Almost every organization that handles protected health information runs some form of HIPAA training. Far fewer can prove it in the way an investigator or a customer's auditor will ask. A completion dashboard from a learning platform shows that some people finished a course. It does not show that everyone who needed training got it, on the right content, at the right time.
The difference matters because training is one of the first things requested after an incident. If a workforce member mishandled PHI, the next question is whether they had been trained on the policy they broke.
This article covers the two HIPAA training requirements, who counts as workforce, what records make training defensible, and how to show the population was complete.
Two rules, two training requirements
HIPAA contains two separate training obligations, and they are often blended together.
The Security Rule, 45 CFR §164.308(a)(5). You must implement a security awareness and training program for all members of your workforce, including management. The standard has four addressable implementation specifications: security reminders, protection from malicious software, log-in monitoring, and password management. It applies to covered entities and business associates alike.
The Privacy Rule, §164.530(b). A covered entity must train all workforce members on its policies and procedures for PHI, as necessary and appropriate for them to carry out their functions. The rule sets timing: each new workforce member within a reasonable period after joining, and each member whose functions are affected by a material change in policy within a reasonable period after the change takes effect. The covered entity must document that the training was provided.
Business associates are not directly bound by §164.530. In practice, most business associate agreements require privacy training anyway, and the Security Rule training standard applies to business associates directly. Treat both as in scope if you sign BAAs.
Neither rule says "annually." Yearly refresher training is a common convention and a frequent BAA term, not a regulatory text. If your policy says annual, annual becomes the standard you are measured against.
Who counts as workforce
The definition at §160.103 is broader than "employees." It includes employees, volunteers, trainees, and other persons whose conduct, in the performance of work for you, is under your direct control, whether or not you pay them.
For a SaaS company, that usually captures:
Full-time and part-time employees
Interns
Contractors who work under your direction, inside your systems, with your accounts
Executives and board-appointed officers who have access to PHI or set policy
Contractors are where gaps appear. They often sit outside the HR system that drives training assignments, so they never receive the course. Decide which contractors are workforce under the definition, record that decision, and make sure your training roster pulls from the same source as your access provisioning.
What an investigator or auditor asks for
A defensible training record answers four questions: who was trained, on what, when, and what happened to anyone who was not. The evidence that supports it:
- Not done:
Training policy. Who must complete what, by when, how completion is tracked, and what happens on non-completion.
- Not done:
Versioned content. Each course or module with a version and date, so you can show what a given person saw.
- Not done:
A dated population. The workforce roster as of each training cycle, exported from the HR or identity system.
- Not done:
Completion records. Per person, with completion date and content version.
- Not done:
New-hire records. Training dates compared with start dates or first-access dates.
- Not done:
Policy-change records. Evidence that affected staff were trained after material policy changes.
- Not done:
Security reminders. What was sent, to whom, and when.
- Not done:
Follow-up. Escalations for overdue training, and sanctions applied under your sanction policy at §164.308(a)(1)(ii)(C).
Most programs produce the completion records and little else. The population, the content version, and the follow-up are what turn a dashboard into evidence. The what auditors actually ask for article explains why auditors want each artifact dated.
Defining "a reasonable period" yourself
The Privacy Rule does not define "reasonable period" for new hires. That leaves you to set a number, write it in policy, and meet it.
The strongest choice is to require training before access to PHI is granted. It is easy to test: compare the access grant date with the training completion date for every new hire. Any access that predates training is an exception you can see and fix. A rule like "within 30 days of joining" also works, as long as you can show it was met. What does not work is a policy with no number, because nobody can show compliance with it.
Tie training to your joiner, mover, and leaver process. A role change that brings new PHI access should trigger the role-specific module, in the same way a material policy change does.
Content that matches your environment
The Privacy Rule requires training on your policies and procedures, not on HIPAA in general. An off-the-shelf course on phishing and the history of the law satisfies part of the Security Rule requirement. It does not show that your staff know your rules.
Supplement the general course with short, role-based modules:
Engineers: keeping PHI out of logs and test data, rules for production access, and how to handle a suspected incident.
Support staff: verifying a caller's identity, viewing only the records the ticket needs, and when to escalate. The minimum necessary standard is the policy most worth teaching here.
Sales and success: never using real patient data in demos, and how to route a customer's PHI questions.
Everyone: how to report a security incident or a privacy complaint, and to whom.
Keep each module mapped to the policy it teaches. When the policy changes, the mapping tells you which module to revise and who must retake it.
Proving the population was complete
The most common finding is not bad training. It is a person who was never assigned it. To show completeness, reconcile two lists each cycle:
Export the workforce roster from your HR system and add contractors from your contractor register.
Export completion records from your training platform.
Match them by a stable identifier, not by name.
Investigate every unmatched person. Record whether they were exempt, on leave, departed, or missed.
Close each miss with training, and keep the reconciliation itself.
The reconciliation record is the strongest piece of training evidence you can produce. It shows you checked, rather than assumed. The proving population completeness article covers the same technique for other controls.
Security reminders and phishing simulations
Security reminders are an addressable specification, and among the easiest to implement. Short periodic messages about a current threat, a policy change, or how to report a suspicious email all qualify. Keep the message, the date, and the distribution list.
Phishing simulations are not named in the rule. They can support your awareness program and your protection from malicious software. They do not replace training on your policies, and a completion record for a simulation is not a record of training.
How long to keep training records
Both rules require six-year retention. Section 164.316(b)(2)(i) covers Security Rule documentation, and §164.530(j)(2) covers Privacy Rule documentation, each measured from creation or the date last in effect, whichever is later. Keep the content versions alongside the completion records, or you will be able to say who finished training but not what they were taught.
HHS has proposed changes to the Security Rule that would make training requirements more prescriptive. These are proposals, not current law, so confirm their status before you change your intervals. A program that already trains before access, refreshes on a stated cycle, and reconciles its population will need little adjustment.
How TrustLynce helps
TrustLynce's security training assigns courses and records completions against your workforce roster. Policy management tracks policy versions and acceptance, so you can show which version each person was trained on and acknowledged.