Workforce training policy and roster

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.530(b) (privacy training for all workforce members); 164.308(a)(5) (security awareness and training, including security reminders, protection from malicious software, log-in monitoring and password management); 164.530(j) (documentation). Password and authentication rules themselves are in document 15.

Approved by Dr. Maria Lindqvist, Owner. Policy owner: Janelle Okafor, Office Manager. Training records kept by: Janelle Okafor.

Purpose

Almost every HIPAA failure HHS cites against small practices traces back to a person who did not know the rule or did not think it applied to them. Granite City Family Dental trains every workforce member on this binder's policies before they touch patient information and keeps training them for as long as they work here. The roster at the end of this document is the evidence HHS asks for first; a name without a date, or a date without a signature, counts as untrained.

1. Who must be trained

Everyone who works for or under the control of Granite City Family Dental, whether or not they are paid: employees, owners and providers, contractors and temporary staff, volunteers, students and interns, and anyone else given a login, a key or a seat where PHI is handled. The practice profile reports a workforce of 9 people across the following roles:

A role with "No PHI access" is still trained on the privacy basics, incident reporting and sanctions, because people in those roles still overhear, see screens and answer phones. CRU Technologies and other business associates train their own staff under their BAA; the practice confirms this during the annual BA review (document 19).

2. When training happens

• New hires and new roles. Within 30 days of the start date, and in every case before the person is given unsupervised access to PHI or their own login to the EHR, email or any system that holds ePHI. Until training is complete the person works under direct supervision with no credentials of their own. A person who moves to a role with more PHI access is retrained on the parts that are new to them.
• Refresher. Annually, for every workforce member, with the date recorded on the roster. The refresher covers the full curriculum in section 3 with emphasis on what changed and on what the incident log and phishing results show people are getting wrong.
• After a material policy change. Within 30 days of the change, for everyone the change affects: for example a new telehealth platform, a new fax procedure, a change to the sanction ladder or a new Minnesota consent form.
• After an incident. The people involved are retrained within 30 days as part of mitigation (document 10); if the lessons-learned review in document 16 finds a general gap, the whole workforce is retrained on that topic.
• Ongoing. Security reminders at the cadence in section 5, so that awareness does not wait for the next annual session.

3. What the training covers

Every new-hire and refresher session covers each of the following; the Training Acknowledgment form at the end of this document lists them as checkboxes so the record shows what was actually taught:

• Privacy basics: what PHI is in every form, who may see it, and why it matters to the patient and to the practice.
• Minimum necessary: using and disclosing only what the task needs, and the role-based access matrix in document 07.
• Patient rights: access, amendment, accounting, restrictions, confidential communications and complaints, and the timelines in document 09.
• This binder's policies: where the binder is, which policies apply to the person's role, and how to look something up.
• Passwords and multi-factor authentication under document 15, including never sharing a login.
• Phishing and social engineering: how to recognize a suspicious email, text or call, what to do with it, and that reporting a click is never punished.
• Device security: screen locking, encryption, no PHI on personal devices or cloud accounts, removable media rules, safe disposal and what to do if a device is lost.
• Safeguards for PHI in every form (document 11): paper, conversations, fax, mail, email, text, telehealth, social media and photographs.
• Incident reporting: what counts as an incident, whom to tell (Janelle Okafor), and the rule that staff do not investigate, delete or forward anything themselves.
• Sanctions: the sanction ladder in document 05, which applies to owners and providers as well as staff, and the non-retaliation rule.
• Business associates: no PHI to any vendor without a signed BAA, and how to check the register.
• Breach notification basics: why the four-factor assessment exists and why the 60-day clock starts at discovery.
• Minnesota Health Records Act: most releases outside the practice need the patient's signed, dated consent, valid for 12 months, even when HIPAA alone would allow the disclosure (document 23).

4. Training source and delivery

Training at Granite City Family Dental comes from: CRU training seats (included with add-on).

Each workforce member has a named seat; completion reports are exported by Janelle Okafor and filed in this binder as evidence. The practice-specific portion (this binder's own policies, officers, channels and forms) is delivered in person or by walkthrough by the Privacy Officer, because no outside course knows this practice's procedures.

Whatever the source, the session ends with the person signing the Training Acknowledgment form, which is filed with the roster.

5. Security reminders

Authority: 45 CFR 164.308(a)(5)(ii)(A).

Security reminders go to the whole workforce quarterly, as a huddle topic, a short email, a poster or a newsletter item. Topics rotate through phishing, passwords and MFA, device and screen locking, clean desk, social media, safe disposal, incident reporting and whatever the incident log or the news makes timely. Janelle Okafor keeps a one-line log of the date and topic of each reminder; the log is reviewed at the annual meeting.

6. Phishing simulations

Granite City Family Dental does not currently run simulated phishing tests. Phishing is the leading cause of breaches reported to HHS by practices of this size, and simulation is the one training method that produces measurable results. The practice records "adopt quarterly phishing simulations" in the risk register with an owner and due date, and until a tool is in place the Security Officer covers phishing recognition in every security reminder and asks staff to forward suspicious messages to CRU Technologies.

7. Tracking and documentation

Authority: 45 CFR 164.530(b)(2)(ii), 164.530(j); 164.316(b).

• Janelle Okafor keeps the roster current: one row per workforce member with hire date, privacy training date, security awareness date, the course or module used and whether the acknowledgment was signed.
• Evidence kept with the roster: signed acknowledgment forms, completion certificates or platform exports, the slides or materials used, the reminder log and phishing results.
• Records are kept for six years from the date of the training in This binder (CRU HIPAA Binder Builder, exported yearly) and a printed copy in the administrator's locked office., including records of people who have left.
• The roster is reconciled against the current staff list and the user access list (document 14) each October; every person with a login must appear on the roster with a current date.
• The completion percentage is reported at the annual review meeting (document 24).

8. Consequences

A workforce member who does not complete training by the deadline loses system access until it is done. Supervisors who allow unsupervised PHI access to an untrained person, and anyone who falsifies a training record, are sanctioned under document 05.

Training roster — 2026

Authority: 45 CFR 164.530(b)(2)(ii); 164.308(a)(5). Retain six years.

The roster lists 3 people but the practice profile reports a workforce of 9. Everyone in the profile must appear on the roster; the missing names are added and trained within 30 days, and the gap is recorded in the risk register.

1 roster entry has no privacy training date (Tom Reyes). Those people are trained within 30 days and their access is supervised until then.

1 roster entry has no security awareness date (Tom Reyes). Security awareness training is completed within 30 days.

1 roster entry lacks a signed acknowledgment (Tom Reyes). The form below is signed and filed at the next session.

Roster reviewed at the annual meeting by: ___________________________ Date: ______________

Training Acknowledgment

Granite City Family Dental — Workforce training record. Complete one form per person per session and file it with the roster.

Name: __________________________________________ Role: ______________________________

Session date: ______________ Session type: [ ] New hire [ ] Annually refresher [ ] Policy change [ ] After incident

Delivered by (trainer): __________________________________________ Source: CRU training seats (included with add-on)

Topics covered in this session:

☐ Privacy basics and what PHI is, in every form

☐ Minimum necessary and the role-based access matrix

☐ Patient rights and request timelines

☐ This binder's policies and where to find them

☐ Passwords, multi-factor authentication and no shared logins

☐ Phishing and social engineering; how to report a suspicious message

☐ Device security, encryption, removable media and disposal

☐ Safeguards for paper, conversations, fax, mail, email, text, telehealth and social media

☐ Incident reporting: whom to tell and what not to do

☐ Sanction policy and non-retaliation

☐ Business associates and the BAA rule

☐ Breach notification basics

☐ Minnesota Health Records Act consent for release

I confirm that I attended this training, that I received access to the Granite City Family Dental HIPAA policies, that I understand I must follow them, that I know how to report a suspected incident, and that violations may lead to sanctions up to termination.

Workforce member signature: ___________________________ Date: ______________

Trainer signature: ___________________________ Date: ______________

Recorded on roster by Janelle Okafor: ___________________________ Date: ______________

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________