Security Awareness and Training 45 CFR 164.308(a)(5)
HIPAA Security Awareness and Training is required for every workforce member, including providers, leadership, and contractors. Generic annual videos do not meet the standard - training must be mapped to the practice's actual risks.
What the regulation requires
Four addressable implementation specifications make this an ongoing program rather than a once-a-year click-through. The training program must be documented, evidence retained six years, and the content updated as risks change.
Implementation specifications
Security Reminders
Periodic security updates - phishing alerts, policy refreshers, threat briefings - delivered to the workforce throughout the year. (164.308(a)(5)(ii)(A))
Protection from Malicious Software
Procedures for guarding against, detecting, and reporting malicious software, including ransomware. (164.308(a)(5)(ii)(B))
Log-in Monitoring
Procedures for monitoring log-in attempts and reporting discrepancies. (164.308(a)(5)(ii)(C))
Password Management
Procedures for creating, changing, and safeguarding passwords. Modern guidance follows NIST SP 800-63B - long passphrases, no forced rotation absent compromise. (164.308(a)(5)(ii)(D))
How Petronella implements this safeguard
Every Petronella HIPAA engagement maps 45 CFR 164.308(a)(5)(i) to documented evidence in your environment. This is what that looks like in practice for the security awareness and training standard:
- Role-based training tied to the risks identified in your Risk Analysis: front desk gets phishing and BAA awareness, providers get mobile device and AI-tool guidance, IT gets log-in monitoring procedures.
- Monthly phishing simulations with reporting on click rates, repeat clickers, and remediation training.
- Threat briefings within 24 hours of OCR alerts, HHS HC3 advisories, or relevant CISA advisories.
- Completion tracking, automated reminders, and six-year retention through ComplianceArmor.
Built on top of ComplianceArmor for documentation, training records, and BAA inventory, with optional HIPAA managed IT services for the technical safeguard layer and vCISO services for the named Security Official role.
Where most practices fall short
OCR resolution agreements, HHS audit reports, and our own engagements show the same handful of gaps under 45 CFR 164.308(a)(5)(i). We surface these before they become a finding.
- Annual generic video with a quiz but no role-based content (cited in the $5 million Anthem settlement and the $475,000 Presence Health settlement).
- Training records do not survive the six-year retention requirement under 164.316(b)(2)(i).
- Leadership and providers exempt from the same training the front desk takes.
- No re-training when a workforce member is involved in an incident or fails a phishing simulation.
Related HIPAA safeguards
Security Awareness and Training interacts with several other Security Rule standards. Cover them together for a defensible program.
Need help with Security Awareness and Training?
Penny answers before the third ring, asks 3 qualifying questions, then books your free 15. Or jump straight to the platform that runs your HIPAA program.