How often is HIPAA training required?
Updated October 16, 2026
45 CFR 164.530(b) requires covered entities to train each new workforce member within a reasonable period after joining, and affected members within a reasonable period after a material change in privacy policies. The rule does not specify an annual interval; the Security Rule separately requires an ongoing security awareness and training program.
What the Privacy Rule requires
Under 45 CFR 164.530(b)(1), a covered entity must train all members of its workforce on its policies and procedures with respect to protected health information, as necessary and appropriate for them to carry out their functions.
Section 164.530(b)(2)(i) sets the timing: training for each new member of the workforce within a reasonable period of time after the person joins, and training for each member whose functions are affected by a material change in the required policies or procedures, within a reasonable period of time after the change becomes effective. The rule does not define "reasonable period" in days.
Is annual HIPAA training required?
The Privacy Rule text does not require annual training. Its triggers are joining the workforce and material changes to policies or procedures.
Some organizations train annually as internal policy. That is a practice choice, not a fixed interval stated in the regulation.
Security awareness training
The Security Rule adds a separate standard. Under 45 CFR 164.308(a)(5)(i), a covered entity or business associate must implement a security awareness and training program for all members of its workforce, including management.
Section 164.308(a)(5)(ii) lists four addressable implementation specifications: security reminders (periodic security updates), protection from malicious software, log-in monitoring, and password management. The rule does not set a fixed frequency for this program.
Documentation and retention
Section 164.530(b)(2)(ii) requires the covered entity to document that training has been provided, as required by paragraph (j).
Under 164.530(j)(2), required documentation must be retained for six years from the date of its creation or the date when it last was in effect, whichever is later. This retention period applies to the training documentation required by 164.530(b)(2)(ii). Keeping dated training records with the content covered makes it possible to show when each workforce member was trained.
Sources
- 45 CFR 164.530 - Administrative requirements (training, documentation)
- 45 CFR 164.308 - Administrative safeguards (security awareness and training)