HIPAA security awareness training requirements: §164.308(a)(5) explained
What the HIPAA Security Rule requires under 45 CFR §164.308(a)(5), what “addressable” means, the status of the proposed update, and the evidence a simulation programme can add.
The HIPAA Security Rule requires covered entities and business associates to implement a security awareness and training programme for all members of the workforce, including management. It does not mention phishing simulation. This post quotes the current clause, explains what “addressable” means, notes the status of the proposed update, and lists the evidence a simulation programme can add.
Key takeaway
§164.308(a)(5) is mandatory. Its four specifications are addressable, which means you assess and document them; it does not mean they are optional. The rule never names phishing simulation.
The current standard
| Detail | Text (eCFR, current as of 14 October 2026) |
|---|---|
| §164.308(a)(5)(i) | “Implement a security awareness and training program for all members of its workforce (including management).” |
| (ii)(A) Security reminders (Addressable) | “Periodic security updates.” |
| (ii)(B) Protection from malicious software (Addressable) | “Procedures for guarding against, detecting, and reporting malicious software.” |
| (ii)(C)–(D) (Addressable) | Log-in monitoring and password management. |
| §164.306(d)(3) | For each addressable specification: implement it if reasonable and appropriate, or document why not and implement an equivalent alternative where reasonable. |
| §164.316(b) | Keep written policies and procedures and a written record of required actions; retain documentation for six years from creation or last effective date, whichever is later. |
What auditors look for
Auditors and OCR reviewers often ask for the workforce training policy, proof that all members of the workforce (including management) were trained, periodic reminders, and documentation retained for six years. Dated campaign reports and completion records for people who clicked can go into that file; they are one part of a workforce programme, not all of it.
The proposed update (not in force)
On 6 January 2025 HHS published an NPRM (90 FR 898) that would rewrite the awareness standard, including training that addresses social engineering and malicious software, with timing rules (for example, within 30 days of access and at least once every 12 months). HHS’s regulatory agenda (Unified Agenda RIN 0945-AA22, 2026 publication, Long-Term Actions) lists a tentative final-action target of July 2027 (as of 16 October 2026); no final rule has been issued. The current Security Rule remains in effect. Read the NPRM and the Unified Agenda before you plan around the proposal.
Evidence checklist
- Per-person lesson-completion records and dated campaign reports for the people you enrol (§164.308(a)(5)(i)).
- Recurring campaigns as periodic security updates ((ii)(A)).
- Simulations and lessons as one part of “protection from malicious software” procedures ((ii)(B)).
- PPT, PDF or CSV exports retained in your compliance file for six years (§164.316(b)); retention is your responsibility.
How SecurityRing helps
SecurityRing gives that awareness evidence for the employees you enrol. It is not a HIPAA risk analysis, it does not cover the rest of the Security Rule, and no regulator endorses it. Your auditor or OCR decides whether you comply.
Sources
Every clause, incident and figure above comes from these official or original sources.
- eCFRHIPAA Security Rule, 45 CFR §164.308 Administrative safeguardsPublished 14 October 2026 · Accessed 16 October 2026.
- eCFR45 CFR §164.306 Security standards: general rulesPublished 14 October 2026 · Accessed 16 October 2026.
- eCFR45 CFR §164.316 Policies and procedures and documentation requirementsPublished 14 October 2026 · Accessed 16 October 2026.
- HHS OCRHIPAA Security Rule NPRM (proposed update)Published 27 December 2024 · Accessed 16 October 2026.
- OIRA / Reginfo.govUnified Agenda RIN 0945-AA22 (2026 publication): Long-Term Actions; Final Action listed 07/00/2027Published 1 January 2026 · Accessed 16 October 2026.
