Every new hire completes security and HIPAA training in their first week, before they receive access to any system that handles customer data.
Refresh training happens annually for everyone and quarterly for roles with elevated access. The content is tailored — engineers get different training than sales.
We also run unannounced phishing exercises and we use the failure rate as a real engineering signal, not a punishment lever.
