The burden of proof most often refers to breach notifications inasmuch as a Covered Entity or Business Associate has a burden of proof to show an unauthorized use or disclosure of unsecured PHI did not constitute a breach if – for example – there is a low probability the PHI was compromised by the unauthorized use or disclosure. In the context of HIPAA compliance training for Business Associates, the burden of proof refers to documentation that workforce members have received training to comply with the Administrative Safeguards of the Security Rule and to mitigate threats to ePHI identified in a risk assessment. Consequently, a copy of the risk assessment should be included in the training documentation.