Compliance
Compliance Training for Healthcare Staff: HIPAA, OSHA and FWA
Healthcare compliance training runs on several clocks: HIPAA's starts when someone joins or a policy changes, your licensing board's at each renewal, and OSHA's every year: staff with occupational exposure to blood must be trained at initial assignment and within one year of the last session, at no cost and during working hours. We develop and coordinate required workforce training, from HIPAA, OSHA and fraud, waste and abuse to infection control and patient rights.
The short answer
What healthcare compliance training is required, and how often?
Each rule sets its own clock: HIPAA, for new workforce members within a reasonable period and after a material policy change; OSHA, for staff exposed to blood at initial assignment and within one year of the last session; OIG's guidance, at least once a year. The Advixor Group develops and coordinates required workforce training, from HIPAA, OSHA and fraud, waste and abuse to infection control and patient rights.
Sources45 CFR 164.53029 CFR 1910.1030OIG compliance program guidance
Rule by Rule
Healthcare compliance training by rule: who and when
| Training | Who | When | Rule |
|---|---|---|---|
| HIPAA privacy policies | Every workforce member, as their job requires | New members within a reasonable period; anyone affected by a material policy change | 45 CFR 164.530(b) |
| HIPAA security awareness | All workforce, management included | An ongoing program | 45 CFR 164.308(a)(5) |
| OSHA bloodborne pathogens | Staff with occupational exposure | At initial assignment; within one year of the last training; when tasks change | 29 CFR 1910.1030(g)(2) |
| OSHA hazard communication | Staff exposed to hazardous chemicals | At initial assignment; whenever a new chemical hazard arrives | 29 CFR 1910.1200(h) |
| Florida biomedical waste | Staff who handle it | Before handling it; a refresher every year | Rule 64E-16.003(2) |
| Section 1557 nondiscrimination | Staff who deal with patients or decide on their care or bills, at practices that receive federal financial assistance | Every relevant employee within 30 days of implementing the § 92.8 policies; new ones within a reasonable period; after a material policy change | 45 CFR 92.9 |
| Compliance program and fraud and abuse laws | Board members, officers, employees, contractors, medical staff | At least once a year (OIG’s guidance, not a regulation) | OIG guidance, pp. 46–48 |
Sources eCFR (current as of Oct 15, 2026); Florida Administrative Code; HHS-OIG General Compliance Program Guidance (Nov 2023). Read Oct 19, 2026.
A practice with 15 or more employees also names a Section 1557 Coordinator, who coordinates that training (45 CFR 92.7). Topics no rule above names still get surveyed: infection prevention and emergency management are among AAAHC’s most common primary-care deficiencies (accreditation). We put each employee’s trainings and each license’s CE due dates on one calendar.
HIPAA
HIPAA compliance training for employees
The security program’s four addressable topics are security reminders, protection from malicious software, log-in monitoring and password management (45 CFR 164.308(a)(5)).
After an investigation, OCR can require more: in an August 2026 right-of-access case with an eye care group ($50,000), the corrective action plan required access training for every workforce member within 90 days and at least every 12 months after, new members within 30 days of starting, and a dated certification from each person.
OSHA
Beyond HIPAA: OSHA training on bloodborne pathogens and chemicals
Hazard communication is OSHA’s second most cited standard in its preliminary count for fiscal 2026 (Oct 1, 2025 to Aug 31, 2026).
- 14required elements in the bloodborne pathogens course, among them a copy of the standard, your exposure control plan, protective equipment, the hepatitis B vaccine and what to do after an exposure.
- 10working days from initial assignment to offer the hepatitis B vaccine, free.
- 2hazard communication training dates in OSHA’s 2024 update, as extended in January 2026: November 20, 2026 for newly classified substances and May 19, 2028 for mixtures.
Sources 29 CFR 1910.1030 and 1910.1200(j); 91 FR 1695.
The bloodborne pathogens trainer must know the subject as it applies to your workplace, and the material must suit employees’ education, literacy and language (29 CFR 1910.1030). Hazard communication training covers how to detect a chemical release, the hazards, how to protect yourself, labels and safety data sheets, and where the written program, chemical list and data sheets are kept.
Fraud and Abuse
Fraud, waste and abuse (FWA) training: when CMS and your contracts require it
Medicare Advantage plans must train their own employees, leaders and board every year and at orientation (42 CFR 422.503(b)(4)(vi)(C)). Since January 1, 2019, CMS no longer requires that training of the practices in their networks; a plan can still write it into your contract (payer contracting).
OIG’s guidance has compliance training review these laws and topics:
- the False Claims Act, the anti-kickback statute and the physician self-referral law;
- topics by role: billing, coding, documentation, medical necessity, patient inducements, gifts, referral relationships and marketing (compliance program).
CMS’s Medicare Learning Network offers two courses, “Combating Medicare Parts C and D Fraud, Waste, & Abuse” (30 minutes) and “Medicare Fraud & Abuse: Prevent, Detect, Report” (88 minutes), without CE credit. OIG also notes that training from an affiliated hospital can raise anti-kickback and self-referral questions; those go to your attorney.
License Renewal
Training and compliance at license renewal: Florida CE
- Every renewal: a 2-hour course on preventing medical errors, for every DOH profession (s. 456.013(7)). DEA-registered prescribers must include a 2-hour course on prescribing controlled substances (it counts toward the total), and DOH “may not renew” without it (s. 456.0301); APRNs and prescribing PAs take 3 hours under their own practice acts instead (ss. 464.013(3)(b), 458.347(4)(e)4.).
- Every third renewal: 2 hours on domestic violence for physicians, nurses, dentists, midwives and ch. 491 counselors and therapists (s. 456.031). Ch. 491 licensees also take it within six months of licensure, add 3 hours of laws and rules every third renewal, and a qualified supervisor adds 4 hours of supervision training (clinical supervision).
- Human trafficking: nurses take 2 hours every renewal; physicians, dentists, chiropractors, podiatrists, optometrists, pharmacists, physical therapists and massage therapists take a one-time 1-hour course (due by January 1, 2021, s. 456.0341) and post a workplace sign at least 11 by 15 inches, in at least 32-point type, in English and Spanish, with the hotline 1-855-FLA-SAFE.
DOH checks CE in its electronic tracking system at renewal (verify a Florida license); physicians’ CME does not carry over between cycles, and ch. 491 licensees owe none at their first renewal (therapy practices).
Sources Rules 64B9-5.002, 64B4-6.001 and 64B8-13.005, F.A.C.; s. 464.013(3), F.S.; Board of Nursing APRN renewal page. Read Oct 19, 2026.
Training Records
Annual compliance training records: what to keep and for how long
- Bloodborne pathogens: the dates, the content or a summary, the trainers’ names and qualifications, and each attendee’s name and job title (29 CFR 1910.1030(h)(2)).
- HIPAA: proof the training was given, kept 6 years (45 CFR 164.530(j)).
- Section 1557: completion documented at the time, kept at least 3 calendar years (45 CFR 92.9(c)).
- Biomedical waste: training records kept with the operating plan for 3 years (Rule 64E-16.003(2)).
- OIG’s guidance: completion as a basic part of each employee’s annual performance evaluation.
We help you maintain training records, from sign-in sheets to training certifications, along with competency validations and audit records (audit readiness).
“Training records shall be maintained for 3 years from the date on which the training occurred.”
What’s included
What our healthcare compliance training includes
HIPAA compliance
The HIPAA privacy and security policies your workforce is trained on, written and kept current.
Learn moreOSHA for medical offices
OSHA's bloodborne pathogens and hazard communication rules for a medical office.
Learn moreHR and staff training
Onboarding, orientation and in-service education, coordinated with HR.
Learn moreDocumentation audits
Monthly training by role and identified needs, alongside weekly progress-note review.
Learn moreHIPAA checklist
Every HIPAA document and deadline, including the 6-year record rule.
Learn moreOIG exclusion checks
How to check staff and contractors against OIG's exclusion list.
Learn moreQuick answers
Healthcare compliance training questions: HIPAA, FWA and online courses
HIPAA timing, who needs training, what counts as fraud, waste and abuse, online courses and how to report. Ask about your own staff in a consultation.
How often is HIPAA training required?
Who needs HIPAA training?
What counts as fraud, waste and abuse?
Can staff take compliance training online?
How do I report fraud, waste or abuse?
Talk to an advisor
You care for patients. Who’s taking care of the business?
Tell us where your practice is today. We will tell you what we would do first.
Official sources
- eCFR (current as of Oct 15, 2026), read Oct 19, 2026: 45 CFR 160.103, 164.308, 164.530, 92.7 and 92.9; 29 CFR 1910.1030, 1910.1200 and 1903.15; 42 CFR 422.503
- Federal, read Oct 19, 2026: HHS-OIG, General Compliance Program Guidance (Nov 2023); CMS, Medicare Fraud & Abuse: Prevent, Detect, Report (MLN4649244, April 2026) and MLN web-based training; HHS-OCR, resolution agreements; Federal Register, HIPAA Security Rule proposal (Jan 6, 2025), hazard communication extension (91 FR 1695, Jan 15, 2026) and CMS-4182-F (Apr 16, 2018); OSHA, Top 10 cited standards (preliminary FY 2026); AAAHC, 2025 Quality Roadmap release (Sept 18, 2025)
- Florida, read Oct 19, 2026: Florida Statutes s. 456.013, s. 456.0301, s. 456.031, s. 456.0341 and s. 464.013; Florida Administrative Code 64B8-13.005, 64B4-6.001, 64B9-5.002 and 64E-16.003; Board of Medicine, MD renewal; Board of Nursing, APRN renewal