LMS Compliance Requirements: SCORM, HIPAA, CE in 2026

Direct answer

"LMS compliance" is not one requirement, it's three unrelated ones. SCORM is a technical packaging standard that proves a learner finished a course inside that LMS, not a law. HIPAA governs health data through contracts and technical safeguards, not software certification. CE and CME rules come from your state board or accreditor, and your LMS vendor has no say in what they'll accept.

• Did the learner finish, and can you prove it? — What actually governs it: SCORM or xAPI — a technical spec, not a regulation; What to check: Whether your LMS tracks completion, score and time correctly, and keeps the record after the account is deactivated; Who enforces it: No one. It's on you to verify — no regulator inspects LMS software directly
• Is protected health information involved? — What actually governs it: HIPAA's Privacy and Security Rules; What to check: A signed Business Associate Agreement, encryption, access control, audit logs; Who enforces it: HHS Office for Civil Rights
• Does this training count toward a license or certification? — What actually governs it: Your state board or accrediting body — NAIC, ACCME, a state nursing or EMS board, etc.; What to check: Whether the course and completion report match that board's exact format and reporting channel; Who enforces it: The specific board or accreditor, never the LMS vendor

Search "LMS compliance requirements" and most of what ranks is a vendor feature list dressed up as advice, and it bundles three unrelated problems into one page: a technical tracking standard, a federal privacy law, and a patchwork of state and accreditor rules that have nothing to do with either one. Separate them, and the actual work gets a lot more specific, and a lot more manageable.

Does SCORM Completion Actually Prove Compliance?

SCORM comes from the Advanced Distributed Learning initiative, the group that still publishes the conformance requirements packages must meet to call themselves SCORM 2004 4th Edition compliant. It's a packaging and runtime spec: how a course talks to an LMS, how it reports completion, score and time, and how that data gets written back to the LMS's own records.

That's useful, and it's also narrower than a lot of marketing pages let on. A SCORM completion record proves a learner opened a package inside your LMS and that the package reported back "completed" with whatever score it generated. It does not, on its own, satisfy OSHA, HIPAA, GDPR or any other named regulation, whatever confidence a vendor blog states this with. Those are separate legal frameworks with their own requirements, and a completion timestamp is evidence you can point to, not a substitute for meeting them.

xAPI, and cmi5, which pairs xAPI's tracking with SCORM-style launch rules, exists because SCORM's record lives inside one LMS session. If you need evidence that survives outside that session, across devices or tools, or an auditor wants a record not tied to the platform's own database, xAPI writing to a separate Learning Record Store is the stronger fit. Most organizations running compliance training don't need that yet. If "completed, with a score, inside this LMS" answers your audit question, SCORM is enough.

If you are moving platforms, test this before cutover, not after — what actually survives a Moodle or LearnUpon migration covers which records travel and which get rebuilt. Before you trust either one for an audit: upload a real package, complete it as a test learner, deactivate that test account, and confirm the completion record and score are still there and still exportable. Some platforms quietly drop deactivated users from standard reports unless you ask for one that specifically includes them. Test it before you need it, not during an audit.

Is There Such a Thing as a HIPAA-Compliant LMS?

No. HIPAA has no product certification, and no federal agency reviews or stamps software as "HIPAA compliant." Any platform using that phrase on its homepage is describing its own feature set, not a status HHS granted it. What actually matters is narrower and more concrete.

First: if protected health information will ever touch the LMS, through completion records tied to patient cases, uploaded materials that reference real patients, or any other channel, the vendor becomes a business associate under HIPAA and needs a signed Business Associate Agreement with you. HHS publishes sample BA agreement provisions specifically to make this contract easier to get right, and says plainly that using its sample language is optional, not a shortcut around having it reviewed. Ask any vendor directly whether they'll sign a BAA before assuming either way. If they won't, and PHI genuinely touches the system, that's a dealbreaker.

Second, the platform needs the technical controls HIPAA's Security Rule expects, regardless of who built it: encryption in transit and at rest, role-based access so training records aren't visible to everyone with a login, SSO and MFA so account takeover doesn't become a PHI exposure, and audit logs showing who viewed or changed what, and when.

None of this means a SaaS LMS "owns your content" or that you lose it the moment you stop paying, a claim that shows up often in build-vs-buy content and doesn't hold up to scrutiny. Content rights, the ability to export your data, and the right to run the underlying software are three separate questions, and most mainstream SaaS LMS platforms let you export completion records and certificates on request. What you actually give up with SaaS isn't ownership of your training records. It's control over exactly how those technical safeguards get implemented and exactly what the BAA covers, since you're negotiating within whatever the vendor already offers.

How Does CE and CME Credit Tracking Actually Work?

This is where SCORM and HIPAA both stop being relevant and a third, completely different rulebook takes over, and it's the one most "LMS compliance" articles skip entirely.

Continuing education credit isn't verified by your LMS. It's verified by whichever board or accrediting body licenses the profession, and that body sets its own format for what counts as proof. Take insurance producers: the NAIC's Uniform Licensing Standards call for 24 CE credits per two-year compliance period, with 3 of those specifically in ethics, reported electronically and tied to the producer's National Producer Number, generally by the course provider rather than self-reported by the producer. File that credit under the wrong NPN and it can vanish into the system even though the producer genuinely sat through the course.

Medical continuing education runs on a different system again. Accredited CME providers report through ACCME's PARS system, and credits for other health professions route through CE Broker or CPE Monitor depending on the license type. None of these are LMS features. They're reporting destinations your LMS has to be built to talk to correctly, in the exact format each one expects.

Some states go further and mandate the tracking system itself. Florida requires its Department of Health to run an electronic CE tracking system for licensed health professions and has standardized on CE Broker for that purpose, meaning the system your training has to report into isn't a choice you get to make as the training provider.

The practical upshot: a general-purpose LMS tracks SCORM completion fine. Whether it can also produce a report in the exact format your board, accreditor or state-mandated system requires is a separate question, and it's the one that actually determines whether your CE program holds up at renewal time.

What Happens to Training Records When a Learner's Account Is Deactivated?

Deactivating an account and deleting a record are two different actions, and most platforms treat them that way: deactivation removes login access while preserving the learner's history, completions, scores and certificates, and reactivating the account restores both access and that history intact.

The part worth checking directly is whether your standard reports include deactivated users by default. On a lot of platforms they don't, which means a completion report run six months after someone leaves can quietly miss them, even though the record still exists in the database. If an auditor asks for every completion in a date range, "still exists" and "shows up in the report you just ran" are not the same guarantee.

There's a second layer specific to SCORM: the completion record and the underlying content package are usually stored separately. Replacing or removing the SCORM package itself doesn't have to touch the transcript, but whether it actually does depends on how your specific LMS handles that relationship, not on anything the SCORM spec guarantees. Confirm it with a real test rather than assuming it from a sales page.

Should You Build a Custom LMS for Compliance, or Buy One?

Buy, in most cases, at least to start. None of what's covered above, a BAA, encryption, audit logs, SCORM tracking, is something you need to build from scratch. Established platforms already have it, and a well-chosen SaaS plan or a specialist platform built for a specific accreditor's reporting format will usually get you compliant faster and cheaper than a custom build will.

The case for building shows up later, and it's narrower than "SaaS is expensive." It shows up when your compliance reporting has to match a format no generic export produces, when training data has to flow directly into another system you already run, like an agency management system or an HR platform, or when a state or accreditor mandates an integration your current vendor doesn't support and won't commit to building.

SkillBuild is a plain version of the same requirement: a home-services company training its own technicians and needing to prove, on demand, who is qualified to do what. That's also the pattern behind Agency Elite, the training and operations platform Developios built for a State Farm insurance agency, where the reporting a leader actually needed had to sit in the same system as the training rather than in a separate export. It's the same pattern behind GED Masters: a credentialing workflow specific enough that a generic LMS wasn't going to match it without heavy customization anyway.

The cost side is worked through properly in build vs buy: the real LMS cost math and custom LMS development cost. Here's a model, not a client's real invoice, to show the shape of the decision: an organization paying $300/month for a compliance-focused SaaS plan spends $3,600 a year in license fees. A custom build quoted at $40,000 up front plus $600/month in hosting and maintenance runs about $7,200 a year ongoing. Under these assumptions it never breaks even on licence cost alone — running the owned platform costs about $3,600 a year more than the subscription did, every year, before the build cost is even counted. The case for building isn't that it's cheaper. It's that once your compliance reporting has to match someone else's exact format, a state board or an accreditor, owning the system that generates that report stops being optional.

If a generic LMS or specialist SaaS platform already gets your compliance reporting into the right format, use it. Developios builds custom learning management systems for the cases where it doesn't, and a client's compliance reporting has to match a format nothing off the shelf produces.

FAQ

Is there a HIPAA-certified LMS?

No. HIPAA has no product certification program, and no government agency reviews or approves software as HIPAA compliant. What matters is whether the vendor will sign a Business Associate Agreement if protected health information touches the platform, and whether it has the technical safeguards, encryption, access control, audit logging, that HIPAA's Security Rule expects. Ask the vendor directly rather than trusting a badge on their homepage.

What's the difference between SCORM and xAPI?

SCORM tracks completion, score and time inside a single LMS session, and its record lives in that LMS's own database. xAPI records activity as separate statements sent to an external Learning Record Store, so the evidence isn't tied to one platform or session. SCORM is enough if "completed, with a score, in this LMS" answers your audit question. xAPI fits better when you need proof across devices, tools or offline activity.

Does my LMS vendor need to sign a Business Associate Agreement?

Only if protected health information will touch the platform, through completion records, uploaded materials, or any other channel. If PHI is involved, the vendor becomes a HIPAA business associate and a signed BAA is required, not optional. HHS publishes sample BAA language to make the contract easier to draft. If a vendor won't sign one and your training data includes PHI, look elsewhere.

Can a general-purpose LMS track CE or CME credits for accreditors like NAIC or ACCME?

It can track completion. Whether it can report that completion in the specific format your accreditor requires, matched to the right ID, like a National Producer Number for insurance CE or a PARS submission for CME, is a separate question most general LMS platforms don't advertise as a built-in feature. Confirm directly with the vendor, or the accreditor, before assuming either way.

What happens to SCORM completion records when I deactivate a learner's account?

On most platforms, deactivation preserves the learner's completions, scores and certificates while removing login access, and reactivating the account restores both. The real risk is reporting, not retention: standard completion reports on many systems exclude deactivated users by default, so a record that still exists in the database can still fail to appear in the report you run for an audit.

Is SOC 2 the same thing as HIPAA compliance?

No. SOC 2 is a security audit framework that evaluates a vendor's internal controls and is useful supporting evidence, but it isn't a HIPAA certification and doesn't replace a signed Business Associate Agreement if protected health information is involved. Treat a SOC 2 report as documentation for your HIPAA review, not as proof the platform is automatically compliant.