HIPAA Training Requirements — Who & How Often

Who must take HIPAA training?

Per 45 CFR 164.530(b): all members of the covered entity's workforce who handle PHI (Protected Health Information) — clinicians, billing staff, IT staff, administrators, students, interns, volunteers. Business Associates of covered entities must train their own workforce under 45 CFR 164.308(a)(5).

How often is HIPAA training required?

(1) At hire — initial training must occur within a reasonable time after hire date, before the new workforce member has access to PHI. (2) After material change — when policies or procedures affecting PHI handling change. (3) Periodic — most organizations train annually as a best practice, though HIPAA itself doesn't specify an interval.

What does HIPAA training need to cover?

Privacy Rule (PHI use, disclosure, minimum-necessary, NPP), Security Rule (administrative, physical, technical safeguards), Breach Notification Rule (reporting timelines), patient rights (access, amendment, accounting of disclosures, restriction requests), workforce sanction policy, security incident response procedures, and the entity-specific NPP and policies.

How do I document HIPAA training?

Per 45 CFR 164.530(b)(2)(ii): retain training documentation for 6 years. Records must include: (1) date of training, (2) topics covered, (3) attendance roster with employee signatures or electronic confirmation, (4) post-training assessment score (if applicable), (5) trainer credentials. OCR audits frequently sample training records first.

Can FileFlo track HIPAA training across providers and staff?

Yes. FileFlo's healthcare rule-pack tracks training records under 45 CFR 164.530(b): per-employee training history, automatic 'must-retrain' alerts when policies change (linked to your NPP version), and audit binder export listing every workforce member's training completion. Free CMS/HIPAA audit at /tools/cms-survey-readiness-score.