HIPAA training scenarios for shared workstations and unusual requests
A staff member can remember a training answer and still hesitate when someone asks for a patient record at a busy desk. Practice gives the team a chance to work through that decision using the procedures and contact routes they will actually need.
Short exercises can supplement your HIPAA training program. Use invented information, discuss the reasoning, and ask participants to show where they would find help. The goal is to discover confusing steps while there is time to improve them.
Start with your own procedures
Choose a situation your team recognizes. Identify the current policy that applies and have the person responsible for it review the exercise. A privacy question and an IT access question may need different reviewers.
The 2025 SAFER Organizational Responsibilities guide recommends training tailored to EHR users' roles and includes interactive simulations among its implementation examples. That is useful guidance for designing practice exercises. The guide is informational; these scenarios are not a complete HIPAA curriculum or a statement of a required training frequency.
Source: SAFER Organizational Responsibilities guide, training resources and education practices.
Exercise: the workstation is already signed in
Imagine a staff member arriving at a shared workstation and finding a colleague's session open. A patient is waiting, and the colleague has stepped away.
Ask the participant to explain the next step under your procedure. Where should they sign in with their own authorized account? Who can help if they cannot access the system? How should they handle an exposed screen without opening more information?
Do not practice this in a live patient chart. A picture of an invented screen or a suitable training environment is enough to discuss the decision. Have the trainer explain the approved approach, including how staff should continue work when access is unavailable. “Keep things moving” should not leave people guessing about whose account they may use.
Exercise: an unexpected request sounds urgent
An unfamiliar caller says they are helping a clinician and need a document sent immediately. They offer a new email address and say there is no time to follow the usual process.
Ask the participant how they would check the request using the practice's established procedure. Which trusted contact route would they use? Who can authorize the disclosure or help assess it? Where would they report a suspicious request?
Keep the discussion focused on the decision, without asking staff to memorize an answer for every possible caller. A useful outcome is that participants can find the appropriate procedure and know when to pause for help. Clinical urgency should be handled through the organization's approved clinical and emergency processes.
Discuss what happens after a mistake
Change the exercise: the staff member realizes a document may have gone to the wrong recipient. Ask them to find the reporting route and explain what information they would give the designated responder.
Use the organization's incident process. Do not ask participants to decide on their own whether an event is legally reportable, delete evidence or contact an unintended recipient without direction. The exercise can reveal whether the reporting contact is easy to find and whether staff know how to reach help outside normal hours.
Keep a record that helps the next session
Record the exercise date, policy version and roles involved in the way your training program requires. Keep participant questions and any needed procedure changes separate from the evidence of course completion. Finishing a course and successfully demonstrating a local task answer different questions.
If several people misunderstand a step, assign someone to review the instruction. Repeat the relevant part after it is clarified. Avoid collecting patient details in exercise notes; an invented example should remain invented throughout the discussion.
When responsibilities change, use a more specific handoff to check the person's new training and access needs. Our related guide covers that transition.
Medcurity offers HIPAA training with completion tracking. Explore the training options and discuss how they could support your program. The practice exercises in this article are examples for your team to adapt, not a description of included course content.