Employees are required to take HIPAA compliance training on Part 162 covered transactions if “their functions within the Covered Entity” (or, in some cases, the Business Associate) relate to Part 162 covered transactions. Generally, the training will be the same as Privacy Rule/Breach Notification Rule policy and procedure training and Security Rule security awareness training, with additional training with regards to CMS reporting requirements.