Section § 164.308(a)(5)Security awareness and training

(5)(i) Standard: Security awareness and training. Implement a security awareness and training program for all members of its workforce (including management).

(ii) Implementation specifications. Implement:

(A) Security reminders (Addressable). Periodic security updates.

(B) Protection from malicious software (Addressable). Procedures for guarding against, detecting, and reporting malicious software.

(C) Log-in monitoring (Addressable). Procedures for monitoring log-in attempts and reporting discrepancies.

(D) Password management (Addressable). Procedures for creating, changing, and safeguarding passwords.

HIPAA, the United States rules protecting health information, § 164.308(a)(5)

Text: 45 CFR Part 164, from the Electronic Code of Federal Regulations (eCFR) as it stood on 6 October 2026.