Although the statement relating to the non-recognition of certifications is directed at the Security Rule, it applies in many cases to the Privacy Rule as well. This is because any certification stating a Covered Entity is complying with the Privacy Rule is a point-in-time certification and demonstrates the Covered Entity was compliant at the time an evaluation took place. However, despite the possibility it might not be recognized, any documentation relating to periodic evaluations (above), Privacy Rule compliance, or workforce training should be kept for a minimum of six years to comply with the HIPAA documentation requirements. This is especially important for workforce training as the majority of HIPAA violations are attributable to human error.