HIPAA training for home care agencies

HIPAA training for home care and home health teams, one seat per caregiver

Caregivers carry client information into homes, cars, and phones every shift. HIPAA requires covered agencies to train every workforce member, Medicare's home health rules tie the clinical record to HIPAA, and states such as Texas, Pennsylvania, and Illinois write confidentiality or privacy into the training rules that reach home care staff.

Buy a seat for every caregiver, nurse, scheduler, and office lead in one order, invite them by email after payment, and track each certificate from the team workspace.

Price my team See the requirements

$39for one caregiver

$16per caregiver at 100+

1 yearcertificate term

Start here

Whether HIPAA applies depends on how your agency is paid

HIPAA covers a health care provider “who transmits any health information in electronic form in connection with a transaction covered by this subchapter,” in the words of 45 CFR 160.103. An agency that bills Medicare, Medicaid, or a health plan electronically meets that test. An agency paid only privately by clients may not, although it can still be a business associate of a hospital, plan, or other covered entity it works for.

State rules do not wait for that answer. Texas, Pennsylvania, and Illinois each write confidentiality or privacy into training rules that reach home care staff, whatever the agency's HIPAA status. If you are unsure where your agency lands, the covered entity checker walks through the questions.

Who counts as your workforce

HIPAA's definition at 45 CFR 160.103 reaches everyone under the agency's direct control, whether or not they are paid.

Caregivers, aides, and companions on your payroll.
Nurses, therapists, and clinical supervisors.
Schedulers, intake coordinators, billers, and office managers.
Volunteers and trainees who work under your direction.

Federal requirements

What HIPAA and Medicare require of home care and home health agencies

Each card quotes the regulation it links to. The Medicare entries apply to Medicare-certified home health agencies. Reviewed November 3, 2026.

HIPAA Privacy Rule

Train every workforce member on your privacy policies

“A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.”

Timing: New workforce members within a reasonable period after joining, and anyone whose functions are affected by a material policy change. Document it and keep the record six years.

45 CFR 164.530(b) and (j)(2)

HIPAA Security Rule

Run security awareness training, management included

“Implement a security awareness and training program for all members of its workforce (including management).”

Timing: No interval stated. Applies to covered entities and to business associates, with periodic security updates as an addressable specification.

45 CFR 164.308(a)(5)

Medicare home health

Clinical records must follow the HIPAA rules

“The HHA must be in compliance with the rules regarding protected health information set out at 45 CFR parts 160 and 164.”

Timing: A standing condition of participation for Medicare-certified home health agencies. Patients also hold the right to a confidential clinical record under 42 CFR 484.50(c)(6).

42 CFR 484.110(d)

Medicare aide training

Privacy is part of aide training, and in-service hours repeat yearly

“A home health aide must receive at least 12 hours of in-service training during each 12-month period.”

Timing: Every 12 months, supervised by a registered nurse. Basic aide training must address respect for the patient's privacy. The rule does not name HIPAA as a required in-service topic.

42 CFR 484.80(b)(3)(viii) and (d)

State examples

Three states whose training rules reach home care staff

These are examples, not a survey of every state. Licensing rules for home care, home health, and personal care agencies vary widely, so check your own state agency's rules before you set a training calendar.

Texas

Training within 90 days of hire, with a signed statement

“An employee of a covered entity must complete training described by Subsection (a) not later than the 90th day after the date the employee is hired by the covered entity.”

Timing: Within 90 days of hire, and within a reasonable period (no later than one year) after a material change in law affects an employee's duties. Each employee signs a completion statement the agency keeps until its sixth anniversary.

Texas Health and Safety Code 181.101

Pennsylvania

Confidentiality is the first required competency area

“A competency examination or training program developed by an agency or registry for a direct care worker must address, at a minimum, the following subject areas: (1) Confidentiality.”

Timing: Before the worker is assigned to a consumer, then a documented competency review at least once per year.

28 Pa. Code 611.55(b) and (e)

Illinois

Confidentiality in initial training, privacy every year

“Confidentiality of client's personal, financial and health information”

Timing: Ten initial hours (five before the first assignment, five within 30 days), then at least ten hours each year that include client privacy and rights.

77 Ill. Adm. Code 245.71(c), (e) and (f)

Why caregivers

Home care puts PHI where the agency cannot see it

Office staff work where the agency controls the doors, screens, and files. Caregivers work in clients' homes, in their own cars, and on their own phones, which is why the training has to land with the people in the field.

Family and visitors

Not everyone in the house is on the care plan

A daughter on the phone, a neighbor at the door, a relative visiting from out of town. Caregivers need to know who may hear what before they answer a question.

Scheduling texts

Client updates drift into personal text threads

Shift swaps, late arrivals, and condition updates move fast. Approved channels and minimum necessary keep client details out of personal messages and group chats.

Paper on the road

Care plans and visit notes ride between homes

Paper left on a car seat or a client's counter is the most ordinary way a home care record gets lost. Training sets the rule for where paper goes at the end of each visit.

Phones and apps

A clinical or visit app on a personal phone is ePHI on the go

Screen locks, unique logins, no screenshots, and reporting a lost phone the same day are the safeguards that matter most for staff who never sit at an office workstation.

Inside the home

Privacy looks different in someone's living room

Medication lists on the refrigerator, mail on the table, and conversations other residents can hear. Caregivers protect privacy in a space the agency does not control.

Incidents

A wrong recipient or lost folder is reported, not fixed quietly

The agency decides whether an incident is a breach. The caregiver's job is to stop the spread, write down what happened, and report it right away.

What caregivers learn

HIPAA Essentials: six modules, then the assessment

Caregivers and office staff take the same HIPAA Essentials course, at their own pace on any device. Modules include short knowledge checks, and the certificate is issued only after a passing score of at least 80% on the final assessment. Texas agencies can add the Texas HB 300 course for the state-law layer.

Module 1
HIPAA Foundations
What HIPAA does and does not do, what PHI and ePHI are, who counts as a covered entity or business associate, and why minimum necessary matters in real workflows.
Module 2
Privacy Rule and Minimum Necessary
Permitted uses and disclosures, treatment/payment/operations, patient rights, authorizations, incidental disclosures, and front-desk or phone scenarios where minimum necessary discipline matters.
Module 3
Security Rule and Everyday Safeguards
Administrative, physical, and technical safeguards for ePHI, including passwords, access control, workstation discipline, malware awareness, device security, and remote access basics.
Module 4
Business Associates and Communications
Who counts as a business associate, when a BAA matters, how to handle vendors and cloud tools, and how to think about texting, emailing, and portal-based communication.
Module 5
Incidents and Breach Response
What to do after a suspected privacy or security incident, how to escalate quickly, what to document, and how breach review and notification timing work at a high level.
Module 6
Final Review and Assessment Prep
Short recap, final checklist, sanctions reminder, and clear instruction on what the learner should know before starting the assessment.

How a team order works

From one order to a certificate for every caregiver

No sales call and no account setup before you pay. This is the same purchase path every team buyer uses.

Enter how many seats you need

Type the number of caregivers into the team form. The cart prices every seat at the volume tier for that quantity, and a signed-out buyer only enters the email the receipt and login will use.

Pay once for the whole order

Checkout runs through Stripe and the whole order arrives on one receipt. Pay once, or choose the optional annual renewal plan the cart offers.

Set up your team and invite caregivers

After payment, name your organization on the purchase page and you become its owner and administrator. Invite each caregiver by email, one at a time or as a pasted list with bulk invite, and keep a seat for yourself if you need one.

Watch progress in one place

The team workspace shows each learner as invited, not started, in progress, completed, renewal due, or expired, with unused seats summarized by course instead of listed one by one.

Keep the certificates

Each caregiver who passes the assessment gets a certificate with their name, the course, issue and expiration dates, and a verification code. Download it or open its verification page from the progress view, and anyone holding the code can confirm it at usahipaa.com/verify.

Reassign a seat before training starts

If a caregiver leaves before starting, release the seat and invite a replacement. A seat locks to its learner once that person begins training.

Team pricing

Volume pricing for HIPAA Essentials, per caregiver

These are the cart's own one-time prices. The tier is set by the number of seats in the order, and when a team admin adds seats for a team they manage while signed in, seats the team already holds count toward the tier.

HIPAA Essentials price per caregiver by order size, one-time payment
Order size	Price per caregiver	Example order
1 learner	$39	1 caregiver: $39
2-9 learners	$29	2 caregivers: $58
10-24 learners	$24	10 caregivers: $240
25-49 learners	$21	25 caregivers: $525
50-99 learners	$18	50 caregivers: $900
100-1,000 learners	$16	100 caregivers: $1,600

Records

Keep the record a surveyor or state reviewer will ask for

HIPAA asks you to document that training happened and keep that documentation for six years. State rules ask for more specific records, and some of them belong in your own files rather than on a course certificate.

A USA HIPAA certificate supplies the learner's name, the course, issue and expiration dates, and a code anyone can verify. Signed statements, in-service logs, RN supervision notes, and competency reviews stay with the agency.

Home care training file checklist

A dated completion record for every workforce member, kept six years under 45 CFR 164.530(j)(2).
New hires trained within a reasonable period after joining, and within 90 days of hire in Texas.
In Texas, each employee's signed completion statement, kept until its sixth anniversary.
For Medicare-certified agencies, documentation of each aide's 12 in-service hours in the 12-month period.
In Pennsylvania, proof of competency and the annual competency review in each direct care worker's file.
In Illinois, the date, time per topic, instructors and their qualifications, a content summary, and a signature or time-stamped certificate for each training.

Open the training log kit

Frequently asked questions

Questions home care owners ask before buying team training

Do home care agencies have to provide HIPAA training?

If the agency is a HIPAA covered entity, yes. A covered health care provider is one that transmits health information electronically in a standard transaction, which includes an agency that bills Medicare, Medicaid, or a health plan electronically. Covered agencies must train every workforce member under 45 CFR 164.530(b) and run a security awareness and training program under 45 CFR 164.308(a)(5). An agency paid only privately by clients may fall outside the covered entity definition, but it can still be a business associate of a covered entity it works for, and state rules such as those in Texas, Pennsylvania, and Illinois put confidentiality or privacy into staff training regardless.

How often do caregivers need HIPAA training?

HIPAA sets no annual interval. It requires training for new workforce members within a reasonable period after they join and again when a material policy change affects their duties. State rules add their own clocks: Texas requires training within 90 days of hire, Pennsylvania requires an annual competency review, and Illinois requires at least ten hours of training every year that include client privacy. Training at hire and then every year keeps HIPAA training on the same calendar as those cycles, and USA HIPAA certificates carry a one-year term to match. State hour requirements, such as Illinois's ten annual hours, cover more topics than HIPAA alone.

Does this count toward the Medicare 12-hour in-service requirement?

That is your agency's call. Under 42 CFR 484.80(d), in-service training may be offered by any organization but must be supervised by a registered nurse, and the agency keeps the documentation. The rule does not name HIPAA as a required in-service topic. Agencies that use this course toward in-service hours should record the RN supervision and the hours in their own in-service log.

Which of our staff need a seat?

HIPAA's training standard covers all members of the workforce, so count caregivers, aides, nurses, therapists, schedulers, intake and billing staff, and managers. HIPAA defines the workforce as employees, volunteers, trainees, and others under the agency's direct control, whether or not they are paid. Each person needs their own seat because the certificate is issued to the named learner.

Do Texas agencies need anything extra?

Texas Health and Safety Code 181.101 requires training on state and federal privacy law within 90 days of hire and a signed completion statement from each employee, kept six years. Texas defines covered entity broadly enough to include anyone who comes into possession of protected health information. A certificate supports that record, and the separate Texas HB 300 course covers the state-law layer.

What proof do we get for each caregiver?

Each caregiver who passes the assessment gets a certificate with their name, the course, issue and expiration dates, and a verification code that a surveyor, client, or referral partner can check on the public verification page. Admins can open every certificate from the team progress view.

How long does the course take, and can caregivers do it on a phone?

HIPAA Essentials has an estimated duration of about 90 minutes, including the final assessment. It is self-paced and works on any device, so caregivers can complete it between visits. The certificate is issued after a score of at least 80% on the final assessment.

Other home health and home care training pages

Home health

HIPAA training for home health agencies

Rollout planning for home health teams: field documentation, supervision, and caregiver coordination.

See the rollout guide

Role

HIPAA training for home health aides

The aide's view of in-home documentation, mobile devices, and caregiver communication.

See aide training

Industry

HIPAA for home health and hospice

Industry overview for home health and hospice providers.

Read the overview

Texas

Texas HB 300 training requirements

Section 181.101 in detail: the 90-day deadline, update training, and signed statements.

Read the Texas guide

Guide

A HIPAA training plan for home health agencies

Curriculum ideas for in-home visits, mobile documentation, and caregiver communication.

Read the plan

Transportation

HIPAA training for NEMT drivers

Broker requirements and fleet ordering for non-emergency medical transportation companies.

See NEMT training

Sources

Every requirement on this page comes from one of these documents. State rules change, so check the current text for your state before you rely on a deadline.

45 CFR 164.530: Privacy Rule training standard at (b) and six-year documentation retention at (j)(2).
45 CFR 164.308: security awareness and training program at (a)(5).
45 CFR 160.103: definitions of covered entity and workforce.
42 CFR 484.50: home health patient rights, including a confidential clinical record at (c)(6).
42 CFR 484.80: home health aide training subjects at (b)(3) and 12 hours of in-service training per 12-month period at (d).
42 CFR 484.110: protection of clinical records under 45 CFR parts 160 and 164 at (d).
Texas Health and Safety Code 181.101: training within 90 days of hire, update training after a material change in law, and signed completion statements. The covered entity definition is in Section 181.001.
28 Pa. Code 611.55: direct care worker competency subjects, including confidentiality, and the annual competency review.
77 Ill. Adm. Code 245.71: home services worker training hours, subjects including confidentiality, annual training, and documentation.

Train every caregiver

One order, one certificate per caregiver

Seats start at $39 for one caregiver and drop to $16 per caregiver at 100 or more. Enter your headcount to see the exact price in the cart.

Price my team See certificate verification