Under 45 CFR 164.308, healthcare organizations must run a security awareness and training program for their workforce. The same section requires them to apply appropriate sanctions against workforce members who fail to comply with security policies and procedures.

Many organizations meet the training requirement partly through simulated phishing, sending staff realistic test messages built to look like an attack. Paubox's guide to the training requirement points out that section 164.308(a)(5) doesn't name simulated phishing as a compulsory activity, and it states that the purpose should be to improve security awareness rather than simply penalize employees for mistakes.

Read more: What HIPAA actually requires for security awareness training | Introducing Paubox Security Awareness Training | Tips to spot phishing emails disguised as healthcare communication

 

What HIPAA's sanction requirement covers

Section 164.308(a)(1) places the sanction policy under the security management process standard, alongside risk analysis, risk management, and review of information system activity. It's listed as a required implementation specification for every covered entity and business associate, meaning every healthcare provider, health plan, and vendor handling patient data on their behalf needs one.

HIPAA's text calls for "appropriate sanctions" without listing which failures trigger them or how severe they should be. Whether clicking a simulated phishing link counts as a policy violation depends on how an organization has written its own security policies.

 

How employees judged simulations in an experiment

Researchers from the German Aerospace Center, the University of the Bundeswehr Munich, the University of Luxembourg, and Aalto University tested what makes a simulated phishing campaign acceptable to the people receiving it. Their experiment, presented at the Symposium on Usable Security and Privacy in February 2025, involved 793 participants. Its design was registered publicly before data collection began, and participants read written scenarios and judged them.

Each scenario varied whether employees had given prior consent, whether the phishing email promised money, and what happened to employees who clicked. Prior consent made a campaign more acceptable to participants. Lures offering a financial incentive made it less acceptable, as did consequences in which an employee who clicked faced an interview or termination of their work contract.

Based on those results, the team recommended that organizations obtain informed consent before including employees in simulated phishing campaigns and describe the consequences clearly in advance. The paper also reported no statistically measurable effect of consent, incentives, or consequences on whether participants said they would try to manipulate a campaign.

 

What organizations do with repeat clickers

Researchers working with the Centre for Research and Evidence on Security Threats studied how organizations use simulated phishing and what they do with the results. In the first of two studies in their 2020 report, organizations described a stepped response to repeat clickers, adding further intervention such as more training or sanctions depending on how often an employee fell for simulations.

Earlier research cited in the report argues that trust between employees and their organization is a vital part of compliance with security policies, and that simulated phishing exercises have been argued to undermine that trust. A second study in the report tested different training approaches and encouraged a lean form of just-in-time training, a short lesson delivered at the moment someone clicks, as a way to lower susceptibility without hurting mood, productivity, or perceived fairness.

 

When a lure costs an organization its staff's trust

Employees at Tribune Publishing received an email in 2020 saying they would receive bonus payments of $5,000 to $10,000. Clicking the link revealed a failed phishing test and a referral to cybersecurity awareness training, and no bonus existed.

That message reached staff during a year of layoffs, furloughs, and pay cuts at the company. Tribune Publishing later apologized, calling the topic of the email "misleading and insensitive" while noting that attackers use similar language. In the 2025 experiment, financial incentive lures were also the type that lowered participants' acceptance of a campaign.

 

Choosing scenarios and following up with Paubox

Paubox Security Awareness Training offers six built-in phishing scenarios and can generate an AI variation of any of them, so administrators approve every lure before a campaign reaches staff. Reports break each employee's response into three stages, from opening a test message to clicking its link to typing in a password, and additional training can go to the people who reached the later stages.

Six years of campaign records give compliance teams documentation of the training program to sit alongside whatever follow-up their sanction policy calls for. Paubox Inbound Email Security handles genuine threats in the same account, reading sender behavior and message intent to stop real phishing before it reaches staff, and both run with Paubox's HIPAA compliant email encryption.

Learn more: Paubox Security Awareness Training | Paubox Inbound Email Security | Paubox Email Suite

 

What a reporting competition found

A university information security office ran a "Phish Derby" in which employees volunteered to compete for prizes by reporting simulated phishing emails, scored on how many they reported and how quickly. The study, published in Frontiers in Education, found that an employee's past performance on simulated phishing campaigns predicted how well they did in the competition.

Its authors framed the work around what they called the protective steward phenomenon, looking at the positive side of employee security behavior instead of focusing on failures. They also noted that some workers see standard simulations as a source of stress, embarrassment, and lost productivity.

 

FAQs

Does HIPAA require sanctions for clicking a simulated phishing email?

HIPAA requires a sanction policy for workforce members who fail to comply with security policies, but it doesn't say which failures qualify. Whether a simulation click counts depends on how each organization writes its own policies.

 

Is employee consent needed before running phishing simulations?

HIPAA doesn't require it. A 2025 experiment with 793 participants found prior consent made campaigns more acceptable, and its authors recommended obtaining informed consent and explaining consequences in advance.

 

Which lures cause the most backlash?

Lures promising money lowered acceptance in the 2025 experiment. Tribune Publishing apologized in 2020 after a simulated bonus email reached staff during a year of layoffs and pay cuts.

 

What is just-in-time training?

A short lesson shown at the moment an employee clicks a simulated phishing link. Research for the Centre for Research and Evidence on Security Threats encouraged a lean version as a way to reduce susceptibility without hurting morale or perceived fairness.

 

How does Paubox help organizations follow up after a simulation?

Paubox Security Awareness Training separates each employee's response into opening, clicking, and entering credentials, so additional training can be targeted. Six years of campaign records document the program.