards, secure communication procedures, access controls, record storage, and steps for reporting a suspected privacy or security incident.

Programs outside HIPAA’s scope can still train staff and volunteers on their own confidentiality policies, applicable law, safe information handling, and referral procedures. A training completion record can document participation, but it does not by itself establish that an organization is HIPAA-compliant. HHS overview of HIPAA security safeguards

How Staff and Volunteers Protect Confidentiality

Start with survivor-centered access: give each person only the information access needed for their assigned duties, and discuss a survivor’s situation only with authorized people for a legitimate purpose. Avoid conversations where others can overhear, and do not leave case notes, messages, or screens visible to unauthorized people.

Use the organization’s approved systems and procedures for storing and sending information. Secure paper records, protect devices and accounts, verify recipients before sending information, and follow rules for retaining and disposing of records. These are practical safeguards; covered entities and business associates must implement appropriate administrative, physical, and technical protections for electronic PHI under the Security Rule. HHS summary of the HIPAA Security Rule

Volunteers should receive confidentiality instructions appropriate to their assignments before they encounter survivor information. HIPAA training requirements apply to covered entity workforce members according to their functions; volunteers who are part of that workforce should receive training suited to their access and duties. Programs should also require volunteers to follow the organization’s confidentiality policies, whether or not HIPAA directly applies.

How to Obtain Consent Before Sharing Survivor Information

Explain what information you propose to share, with whom, for what purpose, and how the sharing could affect the survivor. Give the survivor an opportunity to ask questions and make an informed choice, consistent with applicable law and the program’s policies. Do not treat a general verbal agreement as a substitute for a HIPAA authorization when the Privacy Rule requires one.

For a covered entity, a HIPAA authorization is generally required for a use or disclosure of PHI that is not otherwise permitted or required by the Privacy Rule. A valid authorization must meet HIPAA’s requirements, including identifying the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the individual’s signature and date. HIPAA consent and HIPAA authorization are distinct: consent may be used for certain treatment, payment, or health care operations practices, while authorization is required for uses or disclosures that are not otherwise allowed. HHS explanation of consent and authorization

Before sharing, confirm that the authorization covers the specific information, recipient, and purpose, and that it has not expired or been revoked. Share only what the survivor has authorized and what is appropriate under applicable rules. Some disclosures may be permitted or required without authorization, such as certain disclosures required by law; staff should follow established procedures and consult the designated privacy lead rather than making assumptions. HHS summary of the HIPAA Privacy Rule

How Advocates Coordinate With Health Care Providers

Coordinate around the survivor’s goals and preferences. With permission when needed, agree on what information the provider and advocate will exchange, who will receive it, and how it will be sent. Use the provider’s secure channel or the organization’s approved process, and avoid sending a full case history when a focused referral or update will do.

HIPAA allows covered health care providers to share PHI with one another for treatment without first obtaining the individual’s authorization. The minimum necessary standard does not apply to disclosures to or requests by a health care provider for treatment. An advocacy organization is not automatically a health care provider, however, and a provider’s ability to share information with it depends on the circumstances and the Privacy Rule’s applicable permissions. HHS explains that some disclosures to social service organizations may be permitted when they support an individual’s health or mental health care. HHS guidance on disclosures to social service organizations

For non-treatment disclosures, staff should check whether the provider needs a HIPAA authorization or whether another Privacy Rule permission applies. A BAA is relevant when an organization performs services on behalf of a covered entity involving PHI; it is not a general-purpose consent form. HHS guidance on business associates

How to Handle Breaches and Required Disclosures

If staff discover a possible unauthorized use, disclosure, loss, or access involving PHI, they should promptly report it through the organization’s incident procedure to the designated supervisor or privacy contact. Preserve relevant records, follow instructions to secure the information, and document what happened, when it was discovered, what information may be involved, and who may have received or accessed it. Do not independently promise that no notification is required.

A covered entity or business associate must assess an impermissible use or disclosure under the Breach Notification Rule. For breaches of unsecured PHI, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery; notification to HHS and, in certain cases, the media is also required. A business associate must notify the covered entity of a breach, without unreasonable delay and no later than 60 days after discovery. The covered entity or business associate must determine and document whether notification is required. HHS Breach Notification Rule guidance

Not every disclosure is a breach: HIPAA permits or requires some disclosures without authorization, including certain disclosures required by law. Staff should route requests from law enforcement, courts, or other authorities through established procedures so the organization can confirm the applicable legal basis and disclose only as permitted or required. If the advocacy program is not a covered entity or business associate, HIPAA’s breach-notification duties may not apply directly to it, but contracts and other laws or policies may impose separate obligations.

Effective HIPAA training helps staff understand when HIPAA applies, protect PHI, seek appropriate authorization, coordinate carefully with providers, and escalate possible incidents. Pair that training with survivor-centered confidentiality practices and clear employer-specific procedures.

FAQs

Does HIPAA apply to victim advocacy programs?

Not automatically. HIPAA applies to covered entities and business associates. A victim advocacy program may be covered if it meets one of those definitions, but providing advocacy or receiving information from a provider alone does not establish HIPAA status. Other privacy laws, agreements, or organizational policies may still apply. HHS overview of covered entities and business associates

Do volunteers need confidentiality training?

Volunteers should be trained on the confidentiality rules and information-handling procedures relevant to their assignments. When a volunteer is part of a covered entity’s workforce, the entity must provide HIPAA training as necessary and appropriate for that person’s functions. Training should reflect the volunteer’s actual access and responsibilities.

When is written authorization required to share survivor information?

For a covered entity, written HIPAA authorization is generally required when a proposed use or disclosure of PHI is not otherwise permitted or required by the Privacy Rule. Some disclosures—such as qualifying provider-to-provider disclosures for treatment—may be allowed without authorization. The organization should verify the specific legal basis and use a valid authorization when required. HHS explanation of consent and authorization

What should staff do if they discover a possible HIPAA breach?

Report it promptly to the organization’s designated privacy or security contact, follow instructions to secure the information, preserve relevant records, and document what is known. The covered entity or business associate should assess whether the incident meets the breach definition and whether notification is required; staff should not make that determination alone. HHS breach response and notification guidance