Compliance Wants a Rebuild; the Data Points Elsewhere
A regional hospital's compliance director asks you to rebuild the two-hour HIPAA privacy e-learning. Last year's version had 96% completion. Chart audits show privacy breaches rising from 4 to 11 per quarter, concentrated among nurses on two units. The director wants more policy text and a 90% pass threshold. Unit managers say the medication-room workstations face the hallway and that requests for privacy screens were declined in the last capital cycle. Nurses tell you they know the rules but 'have nowhere else to stand.' You have 40 hours of build time and a launch date in six weeks.
1. What analysis do you complete before responding, and what are you testing for?
Read the worked answer
Test one question: would a nurse who passed the new module behave differently in the same physical environment? If the answer is no, more content and a higher pass mark will not move the breach rate.
Gather evidence before the meeting, not opinions:
- Break down the audit data. Which breach types, which locations, which shifts? If incidents cluster at hallway-facing workstations, that is an environment signal, not a knowledge signal.
- Interview five to eight nurses and two supervisors. Ask what makes the safe action hard, not whether they know the rule. 'I know the rule but there is nowhere to stand' is a performance-environment finding.
- Check the prior course. 96% completion with rising breaches suggests the current module is already clearing the knowledge bar and is not the binding constraint.
- Confirm the capital decision. A declined privacy-screen request is a documented environmental cause you can cite.
Separate what remains genuinely trainable - new staff, novel scenarios, reporting expectations - from what requires equipment, layout, or supervisory follow-up.
2. The compliance director has authority and a regulatory deadline. How do you respond without simply refusing?
Read the worked answer
Do not frame this as training versus no training. The director needs a defensible compliance story; help build one.
- Acknowledge the obligation first. Regulatory exposure is real, and you are not asking him to accept risk.
- Propose a mix, not a veto. A shorter knowledge module for genuinely new content and new hires, plus privacy screens or workstation repositioning, plus supervisor reinforcement on the two affected units.
- Speak in his language. Present breach rate, audit findings, and likely repeat exposure if the environment is unchanged. "A nurse can pass a 90% quiz and still share a screen in a hallway" is the argument, not a complaint about e-learning.
- Offer a pilot and a commitment. Run the environmental fix on one unit, keep the module, and agree in advance what result would justify scaling the fix or returning to a full rebuild.
- Bring facilities or operations into the conversation so the director is not being asked to solve a capital problem alone.
If he still insists on the rebuild, implement it, but document the environmental finding and add the fix as a parallel recommendation.
3. What evaluation design would tell you whether your recommendation worked?
Read the worked answer
Measure behavior and outcomes, not completion. Completion was already at 96% while breaches rose, so it cannot be the success metric.
- Primary outcome: privacy breaches per 1,000 charts, split by unit and by location, with a baseline from the last four quarters.
- Comparison: the unit receiving the environmental fix versus a similar unit that does not, if feasible. If not, use a pre/post design with a clear acknowledgment of its limits.
- Leading indicators: privacy-screen installation and use, observed workstation positioning, supervisor coaching logged, near-miss reports (which should rise before breaches fall - do not misread that as failure).
- Knowledge check as a process measure only, to confirm the module works for new content.
Predefine the review point (90 days) and the decision rule before launch. Also flag small numbers: 11 breaches per quarter is noisy, so treat a one-quarter change as a signal rather than proof.