HIPAA security awareness training: what the rule requires, and what works

In many organizations, HIPAA training means everyone clicks through the same module once a year. That produces a completion report. Whether it prepares a front desk employee to spot a fake invoice, or a nurse to question an urgent password reset request, is a different question. The rule is brief, but it asks for a program, and a program is more than one annual event.

What the Security Rule requires

The standard at 45 CFR 164.308(a)(5) is one sentence: implement "a security awareness and training program for all members of its workforce (including management)." It applies to covered entities and business associates alike, so a billing company or IT vendor that handles ePHI needs its own program.

"Workforce" is broader than payroll. Under 45 CFR 160.103, it includes employees, volunteers, trainees, and other people whose work is under your direct control, whether or not you pay them. The words "including management" mean physicians, owners, and executives are in scope too.

The standard has four implementation specifications:

• Security reminders: periodic security updates.
• Protection from malicious software: procedures for guarding against, detecting, and reporting malicious software.
• Log-in monitoring: procedures for monitoring log-in attempts and reporting discrepancies.
• Password management: procedures for creating, changing, and safeguarding passwords.

All four are currently labeled addressable. Under 164.306(d)(3), that means you assess whether each one is reasonable and appropriate in your environment. If it is, you implement it. If it is not, you document why and implement an equivalent alternative if one is reasonable and appropriate. Few organizations could argue that teaching staff about malware and passwords is unreasonable.

The Privacy Rule training requirement

A second training requirement sits in the Privacy Rule at 45 CFR 164.530(b). Covered entities must train all workforce members on their privacy policies and procedures "as necessary and appropriate" for each person's job. The rule sets the timing for two situations: new workforce members must be trained "within a reasonable period of time" after they join, and anyone whose job is affected by a material change in policies or procedures must be trained within a reasonable period after the change takes effect. The covered entity must also document that the training was provided.

Combining privacy and security training is sensible, as long as the security content is more than a paragraph at the end of a privacy module.

How often: what the rule says and what is expected

Neither rule names a frequency. The Security Rule asks for periodic reminders; the Privacy Rule ties training to onboarding and policy changes. OCR addressed the question in its July 2017 cybersecurity newsletter, telling organizations to consider how often to train "given the risks and threats to their enterprises" and observing that "many entities have determined that bi-annual training, and monthly security updates are necessary." The same newsletter described a training program as "an ongoing, evolving process."

In practice, annual formal training with shorter reminders through the year is what most compliance programs aim for, and it is what the proposed rule, discussed below, would require.

Documentation and retention

Under 164.316(b), any activity the Security Rule requires to be documented must be kept in written form (electronic is fine) and retained for six years from the date it was created or last in effect, whichever is later. Section 164.530(j) sets the same six-year period for Privacy Rule documentation, including training records. OCR's 2017 newsletter suggested documenting "dates and types of training, training materials, and evidence of workforce participation."

A workable record includes the roster, the date and topic of each session, the materials, completion records, and the reminders you sent during the year.

What the proposed Security Rule would change

In January 2025, HHS published a proposed update to the Security Rule, with comments due March 7, 2025. Based on HHS's fact sheet and summaries by Arnold & Porter and Faegre Drinker, the proposal would:

• Remove the distinction between required and addressable specifications, making nearly all of them required, with limited exceptions.
• Require security awareness training for all workforce members at least once every 12 months.
• Require training for new workforce members within 30 days after they first get access to the organization's relevant electronic information systems.
• Spell out the content, including the organization's security policies and procedures, guidance on identifying and reporting security incidents such as malicious software and social engineering, and procedures for securely accessing systems.

The proposal is not final, and its details may change. The federal regulatory agenda lists July 2027 as the projected date for final action, as reported by Holland & Knight. Organizations that already train annually and train new staff promptly would have little to adjust.

Why phishing and stolen credentials matter in healthcare

The HIPAA Journal's analysis of OCR breach portal data counted 710 breaches of 500 or more records reported in 2025, and almost a quarter of them (24.9%) involved compromised email accounts.

Verizon's 2026 Data Breach Investigations Report, as summarized by the HIPAA Journal, found that in healthcare, phishing was the way in for 14% of incidents and stolen credentials for 11%, with employee errors accounting for another 11%. And HHS's Health Industry Cybersecurity Practices (HICP), produced through the 405(d) program, lists social engineering, such as phishing and impersonation scams, first among the five most significant threats to the sector.

Training is not the whole answer; multifactor authentication, email filtering, and prompt patching matter at least as much. But many incidents begin with one person making one decision, and that is the part training can reach.

What effective training looks like in a small practice

Small practices and rural hospitals rarely have a training department, and they do not need one. Good training tends to share a few traits.

• Short and regular. A focused annual session plus brief reminders through the year is easier to keep current, and easier to sit through, than one long module.
• Role-based. Front desk staff need to recognize phone pretexting and verify callers. Billing staff need to question changes to payment instructions. Clinicians need to understand shared logins and unlocked workstations. Managers approve exceptions, so they need to know the policies best.
• Real examples. Suspicious emails your own staff have received, with sensitive details removed, teach more than generic samples.
• Clear reporting. Everyone should know exactly how to report a suspicious email, a lost device, or a mistake, and should hear that quick reporting is expected and will not be punished. Reporting is part of the malicious software and log-in monitoring specifications.
• Phishing simulations, where appropriate. Simulated phishing emails can show who needs more help. Use them to teach, not to embarrass, and follow a click with a short lesson. In a very small office, a guided discussion of real examples may be enough.
• Onboarding. Train new people when they get access, not at the next annual session.
• Volunteers, students, and contractors. Volunteers and trainees are workforce members and should be trained. For vendors whose people are not under your direct control, confirm through the business associate agreement that they train their own staff.

Free material can help. HHS's 405(d) program offers Knowledge on Demand, a free training tool covering the five HICP threats, and CISA's Secure Our World campaign reduces basic hygiene to four steps: recognize and report phishing, use strong passwords, turn on MFA, and update software.

How training connects to the risk analysis

Training should not be built in isolation. Your security risk analysis should identify where human error and social engineering could expose ePHI, and training should address those specific risks. If the analysis finds shared logins, staff forwarding work email to personal accounts, or weak password practices, those become the training topics. The addressable decisions for each training specification should be documented with the factors in 164.306(b)(2) in mind: your size and complexity, your technical capabilities, cost, and the probability and criticality of the risks.

The connection runs the other way too. Phishing test results, reported incidents, and questions staff ask during training are evidence about your environment, and they belong in the next risk analysis. That is the approach we take when we build workforce training for clients: start from what the risk analysis found, shape the sessions around the roles in the organization, and leave behind the documentation a reviewer would expect to see.