A single document that shows, for every training your workforce is assigned, the regulation or funding condition that requires it — and for every regulation that applies to you, whether anything currently satisfies it.
Most organizations assemble their training list by accretion. A surveyor asks for something, a course gets added. A grant arrives, a module gets assigned. Staff turns over, a policy references a training nobody can find. After a decade, the list is long and nobody can say where any single item came from.
That works until someone asks the question directly. Then there are two failure modes, and both are expensive:
The second one is what generates findings. The crosswalk exists to make both visible before a reviewer makes them visible for you.
Not every training obligation is written as one. Some rules name the training directly — HIPAA's workforce training standard, the Deficit Reduction Act's fraud and abuse education requirement for larger Medicaid recipients. Most don't. They impose a duty, and training is what makes meeting that duty possible.
42 CFR Part 2 is the clearest example: it contains no training standard anywhere in it. But a program cannot implement the confidentiality safeguards Part 2 requires unless its workforce knows what Part 2 protects. The obligation is real; it is simply derived rather than stated.
The crosswalk labels every entry as one or the other. That matters when a reviewer asks why a training exists, because the two answers are different: one points at a sentence, the other at a chain of reasoning you should be able to articulate before you're asked.
We start from your actual regulatory position, not a template: your funding streams, your licensure, your state, your service lines, your populations. A Ryan White grantee in California carries a different stack than a rural health clinic in Missouri, and a generic matrix serves neither.
From there, every applicable authority is identified and cited, your current training assignments are pulled from your LMS, and the two are mapped against each other. What's left over in either column is the finding.
Some vendors hold the map and rent you access. That's a reasonable business model and a bad deal for you, because the artifact is only useful if you can update it when a rule changes at 4pm on a Friday. The crosswalk is delivered in a format you own and control.
Where the gaps usually are
In practice, the missing items cluster in the same places: layered confidentiality rules beyond HIPAA, obligations that arrive attached to a specific grant, and requirements that apply to contractors and volunteers rather than employees.
Almost nobody is missing HIPAA training. Nearly everybody is missing something underneath it.
The content library that sits on top of the map. Five areas, built for organizations that answer to more than one regulator at once.
Where off-the-shelf HIPAA training quietly fails. 42 CFR Part 2, Title X, Ryan White and ADAP, CMIA, and minor consent each add rules a general privacy course never mentions — and each carries a different answer to the same question about the same record.
Compliance and risk are one discipline, taught by a certified ambulatory care risk manager.
False Claims Act, anti-kickback, exclusion and sanction screening, and billing integrity — written for the people who actually touch the claim, not for a compliance audience that already knows.
Section 330 scope, FTCA deeming requirements, 340B integrity, and subrecipient monitoring. The obligations that arrive attached to the funding and get discovered late.
The annual required set, assigned by role and mapped to its authority — so the answer to “why does this person have to take this?” is documented rather than remembered.
Tell us which funding streams you carry and we'll tell you what's likely absent from your training record.
Book a 20-minute call