Why Employee Access Matters

HIPAA compliance is not just a management responsibility — it requires your entire workforce to be trained and aware. The portal's employee section gives each staff member their own login where they can access published policies, complete training modules, and attest to acknowledgments. This creates an individual compliance record for every employee.

Inviting Employees

From the Privacy Officer dashboard, navigate to Employees and click Invite Employee. You will need:

The employee's name
Their work email address
Their department (used for reporting and policy targeting)
Their role designation (Employee or Privacy Officer)

The system sends an invitation email with a secure link to set up their portal account. The invitation link expires after 72 hours — if an employee does not sign up in time, you can resend the invitation from their profile in the Employees list.

Tip: Invite employees in batches by department so you can track completion by team. Use the department filter in the Employees list to see compliance status for each group.

The Three Required Training Items

Once an employee has a portal account, they need to complete three specific activities. These are what HIPAA requires for workforce training, and the portal tracks completion of each:

1. Policy Attestations

Employees must read and acknowledge all published policies marked as requiring attestation. From their dashboard, employees see a list of all policies with their status. They click into each policy, read it, and click Acknowledge. Your compliance dashboard shows completion rates across your workforce.

2. HIPAA 101 Training

This is a structured training module covering the fundamentals of HIPAA: what it is, why it matters, the key rules (Privacy, Security, Breach Notification), what counts as PHI, and employees' specific obligations. Employees complete the module at their own pace and take a short quiz at the end. Passing the quiz generates a completion certificate tied to their account.

3. Cybersecurity Awareness Training

This module covers practical cybersecurity skills relevant to a healthcare environment: recognizing phishing emails, password hygiene, safe device use, working from home securely, and what to do if they suspect a security incident. Like HIPAA 101, it concludes with a quiz and generates a completion record.

Important: HIPAA requires training for new employees before they have access to PHI, and retraining when policies or procedures change. Use the portal's training completion dates to ensure new hires complete all three items within their first week. Set a calendar reminder to re-run training annually.

Monitoring Workforce Compliance

The Employees section in your Privacy Officer dashboard shows each employee's overall compliance status — a color-coded indicator that reflects whether they have completed all three required activities. Filter by status to quickly identify who needs follow-up. Click any employee's name to see their detailed completion record, including timestamps for each attestation and training module.

Handling Terminations

When an employee leaves your organization, deactivate their portal account immediately from the Employees list. Deactivated accounts lose portal access but their compliance history is retained. This is important for audit purposes — you need to be able to show that terminated employees no longer have access to systems containing PHI.

User Invites and Training