HIPAA & Security Required by law

HIPAA Security Awareness Training for Healthcare Staff

Phishing, passwords, phone scams, devices and what to do when something goes wrong, taught the way it happens in a real practice. Eight core lessons plus one lesson for each person’s job, about 110 minutes in all.

See pricing and buy See the lessons

Certificate of completion. Not continuing-education (CE) credit.

At a glance

9 lessons · about 110 min: Short lessons. Progress saves as they go.
From $25 a person: Card fees included. Volume pricing.
English and Spanish: Every lesson and quiz, in either language. Each learner chooses.
Verifiable certificate: Certificate of completion. Not continuing-education (CE) credit.
Last reviewed October 4, 2026: We update this page when the rules change.

Before you buy: what’s included, and what your office adds

How it works: self-paced online lessons with short videos and a quiz after each lesson. There is no live class or instructor. Learners can send a question to our trainers from any lesson (we answer within 2 business days) or call (916) 770-4050, Monday to Friday, 8am to 6pm Pacific. Each person who passes gets a dated certificate of completion. It is not continuing-education (CE) credit.

The Security Rule requires a security awareness and training program built around your safeguards (45 CFR §164.308(a)(5)). Tell staff your password and device rules, how to report a lost device or suspicious email, and who your Security Officer and IT provider are.

Audience

Who it’s for

Every workforce member who touches a computer, phone or patient record, including managers and providers.
Practices that want their training to line up with the HIPAA Security Rule’s training standard.
Staff who already hold a HIPAA privacy certificate from elsewhere and need only the security half.

The law

What the HIPAA Security Rule requires

45 CFR §164.308(a)(5) requires covered entities and business associates to “implement a security awareness and training program for all members of its workforce (including management).”

The rule lists four topics as addressable parts of that program: periodic security reminders, protection from malicious software, log-in monitoring, and password management. This program covers each of them, plus phone scams, remote work and incident reporting.

The Security Rule does not set a fixed refresher schedule. A yearly cycle with a dated certificate for each person is the simplest way to show an auditor the program is real and ongoing.

Sources checked October 4, 2026

The lessons

What’s covered

9 lessons · about 110 min. Each lesson ends with a short quiz.

#	Lesson	Minutes
1	Phishing and Email Threats in a Healthcare Practice	10
2	Passwords, Logins and Multi-Factor Authentication	13
3	The Phone Call That Is Not What It Seems	11
4	Protecting Patient Information Day to Day	14
5	Workstations, Devices and the Office Itself	14
6	Working Outside the Office: Home, Telehealth and Personal Devices	11
7	Email, Text, Voicemail and the Patient Portal	11
8	When Something Goes Wrong: Reporting and Response	13
9	Plus one lesson for the person’s roleEach person takes the lesson for their job: Front Desk and Patient Intake, Insurance, Claims and Billing, Clinical Staff, Assistants and the Exam Room, Providers, Clinicians and Prescribers, Office Managers and HIPAA Security Officers, Outside Labs, Imaging and Digital Workflow, Sterile Processing, Supplies and Deliveries	13–16
	Total	about 110 min

Certificates

A dated certificate anyone can verify

Dated, with a serial number

Each person who passes gets a certificate showing their name, practice, program, lessons completed, score and date. Lessons end with a short quiz; the pass mark is 80%.

Anyone can check it

An auditor, inspector or employer can confirm a certificate is genuine at hipaa.comodotechnology.com/verify, with no account and without contacting us.

Not CE credit

It is a certificate of completion: proof the training happened. It is not continuing-education credit and not an accreditation or license.

Price

Price and how to buy

Choose a plan on our pricing page, enter your headcount and pay online. Card fees are included. Yearly plans renew each year until you cancel, and you see and agree to those terms before you pay. Replacing someone who leaves costs nothing.

HIPAA & Security plan

$39 / person / year

Both HIPAA programs and every role lesson, for 1–9 people. $35 at 10–24, $32 at 25–49, $29 at 50–99, $25 at 100+.

This program on its own

$25 / person / year

For staff who already hold the other HIPAA certificate. Choose the program after you sign in.

Complete plan

$99 / person / year

All 23 programs. $89 at 10–24 people, $79 at 25+. Also in the $1,199 HIPAA Compliance Pack (documents plus a first year of training for up to 10 staff).

See pricing and buy Certificate of completion. Not continuing-education (CE) credit.

FAQ

Common questions

Is security awareness training required for HIPAA?

Yes. §164.308(a)(5) requires a security awareness and training program for all workforce members, including management. This program is built around that standard.

What is the difference from HIPAA Awareness?

HIPAA Awareness covers the Privacy Rule: what you may share and what patients can ask for. HIPAA Security Awareness covers protecting the systems that hold patient data. Most practices need both, and the HIPAA & Security plan includes both.

How long does it take?

About 110 minutes: eight core lessons and one lesson for the person’s role, each 10 to 16 minutes.

Do we get proof of training?

Yes. Each person who passes gets a dated certificate with a serial number that anyone can verify online. It is a certificate of completion, not CE credit.

Is there a free version?

Our free Security Awareness program covers general habits for any business. For a HIPAA-covered practice, this HIPAA Security Awareness program is the one that maps to the Security Rule.

Related programs