Blog

This guide covers why a hospice has to train volunteers on HIPAA, how to build and document the program yourself in five steps, and how IT Total Care supports the access control, device management, and evidence that sit underneath it.

1. Why Does a Hospice Have to Train Volunteers on HIPAA?

A hospice has to train volunteers on HIPAA because volunteers are workforce members, not visitors. Under 45 CFR 160.103, the workforce of a covered entity includes volunteers and trainees whose conduct is under the direct control of the entity, which places them under the same Privacy Rule obligations as paid clinical staff.

A second requirement runs alongside it. 42 CFR 418.78(a) requires the hospice to maintain, document, and provide volunteer orientation and training consistent with hospice industry standards. Training is therefore a condition of participation and a privacy obligation at the same time, and it has to happen before a volunteer’s first patient contact rather than after onboarding settles down.

Where Does the Obligation Show Up in a Volunteer’s Day?

The obligation shows up in ordinary moments rather than in anything that looks like a records request. Five of them account for most of the exposure:

• Volunteers Are Workforce, Not Guests: A volunteer who sits with a patient for six months has the same obligations as the nurse who visits twice a week. Nothing in the rule distinguishes unpaid from paid.
• The Patient’s Home Is the Workplace: There is no badge reader, no locked file room, and no privacy officer down the hall. The controls that exist in an office do not exist in a living room, so what the volunteer knows is the control.
• Your Own Written Program Is the Survey Standard: CMS sets no minimum number of training hours, which sounds like flexibility and is not. It means the surveyor measures you against your own written program, so a vague program is a weak defense and a detailed one you actually follow is a strong one.
• Volunteers Frequently Know the Family: Hospice volunteers are recruited from the community the agency serves. They often know the patient, the family, or somebody who does, which makes ordinary conversation a disclosure risk in a way it is not for most clinical staff.
• Post-Death Conversations Land on Volunteers: Families call the person who sat with them. What a volunteer may and may not say afterward is governed by the HIPAA rules for deceased hospice patients, and a volunteer who has never been told those rules will answer from instinct and kindness.

What Does a Surveyor Actually Check?

A surveyor checks the file, not the intention. The documentation burden here is not theoretical. In a statement of deficiencies published in the CMS survey database, a hospice was cited after its own volunteer cost savings reports showed one volunteer hour against 15,014.3 total paid patient care hours for 2021, a rate of 1 percent, and zero volunteer hours against 5,409.2 paid hours from January 1 to July 19, 2022. The volunteer coordinator told the surveyor she had not had the chance to track and document any of it. The volunteers may well have been working. The record said they were not, and the record is what gets cited.

For Bay Area hospices the timing is worth noting. Since June 22, 2026, California agencies have been operating under the California Department of Public Health’s emergency hospice licensing regulations at Title 22, sections 74800 through 74908, which put training and personnel documentation standards into license conditions and authorize unannounced inspections. A volunteer file is now something a surveyor can ask to see without warning.

2. How Do You Train Hospice Volunteers on HIPAA Step by Step?

Training hospice volunteers on HIPAA takes five steps: confirm who needs training and when, write a program tiered by role, build the curriculum around what volunteers actually encounter in a home, document completion in a file that survives a survey, and set sanctions and a refresher cadence you hold to. None of it is technically difficult. Keeping it current while volunteers turn over is the part that takes discipline.

Step 1: Confirm Who Needs Training and When It Has to Happen

Every person in a defined volunteer role needs training before any patient contact, including volunteers who will never see a patient. The administrative volunteer answering the phone hears patient names, takes messages from families, and handles mail, which is patient information under the same rule that covers the bedside companion. Treat the training date as a gating item in the same way a background check is: no completed training, no first assignment. Record the date the training was completed, the version of the program that was delivered, and who delivered it, because those three facts are what a surveyor asks for and what nobody can reconstruct a year later.

Role changes trigger the requirement again. A volunteer who has been answering phones for a year and is moving to patient visits needs the patient-facing content before the first visit, not at the next annual refresher, because the situations that content covers start the moment the volunteer walks into a home.

Step 2: Write the Program and Tier It by Volunteer Role

Write the program down and tier it, because an administrative volunteer answering phones needs different content than a patient companion at the bedside or a bereavement volunteer visiting a family after a death. For each tier, define the content, the delivery method, the approximate length, and the refresher interval in writing. Since CMS sets no minimum hours, this document becomes the standard you are measured against, which is an argument for making it specific rather than aspirational. Settle access in the same document: most volunteers need no access to the electronic medical record at all, and where access is granted it should be scoped to the role and issued in the volunteer’s own name rather than shared from an existing login.

Name one responsible party who owns the program end to end. That person does not deliver every session, but they confirm the program is current, that each tier has been delivered as written, and that the file behind each volunteer matches what the program promises. Volunteer training tends to sit across the volunteer coordinator, clinical leadership, and whoever handles compliance, and shared ownership without a named responsible party is the structural reason refreshers slip.

Step 3: Build the Curriculum Around What Volunteers Actually Encounter

Teach the situations, not the regulation. Volunteers do not need a tour of the Privacy Rule; they need to know what to do in the six or seven moments that actually arise in a hospice. Build the curriculum around these:

• The chart left open on a tablet on the kitchen table during a visit, and what the volunteer should do about it.
• The interdisciplinary group meeting where deceased and living patients are discussed by name in a room the volunteer is sitting in.
• The neighbor at the door who asks how the patient is doing.
• Social media, explicitly and by example, because it is the dominant volunteer exposure and the one volunteers least expect to be a violation.
• The small-community problem, meaning what to do when the volunteer already knows the patient, the family, or someone close to them.
• What happens after the death, including what a volunteer may and may not say to a grieving family about the patient’s final days.

Use real scenarios from your own service area and have volunteers talk through the answers out loud. Abstract instruction does not transfer to a living room, and the bereavement scenario in particular is where well-meaning volunteers create exposure, because the impulse to comfort a family is the impulse the agency recruited them for.

Step 4: Document Completion in a File That Survives a Survey

Have every volunteer sign a confidentiality agreement and file it, then build the volunteer file so it answers a surveyor’s questions without anyone hunting. A complete file holds the application and screening records, evidence of the role-appropriate training that was actually delivered, the signed confidentiality agreement, the supervision record, and the time logs. Attach training status to the same record you already use to track volunteer hours for the five percent requirement under 42 CFR 418.78(e), rather than running a training spreadsheet and an hours spreadsheet separately. Two systems means two chances to fall behind, and the hours record is the one that already has to stay current.

Evidence of training means something more specific than a note that says completed. Keep the dated version of the curriculum that was delivered, the sign-in or completion record with the trainer’s name, and a short signed attestation or quiz result showing the volunteer engaged with the content. Keep superseded versions of the program too, because the question a surveyor asks about a volunteer who started in 2024 is what your program required in 2024.

Step 5: Set Sanctions and a Refresher Cadence, Then Hold to Both

Volunteers are subject to the sanction policy required under 45 CFR 164.530(e) the same as paid staff, and the policy should say so in language a volunteer coordinator can actually apply, with the steps spelled out rather than left to judgment in the moment. Set the refresher cadence next and hold to it, because your own written program is the standard: if it says annually, annual is what a surveyor will check. The most common failure in this area is not a bad curriculum. It is volunteers trained once at orientation and never again, against a program that promises yearly refreshers, discovered when a volunteer posts about a patient’s death on social media and nobody had ever named that as a violation.

Limitations: Volunteer HIPAA training is a maintenance problem more than a teaching problem, which is exactly why it slips. Volunteer rosters churn, the coordinator is usually part time and wearing three other hats, training status lives in one place while hours live in another, and the annual refresher gets pushed during a census surge and then forgotten. Agencies rarely fail at writing the program. They fail at proving, eighteen months later, that every currently active volunteer completed the version of it that was in force when they started, which is the exact question a surveyor asks.

3. How Does IT Total Care Help Hospices Train Volunteers on HIPAA?

IT Total Care does not write your clinical curriculum or run your volunteer program, and no IT provider should tell you otherwise. What we build is the layer underneath the training: the identity, access, device, and evidence controls that decide what a volunteer can reach, what happens when a device goes missing, and whether you can show afterward what any individual volunteer actually did.

What Goes In Underneath the Training Program?

Our process includes:

• Named Accounts for Every Workforce Member: Volunteers get their own accounts rather than a shared login. A credential three people use cannot tell you who opened a chart, which makes the audit trail useless for exactly the questions that arise after a complaint or a death.
• Role-Scoped Access: A bereavement volunteer, an administrative volunteer, and a clinician should not see the same thing. We scope access to the role you defined in Step 2, starting from the position that most volunteers need no access to the clinical record at all.
• Device Controls in the Field: Tablets and phones carried into homes get screen locks, encryption, and the ability to remove agency data remotely, so the unlocked screen on the kitchen table is a training point rather than a breach. A current device inventory is the first step, since a device nobody recorded is a device nobody can control.
• Awareness Training Extended to Volunteers: Volunteers who carry agency credentials are workforce and belong in phishing and security awareness training alongside paid staff. Our guidance on cybersecurity awareness training at a home-based care agency covers how the cycle runs.
• Provisioning and Deprovisioning Built for Volunteers: Volunteers join and leave on a different rhythm than employees, often without an exit conversation. We set up the provisioning and removal path as its own workflow rather than a variation on employee offboarding.

One Question to Ask Before Signing an IT Contract

One question is worth asking any IT provider before you sign: how do you provision and deprovision volunteers as distinct from paid staff? A provider who has never been asked it will give a general answer about user accounts, which tells you what you need to know.

“Most agencies we talk to have a volunteer training program but can’t produce evidence that any particular volunteer finished it. When a surveyor asks, the answer has to come out of a documented file, not somebody saying that they remember a Tuesday orientation two years ago.”

Brendan Duebner, President of IT Total Care

Ready to Put Evidence Behind Your Volunteer Training?

IT Total Care works with hospice, home health, and home care agencies throughout the San Francisco Bay Area on the systems that make a training program provable: named accounts for every workforce member, access scoped to the role, device controls that reach into the field, and audit trails that answer questions months later. Our home-based care IT support covers access control, device management, and the documentation a survey asks for. Learn more about our approach to healthcare IT.

Contact Us to talk through what your agency needs.