Last reviewed 28 October 2026 against the sources linked in this post.
Some compliance training really is annual. OSHA's bloodborne pathogens standard says training must be provided at the time of initial assignment and "at least annually thereafter" (29 CFR 1910.1030(g)(2)(ii)). Plenty of other courses are not annual at all, but are run yearly anyway because it is easy to remember. If you plan the training year, the useful question is which rule sets the interval and which is a habit.
This post sorts the rules into three groups, puts them in one table, lists the every-year courses by role, and ends with a free 12-month calendar. Every frequency below is quoted from the regulator's own text, with the citation in the same sentence. These are US federal rules, plus two state examples. Your state, size and industry can change them, so check the regulator for your own workplace.
What "annual" really means
1. Required at least annually
- Bloodborne pathogens training for employees with occupational exposure, under 29 CFR 1910.1030(g)(2)(ii).
- Fire extinguisher education, where the employer provides extinguishers for employee use, under 29 CFR 1910.157(g)(2): on initial employment and "at least annually thereafter".
- Sexual harassment prevention training in New York State, which Labor Law 201-g says must be given to all employees "on an annual basis".
- Compliance programme training for Medicare Advantage organisations, which 42 CFR 422.503(b)(4)(vi)(C) says must occur "at a minimum annually".
2. Required on another cycle
- Sexual harassment training in California: Government Code 12950.1 requires employers with five or more employees to provide it "once every two years", after the first round.
3. Required at hire, on assignment or on change only
- Hazard communication, under 29 CFR 1910.1200(h)(1): at the time of initial assignment, and whenever a new chemical hazard the employees have not been trained about is introduced.
- HIPAA Privacy Rule training, under 45 CFR 164.530(b): to each new member of the workforce within a reasonable period after joining, and to each member whose functions are affected by a material change in the policies or procedures.
- HIPAA Security Rule awareness, under 45 CFR 164.308(a)(5): a security awareness and training programme for all members of the workforce, including management, with no fixed interval. Its addressable "security reminders" specification calls for periodic security updates.
HIPAA is the common trap. Many employers do run HIPAA training every year, and that is good practice, but the Privacy Rule text sets no annual interval.
The table: rule, who it covers, how often
| Rule | Who it covers | How often | Where it says so |
|---|---|---|---|
| Bloodborne pathogens | Employees with occupational exposure | At initial assignment, then "at least annually thereafter" | 29 CFR 1910.1030(g)(2) |
| Portable fire extinguishers | Employees where the employer provides extinguishers for their use | On initial employment and "at least annually thereafter" | 29 CFR 1910.157(g) |
| Hazard communication | Employees working with hazardous chemicals | At initial assignment and when a new chemical hazard is introduced | 29 CFR 1910.1200(h) |
| Sexual harassment prevention (New York State) | All employees | Annually | NY Labor Law 201-g and the state's employer FAQ |
| Sexual harassment prevention (California) | Employers with five or more employees: supervisors (2 hours) and other employees (1 hour) | Once every two years; new staff within six months of hire or promotion | Cal. Gov. Code 12950.1 |
| HIPAA Privacy | Covered entity workforce | At hire (reasonable period) and on material change | 45 CFR 164.530(b) |
| HIPAA Security | Covered entity workforce, including management | A programme with periodic security updates; no fixed interval | 45 CFR 164.308(a)(5) |
| Medicare Advantage compliance programme | Compliance officer, employees, senior administrators, managers, governing body | "At a minimum annually", and as part of orientation | 42 CFR 422.503(b)(4)(vi)(C) |
OSHA adds a detail that matters for scheduling. For bloodborne pathogens, annual training must be provided within one year of the previous training, so a person's due date moves with the date they last trained, not with the calendar.
Every-year courses by role
Below, each role has the courses that rules or good practice put on its yearly list. A rule is marked as such, and anything else is practice. Each role ends with an Our pick, the course we would never skip.
All staff
- Harassment prevention. Annual in New York State and every two years in California (see the table). Elsewhere, check your own state's rules.
- Fire extinguisher education. Annual where the employer provides extinguishers for employee use.
- Emergency action and fire prevention. A short walk-through of exits and alarms is good practice each year.
- Cybersecurity and phishing refresher. Practice, not a rule in the sources above, but the cheapest session on the list.
Our pick: harassment prevention. It is the one with the widest reach and the clearest state rules, and it is where a single manager's reaction counts for most.
Supervisors
- Harassment prevention for supervisors. California sets two hours for supervisors, with new supervisors trained within six months of taking the role (see the table).
- Hazard communication for their area. Required at assignment and when a new hazard arrives, so refresh it whenever the work changes.
- Reporting and escalation. Practice: how to receive a concern and pass it on the same day.
Our pick: the supervisor harassment course. Supervisors are where policy meets the team, so their session carries the most weight.
Healthcare workforce
- Bloodborne pathogens. Annual for employees with occupational exposure.
- HIPAA Privacy. At hire and on material change. Many employers add a yearly refresher as good practice.
- HIPAA Security awareness. A programme with periodic reminders.
- Medicare Advantage compliance programme. Annual for Medicare Advantage organisations only.
Our pick: bloodborne pathogens. It is the one on this list where the regulation itself says "at least annually".
Warehouse and facilities
- Fire extinguisher education. Annual where extinguishers are provided for employee use.
- Hazard communication. At assignment and when a new chemical hazard is introduced.
- Emergency action plans. Rule: review the plan with staff at assignment and when it changes (29 CFR 1910.38). A yearly drill is practice.
Our pick: hazard communication. Chemicals change quietly, and the rule is triggered by the delivery of a new hazard, not by a date.
A free 12-month calendar
Spreading the refreshers across the year avoids a "compliance week" that nobody enjoys. Adjust each date to when the person last trained, for the rules that run from the previous training.
| Month | Session | Type |
|---|---|---|
| January | Review last year's completion records and set this year's list | Planning |
| February | Bloodborne pathogens refresher | Rule: annual |
| March | Fire extinguisher education and emergency walk-through | Rule: annual (extinguishers) |
| April | Harassment prevention for all staff | Rule: state cycle |
| May | Hazard communication check: any new chemicals? | Rule: on change |
| June | HIPAA Privacy and Security refresher | Practice (rule: at hire and on change) |
| July | Supervisor harassment prevention | Rule: state cycle |
| August | Medicare Advantage compliance programme (if applicable) | Rule: annual |
| September | New-starter catch-up for anyone who joined this year | Rule: at hire |
| October | Cybersecurity awareness | Practice |
| November | Audit: who is due, who is late? | Planning |
| December | Plan next year and archive records | Planning |
For tracking, our guide on how to track employee training completion covers the records side, and these training checklist examples give you a template to copy.
What records to keep
Training you cannot prove is training that did not happen, as far as an inspector is concerned. Two of the rules above say exactly what to keep.
- Bloodborne pathogens. OSHA says training records must include the dates of the sessions, the contents or a summary, the names and qualifications of the trainers, and the names and job titles of everyone who attended (29 CFR 1910.1030(h)(2)(i)), and must be kept for 3 years from the date of the training (1910.1030(h)(2)(ii)).
- HIPAA Privacy. The rule requires the covered entity to document that the training has been provided (45 CFR 164.530(b)(2)(ii)), and to keep required documentation for six years from the date it was created or last in effect, whichever is later (164.530(j)(2)).
- Everything else. Use the bloodborne list as a template: date, topic, trainer and attendee. It costs nothing and answers most questions after the fact.
Ways to host a yearly refresher with AhaSlides
A 10-minute live quiz is a good yearly refresher, because it shows who needs more help without a long lecture.
- Pick Answer: one question per rule. For example, "How often must bloodborne pathogens training be given?" Reveal the answer and the regulation behind it.
- Word Cloud: "The course people dread". The biggest word tells you which session to redesign first.
- Rating Scale: "How useful was last year's training?" Ask for 1 to 5 and compare year on year.
- Open Ended: "Topics to add". Collect requests anonymously and use them to plan next year's list.
Frequently asked questions
What compliance training is required annually?
Bloodborne pathogens training and, where employees use extinguishers, fire extinguisher education are annual under OSHA. Some state harassment laws and Medicare Advantage programmes are also annual. Check each rule's own interval.
Is HIPAA training required every year?
No fixed interval is set in the rule. The Privacy Rule requires training at hire and when policies change materially, though many employers run it yearly.
How often is harassment training required?
It depends on the state. California requires it once every two years, and New York State requires it annually.
How do I track annual compliance training?
Keep one record per person with the date of each session, and use the due-date rule for each course. Our guide to tracking training completion shows how.
Where to start
Start with the table: mark which rows apply to you, and book the first session on the calendar. If you only run one session this quarter, make it harassment prevention for all staff.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified employment lawyer or the regulator.
