If you run a healthcare organization, you already know every new hire needs HIPAA training. That part is simple. The hard part is everything that comes after: who finished what, when the next refresher is due, whether your contractors got the same training as your billing team, and how you'll prove all of it to an auditor next Tuesday.
HIPAA is short on operational detail. The Privacy Rule and the Security Rule both say that training must happen, but they leave the how, when, and what to track largely up to you. That gap is where organizations quietly drift into risk. A signature on a paper sheet in a filing cabinet rarely holds up in a real audit.
This guide walks through what HIPAA actually requires, what records are worth keeping, and how a training platform like Learnly can keep all of it in one place.
What HIPAA Actually Requires for Training
The training mandate lives in two places, and people often blend them together.
The Privacy Rule (45 CFR § 164.530(b)) requires a covered entity to train all members of its workforce on its PHI policies and procedures, as necessary and appropriate for their jobs. Training has to happen for each new workforce member within a reasonable period after they join, and for anyone whose functions are affected by a material change in policies or procedures, within a reasonable period after the change takes effect. The covered entity must also document that the training was provided.
The Security Rule (45 CFR § 164.308(a)(5)) adds a separate requirement for electronic PHI: a security awareness and training program for all workforce members, including management. It lists several implementation specifications, such as security reminders and protection from malicious software, and several are "addressable," which means you must assess them and implement them if reasonable and appropriate.
A few details that often get missed:
- HIPAA doesn't set a fixed refresher schedule. The rules require training for new hires and after material changes, and the Security Rule expects an ongoing awareness program. Annual training is the widely accepted industry practice, and it's an easy standard to defend. Whatever cadence you choose, write it down and follow it.
- Documentation must be kept for six years. Under § 164.530(j), the retention period runs from the date a record was created or last in effect, whichever is later.
- Training must fit the job. A nurse who handles medication records has different exposure than a marketing coordinator writing about a new service line.
Who Needs HIPAA Training
Under HIPAA, "workforce" is broad. It includes employees, volunteers, trainees, and other people whose work is under the covered entity's direct control, whether or not they're paid.
That means training reaches well beyond doctors and nurses:
- Front-desk staff who see patient names on intake forms
- Billing and coding teams who work with PHI every day
- IT staff with system access
- Housekeeping and maintenance staff in clinical areas
- Interns, residents, and visiting students
- Contractors and temporary staff who work under your direct control
- Remote employees who handle PHI from home
One point of confusion is business associates, such as outside billing companies or software vendors. Their employees generally aren't part of your workforce, since business associates have their own obligation to train their people. Your job is to have the right business associate agreement in place and confirm they take training seriously.
Each role has a different risk profile. One generic module technically covers everyone, but it can leave real gaps. Tailoring training to job functions is what the rule asks for.
The Records Worth Keeping
This is the part that decides whether an audit is routine or painful. At a minimum, be able to produce the following on request:
- A roster of workforce members with hire dates, roles, and training status
- Completion records for each training event: date, content version, and format (online, in person, or blended)
- Assessment results, not just attendance, so you can show people understood the material
- Refresher due dates and proof they were completed on time
- Role-specific training showing each person received content that fits their access to PHI
- Training after policy changes, such as new procedures or a breach response
- Signed acknowledgments of policies, which aren't required for training itself but are common good practice
- A record of what was taught, including which version of the content was current at the time
Many organizations hold this together with spreadsheets, shared drives, and an LMS that was set up years ago and never revisited. That's where things quietly break.
Common Gaps That Cause Problems
Three gaps come up again and again.
Outdated content. HIPAA rules and guidance keep moving. For example, a federal court vacated most of the 2024 reproductive health privacy rule in June 2025, so modules that still teach its attestation requirements are out of date. Meanwhile, updated Notice of Privacy Practices requirements tied to substance use disorder records had a compliance date of February 16, 2026. And the proposed Security Rule overhaul published in January 2025 is still not final, though it signals where expectations may be heading. Review your content at least once a year.
No role-based differentiation. One module for everyone falls short the moment a contractor handles PHI differently than a front-desk employee.
No refresher process. Without a set cadence, refreshers depend on someone remembering to send them. That works until that person leaves.
How Learnly Helps With Tracking
Learnly is a workforce readiness platform built for regulated, recurring training where you need to show evidence, not just completions. Here's how its capabilities line up with the records above.
- Automated enrollment and reminders. New hires can be enrolled in required training automatically, and overdue employees get reminders, using Learnly's automated journey builder.
- Automated re-certification. You can schedule annual re-certification for topics like HIPAA, so employees are re-enrolled based on their last completion date.
- Audit logs and reporting. Learnly generates audit logs and reports that show who completed which training and when.
- Assessments. AI-powered assessments and gated critical assessments help you record demonstrated understanding, not just attendance.
- Versioned digital certificates. Certificates are issued automatically when someone completes a mandatory course, with version control.
- SCORM and xAPI support. You can upload SCORM 1.2, SCORM 2004, or xAPI content from any authoring tool, so you can keep your existing courseware or bring in third-party HIPAA content, and completions flow into the audit logs.
- Learning paths and competency dashboards. You can build different paths for different roles and see progress in one place. For hands-on roles, Learnly also supports on-the-job training and supervisor validation.
- Security and compliance. Learnly lists SOC 2 Type II and ISO/IEC 27001:2022 certifications, GDPR compliance, and HIPAA compliance with a Business Associate Agreement available. Because you'll be storing training records that relate to your workforce, ask about the BAA early in your evaluation.
Learnly is a training and tracking system. It doesn't replace a risk analysis, policies, or legal review, and you'll still want to choose HIPAA course content that's current and fits your organization.
For multi-location practices, health systems, and staffing agencies placing people at several client sites, consolidating records in one place often pays for itself. One source of truth beats a dozen spreadsheets.
A Practical HIPAA Training Tracking Checklist
Run through these questions with your compliance team:
If you answered "no" or "not sure" to more than two, your risk is larger than it needs to be.
Frequently Asked Questions
Is annual HIPAA training required? Not by the text of the rules. HIPAA requires training for new workforce members and after material changes, and the Security Rule expects an ongoing awareness program. Annual training is the common standard, and it's a sensible default.
How long do I need to keep HIPAA training records? Six years, counted from the date the record was created or last in effect, whichever is later.
Who has to be trained? Everyone in your workforce, including employees, volunteers, trainees, and others under your direct control, to the extent needed for their jobs.
Do I need to train business associates? Business associates are responsible for training their own workforce. You're responsible for having a business associate agreement in place.
See how Learnly automates
enrollments, re-certification reminders, and audit logs for HIPAA training
Start FreeTo Conclude
HIPAA training isn't glamorous, but it's one of the few compliance areas where the work you do ahead of time decides how an audit goes. The rules tell you what to do. Your program defines how you do it and how you prove it.
Organizations that get this right treat training records like clinical documentation: structured, role-specific, timestamped, and easy to search. Learnly is built for recurring, evidence-heavy training where the audit trail matters as much as the certificate.
){kind=link}