HIPAA Training for Clinical and Translational Science Institute Staff

If you work with the University of Minnesota Clinical and Translational Science Institute (CTSI), you may need HIPAA privacy and information security training before accessing protected health information or supporting research activities. Your exact requirements depend on your role, University policy, and the studies or systems you work with.

Who must complete HIPAA and information security training?

At the University of Minnesota, faculty, staff, students, and volunteers who work in areas with access to protected health information (PHI)—or support those areas—may be required to complete both HIPAA and information security training. This can apply even when you do not handle PHI directly, because your work may involve incidental contact with it or require you to recognize and report a privacy concern. See the University’s HIPAA training requirements and Protected Health Information policy.

HIPAA’s federal training requirement applies to members of a covered entity’s workforce, with training appropriate to their functions. It does not establish a single course that every person affiliated with a research institute must take. The covered entity must train its workforce on relevant policies and procedures for handling PHI, as explained in HHS guidance on the HIPAA training requirement.

For your research study team compliance, check your assigned University training, your supervisor’s instructions, and any applicable unit or study requirements. Research partners and volunteers may have additional steps or need to document equivalent training accepted by the University.

How to access HIP019 and ISA101 online courses

The CTSI regulatory and training page lists HIP019 (HIPAA Training) and ISA101 (Information Security Awareness Training). However, course assignments have changed: as of October 1, 2026, the University’s Health Information Privacy & Compliance Office says HIP26 is required and that no previous course is equivalent. ISA101 remains part of the current training requirement. Check the current HIPAA training instructions rather than relying on an older course number shown on the CTSI training page.

To complete assigned training, sign in to the University’s Training Hub with your University Internet ID. Open My Training, select Current Training, and launch the assigned HIPAA and information security courses. If HIPAA training has not been assigned, use the Training Hub course catalog and follow the current instructions from the Health Information Privacy & Compliance Office.

The University requests that HIP26 be completed within one month of assignment. When you finish a course, follow its final on-screen steps and confirm the completion appears in your training record. If a course is missing, inaccessible, or not marked complete, contact the University’s technology support team or the office listed in the training instructions.

What does HIPAA training cover about identifiable health information?

Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate, in electronic, paper, or other form. It can include information that identifies a person and relates to their past, present, or future health, health care, or payment for care. HHS explains the definition in its guidance on protected health information and de-identification.

HIPAA privacy training helps you understand the organization’s rules for protecting that information, including when it may be used or disclosed and how to safeguard it. Information security awareness adds practical attention to protecting data and systems. Follow the University’s procedures for your work, use only approved access and tools, and promptly report suspected privacy or security incidents through the channels your unit provides.

In clinical and translational research, identifiers can appear in study records, recruitment materials, clinical systems, correspondence, or conversations. Use and share only the information permitted for your role and the approved study purpose; do not assume that research use makes identifiable information unrestricted. The applicable privacy rules and local procedures depend on the data, the covered entity, and the study context.

Which additional training may clinical research staff need?

HIPAA training is only one part of research preparation. If you participate in human-subjects research, you may also need Human Subjects training required by the University’s Institutional Review Board (IRB). The University identifies different required CITI courses for biomedical and social-behavioral research personnel; training must generally be completed before participating in research. Review the current IRB Education & Training requirements and your study’s instructions.

Good Clinical Practice (GCP) training may also apply, particularly if you work on an NIH-funded clinical trial. NIH expects investigators and clinical trial staff involved in the design, conduct, oversight, or management of NIH-funded trials to receive GCP training and recommends refreshing it at least every three years. NIH does not require one specific GCP course, though a funding institute or study may specify one. See NIH’s Good Clinical Practice training guidance.

Your role or study may require additional instruction—for example, training on a research protocol, consent procedures, a clinical system, or a site-specific process. Use the University’s CTSI regulatory and training resources and ask your supervisor or study lead which requirements apply before taking on study tasks.

How often must staff renew HIPAA training?

HIPAA does not set a universal annual refresher schedule for every worker. Under the federal Privacy Rule, covered entities must train new workforce members within a reasonable period and provide additional training within a reasonable period when a material policy or procedure change affects their functions. The rule also requires documentation of training; see HHS’s explanation of 45 CFR § 164.530(b).

University of Minnesota policy directs the Health Information Privacy & Compliance Office to communicate the timing and frequency of training; individual units may require more frequent training. Complete the course assigned to you when it appears in Training Hub, and check with your supervisor or the privacy office about your next due date. Do not assume that a course completion certificate or an older course automatically satisfies a current assignment.

GCP refresher timing is separate from HIPAA renewal. NIH recommends refreshing GCP training at least every three years for people covered by its clinical-trial policy, while a sponsor, funding institute, or study may set additional requirements.

How to verify training completion and address program-specific requirements

After completing a course, check My Training in Training Hub for its status and completion date. The University’s HIPAA training page explains how to view current and past courses and print a completed-training record. University employees with the appropriate access may also check training history in the MyU Reporting Center.

For research-specific requirements, CTSI recommends using its Human Research Training Tool, which helps University clinical research professionals and supervisors identify training and other requirements for working with human participants. Confirm that your study team’s records match the requirements of your role, protocol, IRB, sponsor, and funding source.

A course completion record documents that you completed that course; it is not a certificate that establishes organization-wide HIPAA compliance. Keep your records, follow employer-specific policies, and ask your supervisor or compliance office to resolve conflicting course names, deadlines, or study requirements. In short, complete the current HIPAA and information security assignments, verify your records, and add the human-subjects or GCP training required for your research role.

FAQs

Is HIPAA training required for all institute employees and students?

Not simply because someone is affiliated with an institute under a universal federal annual-training rule. At the University of Minnesota, faculty, staff, students, and volunteers who work in or support areas with access to PHI may be required to complete HIPAA and information security training, including when their contact with PHI may be incidental. Follow University policy and your assigned requirements.

Which online courses satisfy HIPAA and information security training requirements?

For University of Minnesota personnel, the current HIPAA course is HIP26, and ISA101 is the required information security awareness course. As of October 1, 2026, the University says no earlier HIPAA course is equivalent to HIP26. Check your Training Hub assignment and the Health Information Privacy & Compliance Office’s current instructions.

Do clinical research staff need Human Subjects and Good Clinical Practice training?

They may. The University IRB requires applicable CITI Human Subjects courses for research personnel before participation, with the required course depending on the research type. NIH expects GCP training for investigators and clinical trial staff involved in NIH-funded clinical trials. Your study, sponsor, or funding institute may add requirements.

How often must HIPAA training be renewed?

HIPAA does not impose a universal annual refresher interval. Federal rules require training for new workforce members within a reasonable period and additional training when material policy or procedure changes affect their work. The University communicates training timing and frequency, so complete new assignments in Training Hub and confirm your renewal schedule with your unit.