HIPAA Workforce Training Log Template (2026) — Annual + New Hire

HIPAA workforce training is required at hire and on material change under 45 CFR § 164.530(b), with an ongoing security awareness program plus periodic security reminders under 45 CFR § 164.308(a)(5); HIPAA itself does not fix an annual cadence, but annual refresher training is the standard defensible practice. The training log must document, per workforce member, the topic, date, completion evidence, and reviewer — and be retained six years per § 164.530(j). New hires must complete training within a reasonable time after hire; Texas Health & Safety Code § 181.101 fixes this at 90 days.

What auditors actually want

In our analysis of 400+ d3rx client binders, training logs fail on two predictable axes. First, completeness: the log lists W-2 employees but misses locum tenens, volunteers, students, and clinical contractors. Second, evidence: the log says "completed" but no certificate is filed, no course name is recorded, and no instructor is named — leaving the auditor unable to verify the training actually happened.

OCR's investigation protocol asks for the training log as a primary artifact in every Phase 2 audit selection. The protocol expects: name of workforce member, role, topic, date, source/instructor, and evidence of completion. Practices that produce all six columns close the training inquiry quickly; practices that produce a name-and-date list invite a deeper look.

The required entities to name in a credible training discussion: HHS Office for Civil Rights (OCR), the Privacy Rule at § 164.530(b), the Security Rule awareness standard at § 164.308(a)(5), the OCR Audit Protocol, state laws including Texas HB 300 and California CMIA, and the HHS 405(d) Health Industry Cybersecurity Practices for ongoing awareness content.

Cadence: hire + annual + on material change

The defensible cadence is three layers stacked:

| Trigger | Population | Required topics | Deadline | |---|---|---|---| | New hire | Every workforce member | Full Privacy + Security baseline | Within 30 days; TX requires within 90 | | Annual refresher | Every workforce member | Privacy + Security refresher, current threats | Every 12 months from prior training | | Material change | Workforce affected by change | Change-specific content | Within 30 days of effective date | | Specialty layer | Targeted workforce | OSHA, FWA, CLIA, DEA/PDMP, state | Per applicable rule |

The "annual" anchor date can be hire anniversary or a fixed practice-wide date (e.g., every February). Fixed dates are operationally easier for small practices.

Required topics

The Privacy Rule does not enumerate topics; the Security Rule does. Combined, the audit-ready topic list:

• Privacy Rule baseline: Notice of Privacy Practices, minimum-necessary standard, permitted uses and disclosures, patient access rights at § 164.524, accounting of disclosures at § 164.528.
• Security Rule awareness (§ 164.308(a)(5)): security reminders, malware protection, log-in monitoring, password management.
• Breach response: workforce member's role in identifying and reporting a suspected breach; the four-factor risk assessment at § 164.402.
• Phishing and social engineering: scenario-based recognition, reporting workflow.
• Mobile device and BYOD: encryption, lock screens, reporting loss.
• Sanction policy (§ 164.530(e)): workforce member knows the consequences for violations.

State layers, where applicable: Texas HB 300 (90-day hire training + 2-year refresh), California CMIA disclosure rules, New York SHIELD reasonable safeguards training, Florida FIPA, Washington My Health My Data.

Specialty layers, where applicable: OSHA Bloodborne Pathogens (29 CFR 1910.1030) at hire and annually; FWA training (CMS) at hire and annually; CLIA competency (for in-office lab) at 6 months and annually; DEA prescribing/PDMP refresher. Texas Health & Safety Code § 181.101 anchors the in-state HIPAA workforce-training cadence: training within 90 days of hire, material-law-change training no later than the workforce member's first anniversary, and six-year retention of signed verification.

The training log — exact format

This is the column set that survives an OCR audit. One row per workforce member per training event.

| Workforce member (last, first) | Role | Hire date | Training topic | Training source / instructor | Training date | Duration (min) | Completion evidence | Next due | Reviewer | |---|---|---|---|---|---|---|---|---|---| | Adams, Jane (MD) | Provider | 2024-03-10 | Privacy Rule baseline | KnowBe4 — HIPAA Annual | 2026-02-12 | 45 | Cert #ABC-12345 (PDF filed) | 2027-02-12 | RJ | | Brown, Marcus | Medical assistant | 2025-08-22 | Privacy + Security at hire | In-house, J. Smith CCEP | 2025-08-25 | 90 | Sign-off form (filed) | 2026-08-25 | RJ | | Chen, Lisa (NP) | Locum tenens | 2026-01-15 | Privacy Rule baseline | KnowBe4 — HIPAA Annual | 2026-01-18 | 45 | Cert #ABC-67890 (PDF filed) | 2027-01-18 | RJ | | Davis, Tom | IT MSP onsite contractor | 2024-05-01 | Security awareness | KnowBe4 — Sec Aware | 2026-02-10 | 30 | Cert #ABC-54321 | 2027-02-10 | RJ | | All workforce | n/a | n/a | New phishing module (material change) | KnowBe4 — Phishing 2026 | 2026-03-15 | 20 | Roster PDF filed | n/a | RJ |

Required columns

• Workforce member's full legal name (matched to HR record).
• Role (provider, clinical staff, billing, IT, locum, contractor, volunteer).
• Hire date (anchors the new-hire timeline).
• Training topic (specific, not "HIPAA training" — name the module).
• Source or instructor (vendor + course name, or in-house instructor's name and credential).
• Date of completion (exact date).
• Duration in minutes (for material-completeness evidence).
• Completion evidence (certificate number, signed roster, LMS export — and the file path or PDF reference in the binder).
• Next due date.
• Reviewer initials (Privacy Officer or designee who validated the entry).

Retention: six years from training date under § 164.530(j). Texas medical record retention rules may require longer for some entities.

The new-hire mini-workflow

`` Day 0 (offer accepted): HR adds candidate to training roster. Day 1-7 (start date): Privacy Officer assigns required modules in LMS or delivers in-house training. Day 1-30: Workforce member completes full Privacy + Security baseline. TX practices: must complete HB 300 module within 90 days of hire. Day 1-30: Privacy Officer logs the training in the binder with all required columns and files the certificate PDF. Annual anniversary (or fixed practice date): refresher cycle begins. ``

In practice, gating system access to PHI on training completion is the operational forcing function: the EHR account is created but disabled until the training certificate is filed. d3rx client practices that use this pattern average <2% training gaps; practices that do not average 15-30% gaps at any given audit moment.

Evidence to retain

For every training event, file in the binder:

1. The course name, vendor, and version.
2. The completion certificate (PDF) per workforce member, with completion date.
3. The roster of who was assigned the module and the completion status.
4. For in-house training: the instructor's name and credential, the training materials (slide deck or outline), the sign-in sheet.
5. For material-change re-training: the change description, effective date, scope of affected workforce, completion evidence.
6. Sanction policy acknowledgment per workforce member (separate document, retained alongside training file).

Retention: six years federal floor; Texas medical record retention can exceed; California CMIA does not name a training retention period but the underlying employment records typically require longer.

What goes wrong

The recurring defects in d3rx's review:

1. Locums, volunteers, students missing. The log lists W-2 only.
2. No certificate evidence. "Completed" is recorded with no PDF.
3. No source named. The log says "HIPAA training" but does not name the vendor or course.
4. Sanction policy never acknowledged. § 164.530(e) requires a sanction policy; absent acknowledgment, training is half-done.
5. Material-change events not logged. The practice rolled out a new EHR and never re-trained the workforce on the new breach workflow.
6. Annual cadence drift. The first annual happened 14 months after hire, the second 16 months later, no anchor date.

Maintenance cadence

• Weekly: HR notifies Privacy Officer of any new hires, contractors, locums, volunteers.
• Monthly: Privacy Officer reviews the log for upcoming due dates (30-day lookahead) and assigns modules.
• Quarterly: spot-check 5-10 entries for evidence completeness.
• Annually: full log review with leadership; sign-off on completion percentages; renew course content if vendor has updated.
• On material change: re-training within 30 days of effective date; log the change as a dated event.

State preemption note: Texas Health & Safety Code § 181.101 fixes the new-hire deadline at 90 days, requires material-law-change training no later than the workforce member's first anniversary, and requires six-year retention of signed verification of training. California CMIA imposes additional disclosure-rule content. New York SHIELD requires reasonable-safeguards training. Florida FIPA imposes data-security awareness training. The federal HIPAA training is the floor; state layers stack on top.

How d3rx fits

The d3rx compliance binder tracks the training roster, assigns modules at hire, flags upcoming annual renewals, and files the dated certificates per workforce member. It is an administrative documentation aid, not a training-content vendor. The practice remains responsible for selecting training content adequate to its workforce and operations.