Are student externs required to complete HIPAA training?

• A. No
• B. Yes
• C. Only if they handle PHI
• D. Only for clinical rotations

Answer: (B)

HIPAA training is required for anyone who could encounter PHI as part of their role, including student externs. The Privacy and Security rules expect the workforce of a covered entity—everyone who might access PHI or systems containing PHI—to be trained. This training isn’t limited to those who directly “handle” PHI in a hands-on way; simply having access to PHI, systems, or patient information in the course of extern duties means you’re part of the workforce and must complete the training. Training is typically provided soon after affiliation and updated annually to cover privacy basics, the minimum necessary standard, safeguarding PHI, breach reporting, and the consequences of noncompliance. Given that externs often participate in rotations or activities where PHI could be viewed or accessed, they must complete HIPAA training.