‍What HIPAA says about workforce training

HIPAA training requirements come from two separate rules: the Privacy Rule at 45 CFR 164.530(b) and the Security Rule at 45 CFR 164.308(a)(5). Most organizations treat them as one obligation, but they differ in scope, audience, and content, and auditors check each one on its own terms.

The Privacy Rule: train on your policies, at defined moments

The Privacy Rule requires a covered entity to train every member of its workforce on its policies and procedures for protected health information (PHI), "as necessary and appropriate" for each person to do their job. The rule then sets three trigger points for that training: by the original compliance date, for each new workforce member within a reasonable period after they join, and for anyone whose functions are affected by a material change in policy, within a reasonable period after that change takes effect (45 CFR 164.530, Cornell LII).

Two aspects of this requirement warrant particular attention. First, the training covers the policies required by both the Privacy Rule and the Breach Notification Rule, so staff must know how to recognize and escalate a potential breach, not just how to protect records. Second, the organization must document that training took place, which brings the six-year documentation rule in 164.530(j) into play.

The Security Rule: run a program, not a one-time course

The Security Rule asks for something broader. Covered entities and business associates must "implement a security awareness and training program for all members of its workforce (including management)" (45 CFR 164.308, eCFR). The word program is deliberate. It implies something continuous that adapts as threats change, rather than a single annual event.

The standard lists four implementation specifications: periodic security reminders, protection from malicious software, log-in monitoring, and password management. These are currently "addressable," which means an organization must implement them or document a reasonable alternative based on its risk analysis. An addressable specification is therefore not optional; it requires a documented, risk-based decision.

How the two rules compare

‍

HIPAA compliance training is a privacy curriculum tied to your own policies, combined with a living security awareness program that responds to how attackers actually reach your workforce.

Who needs HIPAA training?

Every member of the workforce of a covered entity or business associate needs HIPAA training, whether or not they handle patient records directly. That includes clinicians, front desk staff, billing teams, IT administrators, executives, volunteers, students, and temporary staff.

Covered entities

Covered entities are health plans, healthcare clearinghouses, and healthcare providers that conduct standard electronic transactions. Hospitals, physician practices, dental offices, pharmacies, behavioral health providers, and employer-sponsored group health plans all fall into this group.

Business associates and their subcontractors

Business associates are vendors that create, receive, maintain, or transmit PHI on behalf of a covered entity. Billing companies, EHR and cloud hosting providers, managed IT and security providers, transcription services, and consultants are common examples. Since the 2013 Omnibus Final Rule, business associates have been directly liable for HIPAA violations attributable to their own noncompliance. The same obligations flow down to subcontractors that touch PHI.

For business associates, the Security Rule training requirement under 164.308(a)(5) applies to every workforce member with access to IT systems, not only staff who use or disclose PHI. Privacy training is usually required through the business associate agreement as well.

Training obligations follow PHI wherever it goes: from the covered entity, to its business associates, to their subcontractors, and to every workforce member inside each one.

What "workforce" really means

HIPAA defines the workforce broadly at 45 CFR 160.103. It covers employees, volunteers, trainees, and other persons whose conduct is under the direct control of the organization, whether or not they are paid. Three groups are most often missed in practice:

• Staff with no clinical role. An attacker can enter through a device that never touches ePHI and then move laterally toward systems that do, which is why security awareness training must reach everyone.
• Executives and administrators. The Security Rule names management explicitly. Senior leaders and IT admins hold the broadest access, so they carry the highest impact if compromised.
• Experienced new hires. Training must be provided even when a new workforce member held a similar role elsewhere, because they need your policies, not their last employer's.

State law can add to the federal baseline. Texas, for example, sets a mandatory window for training new workforce members of 90 days (HIPAA Journal), so multistate organizations should map local rules before setting a single onboarding deadline.

Is HIPAA training required every year?

The current HIPAA text does not set a calendar frequency, but HIPAA annual training is the de facto minimum, and OCR now writes it into its settlements. The Privacy Rule ties training to onboarding and material policy changes, and the Security Rule asks for an ongoing program with periodic reminders. Neither names a number of months, which is why the question “How often is HIPAA training required?” generates so much confusion.

Why annual training is the real baseline

Three forces have turned annual training from best practice into expectation.

OCR enforcement. In February 2026, OCR settled with Top of the World Ranch Treatment Center for $103,000 after a phishing attack exposed the ePHI of 1,980 patients through one workforce member's email account. The corrective action plan requires the provider to deliver annual HIPAA training to workforce members with access to ePHI, and OCR's announcement urged all regulated entities to provide role-based training. When the regulator negotiates remediation, a yearly cycle is what it asks for.

The proposed Security Rule. The January 2025 proposal would require security awareness training for each workforce member annually, and training for new workforce members within 30 calendar days of gaining access to relevant systems. The final rule has slipped: the 2026 Unified Agenda now targets July 2027, and the administration has not yet decided whether to finalize it. The direction of travel is clear regardless.

The threat tempo. Attack techniques change faster than an annual cycle. A training program that last addressed phishing in a generic, email-only format will not prepare staff for AI-generated voice calls or help desk impersonation.

A defensible cadence for 2026

1. At onboarding. Complete core privacy and security training before, or within days of, a new workforce member's first access to PHI or ePHI. Thirty days is the outer limit most counsel accept, and it matches the proposed rule.
2. After a material change. Retrain affected staff when policies, systems, or workflows change, such as a new EHR, a new remote access method, or a revised breach reporting procedure.
3. Annually for everyone. Run a full refresher each year, including staff whose roles have not changed.
4. Continuously in between. Deliver short security reminders, phishing simulations, and targeted refreshers through the year, prioritized by who carries the most risk.

Two triggers come straight from the rule, the annual refresher is now an enforcement expectation, and the continuous layer is where measurable risk reduction happens.

The fourth step is where HIPAA compliance training turns into genuine risk reduction, and it is the step most programs skip.

What HIPAA training has to cover

HIPAA training must cover your organization's own privacy, security, and breach notification policies, plus the security awareness topics named in the Security Rule. A generic video about "what HIPAA is" does not meet the standard, because the Privacy Rule requires training on the policies and procedures your workforce actually follows.

What 2026 training also needs

The regulation's topic list was written in 2003. The threats facing healthcare workforces in 2026 look very different, and a program built only on the original list will leave obvious gaps.

• Voice phishing and help desk impersonation. Attackers now call staff and IT support directly, using urgency around patient care to push password resets or new MFA device registrations.
• MFA fatigue and approval fraud. Staff need to know that an unexpected push approval is an attack signal, not a glitch.
• Misdelivery and everyday errors. Misdelivered emails, faxes, and mail remain the most common human error in healthcare breaches, so practical handling drills matter as much as threat awareness.
• Generative AI use. Pasting patient details into an unapproved AI tool can be an impermissible disclosure. Training should state which tools are approved and what data may never be entered.
• Third-party and vendor requests. Fraudulent requests that appear to come from a trusted vendor, billing partner, or SaaS platform are a growing route into healthcare data.

The strongest programs treat the core list as the floor and update the rest of the curriculum based on what is actually happening to their own workforce, which is where Human Risk Intelligence comes in.

Why completion rates alone will not protect PHI

Most healthcare organizations can prove their workforce completed HIPAA training, yet breaches that start with a single human interaction keep growing. A 100% completion rate tells an auditor that training happened. It does not tell a security leader which workforce members are most likely to be manipulated next.

The numbers behind the human layer

In 2025, a record 772 large healthcare data breaches were reported to OCR, and the PHI of more than 100 million individuals has been breached in each of the past three years. Verizon's 2026 healthcare snapshot found the human element in 54% of healthcare breaches, with phishing behind 14% of initial access and credential abuse behind a further 11%. Healthcare also remains the costliest industry for breaches for the 13th consecutive year, at an average of $6.64 million per incident.

What Human Risk Intelligence adds to HIPAA compliance training

Human Risk Intelligence treats training as one signal among many. Instead of asking only, “Did this person finish the course?” it correlates training results with phishing and vishing simulation behavior, identity hygiene such as MFA status and password age, dark web credential exposure, policy acknowledgments, and the level of access each person holds to ePHI.

That correlation matters because human risk is contextual. A billing clerk who clicks a simulated phishing link carries a moderate risk. A nurse manager with broad EHR access, no MFA on a legacy system, credentials found in a breach database, and a history of approving unexpected MFA prompts is a far greater concern. Each factor alone looks manageable. Together they form a toxic combination, a single account where several weaknesses reinforce one another into a likely and high-impact attack path.

A completion report would show this account as fully trained. Only correlating the five signals reveals it as one of the most dangerous accounts in the organization.

For HIPAA programs, this shifts the question from "is everyone trained?" to "who is most likely to cause the next breach, and what are we doing about it this month?" It also gives compliance teams stronger evidence for an OCR investigation, because it shows that training is driven by the organization's risk analysis, which is exactly what OCR's Risk Analysis Initiative keeps asking for.

The loop also produces the evidence OCR asks for: a documented link between identified human risks, the training delivered to address them, and the measured result.

How to document HIPAA training for an audit

To document HIPAA training for an audit, keep a dated record for every workforce member that shows what they were trained on, when, in which version, and how they confirmed it, and retain it for at least six years. Under 45 CFR 164.530(j), documentation must be kept for six years from the date it was created or the date it was last in effect, whichever is later (45 CFR 164.530, Cornell LII).

OCR audits and breach investigations rarely stop at “Was there training?” Investigators ask whether training was timely, whether it matched the person's role, and whether it reflected the risks identified in the risk analysis. With OCR's third phase of compliance audits underway, initially covering 50 covered entities and business associates, it pays to assume your records will be read closely.

Role-based training for staff, managers, clinical teams and business associates

Role-based HIPAA training gives every workforce member a shared foundation, then adds modules matched to the PHI they touch and the attacks they are most likely to face. The Privacy Rule already requires training "as necessary and appropriate" for each person's functions, and OCR's 2026 settlements explicitly recommend training specific to each workforce member's job duties.

• General staff: Front desk, scheduling, billing, and administrative teams handle PHI constantly and are the first point of contact for callers. Their training should focus on verifying identity before sharing information, handling records requests, avoiding misdelivery, and recognizing phishing and phone pretexting.
  
  
• Managers and executives: Leaders hold broad access and approval authority, which makes them prime targets for impersonation, invoice fraud, and MFA approval attacks. Their training should also cover their oversight duties: enforcing sanctions consistently, triggering retraining after policy changes, and reporting human risk to the board alongside technical metrics.
• Clinical teams: Physicians, nurses, and allied health staff work under time pressure on shared workstations and mobile devices. Training should cover the minimum necessary standard, EHR snooping and its sanctions, secure messaging, safe use of AI scribes and other generative AI tools, and how to report a suspected breach without disrupting care.
  
  
• IT and help desk teams: These teams can reset passwords and enroll MFA devices, which is why they are now a primary social engineering target. They need scenario-based vishing drills, strict caller verification procedures, and the authority to refuse urgent requests that bypass those procedures.
  
  
• Business associates: Vendors must run their own Security Rule training program and usually agree to privacy training through the business associate agreement. Covered entities should request evidence annually and confirm that vendor staff with access to PHI understand breach reporting timelines under the agreement.
  

From a compliance checkbox to a human risk program

HIPAA training requirements are clear on the essentials. Every workforce member at a covered entity or business associate must be trained on privacy and security, at onboarding, after material policy changes, and through an ongoing security awareness program, with records retained for six years. Annual training is not written into the current rule, but OCR's corrective action plans and the proposed Security Rule both treat it as the minimum.

The harder truth is that compliance alone is not stopping healthcare breaches. The 2026 incidents at Central Ohio Primary Care, Quantum Health, and McKesson show attackers reaching PHI through phone calls and identity systems, not just inboxes. Organizations that combine role-based HIPAA training with Human Risk Intelligence, correlating training, simulation, identity, and exposure data to find their highest-risk humans, will be better protected and better able to prove it to OCR, insurers, and the board. Book a demo with us to learn more about HIPAA training requirements today.

Frequently asked questions

• Is HIPAA training mandatory?
  Yes. HIPAA compliance training is mandatory under the Privacy Rule at 45 CFR 164.530(b) for covered entities and under the Security Rule at 45 CFR 164.308(a)(5) for both covered entities and business associates. Failing to train, or failing to document training, is a violation OCR can cite in an investigation.
  
  
• How often is HIPAA training required?
  The rule requires training at onboarding, after any material change to policies or procedures, and as part of an ongoing security awareness program. It does not set a fixed interval, but annual refresher training is the accepted minimum and is routinely required in OCR corrective action plans.
  
  
• How soon must new employees complete HIPAA training?
  The Privacy Rule says "within a reasonable period of time" after joining. Best practice is to complete core training before a new hire accesses PHI, and no later than 30 days, which matches the timeline in the proposed Security Rule. Some states, such as Texas, set their own deadlines.
  
  
• Does HIPAA training for employees have to be role-based?
  The Privacy Rule requires training that is necessary and appropriate for each person's functions, which in practice means role-based content on top of a common foundation. OCR has repeatedly recommended training specific to each workforce member's job duties in its 2026 settlements.
  
  
• Do business associates need HIPAA training?
  Yes. Business associates must run a security awareness and training program for their entire workforce under the Security Rule, and most business associate agreements also require privacy and breach reporting training for staff who handle PHI.
  
  
• Is there an official HIPAA certification?
  No. HHS does not certify individuals or training providers. A "HIPAA-certified" badge from a vendor only shows that someone completed that vendor's course, which is why your own training records and policy mapping matter more in an audit.
  
  
• What happens if an organization cannot prove its workforce was trained?
  OCR can treat missing training records as noncompliance, which can contribute to a settlement, a multiyear corrective action plan, or a civil money penalty. Training gaps also weaken the organization's position when demonstrating recognized security practices, which OCR can consider as a mitigating factor.