More about Shadow Students and HIPAA: HIPAA & HITECH Act Blog by Jonathan P. Tomes

JonTomesWe received a follow-on question from one of our blog readers after my previous post about shadow students. Thanks to Erin Barlow, Practice Manager, Xcel Sports Medicine, LLC, in Vandalia, OH.

Her follow-on question was whether the shadow students should receive special HIPAA training from the covered entity and, if so, what kind of training. In my opinion, first, you need to conduct a risk analysis to consider the risks associated with shadow students, what the threat would be (such as from the often zealous use of cellphone photos and social media among students), what the harm would be to you as the covered entity from such threats if they did occur, and what you should do about it. Keep a written record of this risk analysis. Likely, if you have shadow students, you will need to develop a policy and procedure based on your risk analysis for what your orientation should include in the way of HIPAA training. Again, as with everything else, keep HIPAA training records for each of your shadow students for the six-year records retention period under HIPAA.

As a starting place, consider using my Basic HIPAA Training Video, 6th edition, with accompanying workbook, both available here.

As an aside, again please note our new address for both Veterans Press and EMR Legal: 121 W. 63rd Street, Suite 209, Kansas City, MO 64113. Also, again please note that I have bought out Richard Dvorak’s interest in both Veterans Press and EMR Legal, so please contact me directly at or my associate, Alice McCart, at or our IT guru, Brent Sadler, at Sherry, Dasha, Patrick, and Daine will no longer be helping with orders. If you have questions or concerns about your order, please email Again, as always, thank you for your business and your questions.

seo by: k.c. seo