The HIPAA Security Officer is responsible for implementing the security and awareness training program required by 45 CFR § 164.308. The content of the program should be guided by a risk analysis and should involve every member of the workforce. Also, if there is a material change to policies and procedures in respect of PHI that impacts the protocols required to safeguard electronic PHI the Security Officer should also be involved in the provision of Privacy Rule training.