GlossCap

Compliance reference · 45 CFR § 164.530(b)

HIPAA training video captions: scope, BAA reality, and a workflow that doesn't touch PHI

HIPAA workforce training is mandatory under 45 CFR § 164.530(b) for every covered entity and most business associates. Two questions follow: what does the captioning bar look like for that training, and does the captioning vendor need a Business Associate Agreement? The honest answers turn on a single fact about training video — properly governed training content does not contain PHI in the first place — which makes the captioning workflow much simpler than the worst-case framing assumes.

TL;DR

HIPAA workforce training under 45 CFR § 164.530(b) requires every workforce member of a covered entity or business associate to be trained on the entity's policies and procedures with respect to PHI. The training itself is not PHI — it's instructional content about how to handle PHI. The captioning workflow processes the audio of that instructional content, which contains drug names, procedure names, regulatory citations, and policy acronyms — none of which are PHI. So a BAA is typically not required for HIPAA training captions in normal operation. The captioning bar that auditors and clinical staff both check is proper-noun accuracy on the dense terminology surface — exactly where general STT fails. Glossary-biased captioning fixes that on first export.

What HIPAA actually requires for training

The Privacy Rule's training mandate at 45 CFR § 164.530(b)(1) is short and load-bearing: a covered entity must "train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity." The Security Rule has a parallel mandate at 45 CFR § 164.308(a)(5) requiring a "security awareness and training program for all members of its workforce."

What this means in practice:

The training is delivered as classroom sessions, live webinars, or — in the modern reality — video modules in an LMS. The video modules are where caption compliance becomes a question.

Why captioning HIPAA training is mandatory in its own right

HIPAA itself doesn't say "captions required." The captioning obligation arrives via three other routes that almost always apply to a covered entity:

The technical bar across all of these is WCAG 2.0 or 2.1 AA — see our WCAG 2.1 AA captions reference. SC 1.2.2 Captions (Prerecorded) is the controlling criterion; synchronized captions at substantial accuracy on every audio-visual training asset.

The PHI question: does a captioning vendor need a BAA?

This is the question every IT-compliance lead asks first when scoping a captioning vendor. The framework for the answer:

There are edge cases. A captioning workflow that processed real recorded patient calls would obviously involve PHI and would require a BAA. A captioning workflow that processed clinical case-discussion video where real patient identifiers slipped through would also cross the line — but that's a content-governance failure upstream of captioning, and the right remediation is at the source. The training-module case, where content is correctly governed, is BAA-free.

What the captioning vendor's posture should look like, even without a BAA:

The proper-noun failure mode in HIPAA training video

HIPAA training is dense with regulatory acronyms and clinical terminology — exactly the surface general STT mangles. Failures cluster around:

An OCR investigator sampling a HIPAA training module reads captions exactly the way a workforce member would. A garbled "HITECH" or "Privacy Rule" in the first 30 seconds of training is the most-cited finding pattern in the few enforcement actions where training adequacy gets called out.

The glossary-biased workflow for HIPAA training

  1. One-time policy-and-acronym glossary. Most compliance teams already maintain a HIPAA acronym list and a policy index. Connect Confluence, SharePoint, or paste a flat list of regulatory citations, programme names, and policy codes used across your training catalogue.
  2. Process the training catalogue in batches. GlossCap runs Whisper-large with the glossary tokens logit-boosted into the decoder. Output is SRT/VTT/TTML with regulatory acronyms and citation strings preserved on first export.
  3. Compliance reviewer pass. The amber-highlight UI shows every glossary-applied term in context — a Privacy Officer or Compliance Coordinator can scrub through and confirm. Corrections feed back into the workspace glossary so the term doesn't break next time.
  4. Export to your LMS. Most healthcare L&D runs Absorb, Cornerstone, or Healthstream; SRT or VTT covers all three. Documentation row: asset → caption source → reviewer → review date, preserved alongside your 45 CFR § 164.530(j) training records.

See pricing

Documentation that survives an OCR audit

OCR enforcement on training adequacy is rare but real. The pattern in the small number of enforcement actions where training got flagged: an investigator reads the training records, samples one or two modules, and looks for evidence the training was actually delivered and accessible. The accessibility piece is where caption documentation matters.

Concretely, the file your Privacy Officer should keep alongside the 45 CFR § 164.530(j) training records:

That row, replicated across the catalogue, is what a clean audit looks like. The glossary-biased workflow makes producing it fast.

Related questions

Does HIPAA require a specific caption accuracy level?

HIPAA itself doesn't specify a technical accessibility standard for training content. The standard arrives via Section 504, Section 508, or ADA — all of which point to WCAG 2.0 or 2.1 AA, with SC 1.2.2 requiring "synchronized" captions at substantial accuracy. Practical reading: 99% character accuracy on the standard sampling.

What if our training video does include real PHI by accident?

That's a content-governance issue upstream of captioning. The remediation is to identify and remove the PHI from the source content — not to handle it at the caption layer. If you discover PHI in a training module after the fact, treat it as a potential breach under 45 CFR § 164.402, follow your incident-response process, and re-shoot or redact the affected segment before re-publishing.

Do we need a BAA for the LMS that hosts the training?

Generally no, on the same logic — a properly governed training catalogue doesn't contain PHI. The BAA question for the LMS turns on whether the same LMS instance also hosts patient-facing content, employee health records, or other PHI. Most healthcare orgs maintain separate LMS environments for workforce training (no PHI, no BAA) and for patient-portal content (PHI, BAA required).

What about state laws — do they change the captioning bar?

State medical-privacy laws (CMIA in California, NY's SHIELD Act for security, etc.) generally don't add a captioning-specific requirement beyond what HIPAA + ADA + 504 already provide. Some states have additional public-entity accessibility analogs to Section 508 — those raise the bar by reference to WCAG, but the captioning standard remains SC 1.2.2.

How does this differ from clinical-procedure training captions?

Pure HIPAA workforce training is dense with regulatory citations and policy acronyms; clinical-procedure training is dense with drug and procedure names. Both fail in the same way under general STT (proper-noun mangling), and both benefit from glossary-biased captioning. See medical training video captions for the clinical-side glossary structure.

Further reading