HIPAA for small clinics
Menu
Free risk assessment Policy kit & pricing Staff training preview Guides Sign in

← All guides

Guide · 2 min read

Does my clinic need HIPAA training every year?

What HIPAA actually requires for workforce training, why annual training is the standard, and how to document it so it holds up in an audit.

Does my clinic need HIPAA training every year?

Short answer: HIPAA requires you to train your workforce and to document it. The rule itself doesn't print the word "annual," but yearly training has become the expected standard, and it's what auditors, payers and cyber insurers look for.

What the rules actually say

The Privacy Rule requires covered entities to train all workforce members on the practice's privacy policies:

  • New staff, within a reasonable time after they join
  • Existing staff, when policies change materially
  • With documentation that the training happened, kept for six years

The Security Rule requires a security awareness and training program for all workforce members, including periodic security reminders, protection from malicious software, login monitoring and password management.

"Workforce" means everyone: clinicians, front desk, billing, temps, students and volunteers.

Why "every year" became the standard

  • Threats change. Phishing and ransomware tactics evolve constantly, and last year's training doesn't cover this year's scams.
  • "Periodic" needs a number. Regulators, payer contracts, and cyber insurance applications commonly ask whether training is done at least annually.
  • People forget. A once-at-hire session years ago doesn't protect you today.

What counts as documentation

If it isn't written down, it didn't happen. Good training records show:

  • Each person's name
  • What the training covered
  • The date they completed it
  • Evidence they understood it, like a quiz score or certificate

A sign-in sheet from a lunch meeting is better than nothing. A dated certificate per person, plus a report you can download on demand, is much better.

What training should cover

At minimum: what PHI is, uses and disclosures, minimum necessary, patient rights, phishing and social engineering, passwords and MFA, device and mobile security, ransomware, remote work, and how to report incidents.

A training program that runs itself

Our staff training course covers all of this in six short videos, about an hour total. A 5-question quiz follows each module, every staff member gets an automatic certificate, and you get a manager dashboard with a downloadable completion report. You can watch the phishing module free first.

This article is general information, not legal advice.