Any differences between employee HIPAA training and volunteer or student HIPAA training are likely to be subtle because the nature of training should be determined by a risk assessment rather than an individual´s employment status. Nonetheless, there are a couple of potential issues Covered Entities and Business Associates should be aware of. Using a sanctions policy to deter volunteers from unauthorized disclosures of PHI is likely to be ineffective, so the focus needs to be on the potential consequences to patients and colleagues. Similarly, students need to be advised that they are not allowed to use PHI in reports and presentations unless they have consent, or the PHI has been de-identified.