Title: USC Healthcare Compliance Education
Standard #:	CO – 115	Issued:	11/01/2018	Reviewed/Revision Date:

PURPOSE

To establish requirements for distributing The University of Southern California (USC)[1] Healthcare Compliance Education and HIPAA Privacy Education for Keck Medicine of USC workforce members[2].

STANDARD

Keck Medicine of USC is committed to complying with applicable healthcare and privacy laws and regulations. To help meet these objectives, USC has implemented mandatory Compliance and Privacy Education. Each employee is required to complete certain mandatory training based on his or her job responsibilities.

Applicable Keck Medicine of USC workforce members are required to complete USC’s Healthcare Compliance Education and HIPAA Privacy Education which provides an explanation of the elements of the Compliance Program and applicable policies and procedures. Please refer to Exhibit A of this policy for required education per role type. Additionally, workforce members that provide services in high-risk regulatory compliance areas may be required to complete additional compliance education.

This education and training program shall include, but not be limited to, the following topics:

1. USC’s general compliance and privacy policies and standards applicable to Keck Medicine of USC workforce members.
2. Keck Medicine of USC workforce members’ obligation to adhere to all applicable laws, regulations and Keck Medicine of USC standards of conduct and the consequences for violations.
3. Keck Medicine of USC workforce member’s obligation to report any suspected illegal or improper conduct and the procedures for making such reports.
4. Identification of the Office of Culture, Ethics and Compliance officers.

In the event of a significant regulatory change, emergent compliance risk, or as part of a corrective action plan, the USC Office of Culture, Ethics and Compliance may provide or direct supplemental compliance education as required. The education required by this policy is a condition of employment or contractual relationship with Keck Medicine of USC. Keck Medicine of USC workforce members whose roles require access to the Electronic Medical Record (EMR) system must complete the Healthcare Compliance and HIPAA Privacy Education[3] before access is granted.

PROCEDURE

1. The Office of Culture, Ethics and Compliance will create and maintain education modules within the Learning Management System(s) including but not limited to:
   1. Healthcare Compliance Education
   2. HIPAA Privacy Education[4]
   3. Compliance Refresher Education
   4. Compliance Billing Education (per USC Healthcare Compliance Program Policy)
2. Learning Management System(s) administrators for each of the below divisions of Keck Medicine of USC are responsible for assigning education either automatically, or as defined by the Office of Culture, Ethics and Compliance.
   1. Keck Health System (KHS)
   2. Keck School of Medicine (KSOM)
   3. Verdugo Hills Hospital (VHH)
3. Requirements for mandatory education are as follows:
   1. All applicable Keck Medicine of USC workforce members are responsible for taking the Healthcare Compliance Education and HIPAA Privacy Education modules within thirty (30) days of their new hire start date, except where an earlier date is required as outlined below in the Workforce Classifications.
   2. All Keck Medicine of USC workforce members are responsible for taking supplemental education modules as assigned by the Office of Culture, Ethics and Compliance.
   3. Contract and vendor staff and volunteers who will be accessing electronic systems with patient information are required to complete USC’s Healthcare Compliance Education and HIPAA Privacy Education modules or provide proof of completion with their organization.
   4. Contract and vendor staff who are not accessing any electronic systems with patient information can provide an attestation from their company noting completion of the company’s education program in lieu of completing USC’s required modules.
   5. Traveler and registry nurses are required to complete the HIPAA Privacy Education through a separate paper education managed by the Nursing Administration.

WORKFORCE CLASSIFICATIONS:

Workforce	Definition	Training Required	Timeframe
Employed Healthcare Workforce	Any person employed by Keck Medicine of USC (Keck Hospital, Norris Hospital, Verdugo Hills Hospital, USC Care and Keck School of Medicine).	HIPAA Compliance	30 days from start date or prior to accessing clinical record systems or PHI
USC Employed Physicians (including Non-ACGME Fellows)	Any physician employed by Keck Medicine of USC with medical privileges.	HIPAA Compliance	30 days from start date or prior to accessing clinical record systems or PHI
Non-USC Employed Physicians	Any physician that is not employed but is privileged by Keck Medicine of USC.	HIPAA (USC Paper Form)	Prior to working at any Keck Medicine of USC facility
Research Faculty and Staff	An individual who may be conducting research and requires access to PHI, limited data sets, or de-identified data.	HIPAA	Prior to start of study
Referring Providers	Any physician that is neither employed nor privileged by Keck Medicine of USC but refers patients to Keck and requires read-only access to follow-up on those patients.	HIPAA (paper and attestation)	Prior to accessing clinical record systems or PHI
Residents and ACGME Fellows	As an academic medical center, Keck Medicine of USC is a teaching facility that utilizes residents and fellows.  They typically require access to clinical record systems or PHI.	HIPAA – Completed at LAC+USC	Prior to start of rotation
Students	Students who require access to clinical record systems or PHI in the completion of their education or treatment of patients.	HIPAA	Prior to accessing clinical record systems or PHI
Contractors	Temporary labor resource(s) brought in through a third-party agency that provides labor directly to Keck.  Contractors receive salary or payment from another employer who is under contract to Keck.	HIPAA – Completed at Contract company Attestation from contract company Travel and registry nurses are contractors at Keck Medicine of USC and complete a separate education packet containing privacy education.	Prior to start date
Vendors	Vendors who provide services to Keck Medicine of USC under a contract, and require access to clinical record systems or PHI.	HIPAA – Completed at Vendor company Attestation from contract company	Prior to accessing clinical record systems or PHI
Healthcare Support Staff	USC employed staff who require access to clinical record systems or PHI.  For example, Legal, Office of Culture, Ethics and Compliance, Human Resources, Development, Senior Administration.	HIPAA Compliance	30 days from start date or prior to accessing clinical record systems or PHI
Volunteers	A person voluntarily performing or providing services to Keck Medicine of USC without compensation.  Most USC volunteers do not have access to PHI or systems using PHI.	HIPAA via verbal Education Session	At start of volunteering

DOCUMENTATION AND ENFORCEMENT

1. Satisfactory completion of the required training must be documented in the Learning Management System(s).
   1. No workforce member shall perform functions which require adherence to compliance and privacy policies and procedures without completing the required education, unless written permission is provided from the Office of Culture, Ethics and Compliance.
2. Failure to comply with this standard will result in disciplinary action in accordance with applicable University policies including the University Training Requirements and Opportunities Policy.

REFERENCES

[1] USC includes those entities that comprise Keck Medicine of USC, including but not limited to, USC Norris Cancer Hospital, Keck Hospital of USC, USC’s employed physicians, nurses and other clinical personnel, those units of USC that provide clinical services within the Keck School of Medicine, School of Pharmacy, the Herman Ostrow School of Dentistry, Physical and Occupational Therapy, Suzanne Dworak-Peck School of Social Work, as well as USC Care Medical Group, affiliated medical foundations of Keck and their physicians, nurses and clinical personnel, Engemann Student Health Center, Eric Cohen Student Health Center, USC Verdugo Hills Hospital, its nurses and other clinical personnel, Verdugo Radiology Medical Group, Verdugo Hills Anesthesia, and Chandnish K. Ahluwalia, M.D., Inc. and those units that support clinical and clinical research functions, including the Health Science Campus administrative support.

[2] Employed Healthcare Workers, USC Employed Physicians, Research Faculty, Community Staff Physicians, Contractors, Vendors, Residents, Referring Providers, Healthcare Support Staff performing work on behalf of Keck Medicine of USC.

[3] Engemann Student Health Center is only required to complete HIPAA Privacy Education prior to being granted access.

[4] A certificate of completion is required from the learning management system: Healthstream or TrojanLearn.

45CFR Part 164 – Security and Privacy

Office of Inspector General US Department of Health and Human Services

USC HIPAA Policy PAT 607 – Mitigations and Sanctions

RESPONSIBLE OFFICE

Office of Culture, Ethics and Compliance
https://ooc.usc.edu/
compliance@usc.edu
(213) 740-8258