HITRUST expects every workforce member, including contractors with access to in-scope systems, to receive security awareness training at onboarding and at least annually, to acknowledge security policies, and to receive role-based training where their duties demand it. Assessors test coverage across the whole population, so completion records matter as much as content.
Where does training sit in the HITRUST CSF?
Training sits in Domain 13: Education, Training and Awareness, and is reinforced in Information Protection Program, Incident Management, Mobile Device Security and Data Protection and Privacy. It maps to the HIPAA Security Rule’s security awareness and training standard. Training requirements appear even at e1, because human error remains a leading cause of incidents.
Exact requirement statement wording is licensed within MyCSF. The expectations below reflect what assessors consistently look for.
What are the core expectations?
| Expectation | What good looks like | Evidence |
| Onboarding training | Completed before or shortly after system access is granted | LMS completion report matched to HR joiner list |
| Annual refresher | All workforce members at least every 12 months | LMS report against current headcount |
| Policy acknowledgement | Acceptable use and security policies signed at hire and on change | Signed or electronic acknowledgements |
| Role-based training | Developers, administrators, incident responders, privacy staff | Course records, attendance, certificates |
| Coverage of contractors | Third-party staff with access are included | Contractor roster and completions |
| Ongoing awareness | Reminders, newsletters, phishing simulations | Campaign records and results |
| Programme ownership | Named owner, content reviewed annually | Training plan, review minutes |
| Consequences | Sanctions process for non-compliance | Sanctions policy, HR records |
What topics should the training cover?
1. Handling PHI and sensitive data, including minimum necessary use
2. Phishing, social engineering and business email compromise
3. Passwords, MFA and credential hygiene
4. Acceptable use, including generative AI tools and personal devices
5. Remote and hybrid working security
6. Mobile device and removable media rules
7. Physical security and clean desk
8. Recognising and reporting incidents, with the specific reporting channel
9. Privacy obligations and patient rights
10. Consequences of policy violations
Does HITRUST require phishing simulations?
Treat them as expected practice. Simulated phishing provides measurable evidence that awareness is effective, which is particularly valuable for r2 measured and managed maturity scoring. Track click rate, report rate and repeat offenders, and show that results drive follow-up training.
Who needs role-based training?
| Role | Additional training |
| Software developers | Secure coding, OWASP Top 10, secrets management |
| System and cloud administrators | Privileged access, hardening, logging |
| Incident response team | Plan walkthroughs, tabletop exercises |
| HR and recruiters | Secure handling of personnel data, joiner mover leaver duties |
| Customer support | Identity verification, PHI disclosure rules |
| Executives | Whaling, approval fraud, governance responsibilities |
| Privacy and compliance staff | HIPAA Privacy Rule, breach assessment |
How do assessors test training?
1. Obtain the population: current workforce and new joiners in the period.
2. Select a sample and request completion evidence with dates.
3. Compare join dates to training dates.
4. Inspect content to confirm relevant topics.
5. For r2, inspect the policy and procedure and any metrics.
The most frequent finding is not poor content. It is incomplete coverage: a handful of contractors, executives or long-tenured staff who never completed the course.
How do you build a HITRUST-ready training programme in 30 days?
- Week 1: Approve a training policy and annual plan. Name an owner.
- Week 1: Select an LMS or awareness platform with reporting by user and date.
- Week 2: Reconcile the LMS user list to HR and contractor rosters.
- Week 2: Launch baseline training and policy acknowledgements.
- Week 3: Launch role-based modules.
- Week 4: Run the first phishing simulation. Report results to management.
- Ongoing: Monthly completion dashboard, escalation for overdue staff.
Remember the 90 day incubation rule. Start the programme well before fieldwork.
Key takeaways
- Train everyone at hire and annually, including contractors.
- Add role-based training for higher-risk roles.
- Evidence of complete coverage is what passes the control.
- Phishing simulations supply the metrics that lift r2 scores.
- Launch early to satisfy the 90 day operating period.
Frequently asked questions
Does HITRUST require annual security awareness training?
Yes. Training at onboarding and at least annually for all workforce members is a baseline expectation.
Do contractors need to complete HITRUST training?
Yes, if they have access to in-scope systems or data.
Does HITRUST require phishing tests?
Simulated phishing is widely expected as part of ongoing awareness and provides metrics that support higher maturity scores.
What evidence do assessors ask for?
Completion reports reconciled to HR and contractor lists, training content, policy acknowledgements and the training policy.
Is HIPAA training enough for HITRUST?
Not usually. HITRUST expects broader security topics, role-based training and demonstrable coverage.
About Finstein
Finstein is a HITRUST Authorized External Assessor. Our team includes CCSFP and CHQP qualified HITRUST professionals, CISA certified auditors and ISO 27001 lead auditors, led by Chartered Accountants. We support readiness assessments, validated e1, i1 and r2 assessments, interim assessments and recertification for organisations in the US, India, the UK and the Middle East that serve US healthcare, using an efficient remote delivery model. Have your training programme checked against HITRUST.
