Security reminders and a one-time course: organize the whole program.
Separate training organization, supporting evidence, and legal requirements.
Think about the program around the course
A completed course can be part of a security-awareness program. It does not by itself explain how people receive reminders, understand reporting procedures, or find instruction when workflows change.
The HHS audit protocol addresses security awareness and training under the Security Rule. Security reminders, malicious software, login monitoring, and password management are addressable implementation specifications. Addressable does not mean optional: evaluate what is reasonable and appropriate and document relevant determinations.
An evidence checklist
| Program question | Evidence to organize |
|---|---|
| Who is covered? | Workforce scope and management inclusion |
| What is taught? | Versioned materials and relevant topics |
| How are reminders handled? | A documented process and examples |
| What has been completed? | Organized completion evidence |
| Who follows up? | Named program ownership |
Some of these are recommended evidence-organizing practices rather than separate universal legal requirements. The tool labels its categories so that recommendations are not mistaken for current law.
Avoid an unsupported annual deadline
The current Security Rule does not prescribe a universal annual course deadline. Annual refreshes may be a reasonable program recommendation, but recommendations, organizational commitments, and legal requirements should be kept distinct. HHS identifies the announced update as proposed; check the current rule before relying on a compliance interpretation.
Review without collecting private records
Use the readiness checker to review organization and known gaps. Do not enter staff rosters, patient examples, certificates, or incident narratives. A high readiness score is self-reported evidence organization, not a certificate of HIPAA compliance. Privacy Rule training and a complete HIPAA assessment are outside this tool's scope.
Sources & review
Put the explanation to work.
Use training readiness to explore your own assumptions.
Open the tool →