Who must receive HIPAA training, when it is required, what topics to cover for different roles, how to deliver training that changes behavior and how to document it.
HIPAA’s training requirements apply to covered entities (health plans, clearinghouses and most healthcare providers) and, under the Security Rule, to business associates. Training must reach the whole workforce: employees, volunteers, trainees and other people whose work is under the organization’s direct control, whether or not they are paid. That includes front desk staff, schedulers, billing staff, caregivers, cleaners and maintenance staff who may see PHI, not only clinicians. See what is HIPAA compliance for the basics of who is covered.
To record clock-ins, breaks and overtime automatically, see EZTime time and attendance software.
| Role | Additional focus |
|---|---|
| Front desk and scheduling | Verifying identity, sign-in sheets, phone calls, leaving messages, visitors and family members |
| Clinical staff | Minimum necessary access in records, conversations in shared spaces, sharing with family |
| Billing and records | Disclosures to insurers, records requests, authorizations, accounting of disclosures |
| IT and administrators | Access controls, audit logs, risk analysis, device and backup management |
| Home care and field staff | PHI in homes and vehicles, mobile devices, paper notes, conversations in public |
| Managers | Responding to incidents, applying sanctions consistently, onboarding and offboarding access |
Many organizations treat HIPAA training as a yearly slide deck. Behavior changes more when training is short, specific and repeated:
Training plan complete.
Short, regular sessions are similar to toolbox talks in other industries. See also refresher training.
| Scenario | Expected response |
|---|---|
| A caller says they are a patient’s daughter and asks for test results | Verify identity and authority under your policy before sharing anything; when in doubt, take a message and involve the appropriate staff member |
| You notice a coworker looking up a celebrity patient’s record | Do not access it yourself; report it to the privacy officer as your policy requires |
| An email with lab results was sent to the wrong patient | Report it immediately as a possible breach so it can be assessed and handled within required timelines |
| A patient’s family member asks you about their relative’s condition in the parking lot | Do not discuss it there; follow your policy on sharing with family and move the conversation to an appropriate setting |
| Your phone with work email is lost | Report it at once so access can be disabled and the risk assessed |
| You receive an urgent email asking you to log in to view a shared file | Treat it as possible phishing; check the sender and report it rather than clicking |
Discuss why each answer is right. Scenarios stick in memory far better than lists of rules, and they reveal where staff are unsure.
For non-exempt employees, required HIPAA training is generally work time that must be paid, whether done in person, online or at home. Record it like other hours worked; it counts toward overtime.
Annual training is common practice, but the rules themselves say this:
The six-year rule is the one to plan for. Training sign-in sheets, slide versions and quiz results from this year should still be retrievable six years from now, so store them somewhere that survives staff changes and software switches.
Covered entities must document that training was provided, and HIPAA requires required documentation to be kept for six years from its creation or the date it was last in effect, whichever is later. For each session, record:
A training attendance sheet works for group sessions, and a training record template tracks each person’s history.
| When | Activity |
|---|---|
| On hire | Core HIPAA training plus role-specific module before PHI access; signed acknowledgment of policies |
| Monthly | Short security reminder or scenario discussion at team meetings |
| Quarterly | Phishing awareness exercise or update on recent incidents and lessons |
| Annually | Refresher on core topics; review of policy changes; updated acknowledgments |
| After changes or incidents | Targeted training on the change or gap |
EZTime is a workforce management tool and is not designed to store patient information. It can help with the logistics of training: scheduling sessions, sending reminders through announcements with read confirmations, collecting signed policy acknowledgments with e-signatures and storing certificates in each employee’s digital file with expiry reminders. Keep patient information out of workforce tools.
Yes. Covered entities must train all workforce members on their HIPAA policies and procedures as needed for their roles, and the Security Rule requires a security awareness and training program.
HIPAA requires training for new workforce members within a reasonable time and when policies materially change. Annual refresher training is standard practice and helps meet ongoing security awareness requirements.
All workforce members of covered entities, including employees, volunteers and trainees, and the workforce of business associates under the Security Rule, including non-clinical staff who may encounter PHI.
HIPAA requires required documentation, including training records, to be kept for six years from creation or the date it was last in effect, whichever is later.
Non-exempt employees generally must be paid for required training time, including online training completed at home, and it counts toward overtime.
Volunteers and trainees are part of the workforce under HIPAA, along with others whose conduct is under the organization’s direct control, paid or not, so they need training. Outside vendors that handle PHI are business associates and are responsible for training their own staff under their agreements.
It can cover the general rules, but HIPAA training should also cover your own policies and procedures: who to report incidents to, how your systems handle passwords and how your front desk handles phone calls. Add a short site-specific session to any generic course.
EZTime schedules training sessions as shifts and records attendance, while patient data stays in your clinical systems.