> Anyone handling PII needs to be trained in HIPAA compliance

Anyone working at a covered entity needs HIPAA training. A random secretary working for some other random company unrelated to healthcare and isn't potentially a covered entity doesn't need it.

I originally took your comment as secretaries in general, but re-reading makes it more clear to me you're specifically talking about secretaries in a healthcare setting. In which case yes, they would be bound to the same HIPAA rules I agree.