Articles · Renewals

How Often Does Each Training Need to Be Renewed?

By the Comodo Technology training team · October 5, 2026 · 4-minute read

Short answer: In California, the main trainings with a fixed schedule in the law are harassment prevention every two years, and SB 553 workplace violence and OSHA bloodborne pathogens every year (plus yearly fire-extinguisher training if staff are expected to use extinguishers). HIPAA has no fixed number of years in federal, California or Texas law, but once a year is the accepted standard, so our HIPAA certificates are valid for 12 months.

The California renewal chart

Find each training on the left. The middle column is what the law says. The right column is how long our certificate stays valid before we remind you to renew.

Training	What the law requires	Our certificate is valid for
HIPAA Awareness (privacy)	No fixed number of years. New staff are trained within a reasonable time after they start, and again when your policies change. This is a federal rule, so it is the same in every state.	1 year. Yearly is the accepted standard.
HIPAA Security Awareness	An ongoing security training program with periodic reminders. Also federal, also no fixed number of years.	1 year
California Harassment Prevention	Every 2 years. New employees and new supervisors within 6 months. Two hours for supervisors, one hour for everyone else. Applies to employers with 5 or more employees.	2 years
SB 553 Workplace Violence	Every year. First when your plan is set up, then once a year, plus extra training when there is a new hazard or the plan changes.	1 year
OSHA Bloodborne Pathogens	Every year. At first assignment, then at least once a year.	1 year
OSHA Hazard Communication	At first assignment, and whenever a new hazardous product comes into the office. No fixed yearly refresher.	1 year. We recommend yearly so nothing is missed.
Medicare Fraud, Waste & Abuse	Not required by law for most dental and medical offices. Medicare Advantage and Part D plans that ask for it usually want it at hire and every year.	1 year
Security Awareness (free program)	No legal schedule. Cyber insurers usually ask for yearly training.	1 year
Other programs: cyber safety, medical ethics, diversity & inclusion, working with regulators, HR for practice managers	No legal schedule.	1 year. A yearly refresh is our recommendation, not a legal rule.

The easy way to remember it in California: HIPAA, Security, SB 553 and Bloodborne Pathogens once a year, all in the same month. Harassment Prevention every two years.

Why your HIPAA certificate says 12 months

Neither federal law nor California law puts a number of years on HIPAA training. What HIPAA does require is training for every new person, retraining when policies change, and a security program that is ongoing. A dated certificate every 12 months is the simplest way to prove all three, and it is what investigators, cyber insurers and business partners expect to see. A proposed federal update from January 2025 would make the 12-month cycle official. It is not final yet. Read more in Is HIPAA training required every year?

If you have staff in Texas

Texas has its own medical privacy law (known as HB 300, Texas Health and Safety Code §181.101). It adds three things on top of HIPAA:

New staff within 90 days. Every new employee must finish training within 90 days of being hired.
Retraining after a change in the law. When state or federal privacy law changes in a way that affects someone’s job, they must be retrained within a reasonable time, and no later than one year after the change takes effect.
A signed statement. Each employee signs a statement that they finished the training, and you keep it for six years.

Texas used to require training at least every two years. That rule was removed in 2013. Most Texas practices still train every year, because it covers law changes automatically and keeps the paperwork simple. Our 12-month HIPAA certificates fit this. Texas does not require harassment training for private employers and has no SB 553-style law, but federal OSHA’s yearly Bloodborne Pathogens rule applies there too.

All other states

HIPAA and OSHA are federal. HIPAA training and the yearly OSHA Bloodborne Pathogens training work the same way in every state, so our 1-year certificates fit everywhere.
Harassment and workplace violence rules depend on the state. Our Harassment Prevention and SB 553 programs are written for California law. Some states have their own rules. For example, New York and Illinois require harassment training every year. If you have staff outside California, check that state’s rules or call us and we will point you in the right direction.

We track the dates for you

Every certificate shows its renewal date, and we email reminders before training is due. Practice managers see who is current and who is due at a glance.

See all programs Verify a certificate

Common questions

Does California require HIPAA training every two years?

No. California law does not set its own HIPAA training schedule. The two-year rule many people remember is California’s harassment prevention training.

Does Texas require HIPAA training every year?

Not in those words. Texas requires training within 90 days of hire, retraining within one year after a privacy law change that affects the job, and a signed statement kept for six years. Most Texas practices train every year to cover all of this.

Which California trainings must be repeated every year?

SB 553 workplace violence prevention and OSHA bloodborne pathogens. HIPAA and HIPAA security are expected yearly as the accepted standard.

How often is harassment prevention training required in California?

Every two years, and within six months for new employees and new supervisors, for employers with five or more employees.

How long should training records be kept?

HIPAA records for six years. Texas HB 300 signed statements for six years. SB 553 training records for at least one year.

This article is general information, not legal advice. Sources: 45 CFR §164.530 · 45 CFR §164.308 · California Civil Rights Department: harassment prevention training · Cal/OSHA: workplace violence prevention · 8 CCR §5193 (bloodborne pathogens) · 8 CCR §5194 (hazard communication) · Texas Health and Safety Code §181.101 · Texas SB 1609 (2013).