164.308(a)(5) Security awareness and training guide

What 164.308(a)(5) security awareness and training requires of a HIPAA organization

If you are the compliance lead or engineer who must prove that training happened, the short answer is this: 45 CFR 164.308(a)(5)(i) requires a security awareness and training program for all members of the workforce, including management. The standard does not ask you to hold a certificate. It asks you to run a program and to be able to show that the program exists, that it reaches every workforce member, and that people actually completed it. Records of completion, dated materials and approved plans are the evidence an OCR investigator or an independent assessor will ask for first.

The standard has four implementation specifications, and all four are addressable. Security reminders are periodic updates between formal sessions, such as notices about a new phishing campaign or a changed policy. Protection from malicious software covers the procedures for guarding against, detecting and reporting malware, which means staff must be taught what to report as well as what the endpoint tools do. Log-in monitoring covers procedures for watching log-in attempts and reporting discrepancies, such as repeated failures. Password management covers how passwords are created, changed and safeguarded. Because these are addressable, you must decide whether each one is reasonable and appropriate for your environment, document the decision, and adopt an equivalent measure where you decline it. Your risk analysis is the document that justifies those choices.

There is no HIPAA certification. HHS states that no Security Rule standard requires certifying compliance and that it does not endorse or recognize private certifications, so a vendor's training badge does not prove your program meets the rule. Training is also hard to prove without records, because it is an activity that leaves no technical trace unless you keep one. Civil money penalties for violations are inflation-adjusted, and for penalties assessed on or after January 28, 2026, they range from $145 per violation (no knowledge) to $2,190,294 per violation (uncorrected willful neglect), with a calendar-year cap of $2,190,294 (45 CFR 102.3). The proposed January 2025 rule would add a specific requirement to train each workforce member by the compliance date and at least once every 12 months afterward. That change was proposed, not finalized, so confirm its status before you design the schedule around it.

Which workforce members and systems the security awareness and training program must cover

The training standard applies to the whole workforce, but the practical scope depends on who touches ePHI and where it lives. Each card below names one scoping decision, what drives it, and what to confirm before the program is designed.

Whole workforce, including management

The standard reaches every member of the workforce, and it expressly includes management, so executives and board-level staff who never open a clinical record still fall in scope. Scope is defined by role relationship to the entity, not by job title or seniority. Confirm with counsel how the entity defines workforce under its own policies, and record that definition so an assessor can trace who was trained and why.

Contractors and temporary staff

Contractors, temporary staff, and trainees are commonly in scope when they work under the entity's direct control and touch ePHI systems or physical locations. Whether a person is workforce or a separate party depends on the control relationship, so the answer can differ between a contracted developer on the EHR and a vendor technician on a single visit. Confirm the classification for each category in the risk analysis and in contracts that set training duties.

Systems and accounts where addressable specifications apply

The four addressable specifications (security reminders, malware protection, log-in monitoring and password management) attach to systems and accounts that hold or access ePHI. Scope them to the EHR, email, remote access, and shared administrative accounts identified in the risk analysis. Confirm which systems the entity has inventoried and whether the training content names the platforms staff actually use.

Workstations, devices and physical locations

Malware and password lessons only work when they reach the people using endpoints and the places where ePHI is viewed. Include staff who use shared workstations, mobile devices, and clinical areas where screens are visible to the public. Confirm with the risk analysis which devices and locations carry ePHI and whether reminders reach users who work off-network.

Business associate staff and subcontractors

Business associates and their subcontractors must comply with the Security Rule for their own workforce, so their staff are generally trained under the vendor's program, not the covered entity's. The covered entity's question is whether its contracts require and evidence that training. Confirm the business associate agreement terms and request the vendor's training records or attestations rather than assuming coverage.

Trainees and students with system access

Trainees, students, and residents who access ePHI systems or care areas may be workforce members even when they are not paid employees. Their scope follows the same control relationship test as contractors. Confirm the entity's policy for onboarding these groups, including whether they receive the same training content and reminders before they gain access.

How to build a security awareness and training program from needs assessment to evaluation

This sequence, drawn from the key activities NIST SP 800-66 Rev. 2 describes for this standard, turns the risk analysis into a workforce training program that is documented, delivered, reminded and evaluated. Each step ends with a record you can show an assessor.

Conduct the training needs assessment
Start from your risk analysis and identify which threats and vulnerabilities involve workforce behavior, such as phishing, credential sharing, mishandling of ePHI and unreported malware. Your security official leads this work with input from HR, clinical and operational managers, and IT. The output is a needs assessment that lists each audience (including management), the risks it addresses, and the knowledge gaps behind them. Confirm that the list is traceable to specific risk analysis entries so the link is visible to an assessor.
Develop and approve the training strategy and plan
Translate the needs assessment into a written strategy that sets which topics each audience receives, how often, and who owns delivery and records. Management approval matters here because the standard covers the whole workforce, including management. The output is an approved training plan with a version date, owners and a scope statement that names the systems and workforce roles it covers. Keep the approval record with the policy set required by 164.316.
Develop content and delivery methods
Build or source training materials for each audience, covering the awareness topics your needs assessment identified. Choose delivery methods that can produce evidence, such as a learning management system that records who completed each module and when. Where you use open-source tools, such as Moodle, confirm how its activity completion settings define completion, because a learner can be marked complete by viewing, by receiving a grade, or by a manual tick. The output is an approved content set with a completion rule for every module.
Implement training for the whole workforce
Deliver the approved content to every workforce member, including new hires, contractors who qualify as workforce, and managers, before or as they gain access to ePHI where your plan requires it. Track attendance and assessment results against the roster from your access management records. The output is a set of completion records that match the workforce list, with exceptions followed up and documented. Ask your auditor which records they expect to see for a sample of staff.
Write security reminders into the program
Security reminders are an addressable specification, so decide how your program delivers them between formal sessions, such as notices about new threats, phishing examples or policy changes. Write a reminder calendar that names the topic, the channel and the owner for each reminder. Also write in how the other three addressable specifications, protection from malicious software, log-in monitoring and password management, are taught and enforced. For any one you decide is not reasonable and appropriate, document the reason in your risk analysis and implement an equivalent alternative measure. The output is a reminder calendar and an addressable specification record for each of the four items.
Monitor and evaluate the training plan
Measure whether the program works by comparing completion rates, assessment results and reported incidents against the plan. Review whether the topics still match the current risk analysis and any changes to systems, workflows or threats. Feed gaps back into the needs assessment and update the plan and content under version control. The output is a dated evaluation record that lists findings, decisions and changes made. Under 164.308(a)(8), periodic evaluation of your security program is a separate obligation, so align this review with that cycle.

How an assessor tests security awareness and training

This table walks through the steps an assessor takes when reviewing 164.308(a)(5), what each step asks for, the evidence usually requested, and the findings that come up most often. Read it as a checklist for your own readiness review, since OCR's audits and complaint investigations test the same points. The main takeaway is that a training program is judged by whether the written plan, the completion records and the evaluation history agree with one another.

Test step	What the assessor asks for	Evidence requested	Common findings
Review the written training plan against the risk analysis	Whether the training plan reflects threats and workforce roles identified in the current risk analysis, and whether a training needs assessment was done	Training needs assessment, approved training strategy and plan, risk analysis summary showing human-related threats	Plan is generic, predates the latest risk analysis, or was never formally approved
Confirm the program covers the whole workforce, including management	Whether every workforce category, including executives, contractors with ePHI access and part-time staff, is in scope	Workforce roster by role, scope statement, role-based training assignments	Management or contractors excluded without documented reasoning
Sample workforce members, including management and recent hires	Whether sampled individuals completed training, and whether the timing fits their start date and access grant	Completion records matched to HR and access provisioning records for a selected sample	Recent hires with access before training, or completion records that cannot be tied to a named person
Check the content and delivery methods	Whether the content addresses the organization's actual systems and PHI handling, and whether delivery methods suit the audience	Training materials, slide decks or LMS course content, version history, quiz or attestation records	Content is an outdated template or does not mention the organization's own systems
Check that security reminders are delivered between formal sessions	Whether periodic reminders are sent, what they cover and whether they reach the whole workforce	Dated reminder notices, distribution lists, intranet or email archives, reminder calendar	Reminders sent once at onboarding and never repeated, or no record of delivery
Test protection from malicious software training and procedures	Whether staff are taught to recognize, avoid and report malware, and whether the procedure is documented	Malware training module, reporting procedure, phishing simulation results and follow-up actions	Procedure exists in policy but staff are never taught how to report suspected malware
Test log-in monitoring training and procedures	Whether staff know how to report failed log-ins or suspicious access, and whether monitoring procedures are documented	Log-in monitoring procedure, training content on reporting, sample reports raised by staff or generated by monitoring	No link between log-in monitoring alerts and the people who must act on them
Test password management training and procedures	Whether password creation, change and safeguarding rules are taught and match the password procedure in the risk analysis	Password procedure, training content, policy version history, evidence of password manager or MFA guidance	Password rules in policy differ from what staff are taught, or procedures set no basis for the chosen rules
Check evaluation and updates to the program	Whether the plan was evaluated after incidents or changes and updated to address what was learned	Evaluation reports, post-incident training reviews, change log for the training plan, management sign-off	No evaluation on record, or updates that do not follow incidents or new risks

Evidence that passes for security awareness and training

An assessor testing 164.308(a)(5) looks for a program that was planned, delivered and measured, with records that show who was trained, when, on what content and with what results. The cards below cover the artifacts that carry that story and the upkeep needed to keep them defensible between reviews.

Approved training plan and strategy

This is the document that sets the program's scope, audience, frequency and owners, and it should trace back to a training needs assessment. Check that it names management as a covered group, because the standard reaches the whole workforce including management. Confirm that a named person approved it, the approval date is recorded, and the plan is reviewed when the risk analysis or staffing changes.

Course content and version history

Assessors want to see what each workforce member was taught and whether the material matched current threats and policies at the time. Keep dated copies of every course, slide set, quiz and policy excerpt, with a change log showing what changed and why. A version history lets you show that a 2024 course was not presented as current guidance in a later year.

Completion records per person

A roster that shows each workforce member, the courses assigned, the completion date and the score is the core proof that training happened. Match the roster against HR and access records so that new hires, contractors and anyone with ePHI access appear. Flag gaps, such as staff who joined without completing training, and record how they were followed up.

Security reminder notices and distribution

Addressable reminders between formal sessions, such as alerts about phishing campaigns or policy changes, need both the message and proof it reached people. Keep a copy of each notice, the date sent, the distribution list and any acknowledgment or read data. Record the decision on how often reminders go out, linked to your risk analysis.

Malware and password guidance records

Training on malicious software and password management is addressable, so the record should show either the guidance delivered or the documented reason for an equivalent measure. Keep the guidance text, the audience, the delivery date and the quiz or attestation results. Check that the password guidance matches the password practices your risk analysis set, since the current rule does not fix a length or rotation interval.

Log-in monitoring procedures and sample reports

Log-in monitoring needs a written procedure for reviewing failed log-ins and reporting discrepancies, plus samples showing the review happened. Keep sample reports from your identity platform or logs, the reviewer's sign-off and the tickets raised from anything found. Confirm that the reports cover the systems holding ePHI, not only the central directory.

Evaluation and effectiveness records

Training should be measured, and the records should show that results fed back into the plan. Keep test results, phishing simulation outcomes, incident trends linked to training topics and the decisions made after each review. These records also support the periodic evaluation required under 164.308(a)(8).

Moodle completion rules must match the evidence

If you use Moodle, activity completion can mark an activity complete when a learner views it, when they receive a grade, or when they tick it manually, depending on the conditions you set. Choose the condition that proves comprehension for each course, such as a passing grade, rather than a page view alone. Export completion reports on a schedule so the proof outlives the platform configuration.

Keeping evidence current between audits

The Security Rule's documentation standard requires that policies, plans and records be kept for six years from creation or last effective date, and be available to the people who need them. Set a retention schedule that covers training plans, rosters and notices, and assign an owner to review and update them when content or staffing changes. Confirm retention with counsel, since state law or contracts may require longer.

What meeting the training requirement costs in money and effort

This table lists each cost component of a 164.308(a)(5) program, who is paid for it, whether it is one-time or recurring, and what moves it up or down. No fee or duration is supplied for any component, so use the table as a checklist for requesting written scope and quotes from vendors and partners. Most of the recurring cost is staff time, not software.

Cost component	One-time or recurring	What drives it	How to keep it down
Training needs assessment and plan	One-time, then repeated when the risk analysis changes	Size and roles of the workforce, number of systems that handle ePHI, and how varied job functions are	Reuse the risk analysis inputs, and scope the assessment to roles that actually touch ePHI
Content development or licensing	Mostly one-time, with updates recurring	Whether content is written in-house, bought as off-the-shelf modules, or adapted to your policies and workflows	Adapt existing material to your own policies, and update only the modules affected by policy or threat changes
Learning platform: licenses or self-hosted hosting	Recurring (licenses or hosting and maintenance)	Per-user license terms for commercial platforms, or server, storage, backup and upgrade effort for self-hosted open-source platforms such as Moodle	Self-hosted open source removes license spend but not staff time for installation, patching, backups and upgrades. Ask for the hosting and support model in writing
Staff time for delivery and reminders	Recurring	Number of workforce members, delivery frequency, time for management and new hires, and the number of security reminder notices	Use short modules tied to real incidents, and schedule reminders through channels staff already use
Monitoring log-in and malware events	Recurring	Log volume, alert rules, tuning of log-in monitoring and malware detection, and who triages alerts	Tune alert thresholds with the risk analysis, and route only reportable events to the people who must act
Evidence upkeep	Recurring	Completion records, attendance and sign-off, training content versions, and retention of records for the period the rule requires	Automate completion tracking in the learning platform, and keep a single dated record for each module version
Evaluation of the training plan	Recurring, usually tied to the evaluation standard in 164.308(a)(8)	Method used to test learning, such as quizzes or phishing exercises, and the review cycle set by management	Combine training evaluation with the periodic evaluation already required, and use results to revise content
External review or third-party assessment	Optional, one-time or periodic	Scope agreed in writing, sample size, depth of testing, and whether the reviewer issues a report	Define the review scope before engaging. An outside reviewer can test your evidence, but it cannot certify HIPAA compliance
Proposed 12-month training cycle	Recurring if the 2025 proposal is finalized	Annual retraining for every workforce member under the proposed rule (90 FR 898, not final as of October 2026)	Plan annual cycles now so that a final rule does not require a new program design

Who owns the training program, who can help build it, and what the auditor tests

Your organization owns the training program. The security official named under 164.308(a)(2) is accountable for the Security Rule policies that training supports, and workforce owners such as HR, clinical leaders and department heads decide who must train and when. Management is in scope of the standard, so executives need to be assigned to the program like everyone else. Your team also owns the sign-off on evaluations under 164.308(a)(8), where the program is judged against the rule and against changes in the environment.

Approving content: the security official reviews and signs off training material so it matches your written policies and risk analysis.
Deciding who trains: HR and department owners maintain the workforce roster that training records must match, including new hires, contractors and management.
Setting frequency and triggers: your team decides how often training runs and which events, such as a new system or a phishing campaign, prompt extra reminders.
Signing off evaluations: the security official approves the periodic review of whether training and reminders are working.
Keeping records: your team retains completion evidence, since documentation under 164.316 must be kept and available.

Confirm that a named owner exists for each of these decisions before any outside party starts work.

Where training programs fall short under OCR and assessor review

Most training gaps are not missing courses. They are disconnects: training that does not follow the risk analysis, records that cannot prove who was trained, and addressable decisions with no written reasoning. Each card below names one gap and the closing action that an OCR investigator or outside assessor would expect to see.

Training not tied to the risk analysis

Generic annual modules often cover topics the organization's own risk analysis never identified, while the paths ePHI actually takes go untouched. Under 164.308(a)(5), the content should reflect the threats and workflows found in the risk analysis. Check that each training topic traces to a documented risk, and that the training needs assessment is written down with its inputs.

Training records that cannot be matched to people

A completion percentage in a dashboard does not show that a named workforce member was trained. Assessors ask for the roster, the date each person completed training, and the version of the content they saw. Export records from the learning platform, reconcile them against the HR and access lists, and keep the reconciliation as evidence.

Management left out of the program

The standard expressly covers management, yet many programs train only frontline staff. Executives who approve access, sign off on the risk management plan and make funding decisions need the same awareness content, delivered in a form suited to their role. Confirm that leadership completion is tracked separately and that the training plan lists management as a named audience.

Security reminders that are not delivered or recorded

Reminders between formal sessions are addressable, but when the organization chooses to use them, it should be able to show what was sent, when, and to whom. Posters and ad hoc emails leave no trail. Set a reminder schedule, keep the sent messages with distribution lists, and log any reminder triggered by a new threat or policy change.

Malware and password guidance that exists only in policy

Policy text that says staff must not open suspicious attachments or must use strong passwords proves little if the technical controls and training content do not match it. Assessors look for the endpoint protection configuration, the password management settings and the training material that teaches recognition and reporting. Walk through each policy statement and confirm a control and a training item back it.

Addressable decisions without documented reasoning

Each of the four specifications in this standard is addressable, which means the entity must decide whether it is reasonable and appropriate and document the choice. Leaving one out without a written rationale, or without an equivalent measure, is a common finding. For each specification, record the decision, the risk analysis input behind it, and any alternative control adopted.

Security awareness training questions buyers ask before hiring outside help

How much effort does a HIPAA security awareness training program take?

The effort depends mostly on the size of the workforce, how many roles handle ePHI, how many systems and locations are in scope, and whether training content already exists. No effort figure is supplied for this work, so ask any provider to base its estimate on a written scope that lists these inputs. The program has several recurring parts: a training needs assessment, a written training strategy and plan, content and delivery methods, security reminders between sessions, and periodic evaluation of the plan. Each part repeats as staff, systems and threats change, so the effort is not a one-time event. Ask for the expected effort in each part and which parts are one-time and which recur.

How long does it take to build a security awareness training program?

No duration is supplied for this work, so no timeline can be stated from the research. The schedule is set by the fixed written scope agreed before work starts, which should name the deliverables, the systems and workforce groups covered, and the dates for each phase. Timing usually depends on how quickly the organization approves the training strategy, supplies role lists and existing policies, and schedules staff for sessions. Ask any provider to show milestones tied to those dependencies rather than a single end date.

What does the work need from our own staff?

Your staff own the program and provide the knowledge an outside party cannot supply on its own. Expect to name a responsible owner, provide job roles and access levels so training can be targeted, share current security policies and incident history, and approve the training plan and content. Your HR or learning team usually runs the learning platform and records completions, and managers confirm who must attend. Leadership must also attend training, because the standard covers management as well as the workforce. Write these responsibilities into the scope so both parties know who delivers each input and by when.

Can a small practice run HIPAA security awareness training by itself?

A small practice can often run the program itself, but it still has to meet every part of the standard. The organization must define its training needs, deliver training to all workforce members including management, send periodic reminders, cover malicious software and log-in monitoring, set password practices, and evaluate whether the program works. The main questions are whether someone has the time to maintain the plan and records and whether the content reflects the systems the practice actually uses. Many small practices choose outside help for the initial plan and content, then keep the recurring reminders and records in house. Ask a provider to split the work this way in the written scope.

Does a training completion report alone prove HIPAA compliance?

No. A completion report shows that people finished a course, but it does not show that the program is effective or that staff can recognize and report threats. The standard asks for a program that covers the whole workforce and is maintained over time, so assessors will also look at the training needs assessment, the approved plan, the content, reminder records, and evidence that the program was evaluated and improved. Evidence of reported phishing, password practices, or malware response can show whether the training changed behavior. Confirm with your assessor which evidence they expect before you rely on completion data.

Is there a HIPAA training certificate we can buy?

There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance and that it does not endorse or recognize private certifications, which also do not prevent HHS from later finding a violation. A provider may issue a course certificate for an individual, and that can be useful as a record of attendance. It does not show that your organization meets the Security Rule. Ask any vendor that offers a HIPAA certificate what it actually covers, and treat it as a training record rather than a compliance result.

How would an annual training requirement change the work if the proposed rule is finalized?

The January 2025 proposed rule would require training for each workforce member by the compliance date and at least once every 12 months after that. It was proposed, not final, and no final rule had been published as of October 2026, so the current rule's addressable wording still applies. If the proposal is finalized, the main change would be a fixed training cadence that must be tracked for every workforce member, including new hires and contractors. That would add recurring scheduling, tracking and records work. Ask any provider to price the recurring cycle separately from the initial build, and to show how the scope would change if the rule takes effect.

How DeployOpen works on this

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, including the training systems and records that support the security awareness and training standard. We prepare the systems and evidence; the organization owns its program, and an independent assessor is the party that tests it.

How we scope

Engagements are fixed-scope, with the training platform, audiences and deliverables agreed in writing before work starts.
The written scope names which of the four addressable specifications the platform will support, such as reminders, malware awareness, log-in monitoring and password guidance.
We confirm which workforce groups, including management, are in scope and where their training records will be kept.

How we build

We install and configure the learning platform in your cloud account, data center or air-gapped network, with access limited to your identity provider groups.
We build course content, completion rules and reporting views that show who completed each module and when.
We test completion tracking end to end, including how activity completion behaves for each course condition, before any workforce member uses it.

How we hand over

You receive documentation for the training plan, the platform configuration and the procedures for recording and retaining completion evidence.
We export sample completion reports and reminder logs so your security official and assessor can see what the evidence looks like.
Your staff are trained to run, update and report on the platform, and ownership of content and records stays with your organization.

How we support

Ongoing support, upgrades and content updates are available as a retainer after handover.
We can update training content when the risk analysis or threat landscape changes, and record each revision for the evaluation process.
Confirm with your assessor which evidence they expect, since only an independent auditor or certification body issues any report or certificate.