HIPAA Compliance for Healthcare Volunteers

Volunteer Workforce Classification

Under HIPAA, volunteers are treated as workforce members if they are under the direct control and supervision of the organization, regardless of compensation status. This means:

• Volunteers must comply with organizational HIPAA policies
• Organization is responsible for their HIPAA training
• Organization is liable for volunteer HIPAA violations
• Volunteers are subject to same sanctions as employees
• Background checks and screening are required if accessing PHI

Types of Healthcare Volunteers

• Patient Care Volunteers: Direct patient interaction (guides, patient companions, transporters)
• Clinical Support Volunteers: EHR access or clinical documentation support
• Administrative Volunteers: Records management, registration, scheduling
• Facility Volunteers: Maintenance, cleaning, security (may incidentally encounter PHI)
• Specialized Volunteers: Chaplains, social workers, counselors with PHI access

Volunteer Screening and Background Check Requirements

Criminal Background Screening

• Conduct criminal background check (minimum 7 years)
• Include county, state, and federal records
• Screen sex offender registry
• Check for violent crimes and healthcare-related offenses
• Document screening completion date and results
• Obtain volunteer authorization and consent

Disqualifying Factors

OIG Exclusions List Screening

• Check LEIE (List of Excluded Individuals/Entities) before volunteer starts
• Screen all volunteers accessing any PHI or billing-related information
• Document LEIE clearance in volunteer file
• Re-screen quarterly or at least annually
• Immediately terminate if volunteer is added to LEIE

Reference Checks

• Obtain minimum 1-2 personal or professional references
• Document reference check completion
• Verify contact with references
• Document reference responses regarding character/reliability
• Retain documentation in volunteer file

Volunteer Orientation and HIPAA Training

Pre-Service Requirements

• Complete volunteer application and background authorization
• Provide volunteer handbook with HIPAA provisions
• Explain organizational confidentiality policies
• Obtain signed confidentiality agreement
• Issue volunteer badge/credentials
• Document orientation completion date

HIPAA Training Content (by Volunteer Type)

All Volunteers with PHI Access:

• HIPAA Privacy Rule overview (30 minutes)
• HIPAA Security Rule basics (20 minutes)
• Patient confidentiality principles
• Examples of confidential information
• Permitted uses and disclosures
• What to do if PHI is accidentally disclosed
• Incident reporting procedures

Patient-Facing Volunteers (additional):

• Patient communication and discretion
• How to handle sensitive patient information appropriately
• De-identification and indirect identifiers
• When to involve staff members with patient inquiries

EHR/Clinical Access Volunteers (additional):

• System access and login procedures
• Password protection and security practices
• Minimum necessary data access principles
• Appropriate use of clinical systems
• Audit logging and monitoring

Training Documentation

• Training attendance log with date and duration
• Volunteer's signed acknowledgment of training
• Trainer name and credentials
• Copy of training materials provided
• Any assessment or quiz results
• File in volunteer records

Volunteer Confidentiality Agreement Template

Access Control and Monitoring

Limiting Access by Role

• Patient Transport Volunteers: No system access; may see patient names/room numbers (necessary for duties)
• Patient Companions: No system access; may be present during patient interactions
• Administrative Support: Limited file room/scheduling system access as needed
• Clinical Documentation Volunteers: Restricted EHR access to specific forms/documents only
• Chaplains/Counselors: Access to basic patient information and department records only

Physical Access Controls

• Issue badge/ID distinguishing volunteers from staff
• Restrict access to specific areas only
• Supervise volunteer access to patient care areas
• Ensure volunteer knows not to remove documents or information
• Prevent access to staff areas with unsecured PHI
• Lock file cabinets and secure patient records when not supervised

Ongoing Monitoring

• Assign volunteer coordinator/supervisor for each volunteer
• Supervisor monitors volunteer conduct and PHI access
• Report any breaches or concerns immediately
• Conduct periodic HIPAA compliance check-ins
• Review volunteer access logs if any system access granted
• Document monitoring activities in volunteer file

Volunteer Termination and Off-Boarding

At End of Service

• Retrieve volunteer badge and credentials
• Collect any volunteer handbook or training materials
• Ensure no documents containing PHI are taken
• Conduct exit conversation regarding confidentiality obligations
• Disablenany system access credentials
• Document volunteer end date

Post-Termination Obligations

• Confidentiality obligations continue indefinitely after service ends
• Volunteer remains subject to HIPAA regulations
• Breach of confidentiality can result in legal action even after service ends
• If volunteer later engages in unauthorized disclosure, pursue appropriate remedies

Record Retention

• Retain volunteer file for minimum 6 years after last service date
• Include background check results
• Store training records and acknowledgments
• Keep confidentiality agreement signed copy
• Archive any incident or performance records
• Maintain HIPAA compliance documentation

Common Volunteer Roles and PHI Risk Assessment

High PHI Risk Volunteers

• Clinical Documentation Volunteers: Direct EHR access - requires full screening and training
• Medical Records Volunteers: Access to patient charts - full screening, training, access controls
• Registration/Intake Volunteers: Collection of patient demographic data - screening and training required

Moderate PHI Risk Volunteers

• Patient Companions/Guides: May observe patient information during interactions - screening and training required
• Chaplains/Counselors: Patient interaction and care coordination - screening and training required

Low PHI Risk Volunteers

• Patient Transporters: May see patient names/room numbers - basic screening and training
• Facility/Maintenance Volunteers: May incidentally see information - basic screening and training
• Reception/Lobby Volunteers: May see patient names in waiting area - basic training

Manage Compliant Volunteer Programs

Medcurity provides volunteer onboarding templates, screening checklists, and HIPAA training materials.