HITRUST security awareness training
HITRUST CSF is a certifiable framework that folds HIPAA, NIST, ISO and dozens of other sources into one control set. Workforce training sits in its Education, Training and Awareness domain, and every assessment tier tests it.
Five-to-ten-minute 3D exercises mapped to each HITRUST duty, with completion evidence your auditor can export.
At a glance
- Framework
- HITRUST CSF v11, now at v11.9.0
- Assessments
- e1 and i1 valid one year, r2 valid two years
- Training domain
- Education, Training and Awareness
- Penalty
- No fines: a lost or delayed certificate and open CAPs
Three assessments, one training control
The tier changes how many requirements an assessor tests. It does not change whether your staff need training.
- e1 Essentials, 1 year 43 foundational requirements. Often the first ask from a smaller vendor.
- i1 Implemented, 1 year 182 requirements built around current threats. Includes everything in e1.
- r2 Risk-based, 2 years The largest set, tailored to your risk factors, with an interim check at year one.
Every e1 requirement is carried into the i1, and every i1 requirement into the r2. A training program built for e1 keeps working as you move up.
One learning path for the training requirements
HITRUST CSF Security Awareness Training runs eight steps, from your role under the security policy to how you report an incident.
- Eight steps
- Policies, phishing, passwords, sensitive data, devices, workplace, public spaces and incident reporting.
- Assigned every 12 months
- The path re-assigns itself each year, so nobody slips past their anniversary.
- Records per person
- PDF certificates, a tenant CSV and a compliance report page, with sync to Vanta or Drata.
How training is assessed under the HITRUST CSF
Where training sits in the CSF and what an assessor asks to see.
01 Pick the tier your customer asked for
The e1 has 43 requirements and is valid for one year. The i1 has 182 and is also valid for one year. The r2 is tailored to your risk factors and is valid for two years.
Training is in scope for all three. What changes is how many related requirements the assessor tests alongside it.
02 Define who is in scope
A HITRUST assessment covers a defined scope: the systems, facilities and people that handle the data your customers care about.
Everyone in that scope needs training. That usually includes contractors with access, not only payroll employees.
03 Cover the content the requirements name
Assessors look for training on your security policy, how to recognise threats like phishing, how to protect credentials and data, and how to report a suspected incident.
The exact requirement statements depend on your tier and CSF version, and you see them in MyCSF once your assessment is set up.
04 Match the training to the written policy
An assessor compares what you trained against what your policy says. A course that skips your reporting route or your password rules leaves a gap.
Keep the policy version next to the content version so the two can be checked side by side.
05 Keep evidence the assessor can sample
Expect a request for a population list and a sample from it. For each sampled person you will need the course, the completion date and proof the content matched your policy.
A dashboard total is not enough. Have the per-person record ready.
06 Keep it running between assessments
An r2 certificate needs an interim assessment around the one-year mark to stay valid. Annual training that lapses in month nine shows up there.
Re-assigning training every 12 months keeps you ready for both the interim and the next full assessment.
07 HITRUST training people finish
Each step is an interactive exercise. The learner reads an inbox, takes a call or works a desk and has to make a call.
Feedback points to the cue they missed and what your policy says to do instead.
Phishing, smishing and deepfake drills run between annual cycles. They give you a second kind of evidence: what people did when a realistic lure arrived.
Completion evidence is per person. You get a PDF certificate for each learner, a tenant-wide CSV, and a compliance report page you can hand to an assessor.
If you use Vanta or Drata, the records sync there too.
HITRUST domains, mapped to exercises
The CSF domains a phishing click or a lost laptop touches, with the exercise that rehearses each one.
01 Information Security Management Program 07 Vulnerability Management 08 Access Control 09 Communications & Operations 11 Information Security Incident Management 12 Business Continuity & Disaster Recovery Recommended exercises
Picked for the people a healthcare customer’s assessor is likely to sample.
Training for the domains around it
The CSF domains next door to training, and the scenario for each.
Education, Training and Awareness
The policy step opens the path because assessors want staff to know what the policy says and what their part is.
Each later step ends with the action the policy expects, so the training and the written policy agree.
Incident Management
The last step of the path is incident reporting: what to report, how fast and to whom.
The general incident reporting exercise rehearses a real report, which helps when an assessor asks how staff raise a suspected breach.
Password Management
Passwords and account security cover password managers, MFA and why reused credentials matter.
The MFA fatigue exercise adds the push-spam attack that still gets people to approve a sign-in they did not start.
Endpoint and Mobile Device Security
Device security covers locking, patching and what to do when a phone or laptop goes missing.
Working in public spaces is optional in the path. Assign it to staff who work from clinics, hotels or trains.
Data Protection and Privacy
Protecting sensitive information teaches people to recognise regulated data and send it only through approved channels.
It pairs with the HIPAA privacy duties if you also fall under that rule.
Physical and Environmental Security
Workplace security covers tailgating, visitors, clean desks and printouts left on the tray.
These are the gaps a walk-through on assessment day tends to find.
What a training gap costs under HITRUST
What a training gap costs when the penalty is a report, not a fine.
A requirement scores low and opens a CAP
When a requirement does not score well enough, it can produce a corrective action plan. The CAP names what you will fix and by when.
CAPs appear on the report your customer reads, so a training gap becomes something you explain in a vendor review.
The r2 interim looks at open CAPs
The r2 interim assessment re-tests a sample of requirements and reviews where your corrective action plans stand. HITRUST expects real progress on them by then.
A training CAP opened at certification is likely to be looked at again a year later.
Missing the window means no certificate
Certificates expire. If your e1 or i1 lapses, or an r2 interim is not submitted on time, a deal that depends on the certificate can stall.
The fix is to treat training as a recurring control with a calendar, not a task you redo before each assessment.
Further reading
Related glossary terms
References
- HITRUST Assessments and Certifications HITRUST Alliance
- HITRUST CSF HITRUST Alliance
- HAA 2025-005: HITRUST CSF v11.7.0 release HITRUST Alliance
- HIPAA Security Rule HHS Office for Civil Rights
Hand your assessor the sample before they ask
Annual HITRUST training with a dated record for every person in scope.
Frequently asked questions
What is HITRUST security awareness training?
HITRUST training is how you show an assessor that the people inside your certified scope know the policy, spot phishing and report incidents. RansomLeak gives you an eight-step HITRUST path, renewed every year, with a record for each person.
Does HITRUST require security awareness training?
Yes. Education, Training and Awareness is one of the 19 assessment domains in the HITRUST CSF, and it is in scope for the e1, i1 and r2.
The exact requirement statements depend on your tier and CSF version. You see them in MyCSF once your assessment is set up.
How often do staff need HITRUST training?
Plan for training at onboarding and at least once a year after that. Most assessors expect an annual cycle, and both the e1 and i1 are only valid for one year anyway.
Our HITRUST learning path re-assigns itself every 12 months.
Is HITRUST certification the same as HIPAA compliance?
No. HIPAA is a federal law enforced by the HHS Office for Civil Rights. HITRUST is a private certification that maps to HIPAA and many other sources.
A HITRUST certificate is good evidence that your controls are in place. It does not take over your HIPAA duties. See our HIPAA page for the Security Rule training requirement.
What is the difference between e1, i1 and r2?
The e1 covers 43 foundational requirements and is valid for one year. The i1 covers 182 requirements and is also valid for one year. The r2 is tailored to your risk profile and is valid for two years, with an interim assessment at year one.
Each tier includes the requirements of the one below it.
What training evidence does a HITRUST assessor ask for?
Usually your training policy, the list of people in scope, and a sample of individual records. For each sampled person, have the course, the completion date and the content version ready.
RansomLeak exports this as a per-person PDF certificate, a tenant CSV or a compliance report page.
Can HITRUST fine us for missing training?
No. HITRUST does not issue fines. A training gap can lower a requirement score, open a corrective action plan or keep you from certifying.
The pressure comes from customers and payers who make the certificate a condition of doing business.