Platform feature

Employee Training

Role-based HIPAA training with per-person completion records, aligned to §164.308(a)(5) — not a universal video that never gets updated.

Administrative safeguards Physical safeguards Technical safeguards Privacy rule Breach notification

HIPAA training compliance is not a video. It is a dated record showing that each workforce member was trained to the content current at the time, with reasonable comprehension and a schedule that actually ran. Employee Training is that record, with role-based content underneath.

What it does

  • Assigns role-based modules: clinical, administrative, engineering, business associate, officer, and leadership.
  • Schedules at hire, after material change, and annually — all three triggers tracked.
  • Captures per-person completion with the content version acknowledged.
  • Reports completion by cohort, department, and role for board updates and OCR response.

How it maps to HIPAA

The feature implements §164.308(a)(5) (security awareness and training), §164.530(b) (Privacy Rule training), and feeds §164.316(b)(2) retention. The content-version capture also means a workforce member’s acknowledgement is tied to a specific version — the artefact OCR expects.

Where it fits

Employee Training is a Workforce module capability. For delivery help, see the Workforce Training service; for the free deck and records template, see the training template.

Questions

How often is training required?

§164.530(b) requires training 'as necessary and appropriate'. The practitioner standard is at hire, after a material change, and annually. The platform treats all three triggers as scheduled events.

Does it include phishing drills?

Not by default — that is Phishing Training. HIPAA training covers rule content, roles, and incident reporting; phishing training is the applied drill. Both ship separately so cadences do not collide.

See your compliance program in one place

A 20-minute walkthrough with a practitioner. No slides, no pressure.

Book a demo