What HIPAA requires for security awareness training, in plain terms

The HIPAA Security Rule requires a covered entity or business associate to implement a security awareness and training program for all members of its workforce, including management. The rule names four specific topics under that standard. It does not set a course length, a vendor, or a fixed annual date.

What the regulation actually says

The standard sits at 45 CFR 164.308(a)(5). The core sentence is short: implement a security awareness and training program for all members of the workforce, including management.

Under it are four implementation specifications, each marked addressable:

• Security reminders, described as periodic security updates.
• Protection from malicious software, meaning procedures for guarding against, detecting and reporting it.
• Log-in monitoring, meaning procedures for monitoring log-in attempts and reporting discrepancies.
• Password management, meaning procedures for creating, changing and safeguarding passwords.

Notice that the text talks about procedures, not slides. Training is how staff learn the procedures.

What addressable means

Addressable does not mean optional. You assess whether the specification is reasonable and appropriate for your environment. If it is, you implement it. If it is not, you document why and put an equivalent measure in place where reasonable. Either way, a written decision beats silence.

Turning four bullets into a program

A workable program for a small organization has these parts:

1. An onboarding module covering the four topics, completed before system access is granted or within a short, stated window.
2. Periodic reminders. The regulation says periodic, so pick a cadence you can keep, such as a short monthly note, and keep it.
3. A reporting path for suspected malware and odd log-in activity, with a named mailbox or ticket queue.
4. A password and MFA procedure that matches what your systems enforce.
5. A record of who completed what, and when.

Who counts as workforce

The standard says all members of the workforce, including management. In practice that means employees, and typically volunteers, trainees and contractors who work under your direct control. Whether a given contractor is workforce or a separate business associate is a legal question worth checking with counsel. Executives are named explicitly, so do not exempt them.

What to keep as evidence

Keep the training content as it was delivered, the roster, completion dates, any quiz results, and the reminders you sent. If you decided an addressable item was not reasonable, keep that analysis. An assessor or investigator will usually ask for the material, then sample a few names against the roster.

Common gaps

• New hires trained weeks after they already had access to records.
• Training that never mentions how to report an incident.
• Management excused from sessions.
• A cadence written in policy that nobody follows.

Safeguard's compliance and evidence automation can help collect and organize completion records alongside other control evidence, but the program content and the decisions are yours to own.

Quick check

Sources

• 45 CFR 164.308, Cornell Legal Information Institute

This is general information, not legal advice.

Last reviewed: 19 October 2026.