HIPAA training applies to volunteers and temporary staff working at a covered entity because both categories fall within the HIPAA definition of a workforce, which includes employees, volunteers, trainees, and other persons whose conduct in the performance of work for a covered entity is under the direct control of that entity, regardless of whether they are paid. The training obligation is triggered by workforce membership and the potential for contact with Protected Health Information, not by employment status, contract type, or the duration of the engagement. A volunteer who greets patients at a hospital reception desk, a temporary administrator who processes medical records for a short-term assignment, and a student completing a clinical placement all present the same compliance risks as permanent employees in equivalent roles and must receive training accordingly. The HIPAA Journal’s HIPAA Training for Employees is an online course satisfying HIPAA training requirements regarding HIPAA rules and regulations for covered entities of all sizes, suitable for all workforce categories including volunteers, temporary staff, and students on placement.
Why Employment Status Does Not Determine the Obligation
Covered entities that assume volunteers and temporary staff fall outside HIPAA’s training requirements because they are not permanent employees misread the regulatory definition of workforce. HIPAA’s definition is intentionally broad, and HHS’ Office for Civil Rights applies it consistently. An organization investigated following a breach involving a volunteer or temporary worker cannot defend the absence of training on the basis that the individual was not a full-time employee. The question regulators ask is whether the individual was performing work under the covered entity’s control and whether that work created potential access to PHI. Where both conditions are met, the training obligation applies.
Practical Implications for Temporary and Volunteer Workforces
Organizations that rely heavily on volunteers, such as hospitals, hospices, and community health programs, must build HIPAA training into their volunteer onboarding process with the same consistency applied to permanent staff. Temporary workers placed through staffing agencies present an additional consideration: while the agency may provide some compliance orientation, the covered entity retains responsibility for ensuring that HIPAA training has been provided and documented before the temporary worker is given access to PHI or PHI-containing systems.
