Usually, refresher training is required when there is a material change to policies because the material change affects the way(s) in which the Covered Entity or Business Associate complies with HIPAA. This can be for several reasons, and might only affect one area of operations – such as responding to patient access requests – in which case refresher training will only be necessary for members of the workforce that respond to patient access requests.