Security and awareness training should go beyond the basic requirements of the Security Rule because it is important for members of the workforce to understand what the threats are to the confidentiality, integrity, and availability of electronic PHI and what their roles are in mitigating the threats and their impact. Therefore, it is essential members of the workforce are encouraged to report a mistake that results in a security incident rather than try to hide the mistake.