A Covered Entity may award certificates to members of the workforce when they complete their initial policy and procedure training, if they undergo refresher training, or when reaching milestones in security and awareness training. In these cases, although not officially recognized as certification by HHS, copies of certificates have to be retained for a minimum of six years to comply with the document retention requirements of the Privacy Rule.