HIPAA doesn't specify what annual security training must cover, how long it must be, or what format it must take. What it does specify is that covered entities must implement "a security awareness and training program for all members of its workforce." The word "all" is not qualified — it applies to the field nurse on her first day and the billing coordinator who has been with the agency for fifteen years. It applies to the agency owner. It applies to the contractor who provides billing services and has access to patient financial data. If they touch ePHI, they need training, and you need documentation proving they had it.
The annual training requirement is one of the most commonly cited deficiencies in OCR HIPAA audits of home health agencies — not because agencies fail to conduct training, but because they fail to document it in a way that demonstrates compliance. A training session that happened but cannot be proven happened is, from an OCR perspective, a session that did not happen.
Designing Training Content That Actually Works
Generic cybersecurity awareness training — the kind that covers phishing, password security, and social engineering in terms suited for office workers at a technology company — is not well-designed for home health staff. A nurse documenting a visit in a patient's living room faces different risk scenarios than an office worker sitting at a desk. Training that addresses her actual environment produces behavioral changes that generic training does not — see Security Awareness Training That Actually Works for Home Health Care Teams for a deeper look at why mobile-first, field-scenario training outperforms the standard desktop-oriented module, including the specific ways mobile phishing differs from what generic training prepares staff for.
Role-Based Content Segmentation
Design training with at minimum three role-specific tracks: clinical field staff (nurses, therapists, aides), administrative and office staff (scheduling, billing, coordination), and supervisory and management staff. Each track should address the HIPAA security requirements through the specific scenarios that role encounters.
Field nurse training should cover device security in patient homes, appropriate use of cellular data vs. patient WiFi for EHR access, the physical security implications of device loss in a vehicle, and what to do in the critical window right after clicking a suspicious link — see How to Respond to a Phishing Email at Your Home Health Agency: The 6-Step Staff Protocol for training content ready to build directly into this track.
Billing and scheduling staff training should cover recognizing business email compromise targeting payment processes and secure handling of Medicare and Medicaid documentation — and should specifically address phone-based social engineering, since scheduling departments are frequently targeted with attacks that look nothing like a phishing email; see Social Engineering Attacks Targeting Home Health Scheduling Staff for the specific scenarios this track should include.