Covered Entities can outsource workforce training and other elements of HIPAA to third-party compliance companies. Indeed, many smaller Covered Entities use compliance companies to conduct the periodic evaluations required by the Security Rule see 45 CFR § 164.308 and this HHS article). If the outsourced company provides a certificate at the end of a training course or evaluation, these should also be retained to demonstrate good faith efforts to comply with HIPAA in the event of an OCR audit, inspection, or investigation.