Is HIPAA training required annually for home care?

No. The HIPAA Privacy Rule sets no annual schedule: 45 CFR 164.530(b) requires a covered entity to train each new workforce member within a reasonable period after they join, and each member whose functions are affected within a reasonable period after a material change to its privacy policies, then document the training and keep the record 6 years.

45 CFR 164.530(b) binds covered entities only. A Medicare-certified home health agency is one; a non-medical home care agency is one only if it conducts HIPAA transactions electronically, such as Medicaid billing, which is why many private-pay home care agencies are not. Separately, the HIPAA Security Rule requires an ongoing security awareness and training program, and a January 2025 proposal that is not in force would put that training on a 12-month clock.

Is HIPAA training required every year?

No. 45 CFR 164.530(b) ties HIPAA privacy training to events, not to the calendar. The events are the covered entity's compliance date, a new person joining the workforce, and a material change in policy that affects a person's functions.

A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.

45 CFR 164.530(b)(1)

45 CFR 164.530(b)(2) sets the timing. A covered entity must train each new member "within a reasonable period of time after the person joins the covered entity's workforce". The covered entity must also train each member "whose functions are affected by a material change in the policies or procedures required by this subpart or subpart D of this part, within a reasonable period of time after the material change becomes effective".

HHS once proposed recertification every 3 years and dropped it in the preamble to the final Privacy Rule, published 28 December 2000. The same preamble says: "Retraining is only required in the case of material changes to the privacy policies and procedures of the covered entity."

A preamble explains a rule; it is not the rule, and this one dates from 2000. The text of 45 CFR 164.530, last amended in 2009, still sets no annual cycle.

That "no" covers the Privacy Rule only, not your security training. The HIPAA Security Rule, 45 CFR 164.308(a)(5), requires a standing security awareness and training program. A proposal HHS published in January 2025 would put that training on a 12-month clock.

Does 45 CFR 164.530(b) apply to your agency?

45 CFR 164.530(b) applies only to a HIPAA covered entity. A Medicare-certified home health agency is a covered entity; a non-medical home care agency is one only if it is a health care provider that conducts HIPAA transactions electronically.

Work through these 4 steps, taken from CMS's Covered Entity Decision Tool and the definitions in 45 CFR 160.103.

1. Are you a Medicare-certified home health agency? Then you are a covered entity, and 45 CFR 164.530(b) applies to your whole workforce.
2. Do you furnish, bill or get paid for health care in the normal course of business? This is the first of CMS's 2 questions for a provider. 45 CFR 160.103 defines health care to include preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, and counseling, service, assessment or procedure, with respect to an individual's physical or mental condition or functional status, or that affects the structure or function of the body. Whether non-medical personal care meets that definition is a question this page does not rule on.
3. Do you send any HIPAA standard transaction electronically, such as claims, eligibility checks, claim status inquiries or remittance? If you are a health care provider and the answer is yes, you are a covered entity: 45 CFR 160.103 covers "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter". CMS says: "If a healthcare provider uses another entity (such as a clearinghouse) to conduct covered transactions in electronic form on its behalf, the health care provider is considered to be conducting the transaction in electronic form." Medicaid billing is the common way a non-medical home care agency crosses this line.
4. If neither step 1 nor step 3 makes you a covered entity, 45 CFR 164.530(b) does not bind you. You may still be a business associate if you handle protected health information on a covered entity's behalf. A business associate is not a covered entity; 45 CFR 160.103 defines the two separately. A business associate's training duty comes from the HIPAA Security Rule and its contract, not from 164.530(b).

State privacy law may still reach an agency that HIPAA does not cover; check your state's rules.

When exactly does each person have to be trained?

Under 45 CFR 164.530(b), a covered entity trains each new workforce member, and each member whose functions a material policy change affects, "within a reasonable period of time" after the event. The covered entity then documents that it did. The table applies to covered entities only.

"Reasonable period" is the rule's own phrase, and 45 CFR 164.530(b) does not define it. Your agency's written policy turns that phrase into a number of days. The 2025 Security Rule proposal, not in force, would make it 30 days for security training.

A move to a new job inside the agency is not one of the rule's listed triggers in 45 CFR 164.530(b)(2). 45 CFR 164.530(b)(1) still requires training "as necessary and appropriate for the members of the workforce to carry out their functions". One reading of the rule is that an aide who becomes a scheduler needs the training the scheduler role requires.

What does the HIPAA Security Rule add?

The HIPAA Security Rule adds a standing program: 45 CFR 164.308(a)(5) requires a security awareness and training program for all members of the workforce, including management. If you are a business associate, this rule reaches you: under 45 CFR 164.302, the Security Rule binds covered entities and business associates alike.

One of that program's implementation specifications reads, in full: "Security reminders (Addressable). Periodic security updates."

Addressable does not mean optional. Under 45 CFR 164.306(d)(3), the agency assesses whether the item is reasonable and appropriate in its setting, and implements it if it is. If it is not, the agency documents why and implements an equivalent alternative where that is reasonable and appropriate.

The Security Rule does not define "periodic".

Why do agencies still train every year?

An annual HIPAA session has 4 sound reasons behind it, and 45 CFR 164.530(b) is not one of them.

1. Your own written policy. If your agency's HIPAA policy says training is annual, you have committed to it in writing.
2. The Security Rule's periodic updates. 45 CFR 164.308(a)(5) calls for periodic security updates, an addressable item, and a yearly session is one way to deliver them.
3. The proposed 12-month clock. A Security Rule proposal HHS published on 6 January 2025 would require training at least once every 12 months. As of 26 September 2026 it is still a proposed rule; HHS has published no final rule. The proposed 45 CFR 164.308(a)(11)(ii)(B) would require training "by no later than the compliance date, and at least once every 12 months thereafter". The proposal would add 30-day windows: new workforce members trained "no later than 30 days after the person first has access" to the agency's systems, and affected members trained "no later than 30 days after the material change occurs". Like the current Security Rule, the proposal would apply to covered entities and business associates. If the proposal is finalized as written, an agency already training every 12 months would need no change to its cycle.
4. Catching a material change. A yearly policy review helps an agency notice that a policy changed enough to trigger retraining under 45 CFR 164.530(b)(2)(i)(C). That link is an inference, not the rule's text.

Your state, your payer contracts or your accreditor may set a schedule of their own. Check each one before you change the calendar. The other training rules your agency works against are in the home care training requirements map.

How long do you keep HIPAA training records?

Keep a record that each training was provided, for 6 years from the date it was created or the date it was last in effect, whichever is later. 45 CFR 164.530(b)(2)(ii) requires the documentation, and 164.530(j)(2) sets the clock: "for six years from the date of its creation or the date when it last was in effect, whichever is later".

The Security Rule's documentation runs on the same 6-year clock, under 45 CFR 164.316(b)(2)(i).

The rule does not list the fields. A workable record for each person and session holds name, role, date, the version of the policy trained on, and the method (online lesson or classroom session). That list is practice, not the rule.

How do you train your staff on HIPAA yourself?

A privacy officer or administrator with the agency's policy manual can run HIPAA workforce training in house, using free material and staff already on payroll. For a first build from a short policy manual, plan on about a working week of office time; after that, the work is the new-hire lesson and the occasional retraining round.

The free tools:

• The rule text on Cornell's Legal Information Institute: 45 CFR 164.530 for the Privacy Rule, and 164.302, 164.306, 164.308 and 164.316 for the Security Rule.
• CMS's covered-entity material. The "Are You a Covered Entity?" page and the Covered Entity Decision Tool.
• HHS's own words. The 2000 preamble to the Privacy Rule, and the January 2025 Security Rule proposal, 90 FR 898, to watch for a final rule.
• Your own policy manual, with the version date of each privacy and security policy.

The steps:

1. Decide whether you are a covered entity. Run the 4 steps above with whoever handles your billing, since claims a billing company or clearinghouse sends for you still count. If you are not one, check whether you are a business associate, and what your state requires.
2. Inventory the privacy and security policies in force. List each one with its version date. 45 CFR 164.530(b)(1) asks for training on the policies and procedures, so this list is the curriculum. The dates may show a snag: a privacy policy that changed materially in March, say, and the schedulers it affects never retrained. Under 164.530(b)(2)(i)(C), that retraining is owed within a reasonable period, which the rule does not define.
3. Map each policy to the roles whose functions it touches. An aide, a scheduler and a biller do different work with protected health information, and 45 CFR 164.530(b)(1) asks for training "as necessary and appropriate for the members of the workforce to carry out their functions".
4. Write one short lesson per policy, in the words your staff use. The Security Rule half is less specific to your agency, so more ready-made security awareness material fits it. Your own security policies still need a lesson of their own.
5. Add a few questions at the end of each lesson. A wrong answer that keeps coming back tells you which policy needs a plainer lesson.
6. Write the 3 triggers into your written policy. How many days after hire counts as a reasonable period; how many days after a material change becomes effective; and your own choice for a move to a new job, which is not one of the rule's listed triggers. In your security policy, set the interval for periodic security updates, or document why not under 45 CFR 164.306(d)(3).
7. Record every session and keep it 6 years. Name, role, date, policy version and method, kept for 6 years from creation or from when it was last in effect, whichever is later.

These times are working estimates for a short policy manual, not HHS figures; a long manual or many roles adds time. More on cost in compliance training cost.

What HIPAA training mistakes do agencies make?

1. Assuming a billing company keeps you out of HIPAA. CMS says a provider that uses a clearinghouse to send covered transactions "is considered to be conducting the transaction in electronic form". A health care provider that bills Medicaid through a vendor is still a covered entity.
2. Training to the calendar and missing the events. 45 CFR 164.530(b)(2) ties training to hire and to material policy changes. An annual session does not cover the aide who joins the month after it, or the policy that changes mid-year.
3. Training without a record. 45 CFR 164.530(b)(2)(ii) requires documentation that training was provided, and 164.530(j)(2) keeps it 6 years. An agency that trained every aide and logged none of it can show no training at all.

Need this training built for your team? We build the first lesson free from your own policies, with a quiz and a SCORM file for your LMS. Then you get a fixed price for the rest. Get your free first lesson.

Other questions about HIPAA training

Do you have to do HIPAA training every year?

No. 45 CFR 164.530(b) ties privacy training to hire and to material policy changes, not to a yearly schedule.

How long is a HIPAA certification good for?

45 CFR 164.530 asks a covered entity to document that training was provided, and it mentions no certificate and no expiry date. In 2000, HHS dropped a proposed recertification every 3 years. A vendor's certificate records that someone finished that vendor's course.

Is HIPAA training an annual requirement per OSHA?

No. HIPAA is an HHS rule, not an OSHA rule. OSHA's annual training rule for this workforce is bloodborne pathogens, 29 CFR 1910.1030(g)(2)(iv), and it runs on a rolling anniversary: training is due "within one year of their previous training". More in bloodborne pathogens training for home health agencies.

What are the new HIPAA requirements for 2026?

For training, the change on the table is the Security Rule proposal HHS published in January 2025, which would require training at least once every 12 months. As of 26 September 2026 it is still proposed, and HHS has published no final rule.

Who is required to complete HIPAA training at a home care agency?

Every member of a covered entity's workforce, as defined in 45 CFR 160.103.

Does a business associate have to follow 164.530(b)?

No. 45 CFR 164.530(b) binds covered entities, and a business associate is not a covered entity. A business associate's training duty comes from the HIPAA Security Rule and its contract.