What are the HIPAA training requirements?

Two: the Privacy Rule requires training every workforce member on your PHI policies as necessary and appropriate for their role, and the Security Rule requires a security awareness and training program for the entire workforce, management included.

Is annual HIPAA training required by law?

Not by the current text. The law requires training new workforce members, retraining after material policy changes, and periodic security reminders. Annual training is the standard investigators expect, and the proposed Security Rule update would make it mandatory.

What training documentation does HIPAA require?

Written or electronic records showing who trained, when, and on what, retained for six years. Training without documentation counts for nothing in an audit.

Do business associates have HIPAA training requirements?

Yes. Business associates carry the Security Rule's training requirement directly, and their workforce must follow the privacy commitments in each business associate agreement.

ComplianceAugust 3, 2026 · 5 min read

HIPAA Training Requirements: What the Law Actually Says

Two federal rules require HIPAA training. See the exact requirements: who must train, on what, how often, and the documentation that proves it.

HIPAA's training requirements live in two regulations. The Privacy Rule at 45 CFR §164.530(b) requires a covered entity to train "all members of its workforce" on its policies and procedures for protected health information, "as necessary and appropriate for the members of the workforce to carry out their functions." The Security Rule at 45 CFR §164.308(a)(5) requires a "security awareness and training program for all members of its workforce (including management)." Everything else you have heard about HIPAA training hangs off those two sentences. This page walks through what each one demands in practice.

Requirement 1: Privacy Rule training

The Privacy Rule ties training to your own policies, not to a government curriculum. Your staff must learn your rules for using and disclosing PHI, the minimum necessary standard, and patients' rights, at the depth their role demands. A biller and a hygienist need different emphasis; both need training.

The rule also sets the clock: train each new workforce member "within a reasonable period of time" after they join, and retrain anyone whose functions a material policy change affects.

Requirement 2: Security Rule training

The Security Rule requires an ongoing security awareness program for everyone, with periodic security updates. In practice that means password and access hygiene, workstation habits, malware awareness, and phishing recognition, because stolen credentials start most healthcare breaches. "Including management" is in the regulation's text; owners and executives are not exempt.

The frequency question

Neither rule says "annual." The binding triggers are new hires, material policy changes, and the Security Rule's "periodic" reminders. Annual retraining became the standard anyway because it is what OCR investigators, auditors, and clients expect to see, and the proposed Security Rule update would turn that expectation into law: training within 30 days of system access and refreshers at least every 12 months. The full cadence discussion is in how often HIPAA training is required.

The documentation requirement

45 CFR §164.530(j) requires you to document the training and keep the records for six years. When OCR investigates, training records are an early document request, and training you cannot prove is treated as training that never happened. A dated, per-person certificate satisfies this; so does a completion report from your training platform. What HIPAA does not require is an official government credential, a distinction our certification guide unpacks.

Meeting the requirements

A course that covers all three rules, produces dated per-person records, and reruns easily on the annual clock satisfies both regulations for most organizations. That is the entire design brief for HIPAA compliance training, and TeachMeHIPAA's course meets it in under an hour per person: lessons, an assessment, and a verifiable certificate the moment they pass. Employers rolling this out to a workforce should start with HIPAA training for employees.