Further, plans must train all workforce members, including employees, volunteers, trainees and other persons whose conduct is under the direct control of the plan entity, on privacy policies and procedures, as necessary and appropriate for them to carry out their functions.[7] If it is necessary for an employee to handle PHI to perform his or her duties, that employee must be trained with respect