HIPAA Training Requirements for Small Practices: A Manager’s FAQ

If you run a small medical, dental, or behavioral health practice, HIPAA training is likely one of a dozen things on your compliance list. The rules themselves are short, but they leave a lot to judgment. That is where most managers get stuck: who exactly needs training, how soon, what it should cover, and what proof to keep.

This FAQ answers those questions with the actual regulatory language, so you can build a training plan your whole team can follow, and one you can defend if the Office for Civil Rights (OCR) ever asks.

What do HIPAA training requirements actually say?

HIPAA training requirements come from two places in the regulations.

The Privacy Rule

Under the Privacy Rule, a covered entity must train all members of its workforce on its policies and procedures for protected health information (PHI), “as necessary and appropriate for the members of the workforce to carry out their functions” (45 CFR 164.530(b)). The rule sets three timing triggers:

• Every workforce member, by the entity’s original compliance date
• Each new workforce member, “within a reasonable period of time” after joining
• Any workforce member whose job is affected by a material change in policies or procedures, within a reasonable period after the change takes effect

The Security Rule

The Security Rule separately requires covered entities and business associates to “implement a security awareness and training program for all members of its workforce (including management)” (45 CFR 164.308(a)(5)). This is the part of training that covers electronic PHI: passwords, phishing, malware, and log-in practices.

Who needs HIPAA training in a small practice?

Everyone in your workforce. HIPAA defines “workforce” broadly to include employees, volunteers, trainees, and other people whose work is under your direct control, whether or not you pay them (45 CFR 160.103). In a typical practice, that means:

• Physicians, dentists, nurses, hygienists, and medical assistants
• Front-desk, scheduling, and billing staff
• Office managers and practice owners (the Security Rule specifically names management)
• Students, interns, and volunteers

Outside vendors that handle PHI on your behalf, such as billing companies or IT providers, are usually business associates rather than workforce members. They have their own HIPAA obligations and should be covered in your business associate agreement.

How often is HIPAA training required?

The HIPAA rules do not set a fixed annual schedule. They require training at onboarding, after material policy changes, and on an ongoing basis for security awareness. In practice, many organizations train every year because it keeps knowledge current and creates a clean record. We cover this question in more depth in How Often Is HIPAA Training Required for Healthcare Employees?

What should HIPAA training cover?

The rule says training should fit each person’s role. A useful baseline for a practice includes:

• What PHI is and the minimum necessary standard
• Patient rights, such as access to records
• Permitted uses and disclosures, and when authorization is needed
• Recognizing and reporting a possible breach
• Security basics: passwords, phishing, device and screen safety, and secure messaging
• Your practice’s own policies, your HIPAA sanctions policy for staff violations, and who to contact with questions

Matching course depth to roles

Not every role needs the same depth. Staff with limited PHI contact may need a solid awareness course. Staff who use, disclose, or manage PHI every day, or who supervise others, benefit from training built around covered-entity responsibilities. Evolve offers both: HIPAA Awareness ($15 per learner) and HIPAA for Covered Entities ($20 per learner).

How do I document HIPAA training?

Documentation is where many small practices are weakest, and it matters. The Privacy Rule requires covered entities to document that training has been provided (45 CFR 164.530(b)(2)(ii)). Required documentation must be kept for six years from the date it was created or the date it was last in effect, whichever is later (45 CFR 164.530(j)(2); see also 45 CFR 164.316(b)(2) for Security Rule documentation).

For each person, keep:

• Name and role
• Course title and completion date
• A completion certificate or report
• The version of your policies the training covered

An online course with completion tracking makes this much easier than sign-in sheets.

Why does this matter now?

OCR has made the Security Rule’s basics an enforcement priority. Its Risk Analysis Initiative continues in 2026 and now also targets risk management (HIPAA Journal report on OCR’s 2026 enforcement priorities). Workforce training is one of the most visible, documentable safeguards a small practice has. A proposed overhaul of the Security Rule is also pending, with final action listed for July 2027 on the federal regulatory agenda (Reginfo.gov, RIN 0945-AA22). Until a final rule is issued, the current rules apply.

A simple training plan for your practice

1. List every workforce member, including part-time staff, students, and volunteers.
2. Assign a course by role: awareness for limited-PHI roles, covered-entity training for clinical, billing, and management roles.
3. Set your schedule: new hires within their first weeks, plus a recurring cycle (many practices choose annually).
4. Track completion and save certificates in one place for at least six years.
5. Retrain after policy changes, incidents, or new systems.

Train your whole team in one place

Evolve eLearning has provided healthcare compliance training since 2003. You can enroll your whole team online, assign courses by role, and keep completion certificates in one place, with access valid for 365 days. Volume discounts are available for groups. Explore HIPAA training or enroll your team in HIPAA for Covered Entities.