- Citation
45 CFR 164.308(a)(5)- Standard
- Security awareness and training, 164.308(a)(5)(i)
- Safeguard
- Administrative safeguards
- Type
- Standard, with four addressable specifications
What the rule says
Implement a security awareness and training program for all members of its workforce (including management).45 CFR 164.308(a)(5), as currently in force
In plain English: Teach everyone who works for you, including the owners, how to protect patient information and spot an attack, when they join and on an ongoing basis, and keep a record for each person.
What it means in practice
- Two rules apply. The Security Rule's standard above, with addressable specifications for security reminders, protection from malicious software, log-in monitoring and password management. And the Privacy Rule, 164.530(b), which requires training on your privacy policies within a reasonable period after someone joins and when policies materially change.
- Covers everyone: clinicians, front desk, billing, volunteers, students, management and owners.
- Is specific to your policies and your systems, not only a generic video.
- Is recorded per person, with dates, and the records are kept six years.
- Continues: reminders, phishing awareness, and a refresher on a schedule your policy states.
Teaching the whole herd to spot the crocodile. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- Training materials and the policies they cover.
- Completion records for each workforce member, with dates.
- Evidence of ongoing reminders or phishing simulations.
- Training for new hires within the period your policy sets.
Where entities get caught
Shen Smiles, $140,000, 2026: no formal HIPAA Privacy Rule training for staff. Westend Dental, $350,000 from the Indiana Attorney General, announced December 2024: no training among the findings.
Nearly every corrective action plan requires training within 30 to 90 days of OCR approving the materials and annually thereafter, with certification to OCR.
How to meet it at a small organization
Pick a short course that covers your actual policies, assign it at hire and annually, send a monthly reminder about phishing or passwords, and keep a spreadsheet or platform record per person. Owners and physicians take it too; OCR has noticed when they didn't.
Under the proposed Security Rule update
The proposal would require security awareness training within 30 days of joining and at least every 12 months, with written procedures and records. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: Training is assigned and tracked per person in the platform, reminders go out on the schedule your policy states, and the completion records are part of the documentation pack. Policy acknowledgments are captured in the same place.