What does HIPAA require for security awareness training?

The Security Rule's administrative safeguards are in 45 CFR 164.308. Paragraph (a)(5)(i) sets the standard: "Implement a security awareness and training program for all members of its workforce (including management)."

That standard applies to covered entities (health plans, health care clearinghouses and most health care providers) and to their business associates. It covers everyone in the workforce, not only clinical staff or people in IT.

Paragraph (a)(5)(ii) lists four implementation specifications. All four are marked addressable in the current rule.

No. The training standard itself is not addressable, so every regulated entity must have a security awareness and training program.

HHS explains that addressable does not mean optional. It means the entity must decide whether each specification is reasonable and appropriate for it. If it is, the entity must implement it. If it is not, the entity must document why and adopt an equivalent alternative measure where that is reasonable and appropriate.

In practice, few small practices can document a good reason not to send security reminders or teach staff about passwords and malicious software.

HHS Office for Civil Rights (OCR) addressed this in its first quarter 2022 cybersecurity newsletter. It said regulated entities should train workforce members to recognize phishing attacks and have a protocol for what to do when one is suspected.

The same newsletter gives sending simulated phishing emails to workforce members as an example of a security reminder, used to gauge how well training is working and to offer targeted follow-up training. It also warns that training can fail when staff see it as a "check-the-box" exercise.

OCR also notes that senior executives are often targeted by phishing, which is one reason the standard names management explicitly.

The Privacy Rule has its own training standard at 45 CFR 164.530(b). Covered entities must train all workforce members on their privacy policies and procedures, train new workforce members within a reasonable period after they join, and retrain people whose functions are affected by a material change in policy. That training must be documented.

Under 45 CFR 164.316(b)(2)(i), Security Rule documentation, including records of actions and activities the rule requires, must be kept for six years from the date it was created or last in effect, whichever is later. Dated training records are part of that.

On December 27, 2024, HHS issued a notice of proposed rulemaking to update the Security Rule. Among other changes, it proposes removing the distinction between required and addressable specifications, so most specifications would become required.

As of this page's update date, that proposal has not been finalized. HHS states that the current Security Rule remains in effect while the rulemaking is under way. Practices should follow the current rule and watch for a final rule.

A small clinic or dental office usually needs three things: training that happens on a schedule, periodic reminders through the year, and records it can produce if OCR, an auditor or an insurer asks.

NetMinder is a phishing simulation and awareness training platform that MSPs run for their clients under their own brand. It sends monthly practice phishing emails, shows a short lesson when someone clicks, and produces per-employee certificates and a training report for any date range. These records can help a practice document its training. NetMinder does not make a practice HIPAA compliant, and the practice remains responsible for its own Security Rule and Privacy Rule obligations.