HIPAA training for the vendors who handle PHI without being the practice.
Billing companies, IT and MSP vendors, answering services, document storage, transcription, couriers and consultants — if patient information passes through your hands on a covered entity's behalf, you are a business associate under HIPAA, and HITECH made you directly liable for parts of the Security Rule. This is the same training program, priced and delivered the same way, written for your side of the relationship instead of the practice's.
Comodo Technology is a Sacramento managed IT provider. We have supported California healthcare practices through real incidents, and this training is written from that experience rather than from a template.
- Two programs, 17 lessons
- HIPAA Security Awareness and HIPAA Awareness. Buy one or both.
- About 10–15 minutes a lesson
- Done between patients. Progress saves as they go.
- Assigned by role
- Front desk, billing, clinical, providers, managers, lab, sterile processing.
- Publicly verifiable certificates
- Serial number, program, lessons completed, date. Check any real certificate number below.
- Backs up your BAA
- The signed business associate agreement you already have with each client is a promise. This is the documentation that backs it up.
If you touch PHI on someone else's behalf, this applies to you
A business associate agreement is not a formality — HITECH made business associates directly liable for their own Security Rule failures and their own breach-notification failures, independent of the covered entity's contract. Training your own staff is part of holding up your end of it.
Two programs. Take one, or both.
They answer two different questions. HIPAA Security Awareness is about protecting the systems — §164.308(a)(5). HIPAA Awareness is about what you are allowed to say, to whom, and what patients can demand of you — §164.530(b). Most practices need both, but if you already have a HIPAA certificate from somewhere else, buy the security half on its own.
HIPAA Security Awareness Training
9 lessons for each person · about 110 minutes · 8 questions per lesson
- 01Phishing and Email Threats in a Healthcare Practice
The lookalike domain trick, the three fakes that actually arrive, and what to do in the first sixty seconds after a click.
- 02Passwords, Logins and Multi-Factor Authentication
Why unique user identification is a HIPAA requirement, not an IT preference.
- 03The Phone Call That Is Not What It Seems
Voice cloning, spoofed caller ID, and the one sentence that ends every one of these calls.
- 04Protecting Patient Information Day to Day
Screens, voices, faxes and phone cameras — where it actually leaks.
- 05Workstations, Devices and the Office Itself
Open charts, borrowed USB drives, unescorted visitors and the dumpster.
- 06Working Outside the Office: Home, Telehealth and Personal Devices
The post-emergency telehealth rules, personal cloud sync, and paper printed at home.
- 07Email, Text, Voicemail and the Patient Portal
Including the CC-field mistake that has produced some of the largest penalties against small practices anywhere.
- 08When Something Goes Wrong: Reporting and Response
The three things you do in the first five minutes, and why speed decides everything.
- 09Their role lesson
One of seven, assigned automatically by the role they pick when they join.
HIPAA Awareness Training
8 lessons for each person · about 95 minutes · 8 questions per lesson
- 01HIPAA Awareness: What You May Share, and What Patients Can Ask For
Treatment, payment and operations — and everything that falls outside them.
- 02The Notice of Privacy Practices: The Promise Your Practice Made
Why a signed acknowledgment is not consent, and the five findings auditors reliably turn up.
- 03Minimum Necessary: How Much Is Too Much to Share
The whole-chart attachment, and why looking counts as a use.
- 04Records, Amendments and Restrictions: The Deadlines You Have to Meet
30 days, 60 days, cost-based fees, and the one restriction request you cannot refuse.
- 05Business Associates: The Vendors Who Hold Your Patients' Data
Including the free app nobody approved, which is the highest-risk vendor in most practices.
- 06Breach or Not: How That Decision Actually Gets Made
The four-factor risk assessment, the three exceptions, and the encryption safe harbor.
- 07When You May Share Without Asking: Police, Family, Courts and Public Health
Why an attorney's subpoena is not a court order, and does not on its own release anything.
- 08Their role lesson
Same seven roles, written from the privacy side.
Seven role lessons
Front desk and intake · insurance, claims and billing · clinical staff and the exam room · providers and prescribers · office managers and HIPAA officers · outside labs and imaging · sterile processing and deliveries.
Graded on the server
80% to pass. Questions are shuffled and the answer key never reaches the browser, so a certificate means somebody actually knew the material.
Six-year records
Every completion is retained for the full HIPAA documentation period, and your office manager can export the whole practice to a spreadsheet at any time.
You're not a covered entity — you're still directly liable
Before 2013, a business associate's HIPAA obligations lived entirely inside its contract with the covered entity — if something went wrong, the covered entity answered for it. The HITECH Act changed that: enforcement can now investigate and fine a business associate directly, for its own Security Rule failures and its own breach-notification failures, independent of what the contract says.
What a BAA actually promises
Every business associate agreement your clients ask you to sign is your practice-facing promise that you'll safeguard PHI the way HIPAA requires them to. Documented staff training is the evidence that promise is real, not just signed paper.
The audit question you'll get asked
A growing number of practices now add “show us your staff's HIPAA training records” to their vendor onboarding checklist, the same way they'd ask about your insurance. This is exactly the record that answers it.
A certificate anybody can check
Read §164.530(b) closely and you will notice the requirement is not only that you train your workforce. It is that you document it, and keep that documentation for six years. What a practice is really buying is proof.
Every certificate we issue carries a serial number, the program it belongs to, how many of that program's lessons the person had completed, the score, the date, and the practice name — taken from the practice record, never typed by the learner. Anyone holding the serial can confirm it is genuine without an account and without contacting us.
Why the counts are frozen
"Module 4 of 9" is stamped onto the record the moment it is issued, not recalculated when someone looks at it later. When we publish a tenth lesson next year, that certificate still truthfully says what was true on the day. A certificate that quietly changes its own numbers is worthless as evidence.
A question worth asking any training vendor
There is no federal body that certifies HIPAA trainers. HHS states it plainly on its own site. So when a website sells you a “HIPAA certified” certificate, ask them who certified them.
What the rule actually requires you to keep is proof that a named person was trained, on a named date, that you can still produce six years later. That is precisely what this is — and you can check any one of them from this page.
HIPAA Compliance & Training Programs
Check a certificate right now
This is the same public endpoint an auditor or an insurer would use. No account needed.
Four-factor breach self-check
Something went wrong. Is it a breach you have to notify patients about? Under 45 CFR §164.402 it is presumed to be one unless your practice can demonstrate a low probability that the information was compromised — and demonstrate it with a written assessment, not a feeling. Walk the four factors here.
This is a teaching tool, not a legal determination, and nothing you enter leaves your browser. The real assessment is your Privacy Officer's to make and to write down.
How identifiable is it, and how sensitive?
Who ended up holding it?
Not whether it could have been — whether it was.
Mitigation counts — but only where you can evidence it.
Answer the four factors and we will show you how the assessment reads, and what happens next either way.
The clock already started
Discovery is the first day anyone in your workforce knew, or reasonably should have known — not the day it reached the office manager. A fax nobody mentioned until Monday is already three days into the window.
(916) 740-1407Take these whether you buy anything or not
Print them, laminate them, put them where people work. They are useful on their own and we would rather you had them.
Workstation security cheat sheet
One page for the front desk and every clinical workstation.
OpenIncident response plan
Two pages. What to do in the first hour, in order, with the numbers on it.
OpenHIPAA patient rights
What patients can ask for, and the deadlines that come with each one.
OpenStaff training acknowledgment
The signed form that goes in the file. Keep it for six years.
OpenNot quite a fit?
Same training, same price, written for a few other situations: Employer group health plan, Mental health provider, Insurance broker or agent, and medical and specialty practices. Running a dental practice? Start with the main training page and the free dental practice toolkit.
Four steps, and none of them are hard
-
1
Tell us your practice name and which programs you want
HIPAA Security Awareness, HIPAA Awareness, or both.
-
2
We send you one join link for your practice
Forward it to everyone. Each person fills in their own name and role — your practice name comes from the link, so it is always correct on their certificate and nobody can mistype it.
-
3
They work through it at their own pace
No passwords — they get an emailed sign-in link. Progress saves, so they can stop between patients and come back.
-
4
Your office manager gets the record
Who has finished, who has not, every certificate number, exportable to a spreadsheet. That is the file you hand an auditor or an insurance questionnaire.
Talk to a person
No form that goes nowhere. These reach us.