Required Trainings for Behavioral Health Staff: What the Law, Payers and Accreditors Require

Before you schedule anything, name the source of each requirement.

The source decides who the rule actually binds — a federal regulation is not a state statute, and a certification program's criteria are not general law — and it tells you where to look when you need the exact text.

Behavioral health training requirements sort into five buckets:

• Federal law. The HIPAA Privacy and Security Rules, which impose training duties on covered entities, and OSHA's Bloodborne Pathogens Standard, which covers employees with occupational exposure.
• State law. Mandated-reporter training, sexual harassment prevention training and — in California — workplace violence prevention training, each on that state's own terms.
• CMS conditions of participation. Restraint and seclusion training for Medicare- and Medicaid-participating hospitals, and a separate rule set for psychiatric residential treatment facilities (PRTFs) serving people under 21. Outpatient clinics are not in scope.
• Payers and certification programs. The SAMHSA CCBHC certification criteria, for example, require a training plan for all employed and contract staff with direct client or family contact, and that plan must include the state behavioral health authority's and any accreditation standards' training requirements. A state Medicaid provider manual can also add program-specific trainings.
• Accreditors. This page does not restate accreditor training standards; if your practice holds accreditation, pull the training standards from your accreditor directly and add them to the same inventory.

The map in one table:

Training	Source	Who it covers	Cadence
HIPAA privacy training	HIPAA Privacy Rule	All workforce at a covered entity	New hires within a reasonable period; no fixed refresher in the rule text
Security awareness and training	HIPAA Security Rule	All workforce, including management	Ongoing program, no fixed frequency in the rule text
Bloodborne pathogens	OSHA standard	Employees with occupational exposure	At initial assignment, then at least annually
Mandated reporter	State law	The state statute decides	Required by the laws or policies of 23 states (per CWIG, May 2023)
Sexual harassment prevention	State law	California employers with five or more employees; New York and Illinois: all employees	California every two years; New York and Illinois annually
Restraint and seclusion	CMS rules	Participating hospitals; PRTFs serving people under 21	Orientation and periodic retraining; PRTF competency recheck every six months
Workplace violence	California law	California employers; the setting decides which track	When the plan is established, then annually
CCBHC training plan	SAMHSA certification criteria	Certified CCBHCs	Orientation, then annual (some topics at reasonable intervals)
Accreditor standards	Your accreditor	Accredited organizations	Whatever your accreditor's standards set

One more source is easy to miss: the FLSA, which decides whether training time itself is paid.

That is covered in the calendar section below — and if you are classifying roles as salaried or hourly at the same time, see our exempt vs non-exempt guide.

Every one of these requirements lands on people you have already hired or are about to hire.

The behavioral health hiring hub collects the role-by-role hiring guides if you are staffing up alongside the training plan.

Start with coverage, because HIPAA's training duty is not universal.

Per HHS, a health care provider is a HIPAA covered entity only if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard — electronic insurance claims, for example.

A practice that bills insurance electronically meets that test.

A purely private-pay practice that never transmits a standard electronic transaction may not be covered; for those practices, training staff to HIPAA standards is still good practice, but it is not a legal requirement.

If you are a covered entity, the Privacy Rule requires you to train all members of your workforce on your policies and procedures for protected health information, as necessary and appropriate for each person's functions.

Each new workforce member must be trained within a reasonable period of time after they join — the rule sets no fixed number of days, and it does not impose an annual refresher.

If you run annual training anyway, that is your policy or an accreditor's or payer's requirement; just do not describe it as something HIPAA mandates.

Two documentation duties attach.

You must document that the training was provided, and HIPAA documentation — training records included — must be kept for six years from the date of its creation or the date it was last in effect, whichever is later.

The Security Rule adds a separate requirement: implement a security awareness and training program for all members of your workforce, including management.

Treat it as its own line in the plan — a privacy course does not discharge it.

If you run a substance use program covered by 42 CFR Part 2, the 2024 Part 2 final rule is in force: HHS set the compliance date at February 16, 2026, which has now passed.

On training specifically, a search of the current Part 2 text found no workforce-training requirement comparable to HIPAA's — so for a Part 2 program that is also a HIPAA covered entity, the training duty comes from HIPAA plus whatever the program's own Part 2 policies require.

Who must report child abuse is decided by state law.

Per the federal Child Welfare Information Gateway, with data current through May 2023, counselors, therapists and other mental health professionals are named as mandated reporters of child abuse in 38 states plus the District of Columbia and some territories; social workers are named in 41 states.

Training is a separate question from the reporting duty itself.

Per the same source, the laws or policies of 23 states require that mandatory reporters be provided training, while 22 states and DC do not specifically require it.

And even in a state that requires training, the requirement may fall on licensees or on certain employers rather than on every employer — so read your own state's statute before you assume the duty sits with you.

Three practical points as you read it.

First, check who the statute binds: in some states the training duty sits on the clinician's license, not on you as the employer — New York requires licensure applicants — psychologists, social workers, therapists and behavior analysts among them — to complete two hours of state-approved coursework on identifying and reporting child abuse, and Pennsylvania requires social worker license applicants to complete at least three hours of state-approved training in child abuse recognition and reporting — so verify it against the state board's rules rather than schedule it yourself.

Second, where the state does not mandate employer-provided training, train your client-facing staff anyway — every hire should know how to make a report in your state from day one, whatever the statute says about your obligations.

Third, fold the reporting basics into onboarding: who to call, what the timelines are, and how the decision gets documented, even in the 22 states and DC where no training is specifically required.

Restraint and seclusion training rules come from two CMS settings, and only those two.

Medicare- and Medicaid-participating hospitals — including psychiatric hospitals — must train staff under 42 CFR 482.13(f).

Staff must be trained and able to demonstrate competency in the application of restraints, implementation of seclusion, monitoring, assessment and providing care for a patient in restraint or seclusion, before they perform these interventions, as part of orientation and periodically after that under hospital policy.

The training must cover recognizing triggers, nonphysical intervention skills, selecting the least restrictive intervention, the safe application of each type of restraint used (including the signs of physical distress to watch for), recognizing when restraint should be ended, monitoring the patient, and first aid techniques with certification in the use of cardiopulmonary resuscitation, including required periodic recertification.

Trainers must be qualified by education, training and experience, and completed training and competency go in the staff personnel record.

Psychiatric residential treatment facilities — facilities that are not hospitals and provide inpatient psychiatric services to individuals under age 21 — are governed by a separate CMS rule set, 42 CFR 483 subpart G.

PRTF staff need ongoing education and demonstrated knowledge of trigger identification, nonphysical intervention skills such as de-escalation, mediation and active listening, and the safe use of restraint and seclusion.

They must be trained and demonstrate competency before taking part in any emergency safety intervention, hold CPR certification with periodic recertification, re-demonstrate the de-escalation and restraint or seclusion competencies every six months, and re-check CPR competency annually.

Neither rule touches outpatient clinics, group practices or adult residential programs — if that is your setting, these CMS provisions are not the source of your training duties.

There is no federal OSHA standard requiring de-escalation training either; OSHA's guidelines for healthcare and social service settings are advisory, not a standard or regulation, and create no new legal obligations.

What may still bind you is state licensing: rules for residential and SUD programs can carry their own restraint-training requirements — they are not summarized here, so check with your state's licensing agency.

If you certify as a CCBHC, the certification criteria add crisis-adjacent training of their own: at orientation and annually thereafter, staff must be trained on risk assessment, suicide and overdose prevention and response, and the roles of family and peer staff — and these trainings may be delivered online.

OSHA's Bloodborne Pathogens Standard does not apply to every behavioral health employer.

It keys off occupational exposure, defined as reasonably anticipated skin, eye, mucous membrane or parenteral contact with blood or other potentially infectious materials that may result from the performance of an employee's duties.

Staff who give injections, or who collect urine or blood specimens in a substance use program, meet the definition.

A talk-therapy-only practice may have no employees who do.

Assess role by role before you schedule anything.

Where staff do have occupational exposure, the standard requires training for each covered employee at no cost to the employee and during working hours, at initial assignment and at least annually, within one year of the previous training.

The hepatitis B vaccination must be made available after the training and within 10 working days of initial assignment, and bloodborne pathogens training records must be kept for three years.

Workplace violence is a different story.

Federal OSHA has no standard requiring workplace violence or de-escalation training — its 2016 guidelines for healthcare and social service employers are explicitly advisory, not a standard or regulation, and create no new legal obligations, even though they are written for your settings: the guidance names community mental health clinics, drug abuse treatment centers and psychiatric facilities among those it covers.

California is where binding rules exist, on two tracks.

The general law, Labor Code 6401.9 (SB 553), applies to all California employers except listed exemptions — which include health care facilities, service categories and operations covered by Cal/OSHA's health care standard 8 CCR 3342; employees teleworking from a location of their choice; and non-public worksites with fewer than 10 employees on site that comply with 8 CCR 3203.

Under SB 553 you must provide effective workplace violence training when the plan is first established and annually after that, covering the plan, how to report incidents without fear of reprisal, job-specific hazards and corrective measures, the violent incident log, and a chance for interactive questions and answers — with additional training when a new hazard is identified or the plan changes.

The 8 CCR 3342 standard, not SB 553, covers 24-hour health facilities (including psychiatric hospitals), home health care and home-based hospice, emergency medical services, drug treatment programs, and outpatient medical services provided to the incarcerated.

The practical split: a California SUD treatment program follows 3342; an outpatient therapy group or ABA clinic that is neither a 24-hour facility nor a drug treatment program will most likely fall under SB 553.

Confirm the split with counsel — the text of 3342 does not define "drug treatment program."

Outside California, workplace violence training is a state-by-state question.

Check your own state's labor agency instead of assuming a general requirement exists.

With the sources named, the calendar is an inventory problem.

List every role, then map each training to its source and its trigger.

• Hire-date triggers. HIPAA training for each new workforce member within a reasonable period; bloodborne pathogens training at initial assignment, with the hepatitis B vaccine offer within 10 working days; California harassment training for new nonsupervisory hires within six months of hire and new supervisors within six months of becoming supervisors.
• Calendar-year anchors. New York and Illinois harassment training annually; California harassment prevention every two years for employers with five or more employees; bloodborne pathogens at least annually; California workplace violence training annually; CCBHC trainings annually after orientation.
• CMS-set cadence. Hospital restraint and seclusion training at orientation and periodically per policy; PRTF competency rechecks every six months with CPR annually.

On harassment prevention specifically: California employers with five or more employees must give at least two hours of sexual harassment prevention training to supervisors and one hour to nonsupervisory employees, once every two years.

New York requires sexual harassment prevention training for all employees annually, and Illinois requires it at least once a year to all employees.

Other states have their own laws — check yours rather than copying a neighboring state's calendar.

If you certify as a CCBHC, the criteria also set the broader orientation list: training at orientation and at reasonable intervals afterward on evidence-based practices, cultural competency, person- and family-centered recovery-oriented planning, trauma-informed care, continuity-of-operations and disaster policy, primary care integration policy, and co-occurring mental health and substance use care.

Documentation is part of the requirement, not an afterthought.

HIPAA training documentation stays for six years; OSHA bloodborne pathogens training records for three years.

The CCBHC criteria go further: regularly assess each clinician's skills and competence, keep written policies on how you assess it, keep a written record of in-service training for each direct-care employee for their whole employment, and document completed training and competency in personnel records.

Even without a rule behind it, keep one log — who completed what, when, and which requirement put it on the calendar.

Budget the time, too.

Under the FLSA regulations, attendance at training need not be counted as working time only if all four of these are true: it is outside regular working hours, attendance is truly voluntary, the training is not directly related to the employee's job, and no productive work is performed during it.

Training is not voluntary if you require it — or if the employee is led to believe that not attending would hurt their job.

And training designed to make an employee handle their current job more effectively, given by the employer or under its auspices, is hours worked.

For a non-exempt team, employer-required compliance training is generally paid time — schedule and budget it that way, and run any pre-hire unpaid training past employment counsel first.

Two more sources belong on the inventory, and this page cannot list them for you: a state Medicaid provider manual can add program-specific trainings for the services you bill, so read the manual for your program; and if you hold accreditation, your accreditor's training standards go on the same list.

The CCBHC criteria make the same point structurally — a CCBHC's training plan must include the state behavioral health authority's and any accreditation standards' training requirements — which is a reasonable shape for any practice's plan.