HIPAA training for the brokers and agents who see PHI during enrollment and claims.
Placing a group health plan, running open enrollment, or working a claims question all put you face-to-face with protected health information that belongs to someone else's plan. Most brokers and agents are business associates of the plans and carriers they work with — this is the training and the documented certificate that relationship expects of you.
Comodo Technology is a Sacramento managed IT provider. We have supported California healthcare practices through real incidents, and this training is written from that experience rather than from a template.
- Two programs, 17 lessons
- HIPAA Security Awareness and HIPAA Awareness. Buy one or both.
- About 10–15 minutes a lesson
- Done between patients. Progress saves as they go.
- Assigned by role
- Front desk, billing, clinical, providers, managers, lab, sterile processing.
- Publicly verifiable certificates
- Serial number, program, lessons completed, date. Check any real certificate number below.
- Documents what your carriers expect
- Carrier and plan contracts increasingly ask brokers to show proof of HIPAA training. This is that proof.
Anyone placing or servicing a health plan
If PHI crosses your desk while doing this work, HIPAA's business-associate obligations likely apply to you the same way they apply to a billing company or an IT vendor.
Administering a self-insured employer's plan? The plan-sponsor page covers the firewall rule that applies on the employer's side of the relationship.
Two programs. Take one, or both.
They answer two different questions. HIPAA Security Awareness is about protecting the systems — §164.308(a)(5). HIPAA Awareness is about what you are allowed to say, to whom, and what patients can demand of you — §164.530(b). Most practices need both, but if you already have a HIPAA certificate from somewhere else, buy the security half on its own.
HIPAA Security Awareness Training
9 lessons for each person · about 110 minutes · 8 questions per lesson
- 01Phishing and Email Threats in a Healthcare Practice
The lookalike domain trick, the three fakes that actually arrive, and what to do in the first sixty seconds after a click.
- 02Passwords, Logins and Multi-Factor Authentication
Why unique user identification is a HIPAA requirement, not an IT preference.
- 03The Phone Call That Is Not What It Seems
Voice cloning, spoofed caller ID, and the one sentence that ends every one of these calls.
- 04Protecting Patient Information Day to Day
Screens, voices, faxes and phone cameras — where it actually leaks.
- 05Workstations, Devices and the Office Itself
Open charts, borrowed USB drives, unescorted visitors and the dumpster.
- 06Working Outside the Office: Home, Telehealth and Personal Devices
The post-emergency telehealth rules, personal cloud sync, and paper printed at home.
- 07Email, Text, Voicemail and the Patient Portal
Including the CC-field mistake that has produced some of the largest penalties against small practices anywhere.
- 08When Something Goes Wrong: Reporting and Response
The three things you do in the first five minutes, and why speed decides everything.
- 09Their role lesson
One of seven, assigned automatically by the role they pick when they join.
HIPAA Awareness Training
8 lessons for each person · about 95 minutes · 8 questions per lesson
- 01HIPAA Awareness: What You May Share, and What Patients Can Ask For
Treatment, payment and operations — and everything that falls outside them.
- 02The Notice of Privacy Practices: The Promise Your Practice Made
Why a signed acknowledgment is not consent, and the five findings auditors reliably turn up.
- 03Minimum Necessary: How Much Is Too Much to Share
The whole-chart attachment, and why looking counts as a use.
- 04Records, Amendments and Restrictions: The Deadlines You Have to Meet
30 days, 60 days, cost-based fees, and the one restriction request you cannot refuse.
- 05Business Associates: The Vendors Who Hold Your Patients' Data
Including the free app nobody approved, which is the highest-risk vendor in most practices.
- 06Breach or Not: How That Decision Actually Gets Made
The four-factor risk assessment, the three exceptions, and the encryption safe harbor.
- 07When You May Share Without Asking: Police, Family, Courts and Public Health
Why an attorney's subpoena is not a court order, and does not on its own release anything.
- 08Their role lesson
Same seven roles, written from the privacy side.
Seven role lessons
Front desk and intake · insurance, claims and billing · clinical staff and the exam room · providers and prescribers · office managers and HIPAA officers · outside labs and imaging · sterile processing and deliveries.
Graded on the server
80% to pass. Questions are shuffled and the answer key never reaches the browser, so a certificate means somebody actually knew the material.
Six-year records
Every completion is retained for the full HIPAA documentation period, and your office manager can export the whole practice to a spreadsheet at any time.
Where PHI actually shows up in broker work
It's easy to think of PHI as something that only lives inside a clinic. In broker and agency work it shows up just as often — in enrollment forms with health questions, in a claims escalation a client forwards you to help resolve, in underwriting information for a small self-insured group. Most of that work makes you a business associate of the plan or carrier you're working with, with the same direct liability under HITECH as any other business associate.
It's usually in your contract already
Most broker-of-record and agency agreements with carriers and plans already include HIPAA business-associate language. This training is what turns that contract language into something your staff actually knows how to act on.
What carriers are starting to ask for
A number of carriers and larger group clients now ask brokerages to document staff HIPAA training as part of due diligence, the same way they'd check E&O insurance. Having a verifiable certificate on file answers that request in one email instead of a scramble.
A certificate anybody can check
Read §164.530(b) closely and you will notice the requirement is not only that you train your workforce. It is that you document it, and keep that documentation for six years. What a practice is really buying is proof.
Every certificate we issue carries a serial number, the program it belongs to, how many of that program's lessons the person had completed, the score, the date, and the practice name — taken from the practice record, never typed by the learner. Anyone holding the serial can confirm it is genuine without an account and without contacting us.
Why the counts are frozen
"Module 4 of 9" is stamped onto the record the moment it is issued, not recalculated when someone looks at it later. When we publish a tenth lesson next year, that certificate still truthfully says what was true on the day. A certificate that quietly changes its own numbers is worthless as evidence.
A question worth asking any training vendor
There is no federal body that certifies HIPAA trainers. HHS states it plainly on its own site. So when a website sells you a “HIPAA certified” certificate, ask them who certified them.
What the rule actually requires you to keep is proof that a named person was trained, on a named date, that you can still produce six years later. That is precisely what this is — and you can check any one of them from this page.
HIPAA Compliance & Training Programs
Check a certificate right now
This is the same public endpoint an auditor or an insurer would use. No account needed.
Four-factor breach self-check
Something went wrong. Is it a breach you have to notify patients about? Under 45 CFR §164.402 it is presumed to be one unless your practice can demonstrate a low probability that the information was compromised — and demonstrate it with a written assessment, not a feeling. Walk the four factors here.
This is a teaching tool, not a legal determination, and nothing you enter leaves your browser. The real assessment is your Privacy Officer's to make and to write down.
How identifiable is it, and how sensitive?
Who ended up holding it?
Not whether it could have been — whether it was.
Mitigation counts — but only where you can evidence it.
Answer the four factors and we will show you how the assessment reads, and what happens next either way.
The clock already started
Discovery is the first day anyone in your workforce knew, or reasonably should have known — not the day it reached the office manager. A fax nobody mentioned until Monday is already three days into the window.
(916) 740-1407Take these whether you buy anything or not
Print them, laminate them, put them where people work. They are useful on their own and we would rather you had them.
Workstation security cheat sheet
One page for the front desk and every clinical workstation.
OpenIncident response plan
Two pages. What to do in the first hour, in order, with the numbers on it.
OpenHIPAA patient rights
What patients can ask for, and the deadlines that come with each one.
OpenStaff training acknowledgment
The signed form that goes in the file. Keep it for six years.
OpenNot quite a fit?
Same training, same price, written for a few other situations: Business associate, Employer group health plan, Mental health provider, and medical and specialty practices. Running a dental practice? Start with the main training page and the free dental practice toolkit.
Four steps, and none of them are hard
-
1
Tell us your practice name and which programs you want
HIPAA Security Awareness, HIPAA Awareness, or both.
-
2
We send you one join link for your practice
Forward it to everyone. Each person fills in their own name and role — your practice name comes from the link, so it is always correct on their certificate and nobody can mistype it.
-
3
They work through it at their own pace
No passwords — they get an emailed sign-in link. Progress saves, so they can stop between patients and come back.
-
4
Your office manager gets the record
Who has finished, who has not, every certificate number, exportable to a spreadsheet. That is the file you hand an auditor or an insurance questionnaire.
Talk to a person
No form that goes nowhere. These reach us.