Domain B: Workforce Security & Training
Who gets access when they join, what happens when they leave, and an ongoing security awareness and training program.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Authorization and/or supervision procedure for workforce with ePHI access
45 C.F.R. §164.308(a)(3)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Workforce clearance (background screening) procedure
45 C.F.R. §164.308(a)(3)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Termination procedure that revokes system access on the effective date
45 C.F.R. §164.308(a)(3)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Security awareness training delivered to every workforce member, including management (role-based content optional)
45 C.F.R. §164.308(a)(5)(i) · Source: www.ecfr.gov/current/title-45/section-164.308
Training refreshed on a defined cycle (annual is common practice; the rule sets no frequency)
45 C.F.R. §supports 164.308(a)(5)(i); 164.530(b)(2) · Source: www.ecfr.gov/current/title-45/section-164.308
Periodic security reminders issued to workforce
45 C.F.R. §164.308(a)(5)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Malicious-software protection procedure and workforce guidance
45 C.F.R. §164.308(a)(5)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
Log-in monitoring and anomaly-reporting procedure
45 C.F.R. §164.308(a)(5)(ii)(C) · Source: www.ecfr.gov/current/title-45/section-164.308
Password management procedure (creation, change, safeguarding)
45 C.F.R. §164.308(a)(5)(ii)(D) · Source: www.ecfr.gov/current/title-45/section-164.308
Job descriptions define the security responsibilities of every role that touches ePHI
45 C.F.R. §164.308(a)(3)(ii)(A) · Source: www.ecfr.gov/current/title-45/section-164.308
Documented criteria and procedures govern hiring and assigning tasks to roles with ePHI access
45 C.F.R. §164.308(a)(3)(ii)(B) · Source: www.ecfr.gov/current/title-45/section-164.308
A training needs assessment identifies what each role must learn
45 C.F.R. §164.308(a)(5)(i) · Source: www.ecfr.gov/current/title-45/section-164.308
An approved training strategy and plan sets audiences, topics, cadence and delivery, including contractors and business associates
45 C.F.R. §164.308(a)(5)(i) · Source: www.ecfr.gov/current/title-45/section-164.308
Training effectiveness is measured and the plan is updated from the results
45 C.F.R. §164.308(a)(5)(i) · Source: www.ecfr.gov/current/title-45/section-164.308