What does the HIPAA Security Rule require?

The HIPAA Security Rule establishes administrative, physical, and technical safeguards for electronic protected health information (PHI). Its administrative safeguards include the security awareness and training standard under 45 CFR § 164.308(a)(5).

More specifically, covered entities and business associates must “Implement a security awareness and training program for all members of its workforce (including management),” Cornell Law School’s Legal Information Institute explains. As a result, this requirement applies throughout the organization, including cybersecurity teams, healthcare providers, administrative staff, billing personnel, managers, and other workforce members. That way, the entire workforce understands their responsibilities for safeguarding PHI and following the organization's security policies and procedures. While the regulation does not prescribe one mandatory training format, organizations must check that their approach meets applicable requirements and addresses relevant security risks.

 

What the law says

Section 164.308(a)(5) contains the overarching security awareness and training standard and four implementation specifications. These address security reminders, protection from malicious software, log-in monitoring, and password management, and affect how organizations must implement the measures.

 

1. Security reminders

Under § 164.308(a)(5)(ii)(A), organizations must have regular security updates as part of their security awareness and training program. Security reminders reinforce the practices employees learn during formal training, like how to communicate possible threats and what lessons they learnt from recent security incidents.

Healthcare organizations can also use HIPAA compliant emails to distribute these reminders. For example, a secure email could explain how to identify suspicious requests for patient records or remind staff members to lock their unattended workstations. Additionally, organizations can use Paubox email to send tailored messages warning staff about fraudulent messages impersonating healthcare executives.

Other approaches include staff meetings, internal newsletters, posters, short online modules, and targeted communications following newly identified risks. These should be implemented routinely, based on the organization’s risk assessments. So, if the organization receives frequent reports of phishing attempts, it would be best to increase the frequency of reminders and training sessions.

 

2. Protection from malicious software

Section 164.308(a)(5)(ii)(B) addresses procedures for guarding against, detecting, and reporting malicious software. Malicious software, like ransomware and spyware, can compromise information systems and threaten the confidentiality, integrity, and availability of patients’ PHI.

Staff must understand how malicious software can reach their devices and what to do when they suspect a threat. Training should cover how to recognize suspicious attachments, avoid untrusted downloads, identify unexpected software installation requests, and report unusual computer behavior.

Healthcare organizations can use HIPAA compliant emails to explain to employees how to report a suspected breach without fear or embarrassment. For example, a secure email platform can provide details on how to communicate directly with IT support for immediate assistance.

Training should also reflect the organization's actual workflows. For instance, staff who regularly exchange patient information through email should understand how to evaluate unexpected messages and use approved channels to verify unusual requests, like phishing attempts. This will help equip employees for handling potential security threats, ultimately protecting patient data and maintaining HIPAA compliance.

 

3. Log-in monitoring

Under § 164.308(a)(5)(ii)(C), organizations must address “procedures for monitoring log-in attempts and reporting discrepancies.” Employees must be able to identify suspicious authentication activity and know how to report it.

Relevant training topics include unexpected login notifications, repeated authentication prompts, unfamiliar account activity, and requests to approve access that the employee did not initiate. Although technical systems can detect and monitor suspicious activity, employees must still be able to escalate concerns.

 

4. Password management

Section 164.308(a)(5)(ii)(D) addresses “procedures for creating, changing, and safeguarding passwords.” The regulation specifically addresses password management; it does not prescribe a particular password length or require one universal password policy through this provision.

As a result, password management training should reflect the organization's authentication policies and the systems employees use to access PHI. For example, if the organization uses Paubox email, the employees should be trained on how multifactor authentication (MFA) works and how to set up their email system.

Additionally, regular audits should be conducted regarding password policies like password complexity requirements, expiration, and password reuse to implement best practices in data security. Regular audits can help identify any weaknesses in the password management system, so IT teams can quickly rectify potential vulnerabilities.

 

Does HIPAA require phishing simulations?

No. The HIPAA Security Rule does not explicitly mandate phishing simulations.

Section 164.308(a)(5) requires a security awareness and training program, but it does not name simulated phishing campaigns as a compulsory activity.

Phishing simulations are exercises in which organizations send controlled, simulated phishing messages to employees to check whether staff recognize and respond appropriately. These exercises can help identify potential weaknesses and provide opportunities for targeted education.

 

How Paubox email can help

Existing Paubox customers can add-on Paubox Security Awareness Training (SAT) to conduct phishing simulations for their employees directly through the Paubox dashboard. The platform includes six predefined scenarios, including Microsoft login resets, DocuSign notifications, optional AI-generated variations, and individual risk scores for each employee. These phishing simulations show exactly who opened, clicked, or entered credentials, so organizations can get a better understanding of who needs more training.

For example, an organization can send out a simulated phishing email to test their employees' awareness of potential threats. This data can then be used to tailor training programs and improve the company’s security measures.

Additionally, Paubox SAT helps document security awareness activities, so healthcare organizations can prove how they implement and maintain their training programs. Paubox SAT provides campaign history and six-year audit logs, supporting recordkeeping for HIPAA compliance efforts. The platform offers email encryption, threat protection, and security awareness training through one vendor, simplifying security management.

The Email Suite add-on typically costs around half as much as a standalone phishing simulation platform. Paubox SAT is a comprehensive solution that streamlines security measures for healthcare organizations. It helps organizations simultaneously improve their cybersecurity and reduce costs associated with managing multiple vendors for different security needs.

In simple terms, Paubox SAT is a cost-effective and efficient option for healthcare organizations looking to enhance their security protocols, as it consolidates different security needs into one platform.

 

When are phishing simulations appropriate?

Phishing simulations can help healthcare organizations assess how effectively employees recognize and respond to email-based social engineering threats. They are especially useful when an organization's risk analysis identifies email-based social engineering as a major threat.

According to Healthcare's email security maturity gap, 58% of healthcare organizations were breached through email in the past 24 months, and 64% have been hit by an AI-generated email attack. These findings show exactly why organizations must prepare their employees to identify gaps in security awareness and determine where additional training is needed.

For example, high click rates may indicate that employees need more guidance on identifying suspicious links, while low reporting rates may suggest uncertainty about how to flag potential threats. Organizations can then use these findings to provide practical information about how employees respond to suspicious messages and whether reporting procedures are understood.

Simulation results should be used constructively, as employees who struggle to recognize suspicious messages may benefit from additional instruction and extra opportunities to practice identifying warning signs. The purpose should be to improve security awareness rather than simply penalize employees for making mistakes.

 

Why phishing simulations on their own aren’t enough

A phishing simulation on its own doesn’t mean that an organization has fulfilled every aspect of § 164.308(a)(5). Organizations should also use other assessments like vulnerability and penetration testing. As Cornell Law School suggests, healthcare organizations must “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”

Combining phishing simulations with other security measures can help improve an organization’s cybersecurity and uphold HIPAA regulations. However, an organization should not assume that purchasing a phishing simulation platform automatically makes it HIPAA compliant. The platform is not a substitute for a complete, documented training program.

 

Why contingency planning matters

Healthcare organizations must complement security awareness training with contingency plans that safeguard patients’ PHI during emergencies. Under the HIPAA Security Rule, organizations must have policies in place for responding to emergency events like fires or system failures.

According to § 164.308, these plans must include a “data backup plan” to maintain retrievable copies of PHI, a “disaster recovery plan” to restore lost data, and an “emergency mode operation plan” to maintain critical business processes.

For example, a healthcare organization can back up its electronic health records (EHR) to a secure, separate location. Additionally, they should have procedures for restoring patient records after a ransomware incident and implement downtime workflows that allow clinicians to access patient information during a system outage.

Organizations must also assess which applications and data should be prioritized in an emergency. For example, systems supporting medication orders and emergency care require faster restoration than nonessential administrative applications. Additionally, organizations must periodically test and revise their contingency plans when appropriate.

Go deeper: Why removing a phishing email does not end the attack

 

FAQs

Does HIPAA require security awareness training?

Yes. Under 45 CFR § 164.308(a)(5), covered entities and business associates must implement a security awareness and training program for all workforce members, including management. The program should address relevant security risks and applicable training requirements.

 

Does HIPAA require annual security awareness training?

HIPAA does not specify a universal annual training schedule under § 164.308(a)(5). Organizations must have a training schedule that reflects their security risks and workforce needs, with additional reminders when appropriate.

 

Who needs HIPAA security awareness training?

All workforce members must be included in a HIPAA security awareness and training program, including management, clinicians, administrative staff, billing personnel, and IT teams. IT and compliance teams at mid-market healthcare organizations typically oversee these initiatives, helping employees understand their security responsibilities and identify potential threats.

Paubox Security Awareness Training (SAT) is available as an Email Suite add-on for existing Paubox customers and organizations evaluating Email Suite, including those in other regulated industries. Regardless of who manages the program, training should address relevant security risks across the workforce.