Audit-ready training records
HIPAA Training Evidence Checklist.
Ten questions an audit-ready HIPAA training record should be able to answer. Written for practice managers, HIPAA officers, and compliance consultants who need to evaluate the completeness of a workforce-training file — whether they built it or inherited it.
Free · No login · Linkable resource for practice managers and consultants
The ten questions
If your training file cannot answer these, it is thinner than it looks.
For each item, ask whether your organization’s current training records can produce the answer on demand — without opening a filing cabinet, searching an inbox, or calling a former office manager.
01
Is every learner individually attributable?
Every completion should identify the individual workforce member — not a shared login, not a role account, not the office collectively.
Look for: learner name, organization, and (where applicable) an account or workforce identifier.
02
Is the training title or series recorded?
The record should name the exact training completed. "HIPAA training" is not sufficient; "HIPAA Foundations series, modules 01–19" is.
Look for: series name, module list, or an explicit identifier for the curriculum completed.
03
Is the completion date recorded?
The Privacy Rule's six-year retention runs from creation or from the date the record was last in effect. Neither timeline works without an actual completion date on the record.
Look for: an ISO-formatted completion date, not just a file-modification date.
04
Is the curriculum version identifiable?
Training content changes as regulations and internal policies change. A record should identify the version of the curriculum in effect at the time of completion.
Look for: a version identifier or an effective-date range for the curriculum completed.
05
Is the assessment result retained?
"Watched the video" and "demonstrated comprehension" are different claims. If the training included an assessment, the record should show the score and the passing standard applied.
Look for: score achieved, passing standard, and (where relevant) attempts or retakes.
06
Is the certificate verifiable?
A PDF alone can be edited or reproduced. A verifiable certificate can be confirmed by an independent party without needing to trust the copy presented.
Look for: unique certificate identifier + a public verification mechanism (e.g., QR code linking to a hosted verification record). How verification works→
07
Can the office produce a consolidated roster?
The learner's copy is not the same as the organization's copy. The office should be able to produce a single roster showing training status across the entire workforce.
Look for: an administrator view listing all workforce members, their assigned training, and their current status.
08
Are incomplete personnel visible?
An audit does not ask what was completed. It asks who has not completed what. If your system cannot list overdue or incomplete personnel on demand, the gap is invisible until it isn't.
Look for: filters or reports that surface incomplete, overdue, or unassigned workforce members.
09
Can records be retrieved after personnel leave?
When an employee leaves, the certificate on their laptop, in their email, or in their personal folder leaves with them. The organization's record should not.
Look for: office-owned retention of training records independent of the learner's continued employment.
10
Does the office retain documentation according to its applicable retention obligations?
The Privacy Rule generally requires retention for six years from creation or the date it was last in effect. State law, accreditation, insurance, or contractual obligations may impose longer periods.
Look for: an explicit retention policy and the mechanical means to enforce it, not "we keep records forever unless someone deletes them."
Scoring your file
10 of 10: An audit-ready training program that can defend itself without depending on any single learner. 7–9 of 10: Materially good. The gaps that remain are the ones most commonly cited when investigations go badly. Under 7 of 10: The training may have happened. The organization cannot yet prove it.
In practice
How Patient Protect answers all ten by default.
The HIPAA Foundations series is designed so that every one of the questions above has a built-in answer — not a workflow the office has to invent.
Attributable completions
Each of the 19 modules is completed against an identified workforce account; the certificate carries the learner's name and organization.
Named series and version
The certificate identifies "HIPAA Foundations" and the exact curriculum version in effect at the time of completion.
Assessment retained
Assessment score is recorded on the certificate and in the office record. 95 total questions across the series, 80% passing standard.
Independent verification
Every certificate carries a unique identifier and a QR code that opens the verification record. Anyone can verify without a Patient Protect account.
Consolidated office roster
Office administrators see per-learner scores, per-module completion, and the workforce-wide roster — including who is incomplete or overdue.
Retention independent of the learner
Records are held at the office level. If an employee leaves, the office's evidence remains intact and retrievable.
HIPAA Training Requirements
The authority article. What the Privacy Rule and Security Rule actually require, what counts as proof of completion, and what most practices miss.
Read the articleCertificate verification
How Patient Protect Certificates of Completion are verified. Any party can confirm attribution and validity without needing to trust the copy in front of them.
How verification worksQuestions
About the checklist.
- Is this checklist itself legal advice?
- No. This checklist is an operational reference intended to help practice managers, HIPAA officers, and consultants evaluate the completeness of their own training records. It is not legal advice, does not create a professional relationship, and does not certify compliance. Consult qualified counsel for legal questions specific to your organization.
- What HIPAA requirement does this map to?
- 45 CFR §164.530(b) requires covered entities to train workforce members on applicable policies and procedures and to document that the required training was provided. 45 CFR §164.308(a)(5) requires covered entities and business associates to implement a security-awareness and training program for all workforce members, including management. 45 CFR §164.316 governs documentation and retention. This checklist targets the practical evidence those provisions imply.
- How long should HIPAA training records be retained?
- The Privacy Rule generally requires retention of required documentation for six years from creation or the date it was last in effect, whichever is later (§164.530(j)). The Security Rule imposes a parallel six-year requirement (§164.316(b)(2)(i)). State law, accreditation, insurance, or contractual obligations may impose longer periods.
- Does completing this checklist mean my practice is HIPAA compliant?
- No. This checklist evaluates the training-evidence portion of a compliance program. HIPAA compliance depends on implementation of policies, safeguards, workforce oversight, risk analysis, business associate agreements, incident response, breach notification, and other operational elements beyond training documentation.
Written and reviewed by Angie Perrin, RDH — Chief Security Officer of Patient Protect and a Certified HIPAA Privacy Consultant (CHPC). Last reviewed 2026-08-15.
Free tools stay free
The evidence checklist stays free. The platform runs the program.
This checklist is a diagnostic. Patient Protect is the platform that answers every question with 'yes' by default — attributable completions, versioned curriculum, retained assessments, verifiable certificates, and an office roster that survives workforce turnover. From $39 per office per month.
Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.