HIPAA Compliance Training for State Agencies: Why NIST CSF Is Voluntary While CJIS, IRS Pub. 1075, and HIPAA Mandate Security Awareness Training

You cite the NIST Cybersecurity Framework when somebody asks why your agency runs a security training program. That answer makes sense, because CSF 2.0 gives you a shared vocabulary for cybersecurity risk and most state agencies have adopted something like it. Its Protect function even includes an Awareness and Training category.

The framework is voluntary, and NIST says so in the document itself. NIST regulates no state agency, imposes no penalty for noncompliance, and operates no enforcement mechanism. So adopting the CSF leaves every binding training obligation your agency already has where it was, and every auditor who reviews those obligations will ask the same questions as before.

Those obligations come from 3 other places, and each applies to a different part of state government. HIPAA binds your state health agencies, the CJIS Security Policy binds anyone with access to criminal justice information, and IRS Publication 1075 binds whoever handles federal tax data. Each mandate names its own audience and its own documentation, which is the part a CSF-shaped program usually misses.

What the NIST CSF Says About Its Own Authority

CSF 2.0 was published on February 26, 2024, for organizations of every sector and size. Its 6 core functions, Govern, Identify, Protect, Detect, Respond and Recover, give you a way to sort what your controls are for. Under Protect, an Awareness and Training category recommends cybersecurity education.

Where the Framework Fits in Your Compliance Architecture

NIST describes the whole document as a resource that may be adopted voluntarily and through governmental policies and mandates. That second half is the only route by which the CSF binds anybody at all. Several states have taken that route, writing CSF alignment into an executive order or a regulation that has enforcement weight of its own. Underneath that order or regulation the framework is still a reference document.

Your mandates are specific in the 4 ways the framework is not:

• Name the people each one covers, because HIPAA counts your whole workforce and CJIS counts only the staff with system access.
• Set each frequency separately, since CJIS and Publication 1075 both run annually and HIPAA states no interval at all.
• Record completion per person, with the date and the content version an auditor will ask about.
• Keep the 3 record sets apart, so evidence for one framework never has to be filtered out of another.

What 45 CFR 164.308(a)(5) Requires of State Health Agencies

HIPAA is the mandate with the widest audience inside your agency. If your state health agency administers Medicaid, runs public health programs, or otherwise handles electronic protected health information, it is a covered entity. That makes the Security Rule apply to it in full.

45 CFR 164.308(a)(5) tells a covered entity to implement a security awareness and training program for all members of its workforce, including management. That standard is marked required in the regulatory text. A covered entity cannot decline it on the strength of a risk assessment, and cannot substitute an alternative control for the program that the standard describes in its own text.

The 4 implementation specifications underneath that standard are the addressable part, and your risk analysis decides how each of them is satisfied:

• Periodic security updates, delivered in whatever form your workforce reads without being chased.
• Procedures for guarding against, detecting and reporting malicious software.
• Log-in monitoring, including how attempts and discrepancies are reported and to whom.
• Password management, covering how your staff create, change and safeguard one.

The program obligation above those 4 is fixed, whatever your analysis decides about any of them. Your agency cannot train one part of its workforce and then treat the remainder as an addressable question. Every person who handles electronic protected health information is inside the standard.

Why CSF Adoption Does Not Close the HIPAA Gap

Nothing in the Awareness and Training category states who must be trained, how often, or what the record has to show. The Security Rule states all 3 of those things. A state Medicaid office that offers general security content to its IT staff has still not trained the caseworkers, eligibility specialists and administrative staff who handle the same protected health information.

That workforce-wide scope is expensive to satisfy and easy to miss. HHS Office for Civil Rights has cited inadequate workforce training as a contributing factor in enforcement actions against covered entities. Our article on HIPAA training and data breaches works through what that exposure looks like.

45 CFR 164.308(a)(5) requires covered entities to "implement a security awareness and training program for all members of its workforce (including management)" as a required standard with no addressable alternative, binding every state health agency that handles electronic protected health information. Source: 45 CFR 164.308(a)(5), HIPAA Security Rule (law.cornell.edu)

What the CJIS Security Policy Asks of Law Enforcement Agencies

Scope is also what decides the second mandate, and this population is much narrower. The CJIS Security Policy governs access to criminal justice information held in federal systems, and your state police department is bound through an agreement with the state CJIS Systems Agency. That agreement makes the policy a contractual condition of continued federal access.

Why Individual Records Decide a CJIS Audit

Policy Area 2 sets the training requirement, and version 6.1 is the one in force. Anyone with access to criminal justice information completes security awareness training before that access is granted, then refresher training at least annually. The required topics are password management, malicious software recognition, phishing identification and incident reporting.

A general awareness program that delivers content to everyone and records no individual completion will not satisfy Policy Area 2. A state CJIS Systems Officer reviewing your compliance wants to see that each named person with access finished the training in the current period. Offering training to the organization is the claim that fails an audit.

That audit asks 4 questions about every person on your access list:

• Who completed the training, named one by one and never counted by department.
• When they completed it, with a date inside the current annual period.
• What content version they saw, so the topics can be matched against Policy Area 2.
• Whether their access predates their training, which is the finding that stops access.

The same discipline already applies elsewhere in state government, and cybersecurity awareness training for public records staff runs on the same per-person evidence. Records staff and system users work in different buildings and answer to different auditors. Both of them want a name, a date and a content version.

What IRS Publication 1075 Adds for Federal Tax Information Handlers

Evidence per person is the standard in the third mandate as well. Publication 1075 governs the federal tax information your agency receives under an IRS agreement. Revenue departments, social services agencies administering Medicaid, child support enforcement offices and workforce development agencies are all inside it. Compliance with its safeguards is a condition of that agreement.

Why a General IT Security Course Does Not Cover It

Section 6 holds the other safeguards, and the training requirements are in 6.2 and 6.3. Revision 11-2021 tells employees to receive disclosure awareness training and sign a confidentiality statement before any access to federal tax information, and annually after that. Your agency then certifies completion to the IRS each year.

A general IT security course is usually delivered enterprise-wide, without separating out the people who handle tax data. The IRS Office of Safeguards reviews documentation at the role level during a safeguard review, either on site or at a desk. An agency that cannot produce individual records for both training types in the current year has a finding, and a finding restricts access.

Your Publication 1075 evidence separates 2 training types that a single enterprise course tends to merge:

• Security awareness under 6.2, covering the risks specific to handling federal tax data and insider threat recognition.
• Disclosure awareness under 6.3, covering confidentiality obligations and the consequences of unauthorized disclosure.
• A signed confidentiality statement, taken before first access and renewed every year after that.
• An annual certification to the IRS that every person handling the data finished both.

How to Run 3 Mandates on One Training Record

Running all 3 at once is the actual job, and the CSF is still a reasonable way to organize the cybersecurity program around them. Its 6 functions give you a structure for sorting risks and controls. What it produces is no training record of its own, and all 3 of the mandates above are judged on the record an agency can produce on the day somebody asks.

Keeping the 3 rows apart on paper is straightforward, and keeping them apart in a system is where agencies lose points. One enterprise course recorded against one completion date cannot answer 3 auditors who are each asking about a different population working to a different annual schedule. The audit failures public sector agencies face usually start with compliance training spread across 5 systems.

The courses for all 3 of them are in KC Library. HIPAA security awareness, password management, phishing and malicious software are all in the catalog, which covers the Policy Area 2 topic list and the HIPAA standard. Disclosure awareness for Publication 1075 is specific to the tax data your own agency holds, so you supply that material and assign it beside the catalog courses.

KC LMS assigns those courses against the roles each mandate covers, and keeps one timestamped completion record for every person. Those records export separately for each framework, so a HIPAA auditor never has to read past the CJIS evidence. One catalog and one assignment engine behind 3 separate record sets turns an awkward problem back into an ordinary operational job.

Agencies already running recurring training across public agencies will recognize the pattern. Your CSF program carries on doing the organizing work it is good at, while your 3 mandates each get the individual evidence their own auditor will ask to see. What changes is only where that evidence comes from, and how long it takes to put a complete record in front of somebody who is asking for one.

Frequently Asked Questions

1. Is NIST CSF mandatory for state agencies?

No. NIST CSF 2.0, released in February 2024, is voluntary guidance. NIST does not regulate state or local government agencies and imposes no penalties for noncompliance with CSF recommendations. A state agency that adopts the CSF as its cybersecurity operating framework is following voluntary best-practice guidance, not a legal mandate. Some states have incorporated CSF alignment into executive orders or regulations that do carry enforcement weight, but in those cases the state law creates the obligation, not the framework itself. For mandatory training obligations, state agencies look to HIPAA, the CJIS Security Policy, and IRS Publication 1075.

2. What does HIPAA require for security awareness training at state health agencies?

HIPAA's Security Rule, at 45 CFR 164.308(a)(5), requires covered entities to implement a security awareness and training program for all members of their workforce, including management. The standard is designated as required in the regulatory text, so covered entities cannot opt out based on risk assessment. State health agencies that handle electronic protected health information as covered entities must maintain an ongoing training program for every workforce member. The four implementation specifications under the standard (periodic security updates, malicious software procedures, log-in monitoring, and password management) are designated addressable, giving agencies flexibility in how they satisfy those specific elements.

3. Who must complete CJIS security awareness training, and how often?

Under CJIS Security Policy Policy Area 2, all personnel with unescorted access to criminal justice information must complete security awareness training before that access is granted and must complete refresher training at least annually. This applies to employees of state agencies that access FBI criminal justice systems, including the National Crime Information Center. Required training topics include password management, malicious software recognition, phishing identification, and incident reporting. Organizations must document individual completion and retain training records. Compliance is verified through state CJIS Systems Officer audits and FBI compliance reviews.

4. What training does IRS Publication 1075 require for state agencies?

IRS Publication 1075 requires state agencies that receive federal tax information to provide annual security awareness training and annual disclosure awareness training to all employees who handle or have access to FTI. Security awareness training covers FTI-specific data protection practices and insider threat recognition. Disclosure awareness training covers the legal framework governing FTI confidentiality and the consequences of unauthorized disclosure. Agencies must certify annually to the IRS that all FTI-accessing employees have completed both training types. The IRS Office of Safeguards reviews training documentation during safeguard examinations and may restrict FTI access for agencies that cannot produce compliant individual completion records.

References

1. National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024).
2. 45 CFR 164.308(a)(5), HIPAA Security Rule, Administrative Safeguards, Security Awareness and Training. Legal Information Institute, Cornell Law School.
3. FBI CJIS Security Policy (version 6.1), Policy Area 2, Security Awareness Training. Federal Bureau of Investigation, Criminal Justice Information Services Division.
4. IRS Publication 1075, Tax Information Security Guidelines for Federal, State, and Local Agencies, Sections 6.2 and 6.3. Internal Revenue Service.
5. HHS Office for Civil Rights, Summary of the HIPAA Security Rule. U.S. Department of Health and Human Services.