Security awareness training for HIPAA
The HIPAA Security Rule requires covered entities and business associates to run a security awareness and training program for the whole workforce, management included (45 CFR 164.308(a)(5)). Our courses cover its malicious software and password topics and support the program; training on your own PHI policies stays with you.
Key facts
| Rule | HIPAA Security Rule, 45 CFR Part 164, Subpart C (current eCFR text) |
|---|---|
| Who it applies to | US covered entities (health plans, providers, clearinghouses) and their business associates |
| Main training standard | 45 CFR 164.308(a)(5): security awareness and training |
| How we describe our part | Supports the security awareness and training standard of the HIPAA Security Rule |
| Our library | A new US library of 51 finished courses, with a HIPAA course for the workforce |
Implement a security awareness and training program for all members of its workforce (including management).
(45 CFR 164.308(a)(5)(i))
Every quote on this page was checked word for word against the official eCFR text (October 2026).
The four implementation specifications and the courses that cover them
All four are “addressable”: you assess each one and put it in place where it is reasonable and appropriate, or document why not (45 CFR 164.306(d)(3)).
The UK and US edition is a new library made for UK and US teams: 40 story courses and 12 standards courses, 52 in all, all finished. Course names here are the names in that library; they have no course pages of their own yet.
| What it asks | Our course topics |
|---|---|
|
164.308(a)(5)(ii)(A) Security reminders
|
Standards course: Annual Refresher Short reminders between courses are not in our offer today. |
|
164.308(a)(5)(ii)(B) Protection from malicious software
|
About it: Safe Software Downloads; Stopping a Ransomware Attack; Risky Browser Extensions; Spotting Fake Official Sites Also: Gifted and Found USB Drives; Fake Virus Warnings; Urgent Security Patches Standards course: How to Report (and why no one is blamed) |
|
164.308(a)(5)(ii)(C) Log-in monitoring
|
Also: MFA, Passkeys and Sign-In Alerts; Breach Notices and Stolen Data Standards course: HIPAA for the Workforce (PHI); How to Report (and why no one is blamed) Our HIPAA course and the password and sign-in courses support this; your own log-in monitoring procedure stays yours. |
|
164.308(a)(5)(ii)(D) Password management
|
About it: Storing Passwords Safely; MFA, Passkeys and Sign-In Alerts Also: Breach Notices and Stolen Data Standards course: Security Onboarding: Your First Week |
|
164.530(b)(1) Privacy Rule training (related)
|
Standards course: HIPAA for the Workforce (PHI) Training on your own PHI policies and procedures is yours. |
When training must happen
The Security Rule sets no fixed interval. The Privacy Rule asks for training of new workforce members soon after they join, and again after a material change to your policies. A proposed rule published in January 2025 would add training at least every 12 months; it is not final.
Periodic security updates.
(45 CFR 164.308(a)(5)(ii)(A))
within a reasonable period of time after the person joins the covered entity's workforce
(45 CFR 164.530(b)(2))
What an auditor asks to see
for 6 years from the date of its creation or the date when it last was in effect, whichever is later
(45 CFR 164.316(b)(2)(i))
Evidence for HIPAA
- A written record (electronic is fine) of the training given, kept 6 years.
- For each person: the courses assigned, the date they finished, the quiz score and the certificate.
- Your decisions on the four addressable specifications, written down.
- A periodic review of the documentation, updated when things change (45 CFR 164.316(b)(2)(iii)).
What our LMS gives you today
- Assignments: give courses to teams or people and see who finished.
- A scenario quiz after every course: 10 questions from a bank of 13 to 15, pass mark 80, a score for each learner.
- A certificate for every learner who passes.
- One space per client, and your own report method and security contact on the last screen of each course.
- The full transcript of every course on its course page, as a copy of the training material.
What stays your job
Our library is the all-staff awareness layer. These parts of HIPAA are yours:
- Training on your own PHI policies and procedures (Privacy Rule, 164.530(b)).
- Your log-in monitoring procedure and who to report discrepancies to.
- Periodic security reminders, until we offer them.
- Keeping your records 6 years, and writing down your addressable decisions.
Questions people ask
Does HIPAA require annual security awareness training?
Not in the current text. The Security Rule asks for periodic security updates without a fixed interval. A January 2025 proposal would add training every 12 months, but it is not final.
What topics does the HIPAA Security Rule name?
Security reminders, protection from malicious software, log-in monitoring and password management (45 CFR 164.308(a)(5)(ii)(A) to (D)).
How long must HIPAA training records be kept?
Six years from the date they were created or last in effect, whichever is later (45 CFR 164.316(b)(2)(i)).
Sources
- 45 CFR 164.308 (eCFR)
- 45 CFR 164.316 (eCFR)
- 45 CFR 164.530 (eCFR)
- 45 CFR 164.306 (eCFR)
- Proposed rule, Federal Register, 6 January 2025 (not final)
Last updated: 2026-10-16. This page explains how our training relates to HIPAA; it is not legal advice.