Who needs HIPAA training?

All workforce members of a covered entity, including employees, volunteers and trainees under its direct control, paid or not. Business associates must run security awareness training for their workforce, including management, under the Security Rule.

Is HIPAA training required every year?

The current rules do not set a fixed annual interval. The Privacy Rule requires training for new workforce members within a reasonable period after joining and after material policy changes, and the Security Rule expects periodic security reminders. Many organisations train annually as good practice or because a contract requires it.

HIPAA training requirements: Privacy and Security Rules

Q: How long must HIPAA training records be kept?

Six years from the date the documentation was created or the date it was last in effect, whichever is later, under 45 CFR 164.530(j)(2) and 164.316(b)(2)(i).

Who needs the training

HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with a HIPAA transaction) and their business associates. Inside those organisations, the duty is to train the workforce. Under 45 CFR 160.103 that means employees, volunteers, trainees and other people whose work is under your direct control, whether or not you pay them.

The Privacy Rule, 45 CFR 164.530(b)(1), requires a covered entity to train all members of its workforce. The Security Rule, 45 CFR 164.308(a)(5)(i), requires a security awareness and training programme for all members of the workforce "including management".

Business associates

Business associates must comply with the Security Rule directly (45 CFR 164.302), so the security awareness and training standard in 164.308(a)(5) applies to them and their workforce.

The Privacy Rule training standard in 164.530(b) is written for covered entities. A business associate's privacy obligations come mainly through its business associate agreement: where it carries out a covered entity's Privacy Rule obligation, it must meet the requirements that apply to the covered entity for that work (45 CFR 164.504(e)(2)(ii)(H)). Many agreements also require training directly, so check yours.

What the training must cover

Privacy Rule. Staff must be trained on your policies and procedures for protected health information, "as necessary and appropriate" for their job (164.530(b)(1)). So content should follow your own policies, and can differ by role. Typical topics: what counts as PHI, when it can be used or disclosed, the minimum necessary standard, patient rights and how to report a privacy incident.

Security Rule. Section 164.308(a)(5)(ii) lists four implementation specifications for the training programme:

Security reminders: periodic security updates
Protection from malicious software: guarding against, detecting and reporting it
Log-in monitoring: monitoring log-in attempts and reporting discrepancies
Password management: creating, changing and safeguarding passwords

All four are addressable. That does not mean optional. Under 164.306(d)(3) you must assess each one, implement it if reasonable and appropriate, or document why not and implement an equivalent alternative where reasonable and appropriate.

We publish separate templates for the Privacy Rule and for Security awareness, because the content is different.

How often

The Privacy Rule sets three points in time (164.530(b)(2)(i)):

Every workforce member by the organisation's compliance date
Each new workforce member within a reasonable period of time after joining
Each workforce member whose functions are affected by a material change in policies or procedures, within a reasonable period after the change takes effect

Neither rule sets a fixed annual refresher. Many organisations train every year anyway, and some contracts require it. The Security Rule's "security reminders" specification also points to ongoing, periodic updates rather than a single session.

HHS proposed changes to the Security Rule in January 2025 (90 FR 898). It is still a proposal: no final rule had been published in the Federal Register when we last reviewed this page. Until a final rule takes effect, the current text applies.

Can it be done online?

The rules don't prescribe a format. Online, classroom or blended training can all work, as long as it covers your policies and procedures as they apply to each person's job and you can document that it was provided. A live Q&A session is a practical way to cover workplace-specific questions.

Who can deliver it

HIPAA doesn't require a certified trainer. You must designate a privacy official responsible for developing and implementing your privacy policies and procedures (164.530(a)(1)(i)) and a security official with the same role for security (164.308(a)(2)). In practice they own the training content, even if someone else delivers it.

What records to keep

You must document that Privacy Rule training was provided (164.530(b)(2)(ii)). Documentation must be kept, in written or electronic form, for six years from the date it was created or the date it was last in effect, whichever is later (164.530(j)(2)). The Security Rule sets the same six-year retention for its required documentation (164.316(b)(2)(i)).

A useful training record shows who was trained, when, on which version of your policies, and how. Keep the training materials too, since they show what was covered.