According to the HIPAA Administrative Safeguards, a security and awareness training program should be implemented for all members of the workforce – including management. The content of the program should be determined by a risk assessment to establish what threats exist to the confidentiality, integrity, and availability of ePHI. It is important to be aware that the requirement to implement a security and awareness training program differs from the training requirements of the Privacy Rule inasmuch as all members of the workforce should undergo security awareness training regardless of their roles, and the program should be ongoing - rather than a one-off training session on policies and procedures.