Washington County warned to prioritize HIPAA training

An adviser to Washington County told its board of supervisors the local government had not faced recent HIPAA breaches, but that more employees needed training on the federal law protecting medical information privacy.

“There’s a 57% completion rate on your training … you want to have your training completion rate up around 80%,” said Roger Shindell, president and CEO of Carosh Compliance Solutions. “Around 80%, historically we will demonstrate, we can protect you from the regulatory agencies when you have a breach … I would strongly recommend we find ways to get the training up. It’s the No. 1 way you can prevent breaches and successfully find your way through a breach.”

According to a report provided by the consultant company, some of those departments below 80% completion rates include veteran’s affairs, (66.7%) the county ambulance service, (60%) the county attorney’s office, (52.8%) and the sheriff’s office (44.6%.) Of departments with more than three eligible employees, public health and the auditor’s office had high marks, at 95.4% and 96.7%, respectively.

Shindell said the risk of breaches was rising with the digital age, citing one from a phishing incident in another Iowa county in 2019, which is also a Carosh client.

A HIPAA breach would not only weigh on county budgets, Shindell said it would also trade off with trust in the community.

“Research has indicated that about two-thirds of patients would terminate their agreements with their vendors or providers if they were part of a breach,” he said. “The point is that the No. 1 cost you’re going to have in terms of a breach is not the fines and penalties, but rather your reputational harm … and as elected officials, that’s something you want to be aware of.”

Comments: Kalen.McCain@southeastiowaunion.com