# Standards and Regulatory References

## Primary Legislation

### HIPAA Privacy Rule — 45 CFR §164.530(b): Training
- **§164.530(b)(1)**: Covered entity must train all workforce members on PHI policies and procedures as necessary and appropriate for their functions.
- **§164.530(b)(2)(i)**: Training for each new workforce member within a reasonable period after joining.
- **§164.530(b)(2)(ii)**: Retraining when functions are materially affected by policy or procedure changes.

### HIPAA Security Rule — 45 CFR §164.308(a)(5): Security Awareness and Training
- **§164.308(a)(5)(i)**: Required standard — implement a security awareness and training program for all workforce members including management.
- **§164.308(a)(5)(ii)(A)**: Addressable — periodic security reminders.
- **§164.308(a)(5)(ii)(B)**: Addressable — procedures for guarding against, detecting, and reporting malicious software.
- **§164.308(a)(5)(ii)(C)**: Addressable — procedures for monitoring log-in attempts and reporting discrepancies.
- **§164.308(a)(5)(ii)(D)**: Addressable — procedures for creating, changing, and safeguarding passwords.

### HIPAA Sanction Policy — 45 CFR §164.530(e) and §164.308(a)(1)(ii)(C)
- **§164.530(e)(1)**: Covered entity must have and apply appropriate sanctions against workforce members who fail to comply with privacy policies and procedures.
- **§164.308(a)(1)(ii)(C)**: Required — apply appropriate sanctions against workforce members who fail to comply with security policies and procedures.

### Documentation Retention — 45 CFR §164.530(j)
- **§164.530(j)(1)**: Policies, procedures, and training records must be maintained for 6 years from the date of creation or the date when it was last in effect, whichever is later.

## HITECH Act Provisions

- **HITECH Act §13402**: Breach notification requirements expanded training obligations to include breach identification and reporting procedures.
- **HITECH Act §13401**: Extended HIPAA Security Rule requirements (including training) directly to business associates.

## Regulatory Guidance

- **OCR Guidance on Training (2013)**: "Covered entities must provide training that is necessary and appropriate for workforce members to carry out their functions. A one-size-fits-all approach may not be sufficient."
- **NIST SP 800-50 (2003)**: Building an Information Technology Security Awareness and Training Program — provides framework for developing IT security awareness programs applicable to HIPAA security training.
- **NIST SP 800-16 Rev. 1 (2014)**: A Role-Based Model for Federal Information Technology / Cybersecurity Training — role-based training framework.

## Enforcement Actions

- **Hospice of North Idaho (2013, $50,000)**: No HIPAA Security Rule training for workforce prior to breach of unencrypted laptop with ePHI of 441 patients.
- **Columbia University/New York Presbyterian (2014, $4.8M combined)**: Inadequate workforce training contributed to physician deactivating server containing ePHI of 6,800 patients.
- **Anthem Inc. (2018, $16M)**: Largest HIPAA settlement; failure to conduct adequate security awareness training cited as contributing factor to breach affecting 78.8 million individuals.
- **Premera Blue Cross (2020, $6.85M)**: OCR found insufficient security training contributed to phishing-based breach affecting 10.4 million individuals.

## ISO/IEC Standards

- **ISO/IEC 27001:2022 — A.6.3**: Information security awareness, education, and training. Personnel must receive appropriate awareness education and training and regular updates in organizational policies and procedures.
- **ISO/IEC 27002:2022 — 6.3**: Provides implementation guidance on awareness programs, including role-based training and competence measurement.