Choosing a HIPAA certification course that works for the people who need to take it is the first step in becoming HIPAA certified. It makes sense to enrol all workers in these programmes, but if you are unable to do so due to a lack of funding or personnel, you may choose to teach a small group of employees to become instructors instead. Remember that HHS does not yet recognise any organisation as an approved certification source. It should have a completely written procedure and a HIPAA policy that uses terminology similar to that of your health and safety policy. Selected portions of the policy should be audited on a monthly basis, or even more regularly if you so want. To guarantee compliance, audit results and corrective measures should be made public, and at the very least quarterly HIPAA management reviews should be held where audit results and the results of the corrective measures are reviewed. Here, top management may decide how much money to spend on enhancing HIPAA compliance. None of this could be implemented in a professional way without HIPAA qualified people who are trained in Act implementation. It will help your case if you can show that your policy and procedures are in place, that you regularly audit your HIPAA Management System, that management reviews have been conducted, and that corrective actions have been taken to address instances of non-compliance, should you come under scrutiny for potential non-compliances that could cost you a lot of money.