Independent guide, not a government agency. We earn commissions on some links.
Is HIPAA training or certification required?
HHS says it does not certify any person or product as "HIPAA compliant," so there is no HIPAA certification from HHS. Training is a different matter. The Privacy Rule says a covered entity must train all members of its workforce and keep a record that the training was provided.
By State Cert GuideChecked against the sources listed below.
The steps, in order
Check who the rule covers
Start with HHS's list
Train the whole workforce
Fit it to each person's job
Train new hires and affected staff
Within a reasonable period of time
Keep a record
Show that the training was provided
Decision steps: check whether HHS counts your employer as covered, train every workforce member for their job, train new hires and staff affected by policy changes, and keep a record of the training.
What the rule says
Does the rule cover my employer?
HHS says a covered entity is a health care provider, a health plan or a health care clearinghouse. A provider counts only if it sends health data electronically in a transaction for which HHS has adopted a standard.
What if it is not covered?
HHS says an employer that is not a covered entity or business associate does not have to comply with the HIPAA Rules.
Who has to be trained?
A covered entity must train all members of its workforce on the policies and procedures the Privacy Rule requires for protected health information. The training fits what each person does in their job.
When does a new hire need it?
The rule says each new member of the workforce is trained within a reasonable period of time after joining.
What if policies change?
Workforce members whose roles are affected by a material change in the policies or procedures need training within a reasonable period of time after the change becomes effective.
Does the training have to be recorded?
Yes. A covered entity must keep a record that the training has been provided.
Does HHS certify anyone as HIPAA compliant?
No. HHS says it and OCR do not certify any persons or products as "HIPAA compliant."
Where people go wrong
- You buy a certificate because a seller says HHS requires it. HHS says it does not endorse private seminars.
- You train people but keep no record. The rule says the training must be documented.
- You train once and forget new hires and staff affected by policy changes.
Questions
Do I have to attend a particular seminar?
No. HHS says the Privacy Rule does not require you to attend any specific seminar.
Is there one standard HIPAA training program?
No. HHS says there is no single standardized program that could appropriately train employees of all entities.
Where can I find free training material?
HHS says all of OCR's materials are available free on its web site. HealthIT.gov also gives a beginner's overview of what the HIPAA Rules require, with links to security training games, risk assessment tools and other aids.
Your next step
Start with HHS's HIPAA training page. Then ask your employer what training your job needs.
Sources we read
- www.hhs.gov › index · read Nov 13, 2026
- www.hhs.gov › index · read Nov 13, 2026
- www.hhs.gov › index · read Nov 13, 2026
- www.hhs.gov › index · read Nov 13, 2026
Who publishes this guide
State Cert Guide is an independent guide to what each state requires. If a fact on this page is wrong, tell us and we fix it.