Texas sets a training deadline for new employees and a retention period for the signed statement, and here is what the statute says and the roster I would build first.
Most clinics trained their staff at some point, and the signed acknowledgment is somewhere, in a drawer or an email folder. The real question is whether you could put your hands on it in a few minutes if someone asked. A missing signature is easy to fix today and uncomfortable to explain later.
What the statute requires
Texas Health and Safety Code Sec. 181.101 says each covered entity must train its employees on state and federal law governing protected health information, to the extent needed for them to carry out their duties. A covered entity, in plain terms, is an organization such as a clinic that holds patient health information while providing care, and the federal law involved is what most people mean by HIPAA training. That ties the training to the role, though I would rather see a short training given to someone with limited access than an argument over whether they needed it.
A new employee must complete the training no later than the 90th day after being hired. I treat that as the outer edge and aim for the first week, before habits form.
What goes on file
The covered entity must require each trained employee to sign a statement verifying completion, on paper or electronically (so a training platform that records signed acknowledgments can work well, as long as you can retrieve the record), and must keep that signed statement until the sixth anniversary of the date it was signed. The clock runs from signing, not from the hire date, so I would not discard a statement just because the employee has left. I read the statute on a public mirror of the code, so please check the official text, and this is not legal advice.
What I would do first
First, I would build a one-page roster with each employee's name, role, hire date, the 90th day after hire, the date training was completed, the date the statement was signed, where it is stored, and the date it reaches its sixth anniversary. Second, I would calculate the deadline on the day someone is hired and write it down, because a deadline that lives in someone's head tends to be missed. Third, I would pull a handful of real files and test the roster against them: does each signed statement exist, and do the dates match? Finally, I would look again at training whenever someone changes roles, since the statute ties it to duties and a move into billing or records is a natural moment to check. Software can deliver the training and store signatures, but someone in the office has to own the process and confirm it happened.
If you would like a second set of eyes on your training files, you are welcome to book a call with AssureRidge Cyber.