HIPAA Training Log & Acknowledgment Template

What a HIPAA training log has to prove

The Privacy Rule requires every covered entity to train all members of its workforce on its PHI policies and to document that the training happened (45 CFR 164.530(b)). The Security Rule adds a security awareness program with periodic updates (164.308(a)(5)). Neither rule prescribes a form. What OCR asks for in an investigation is simple: who was trained, on what, when, by whom, and the signed acknowledgment. This log records exactly those fields, and the training requirements guide walks through the rule text.

When training must be logged

How to use this template

1. 1

   Set the practice header and refresher cycle

   Enter the practice name and Privacy Officer. Choose 12 months unless your written policy says otherwise; the next-due column recalculates immediately.

2. 2

   Fill in each workforce member

   Name, role, hire date, last training date, method, trainer and quiz score. Include volunteers, students, temps and contractors who touch PHI: they are workforce under 45 CFR 160.103.

3. 3

   Tick the topics covered

   Each topic maps to a regulation section so an auditor can see coverage at a glance. Tick Bloodborne pathogens only for staff with occupational exposure.

4. 4

   Act on the status badges

   Red means the refresher date has passed; amber means it is inside 30 days; dark red means no training on file at all. Schedule those first.

5. 5

   Print the acknowledgment for each person

   Switch to the Employee acknowledgment tab, pick the name, print, sign, and file. Keep the signed copy 6 years.

Pair the log with the free HIPAA training quiz for the score column, and with the onboarding checklist so new hires cannot reach the EHR before the first row is filled.

Retention periods that apply to this record

Two agencies, two clocks. Keep the longer one when a record satisfies both.

State medical-record and employment laws can be longer. If staff have occupational exposure, the exposure control plan generator covers the OSHA side, and the bloodborne pathogens training guide explains what the annual session must include.

What an investigator looks for

OCR’s data requests in breach investigations routinely ask for “evidence of workforce training” for the period before the incident. A log that fails usually fails one of these ways:

• Training dates exist but no content: a date without topics does not show the person was trained on your policies.
• New hires trained months after they were given EHR access. Compare the hire-date and trained columns.
• No retraining after a material change, such as the switch to a new patient texting platform.
• No signed acknowledgment, so the sanctions policy cannot be enforced when a common violation happens.

Put the log on the agenda of every compliance committee meeting and fold the overdue count into your annual work plan. Missing training also shows up as a finding in the HIPAA audit checklist.

Frequently asked questions

For what a certificate does and does not prove, read HIPAA and bloodborne pathogens certification. For the penalty exposure when training is missing, see HIPAA violation penalties.