Skip to main content

What to Do When a Compliance Officer Asks for Your Training Records

It happens on a Tuesday. A client, a partner, or a regulator sends a request: they want to see your workforce training records. Not a certificate. Not a screenshot. The records.

This is the moment most compliance programs discover they have a gap.

What an auditor actually wants to see

When the Office for Civil Rights investigates a HIPAA incident, or when a covered entity audits the business associates it works with, they want answers to four questions:

  1. Who completed training? Name, role, date.
  2. What did they complete? Not just the title of the course — the specific version, the content they were shown.
  3. When? Not approximately. A signed, dated record.
  4. Can you prove the record hasn’t been altered? This is the question most organizations can’t answer.

A completion certificate answers questions one, two, and three reasonably well. It does not answer question four at all.

What makes a training record legally defensible

A legally defensible training record has three properties:

It’s tamper-evident. The record must be constructed so that altering or removing any entry — even by an administrator, even by the platform provider — is detectable. Append-only database enforcement (not policy-level protection, not password protection) is the mechanism that makes this real.

It snapshots the exact content. Curriculum changes over time. A record that says “completed HIPAA Workforce Training on June 12” doesn’t prove what that training contained on June 12. A record that includes a version hash of the exact curriculum text does.

It’s independently verifiable. The gold standard is a proof that doesn’t require the auditor to trust your platform or your login screen. A standalone verifier — a script that re-derives every hash in the chain and reports where (if anywhere) the chain breaks — provides this.

What an evidence pack contains

LaborGenie’s evidence pack is a ZIP export containing:

  • The full attestation chain for your organization — every completion, every manager countersignature, every export event
  • The curriculum version hashes for every module completed — proving what the content said at the time
  • The audit trail — who exported what, and when
  • A standalone verification script that an auditor can run without trusting LaborGenie’s dashboard

You export it from Admin → Evidence. The export itself is audit-logged.

Six years

HIPAA’s Privacy Rule (45 CFR §164.530(j)(2)) requires training documentation to be retained for six years from the date of creation or the date it was last in effect, whichever is later.

Six years is longer than most people expect, longer than most HR software retains records by default, and long enough for an incident to surface years after the training was completed.

LaborGenie retains records matched to this requirement. Guarded account deletion refuses to destroy attestation records, audit events, or training chain entries — terminating someone’s access doesn’t erase the record that they trained.

Why a certificate alone isn’t enough

A certificate is a PDF. It proves that a completion event was recorded. It does not prove:

  • What the content said (if the curriculum was updated since, the certificate still looks the same)
  • Whether the record has been altered
  • Whether the record still exists in its original form

An auditor who knows what they’re doing will ask to see the underlying records, not the PDF.

The answer to “why does this matter” is concrete: OCR’s investigation process for HIPAA compliance involves reviewing training documentation, and in cases where records are incomplete, inconsistent, or can’t be verified, that gap becomes part of the finding.

Getting ahead of the request

The organizations that handle audit requests smoothly are the ones that can export a complete evidence pack within twenty minutes of the request arriving. That requires:

  1. Training records that are current (everyone who should have completed, has)
  2. Records that are defensible (tamper-evident, version-bound)
  3. An export mechanism that produces something an auditor can actually use

If you’re not sure your records meet all three criteria, book a short call — we can walk through what your current state produces and what an auditor would actually receive.