HIPAA Training for Healthcare Board Members: What to Know

When are healthcare board members considered part of the HIPAA workforce?

A board title alone does not determine whether someone is part of a healthcare organization’s HIPAA workforce. Under HIPAA, the workforce includes employees, volunteers, trainees, and other people whose work for a covered entity or business associate is under that organization’s direct control, whether or not they are paid. Whether a board member meets that test depends on the person’s actual duties and the organization’s control over their work. See the HIPAA workforce definition in 45 C.F.R. § 160.103.

If a board member is part of the workforce, the organization must provide privacy training appropriate to that person’s functions and include them in its Security Rule security awareness and training program. If the member does not meet the workforce definition, HIPAA’s workforce-training requirement may not apply to them on that basis—but the organization may still require training under its own policies or other applicable rules.

Decide the HIPAA workforce designation based on the member’s actual responsibilities, not assumptions about board service. If members may review patient information, receive incident reports containing identifiable details, or use systems that contain electronic protected health information (ePHI), clarify their authorized access and provide training suited to those activities.

What HIPAA training should board members receive for their roles?

Training should match what board members need to do. For members who are part of the workforce, HIPAA requires training on the organization’s privacy policies and procedures as necessary and appropriate for their functions. The Security Rule separately requires a security awareness and training program for all workforce members, including management. See HHS’s HIPAA regulation text and 45 C.F.R. § 164.308.

A board-focused program can explain how members should handle meeting materials, protect confidential information, report suspected incidents, and use approved channels for board communications. It should also explain the organization’s process for escalation, while making clear that the organization—not individual board members acting merely as overseers—has HIPAA’s breach notification obligations when the rule applies. The HHS Breach Notification Rule guidance describes the covered entity’s and business associate’s notification duties.

Where members may receive protected health information (PHI), cover the minimum necessary standard and the organization’s role-based access rules. HIPAA generally calls for reasonable efforts to limit PHI use, disclosure, and requests to what is needed for the intended purpose, subject to exceptions in the rule. Board members should receive only the information and access needed for their authorized responsibilities. See HHS guidance on the minimum necessary requirement.

If board members do not need identifiable PHI to perform their duties, the organization can consider using aggregate or de-identified information for oversight discussions. Training should also explain that a course-completion certificate documents completion of that course; it does not, by itself, establish that the organization or its policies are HIPAA compliant.

How should board members oversee HIPAA risks and safeguards?

Board oversight is most useful when it focuses on governance questions rather than directing day-to-day technical work. Members can ask whether leaders have assigned privacy and security responsibilities, whether significant risks are being addressed, how incidents are escalated, and whether corrective actions are tracked. These are oversight practices, not a separate HIPAA-mandated board training checklist.

For security, ask management to explain the organization’s Security Rule risk analysis process and how identified risks to ePHI are managed. HIPAA requires covered entities and business associates to conduct an accurate and thorough risk analysis and implement measures to reduce identified risks to a reasonable and appropriate level. The applicable requirements are set out in 45 C.F.R. § 164.308.

Board members can also ask how the organization handles vendors that qualify as business associates, including whether required agreements are in place and how concerns are escalated. HIPAA does not generally require a covered entity to monitor every means a business associate uses to perform its safeguards. However, if the covered entity learns of a material breach or violation, it must take reasonable steps to cure it or end the violation and, if those steps fail, terminate the arrangement when feasible. See HHS guidance on business associate oversight.

Training should help members distinguish these oversight responsibilities from operational tasks assigned to privacy, security, compliance, and executive leaders. A board member should know whom to contact and what to do if they receive PHI unexpectedly or suspect a breach.

When is HIPAA training required or refreshed?

For covered entities, Privacy Rule training must be provided to workforce members by the applicable compliance date, to new workforce members within a reasonable period after they join, and to members whose functions are affected by a material change in relevant policies or procedures within a reasonable period after that change takes effect. The rule does not set a universal annual HIPAA training requirement for board members. See HHS’s HIPAA audit protocol summarizing § 164.530(b).

The Security Rule requires a security awareness and training program for the workforce and identifies periodic security reminders as an implementation specification. It does not establish a universal annual training interval. Organizations may choose annual refreshers as a policy or risk-management practice, and may provide additional updates when roles, threats, systems, or policies change. See 45 C.F.R. § 164.308.

What training records should organizations retain?

Keep records showing that required training was provided. Useful workforce training documentation can include the participant’s name and role, completion date, course or material version, topics covered, and evidence of completion. These specific record fields are sensible documentation practices; the training rules require documentation that the training was provided.

For Privacy Rule documentation, HIPAA requires covered entities to retain required documentation for six years from its creation or from the date it was last in effect, whichever is later. The Security Rule also requires retention of required documentation for six years on the same basis. See HHS’s HIPAA regulation text and 45 C.F.R. § 164.316.

Keep the training record alongside, but distinct from, the organization’s policies, risk assessments, and other compliance records. A certificate from a general course may support the record, but it does not replace training on the organization’s own policies and procedures when those apply to the person’s role.

How do state privacy laws affect board training?

HIPAA is a federal baseline, and certain state laws that provide greater privacy protections or rights may continue to apply. Other federal or state requirements can also affect how health information is handled. The applicable rules depend on the information, organization, and circumstances, so organizations operating across jurisdictions should identify which laws affect their policies and board members’ responsibilities. See HHS guidance on HIPAA and state-law preemption.

State privacy or breach-notification laws may impose additional or different obligations. Organizations should have privacy or legal staff identify relevant state-specific requirements and update training when those requirements materially affect board members’ duties. Avoid treating a generic HIPAA course as a substitute for applicable state privacy training requirements.

In short, board training should reflect each member’s role, access, and applicable policies. Determine workforce status based on actual duties and control, provide timely role-appropriate privacy and security training when required, and retain clear records while keeping state-law requirements in view.

FAQs

Are healthcare board members required to receive HIPAA training?

It depends on their role. If a board member is part of the covered entity’s workforce, the organization must provide privacy training appropriate to that person’s functions and include them in its Security Rule security awareness and training program. A board title alone does not establish workforce status; the organization should assess the member’s duties and whether their work is under its direct control.

Does HIPAA require annual training for board members?

No universal federal rule requires annual HIPAA training for board members. HIPAA requires initial and role-appropriate training in specified circumstances, and the Security Rule calls for a security awareness and training program with periodic security reminders. An organization may set an annual refresher as its own policy or risk-management practice.

What HIPAA topics should board member training cover?

Cover the organization’s privacy and security policies relevant to the member’s role, permitted access to PHI, minimum necessary practices where applicable, protection of board materials and communications, incident reporting, and the organization’s escalation process. Include vendor and breach-response oversight topics when they relate to the board’s responsibilities.

How should an organization document board members’ HIPAA training?

Record who completed the training, when it occurred, what material or policy version was covered, and how completion was confirmed. Retain required HIPAA documentation for six years from creation or from when it was last in effect, whichever is later. A course certificate can be part of the record, but it does not alone demonstrate organizational HIPAA compliance or replace applicable employer-specific policy training.