How Often Is HIPAA Training Required for Healthcare Employees?

The short answer: Federal HIPAA regulations do not expressly require every healthcare employee to repeat the same HIPAA course once every year. The Privacy Rule requires covered entities to train workforce members within a reasonable period after they join the workforce and when a material policy or procedure change affects their job functions. The Security Rule requires covered entities and business associates to maintain a security awareness and training program that includes periodic security updates.

Many healthcare organizations nevertheless conduct HIPAA training annually. An annual refresher can help reinforce expectations, respond to changing threats, satisfy organizational policies or contracts, and demonstrate an active compliance program. However, employers should distinguish that widely accepted practice from the specific minimum frequency stated in federal regulations.

HIPAA training frequency at a glance

Circumstance	Federal HIPAA standard	Recommended employer practice
A person joins the workforce	Provide applicable Privacy Rule training within a reasonable period	Complete training during onboarding and, when practical, before unsupervised access to PHI
A material privacy policy or procedure changes	Retrain affected workforce members within a reasonable period after the change becomes effective	Assign targeted training promptly and document the policy version covered
Security awareness	Maintain a security awareness and training program with periodic security updates	Provide ongoing reminders and at least one substantive refresher each year
Employee changes roles	Train when different duties create new privacy or security responsibilities	Assign role-specific training before granting new access
A privacy or security incident occurs	Retraining is not automatically required after every incident, but corrective measures may be necessary	Provide focused retraining when knowledge or conduct contributed to the incident
Annual refresher	Not expressly mandated as a universal federal deadline	Use annual training as a practical compliance baseline unless a stricter rule applies

Does HIPAA require annual employee training?

HIPAA does not contain a general provision stating that every workforce member must complete HIPAA training every 12 months.

For Privacy Rule training, a covered entity must train its workforce on the privacy policies and procedures necessary and appropriate for each person’s functions. Training is required for new workforce members and for affected personnel following a material change to applicable policies or procedures. The regulation uses a “reasonable period” standard rather than prescribing an exact number of days or an annual deadline (45 C.F.R. § 164.530(b)).

The Security Rule takes a different approach. It requires covered entities and business associates to implement a security awareness and training program for all workforce members, including management. The program must address subjects such as periodic security updates, protection from malicious software, log-in monitoring, and password management when those measures are reasonable and appropriate (45 C.F.R. § 164.308(a)(5)). Therefore, the most accurate answer is:

Federal HIPAA requires training when a person joins the workforce, when material changes affect the person’s work, and through an ongoing security awareness program. It does not establish a universal once-a-year training deadline.

What does the HIPAA Privacy Rule require?

The Privacy Rule’s administrative requirements direct a covered entity to train all members of its workforce on its protected health information policies and procedures. The content must be “necessary and appropriate” for the person’s job. That creates three important obligations.

1. Train new workforce members

Each new workforce member must receive appropriate training within a reasonable period after joining the organization.

HIPAA does not define “reasonable period” as a specific number of days. Healthcare employers should therefore establish a defensible internal deadline. Completing the training during onboarding—and before the employee independently handles protected health information—is generally the safer operational approach.

2. Provide training after material changes

When a material change to a privacy policy or procedure affects a workforce member’s functions, that person must receive relevant training within a reasonable period after the change becomes effective. Examples may include:

• A revised process for responding to patient record requests
• New restrictions on communicating PHI by text or email
• A new electronic health record workflow
• Changes to authorization or identity-verification procedures
• A revised process for reporting suspected privacy incidents
• New rules governing photographs, recordings, or social media
• Changes in how employees communicate with patients’ family members

Not every wording change requires organization-wide retraining. Employers should identify which roles are affected and deliver training targeted to those responsibilities.

3. Document the training

Covered entities must document that required training occurred. HIPAA documentation generally must be retained for six years from the date it was created or the date it was last in effect, whichever is later (45 C.F.R. § 164.530(j)). A defensible training record should identify:

• The learner’s name and role
• The course or training topic
• The completion date
• The course or policy version
• The delivery method
• Assessment results, when applicable
• Acknowledgment or certificate of completion
• Any assigned remediation or follow-up training

A completion certificate can support an employer’s records, but it does not by itself prove that every aspect of the organization’s HIPAA program is compliant.

What does the HIPAA Security Rule require?

The Security Rule applies to electronic protected health information, commonly called ePHI. It requires covered entities and business associates to provide security awareness and training to all workforce members, including management. Unlike the Privacy Rule provision, the Security Rule describes an ongoing program. Its implementation specifications address:

• Periodic security updates
• Procedures for guarding against, detecting, and reporting malicious software
• Monitoring log-in attempts and reporting discrepancies
• Creating, changing, and safeguarding passwords

This language supports more than a one-time orientation course. Healthcare organizations should combine foundational instruction with recurring awareness activities, such as phishing simulations, short security reminders, incident alerts, and targeted retraining.

HHS proposed significant Security Rule revisions in December 2024, but HHS states that the existing Security Rule remains in effect while rulemaking continues. Employers should monitor the proposal’s status and revise training only when a final rule and applicable compliance dates warrant changes (U.S. Department of Health and Human Services, “HIPAA Security Rule NPRM”).

Who must receive HIPAA training?

HIPAA’s definition of “workforce” is broader than full-time employees. It includes employees, volunteers, trainees, and other people whose work is under the direct control of a covered entity or business associate, whether or not they are paid (45 C.F.R. § 160.103). Depending on the organization, the training population may include:

• Physicians and advanced practice providers
• Nurses and clinical support personnel
• Reception, registration, and scheduling employees
• Billing and coding personnel
• Health information management employees
• IT and cybersecurity personnel
• Managers and executives
• Students and trainees
• Volunteers
• Temporary workers
• Contractors working under the organization’s direct control

The appropriate course content will vary. A receptionist, nurse, billing specialist, system administrator, and privacy officer should not necessarily receive identical instruction.

Do business associates have to provide HIPAA training?

The Privacy Rule training provision in 45 C.F.R. § 164.530(b) is directed expressly at covered entities. The Security Rule’s security awareness and training standard, however, applies to both covered entities and business associates.

Business associates should also examine their business associate agreements, written policies, risk analyses, state-law obligations, and customer requirements. Even when a particular Privacy Rule training clause does not apply in the same manner, a business associate still needs an appropriately trained workforce to comply with its safeguards, contractual commitments, and incident-reporting duties.

A business associate’s training program should reflect the services it performs and the ePHI it creates, receives, maintains, or transmits.

Why do many healthcare employers require annual HIPAA training?

Although federal HIPAA does not establish a universal annual deadline, annual refreshers remain a sensible baseline for many organizations. Annual training can help employers:

• Reinforce privacy and security expectations
• Address recurring errors identified through audits or incident reports
• Prepare employees for current phishing and social-engineering tactics
• Review organizational policy changes
• Remind employees how and where to report concerns
• Demonstrate ongoing attention to compliance
• Meet contractual, insurer, accreditation, or internal policy requirements
• Maintain a consistent training cycle across multiple locations

Annual training should not be treated as the entire compliance program. A workforce can complete an annual course and still make preventable mistakes if employees receive no follow-up guidance, policy-specific instruction, or security reminders during the rest of the year. A stronger model combines:

1. New-hire training
2. Annual refresher training
3. Periodic security awareness activities
4. Change-based training
5. Incident-based corrective training
6. Role-specific instruction

Can state law require a different training schedule?

Yes. HIPAA creates a federal baseline, but state privacy laws may impose additional or more protective requirements. A more stringent state privacy provision may not be preempted by HIPAA (U.S. Department of Health and Human Services, “Summary of the HIPAA Privacy Rule”).

Texas provides a useful example. Texas Health and Safety Code § 181.101 generally requires covered entities subject to the provision to train applicable employees within 90 days after hire. When a material change in state or federal law affects an employee’s duties, training must occur within a reasonable period—but no later than the first anniversary of the change. The employer must maintain signed verification of the training for six years (Texas Health and Safety Code § 181.101).

Healthcare employers should check:

• State medical privacy laws
• Professional licensing requirements
• Facility-specific regulations
• Medicaid and Medicare participation requirements
• Accreditation standards
• Business associate agreements
• Cybersecurity insurance conditions
• Corporate compliance policies
• Resolution agreements or corrective action plans

The shortest applicable deadline should generally control the organization’s training calendar.

What should HIPAA employee training cover?

Effective training should address the employee’s actual access, duties, and risks. A general healthcare workforce course commonly covers:

Privacy fundamentals

• What PHI is and where it may exist
• Permitted uses and disclosures
• The minimum necessary standard
• Patient access and other individual rights
• Authorizations
• Verifying identity and authority
• Conversations with family members and caregivers
• Incidental disclosures
• Confidential communication practices
• Appropriate disposal of PHI

Security practices

• Phishing and social engineering
• Malicious software and ransomware
• Password and multifactor-authentication practices
• Mobile device and portable-media security
• Remote work
• Secure email, texting, and file sharing
• Physical workstation safeguards
• Unattended screens and automatic logoff
• Reporting suspicious activity
• Using only approved systems and applications

Organizational expectations

• Where to locate privacy and security policies
• How to report a suspected incident
• Whom to contact with questions
• Prohibitions on unauthorized record access
• Social media and photography rules
• Sanctions for policy violations
• Nonretaliation protections
• Facility-specific workflows and escalation procedures

Employers should also teach through realistic scenarios. Employees are more likely to retain instructions when they see how the rules apply to misplaced paperwork, misdirected email, curious record access, phishing messages, conversations in public areas, personal-device use, and patient requests.

When should an employee be retrained?

Training should not wait for the next annual cycle when circumstances require an earlier response. Consider assigning targeted retraining when:

• The employee assumes a new role or receives new system access
• A policy or procedure materially changes
• A privacy or security audit identifies a recurring knowledge gap
• An employee violates a policy
• A phishing simulation reveals elevated risk
• The organization implements a new EHR, communication platform, or device
• A breach or security incident exposes a process weakness
• A regulator, insurer, client, or accreditation body requires corrective action
• New state requirements affect the employee’s duties

Corrective training should be matched to the cause of the problem. If an incident resulted from a poorly designed workflow or unclear policy, simply assigning the same general course again may not correct the underlying weakness.

Can online training satisfy HIPAA requirements?

HIPAA does not require Privacy Rule instruction to be delivered in a classroom. Online training can support compliance when it is appropriate to the workforce’s functions and accompanied by the organization’s own policies and procedures. A strong online program should provide:

• Accessible, role-relevant content
• Practical healthcare scenarios
• Knowledge checks or an assessment
• Reliable completion tracking
• Version control
• Downloadable records or certificates
• Automated reminders
• Mobile-friendly delivery
• LMS or SCORM compatibility
• A method for assigning targeted retraining

Employers should supplement general coursework with organization-specific information, including the names or contact methods for the privacy and security officials, internal reporting channels, approved communication tools, and facility procedures.

A practical HIPAA training schedule

Healthcare employers can use the following framework as a starting point:

During onboarding

• Assign privacy and security training promptly
• Complete training before independent PHI access when feasible
• Review organization-specific policies
• Document completion and acknowledgment

Throughout the year

• Send periodic security reminders
• Address emerging phishing or malware threats
• Provide updates when policies or workflows change
• Retrain employees after identified knowledge or conduct issues

Annually

• Deliver a substantive privacy and security refresher
• Review common incidents and audit findings
• Confirm contact and reporting information
• Update training to reflect applicable legal and policy changes
• Audit completion records and follow up on overdue assignments

After a material change

• Identify affected roles
• Explain what changed and why
• Provide targeted instruction within a reasonable period
• Record the policy and training versions
• Confirm that old resources have been withdrawn

HIPAA training checklist for healthcare employers

Use this checklist to evaluate your program:

• Have all new workforce members been assigned appropriate training?
• Is training completed before unsupervised PHI access when practical?
• Does the curriculum address each employee’s role?
• Are security updates provided periodically?
• Is retraining triggered by material policy changes?
• Are state-specific requirements included?
• Do temporary workers, trainees, and volunteers receive appropriate training?
• Are business associate workforce obligations addressed?
• Can the organization retrieve completion records promptly?
• Are training records retained for the required period?
• Does the content identify internal reporting procedures?
• Is the course reviewed when regulations or organizational practices change?

Frequently asked questions

How often is HIPAA training required?

Federal HIPAA requires applicable Privacy Rule training for new workforce members within a reasonable period and for affected personnel after material policy or procedure changes. The Security Rule requires an ongoing awareness and training program with periodic security updates. Federal HIPAA does not expressly impose a universal annual deadline.

Must a new employee finish HIPAA training before starting work?

The federal Privacy Rule says training must occur within a reasonable period after the person joins the workforce. It does not expressly say that every employee must complete training before the first work shift. Completing it during onboarding and before independent access to PHI is a prudent employer practice.

Is annual HIPAA training still recommended?

Yes. Annual refreshers provide a consistent opportunity to reinforce requirements, discuss incidents, address current security risks, and document continued compliance efforts. Annual training should be supplemented by periodic awareness activities and change-based instruction.

How long must HIPAA training records be retained?

Covered entities must retain documentation required by the Privacy Rule for six years from its creation date or the date it was last in effect, whichever is later.

Does HIPAA require a test or a particular passing score?

The federal HIPAA training provisions do not prescribe a specific course length, final examination, or passing score. Assessments are nevertheless useful for confirming comprehension and identifying employees who need additional instruction.

Can HIPAA training be completed online?

Yes. HIPAA does not prescribe classroom delivery. Online training can be effective when its content is appropriate for the workforce, completion is documented, and organization-specific policies and reporting procedures are also communicated.

Do volunteers and students need HIPAA training?

They may. HIPAA’s workforce definition includes employees, volunteers, trainees, and certain other persons under the entity’s direct control, whether paid or unpaid. Their training should reflect their duties and access to PHI or ePHI.

Is a HIPAA course completion certificate enough?

A certificate provides useful evidence that a person completed a course, but it is only one part of compliance. Organizations must also maintain appropriate policies, safeguards, incident procedures, documentation, and role-specific instruction.

Build a defensible, manageable HIPAA training program

The best HIPAA training calendar is not based on a single date. It combines prompt onboarding, periodic security awareness, annual reinforcement, role-specific instruction, and retraining when laws, policies, technology, duties, or risks change.

Evolve e-Learning Solutions offers online HIPAA privacy and security training for covered entities, business associates, students, and general workforce awareness. Courses feature practical scenarios, assessments, completion documentation, and SCORM-compatible options for organizations using their own LMS.