Healthcare compliance guide

HIPAA Compliance Training: A Practical Guide for Healthcare Organizations

Understand workforce training, documentation, role-specific learning, and practical recordkeeping without treating a private course certificate as a government credential.

What the rules require

The HIPAA Privacy Rule requires a covered entity to train workforce members on the privacy policies and procedures that apply to their functions. It also requires training for new workforce members within a reasonable period after they join and when a material policy or procedure change affects their functions.

The Security Rule requires a security awareness and training program for all workforce members, including management. The rules do not create one universal annual-training interval; a recurring annual program may be an organization policy or a practical best practice.

What organizations should document

Organizations need a defensible record of required training and the surrounding HIPAA documentation. The Privacy Rule's documentation-retention rule is six years from creation or when the document was last in effect, whichever is later.

ClearComm Academy courses are educational training. A learner who completes the required course work and final assessment can receive a ClearComm Academy Certificate of Completion; it is not an HHS endorsement or a government compliance certification.

Primary sources

• 45 CFR § 164.530 — Administrative requirements — Privacy workforce training, documentation, and the six-year documentation-retention requirement.
• 45 CFR § 164.308 — Administrative safeguards — Security-official, risk-management, and security-awareness-and-training requirements.
• HHS HIPAA FAQ — Security Rule compliance certification — HHS explains that it does not endorse or recognize private Security Rule compliance certifications.

The interactive ClearComm Academy experience is loading. Continue to this page.