Home care and home health training requirements

A Medicare-certified home health agency must train to 6 federal rules: 42 CFR 484.80 (aide competency, and at least 12 hours of in-service training in each 12-month period), 42 CFR 484.102 (emergency preparedness), 42 CFR 484.70 (infection control), OSHA's bloodborne pathogens and hazard communication standards (29 CFR 1910.1030 and 29 CFR 1910.1200) and, as a covered entity, HIPAA's workforce training rule, 45 CFR 164.530(b)¹²³⁴⁵⁶. The 42 CFR 484 rules bind Medicare-certified home health agencies only¹²³. A state-licensed, non-medical home care agency answers to OSHA and to its state license, and to HIPAA's workforce training rule only if it is a covered entity⁴⁵⁶.

4 of these rules name the agency's own documents as the subject of the training: 45 CFR 164.530(b)(1) (training on a covered entity's HIPAA policies and procedures), 29 CFR 1910.1030 (an explanation of your exposure control plan), 29 CFR 1910.1200(h) (the details of your hazard communication program) and 42 CFR 484.102 (initial training in your emergency preparedness policies and procedures)⁶⁷⁸⁹. 42 CFR 484.70 prescribes no curriculum at all, so a home health agency's infection control policy is the curriculum³. The federal rules are the floor; your state may require more.

What does each rule require, and who does it bind?

Each federal requirement takes one row below. Before you read across, read down the How often column: most rows do not run on an annual clock.

The 6 federal rules, in 7 rows. Your state license may add others.

Why is a home care agency's list different from a home health agency's?

A home care agency's list is different because 42 CFR 484 binds only Medicare-certified home health agencies¹. A state-licensed, non-medical home care agency sits outside 42 CFR 484, and its aide training rules come from its state licensing law¹.

OSHA binds both businesses the same way; it does not look at Medicare status. 29 CFR 1910.1030 covers every employee with occupational exposure to blood or other potentially infectious materials, and 29 CFR 1910.1200 applies wherever covered chemicals are present, in home care and home health alike⁴⁵.

The HIPAA Privacy Rule's training standard, 45 CFR 164.530(b), binds covered entities⁶. A Medicare-certified home health agency almost always is one; a private-pay home care agency often is not, unless it conducts electronic HIPAA transactions such as Medicaid billing⁶. Acting as a business associate does not make an agency a covered entity⁶.

Your state may require more under its licensing law. If your state runs its own OSHA-approved State Plan, check that plan as well; each State Plan must be at least as effective as federal OSHA¹⁰.

What does each rule actually require you to train on?

Each rule sets its own subject, and 4 of them name the agency's own documents as that subject⁶⁷⁸⁹.

42 CFR 484.80(d): the 12-hour in-service (home health)

42 CFR 484.80(d) requires every home health aide to receive at least 12 hours of in-service training in each 12-month period, supervised by a registered nurse and documented¹. That is the federal floor for a Medicare-certified home health agency; your state may require more. In-service training requirements for home health agencies covers what the agency has to deliver and record.

42 CFR 484.80(b) and (c): competency evaluation (home health)

42 CFR 484.80 requires a registered nurse to evaluate a home health aide's competency, and certain listed skills, such as transfers and positioning, must be observed with a patient or pseudo-patient, not tested on paper¹. A course can teach the classroom content, and no course replaces the observed part¹. Competency evaluation requirements for home health agencies covers who may run the evaluation and which skills must be observed.

42 CFR 484.102: emergency preparedness (home health)

42 CFR 484.102(d)(1) requires initial training in the agency's emergency preparedness policies and procedures for all new and existing staff, individuals providing services under arrangement and volunteers, then training at least every 2 years, not every year²⁹. The training must be documented, and the agency must demonstrate staff knowledge of emergency procedures⁹. The 2-year cycle replaced an annual one in 2019².

42 CFR 484.70: infection control (home health)

42 CFR 484.70 requires a home health agency to provide infection control education to staff, patients and caregivers, and sets no frequency and no hour count³. The agency's own infection control policy sets the content and the cadence³. If your policy is silent on cadence, so is the rule.

29 CFR 1910.1030(g)(2): bloodborne pathogens (home care and home health)

29 CFR 1910.1030(g)(2) requires training at assignment, then within 1 year of the previous training, for every employee with occupational exposure in home care or home health; the clock is a rolling anniversary, not a calendar-year reset⁴. The training must include an explanation of the employer's exposure control plan and a chance to ask questions of a trainer who knows the subject as it relates to the workplace⁷. Bloodborne pathogens training for home health agencies covers the rolling anniversary and what a session has to include.

29 CFR 1910.1200(h): hazard communication (home care and home health)

29 CFR 1910.1200(h) requires training at initial assignment and whenever a new chemical hazard is introduced, not on an annual clock⁵⁸. The training must cover the details of the hazard communication program the employer developed⁸.

Under the 2024 amendment, employers must, as necessary, update the hazard communication program and give additional training on newly identified hazards by 20 November 2026 for substances and 19 May 2028 for mixtures. An OSHA notice of 15 January 2026 moved the substances date from 20 July 2026⁵. The OSHA HazCom retraining deadline covers what has to be done by 20 November 2026.

45 CFR 164.530(b)(1): HIPAA workforce training (covered entities)

45 CFR 164.530(b)(1) requires a covered entity to train its workforce on its own HIPAA policies and procedures⁶. Under 45 CFR 164.530(b)(2), a covered entity trains each new workforce member within a reasonable period after joining, and each member affected by a material policy change within a reasonable period after the change takes effect. The rule does not say how long a reasonable period is. 45 CFR 164.530(b) sets no annual cadence, and training documentation is kept 6 years under 45 CFR 164.530(j)⁶.

A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.

45 CFR 164.530(b)(1)⁶

HIPAA training requirements for home care agencies starts with whether your agency is a covered entity, then covers the training rule.

Which of these can a catalog course cover?

A catalog course can supply the full content for 1 of the 7 rows, a home health agency's 12-hour in-service under 42 CFR 484.80(d); the other 6 also need the agency's own plan, program or policies, or a skill a registered nurse observes¹²³⁴⁵⁶. 42 CFR 484.80(d)(1) lets any organization offer the in-service, provided a registered nurse supervises it, and the agency keeps the documentation¹.

Catalogs are priced by seat count, as CareAcademy's plans are¹¹, or by hours, as Nevvon's are¹², and they do not contain an agency's own policies. CareAcademy's Complete plan includes tools to upload your own content, so a policy course can sit on a catalog platform, but someone still has to write that course¹¹.

You can also run both: a catalog for the generic content, and your own courses for the training the rules tie to your documents. What compliance training costs does the arithmetic on a subscription against a one-time build, and who builds custom compliance training from your policies sorts the people who can write those courses by type.

How to do it yourself

An administrator and the registered nurse who supervises training can turn the tables above into your agency's own training map in an afternoon. Plan on 3 to 5 hours of office time, more if nobody is sure which version of a policy is in force.

The free tools:

• The rule text. 42 CFR 484.80, 484.102 and 484.70 and 45 CFR 164.530 on eCFR, and 29 CFR 1910.1030 and 1910.1200 on osha.gov¹²³⁶⁴⁵.
• OSHA's State Plans page, if your state runs its own plan¹⁰.
• Your own documents: the current signed version of every policy, including the exposure control plan, the hazard communication program, the emergency preparedness plan, the infection control policy and the HIPAA policies, where each applies to you.
• A spreadsheet with 7 columns: rule, applies (yes or no), policy and version, content source, cadence, record, owner.

The steps:

1. List the rules that bind you. Start from the first table. A Medicare-certified home health agency carries all 7 rows¹²³. A state-licensed, non-medical home care agency carries the bloodborne pathogens row for staff with occupational exposure, the hazard communication row where covered chemicals are present, and the HIPAA row only if it is a covered entity⁴⁵⁶. Add your state's licensing rules as rows of their own; this page does not list them.
2. Map each row to the policy that implements it. 29 CFR 1910.1030 points at your exposure control plan, 29 CFR 1910.1200(h) at your hazard communication program, 42 CFR 484.102 at your emergency preparedness policies and procedures, 45 CFR 164.530(b)(1) at your HIPAA policies and 42 CFR 484.70 at your infection control policy⁷⁸⁹⁶³. Write down which version of each policy is in force and its date. Expect a snag here: a binder copy and a shared drive copy that disagree, which you settle before the row counts, or a row with no document behind it, which you mark; a lesson cannot explain a document that does not exist.
3. Decide catalog or own content, row by row. Use the catalog table. A catalog can carry all of the 12-hour in-service; the emergency preparedness, infection control, bloodborne pathogens and hazard communication rows need general content plus a lesson on your own document; the HIPAA row is your own policies; and the competency skills need a registered nurse's observation, not a course¹⁶.
4. Set the cadence per row. Copy the How often column, then check your own policies and state license for anything stricter. 3 rows trip people: bloodborne pathogens runs from each person's last training, not a calendar year⁴; emergency preparedness is at least every 2 years, not every year²; and hazard communication and HIPAA fall due on events, a new hazard or a material policy change, so name the person who watches for them⁵⁶. Put 20 November 2026 and 19 May 2028 on the calendar for the hazard communication updates⁵.
5. Pick the record you will show a surveyor or inspector. For each row, name the record and where it lives: who was trained, on what, on which date, by whom, and on which version of the policy. 42 CFR 484.80(d) and 42 CFR 484.102(d)(1) require the training to be documented; bloodborne pathogens training records are kept 3 years and HIPAA training documentation 6 years¹⁹⁴⁶. Where a rule names no record, keep one anyway.

These times are working estimates for one agency, not figures from any rule.

The map is the plan; writing the own-content lessons it calls for is the larger job. Have your RN check each script and quiz against the policy text, and for bloodborne pathogens, give staff a knowledgeable trainer they can question⁷. The Chapman Alliance's 2010 study of 249 organizations found that 1 finished hour of basic eLearning took 49 to 125 hours to build, 79 on average¹³. No study of the same size has replaced the 2010 figures in the sources checked for this page, so read them as a rough guide, not a measure of today's tools.

The 3 mistakes that cost the most

1. Training to the wrong list. 42 CFR 484 binds Medicare-certified home health agencies only, so a non-medical home care agency that trains to it can still miss what its state license requires¹. The federal numbers are a floor, and your state may require more.
2. Buying a catalog for a row whose subject is your own document. A general course cannot give "an explanation of the employer's exposure control plan" or teach your HIPAA policies, and no online course replaces the registered nurse's observation in a competency evaluation⁷⁶¹.
3. Putting every row on one annual date. Bloodborne pathogens runs on a rolling anniversary per person, emergency preparedness every 2 years, and hazard communication and HIPAA on events⁴²⁵⁶. One annual date misses the training that events trigger and can spend paid hours where the rule asks for less.

Questions people also ask

Is HIPAA training required every year? No. 45 CFR 164.530(b) sets no annual cadence: a covered entity trains each new workforce member within a reasonable period after joining, and each member affected by a material policy change, and keeps the training documentation 6 years⁶. Your own policy may set a stricter cadence.

Can an online course replace the home health aide competency evaluation? No. Under 42 CFR 484.80(c), a registered nurse must observe certain listed skills with a patient or pseudo-patient, so a course can teach the classroom content but cannot stand in for the observation¹.

Which of these rules apply to a home care agency that is not Medicare-certified? OSHA's bloodborne pathogens and hazard communication standards apply to home care as they do to home health, for staff with occupational exposure and where covered chemicals are present⁴⁵. 42 CFR 484 does not apply. HIPAA's workforce training rule, 45 CFR 164.530(b), applies only if the agency is a covered entity⁶, and your state license may add its own training rules.

How often is emergency preparedness training required for a home health agency? Initial training for all new and existing staff, individuals providing services under arrangement and volunteers, then at least every 2 years under 42 CFR 484.102(d)(1)⁹. The 2-year cycle replaced an annual one in 2019².

Is bloodborne pathogens training annual? It falls at assignment, then within 1 year of the previous training, under 29 CFR 1910.1030(g)(2): a rolling anniversary, not a calendar-year reset⁴.