What is required
Both the Privacy Rule and the Security Rule require workforce training, and they require different things.
| Privacy Rule | Security Rule | |
|---|---|---|
| Requirement | Training on policies and procedures for PHI | A security awareness and training programme |
| Timing | Within a reasonable time after joining | Ongoing |
| Also when | Material change to policies | Periodic reminders |
| Specification type | Required | Addressable |
| Applies to BAs | Partly | Yes |
Addressable does not mean optional. It means you implement it, or document why it is not reasonable and appropriate and what you do instead. For workforce training, "not reasonable" is a very hard argument to make.
How often
Neither rule sets a fixed interval, which is why organizations drift. The defensible pattern:
On hire, before access to PHI is granted rather than within some window afterwards. Annually as a refresh — the practical standard even though no rule states it. On material change to policies or systems. After an incident, targeted at whatever the incident revealed.
The Security Rule also expects periodic security reminders, which is a lower-effort ongoing obligation than formal training and is frequently skipped entirely.
What the evidence has to show
This is where training obligations actually fail. The training usually happens; the record of it does not survive scrutiny.
| Evidence | Works | Does not work |
|---|---|---|
| Completion | Per-person record with a date | "All staff were trained" |
| Content | The material as delivered, versioned | A description of the topics |
| New joiners | Completion before PHI access granted | Completion at some later point |
| Sanctions | Policy plus evidence it has been applied | Policy alone |
The sanctions row is the one organizations most often miss: HIPAA requires a sanction policy for workforce members who violate procedures, and a policy that has never been applied to anyone invites the question of whether it exists in practice.
What to actually cover
Content is not prescribed, which is freedom rather than an excuse. A defensible curriculum covers: what PHI is and where it lives in your systems; permitted uses and the minimum necessary standard; your specific policies rather than generic HIPAA content; how to recognise and report an incident; the sanction policy; and role-specific content where roles differ materially.
The most common weakness is genericness. Training that never mentions your systems, your data flows or your reporting channel demonstrates awareness of HIPAA rather than of your obligations under it.
FAQs
Is HIPAA training required?
Yes. The Privacy Rule requires training on policies and procedures for PHI as a required specification, and the Security Rule requires a security awareness and training programme as an addressable one. Addressable means implement it or document why it is not reasonable and appropriate, which is very hard to argue for training.
How often is HIPAA training required?
Neither rule sets a fixed interval. The defensible pattern is on hire before PHI access is granted, annually as a refresh, on material change to policies or systems, and after an incident. The Security Rule additionally expects periodic security reminders between formal sessions.
What evidence of HIPAA training do auditors want?
Per-person completion records with dates, the training material as delivered and versioned, proof that new joiners completed training before being granted PHI access, and a sanction policy with evidence it has actually been applied. A statement that all staff were trained is not evidence.
What should HIPAA training cover?
What PHI is and where it lives in your specific systems, permitted uses and the minimum necessary standard, your own policies rather than generic HIPAA content, how to recognise and report an incident, the sanction policy, and role-specific content where roles differ materially.
Do business associates need HIPAA training?
Yes. Business associates are fully subject to the Security Rule, which includes the security awareness and training requirement, and their BAA will typically require it explicitly as part of the safeguards obligation.
Where to go next
See the HIPAA risk assessment, the 18 safeguard standards, or HIPAA consulting.