"All employer-sponsored group health plans, including fully insured plans, are HIPAA covered entities.... Employers with a self-insured health plan need to maintain a HIPAA firewall that ensures only those employees with a plan-related need ... are permitted access to the plan's PHI.... HIPAA training is required for an employee within a reasonable period of time upon joining the covered entity's workforce, which includes a new hire within the HIPAA firewall or an existing employee moved to a position within the firewall."