Is HIPAA Training Required?
Yes, for HIPAA covered entities. The Privacy Rule, 45 CFR 164.530(b), says a covered entity must train all members of its workforce on its policies and procedures for protected health information, as needed for their jobs. New workforce members must be trained within a reasonable time after they join. Staff whose jobs are affected by a material change in those policies must be retrained. There is no official government "HIPAA certification." HHS says it does not certify any persons or products as HIPAA compliant.
Updated October 24, 2026 · Checked against the official sources listed at the end
Who has to train
The Privacy Rule training standard applies to covered entities. Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a transaction covered by the HIPAA rules.
The duty covers the whole workforce. HIPAA defines workforce as employees, volunteers, trainees, and other persons whose work for a covered entity or business associate is under its direct control, whether or not they are paid. Students in a clinical setting may fall under trainees, so ask the site how it handles training for you.
What 164.530(b) requires
The standard reads: "A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity."
- Each new workforce member, within a reasonable period of time after joining (164.530(b)(2)(i)(B)).
- Each workforce member whose functions are affected by a material change in the policies or procedures, within a reasonable period after the change takes effect (164.530(b)(2)(i)(C)).
- The covered entity must document that the training was provided (164.530(b)(2)(ii)).
- Required documentation must be kept for six years from the date it was created or last in effect, whichever is later (164.530(j)(2)).
The Security Rule adds its own training
The HIPAA Security Rule, 45 CFR 164.308(a)(5), also requires a covered entity or business associate to implement a security awareness and training program for all members of its workforce, including management.
That standard lists four addressable implementation specifications: security reminders, protection from malicious software, log-in monitoring, and password management. Note that this one applies to business associates too.
In January 2025, HHS proposed changes to the Security Rule that would, among other things, require security awareness training at least once every 12 months. As of October 2026 that proposal is not final, so the current rule above still applies.
What the rule does not say
Section 164.530(b) does not set a fixed yearly schedule. Its timing is tied to joining the workforce and to material changes in policies. A covered entity can choose to train more often.
It also does not name a required course. HHS says the Privacy Rule does not require attendance at any specific seminars.
The training is about the covered entity's own policies and procedures. A general course can explain HIPAA, but only the covered entity can teach its own policies.
There is no official HIPAA certification
HHS warns about misleading marketing. It says HHS and its Office for Civil Rights do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."
Business associates cannot use a certificate in place of a contract either. HHS answers "No" to whether a business associate can self-certify or be certified by a third party instead of signing a contract. A covered entity must enter into a contract or other written arrangement that meets 45 CFR 164.504(e).
Where an online course fits
Pact sells the HIPAA course for $34.95. HIPAA is an online certification course from ProTrainings. Confirm with your program or clinical site that this course meets its requirements before you enroll. ProTrainings makes and runs the course; Pact sells it and handles your order. Buyers must be 18 or older.
If you are a covered entity, the training duty and the documentation are still yours, and your own policies must be part of the training.
Common questions
How often is HIPAA training required?
Section 164.530(b) requires training for each new workforce member within a reasonable time after joining, and for affected staff within a reasonable time after a material change in policies. It does not set a fixed annual schedule. A covered entity may choose to train more often.
Is there an official HIPAA certification?
No. HHS says it does not certify any persons or products as "HIPAA compliant" and does not endorse private education providers' materials.
Do volunteers and trainees need HIPAA training?
HIPAA's definition of workforce includes employees, volunteers, trainees and others under the covered entity's direct control, paid or not. The training standard covers all members of the workforce.
Do business associates have to train their staff?
The Security Rule, 45 CFR 164.308(a)(5), requires a covered entity or business associate to have a security awareness and training program for all workforce members, including management. The business associate contract may add more.
How long should HIPAA training records be kept?
The Privacy Rule requires documentation to be kept for six years from the date it was created or last in effect, whichever is later (164.530(j)(2)).
Will a HIPAA course meet my employer's or clinical site's requirement?
Ask them. Confirm with your program or clinical site that a course meets its requirements before you enroll.
Sources
- 45 CFR 164.530 Administrative requirements (HIPAA Privacy Rule)
- 45 CFR 160.103 Definitions
- 45 CFR 164.308 Administrative safeguards (HIPAA Security Rule)
- HHS: Be Aware of Misleading Marketing Claims
- HHS FAQ: Can business associates self-certify as HIPAA compliant?
- Federal Register, January 6, 2025: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule)