What Training Is Required for Web Designers and Developers to Ensure HIPAA Compliance?
Web designers and developers who handle protected health information (PHI) for a covered entity are business associates and need HIPAA Security and Privacy Rule awareness training before working on the site. Training should cover PHI handling, encryption requirements, access controls, breach reporting, and the terms of the signed Business Associate Agreement (BAA). It is required at onboarding and periodically thereafter.
TL;DR: Quick answer
- A designer or developer who touches PHI is a business associate and needs HIPAA training.
- Training must cover PHI handling, encryption, access controls, and breach reporting.
- The signed BAA defines the developer's specific obligations and should be reviewed in training.
- HIPAA training is required at onboarding and must be repeated periodically.
Do web developers need HIPAA training?
If a developer or agency builds or maintains a site that handles PHI for a covered entity, they are a business associate. HIPAA requires business associates to train their workforce on safeguarding PHI. The training does not need to be elaborate, but it must be real, documented, and relevant to the work being done.
What should the training cover?
- What PHI is and how to recognize it in forms, databases, logs, and analytics.
- Encryption requirements for data in transit and at rest.
- Access controls, unique credentials, and least-privilege principles.
- Secure handling of test data and avoiding PHI in non-production environments.
- Breach recognition and reporting procedures.
- The specific obligations in the signed BAA.
Is HIPAA certification required for developers?
No. HIPAA does not certify individuals or vendors, and there is no official government HIPAA certification. What is required is appropriate training and the safeguards the rules call for. Be cautious of claims that a product or person is officially HIPAA certified, since no such government program exists.
How often is training required?
At onboarding for new workforce members, periodically as a refresher, and when there are material changes to systems or policies. Keep records showing who was trained and when.
Frequently asked questions
Do web developers need HIPAA training?
Yes, if they handle PHI as a business associate. Training must cover safeguarding PHI and the BAA's terms.
Is HIPAA certification required for developers?
No. There is no official HIPAA certification. The requirement is documented training and proper safeguards.
How often is HIPAA training required?
At onboarding, periodically as a refresher, and after significant changes to systems or policies.
Where to go from here
Developers also need a compliant environment to build on. See our key security measures and HIPAA WordPress hosting.
This guide is general information, not legal advice.