HIPAA & Security Required by card-industry rules

Card Payment Security Training for the Front Desk (PCI DSS)

Everything your front desk needs to take cards safely: what PCI DSS asks of a practice, never writing down card numbers or keeping the security code, safe phone payments, spotting skimmers on terminals, fake “processor” calls, refunds and card-on-file, and what to do when something looks wrong.

See pricing and buy See the lessons

Certificate of completion. Not continuing-education (CE) credit.

At a glance

6 lessons · about 60 min: Short lessons. Progress saves as they go.
$25 a person a year: Or included in the Complete plan.
English and Spanish: Every lesson and quiz, in either language. Each learner chooses.
Verifiable certificate: Certificate of completion. Not continuing-education (CE) credit.
Last reviewed October 4, 2026: We update this page when the rules change.

Before you buy: what’s included, and what your office adds

How it works: self-paced online lessons with short videos and a quiz after each lesson. There is no live class or instructor. Learners can send a question to our trainers from any lesson (we answer within 2 business days) or call (916) 770-4050, Monday to Friday, 8am to 6pm Pacific. Each person who passes gets a dated certificate of completion. It is not continuing-education (CE) credit.

Share your own card-handling and refund policy, show staff your terminals and how to inspect them, and tell them who to call about a suspicious device or a possible card data problem. Your processor’s instructions come first.

Audience

Who it’s for

Front desk and checkout staff who take card payments in person or by phone.
Billing staff who process refunds, card-on-file charges or patient financing.
Office managers responsible for the practice’s annual PCI self-assessment.

The law

What the card-industry rules require

PCI DSS is set by the PCI Security Standards Council and applies to your practice through your merchant agreement with your card processor. It is not a government law. The current version is PCI DSS v4.0.1.

Requirement 12.6 calls for a security awareness program, with training when staff are hired and at least once every 12 months. Since March 31, 2025 it must cover phishing and social engineering. Requirement 9.5.1 asks merchants to inspect payment terminals and train staff to spot tampering.

Sources checked October 4, 2026

The lessons

What’s covered

6 lessons · about 60 min. Each lesson ends with a short quiz.

#	Lesson	Minutes
1	Why Card Security Matters: PCI DSS in Plain Language	10
2	Handling Card Data at the Desk: Never Write It Down, Never Keep the Code	11
3	Payment Terminals: Spotting Skimmers and Tampering	10
4	Phishing, Fake Calls and Social Engineering	10
5	Refunds, Chargebacks, Card-on-File and Patient Financing	10
6	When Something Goes Wrong: Reporting Card Security Problems	10
	Total	about 60 min

Certificates

A dated certificate anyone can verify

Dated, with a serial number

Each person who passes gets a certificate showing their name, practice, program, lessons completed, score and date. Lessons end with a short quiz; the pass mark is 80%.

Anyone can check it

An auditor, inspector or employer can confirm a certificate is genuine at hipaa.comodotechnology.com/verify, with no account and without contacting us.

Not CE credit

It is a certificate of completion: proof the training happened. It is not continuing-education credit and not an accreditation or license.

Price

Price and how to buy

Choose a plan on our pricing page, enter your headcount and pay online. Card fees are included. Yearly plans renew each year until you cancel, and you see and agree to those terms before you pay. Replacing someone who leaves costs nothing.

This program

$25 / person / year

Add it to your cart, choose how many people, and pay online. Your sign-in link arrives by email.

Complete plan

$99 / person / year

All 23 programs, including this one. $89 at 10–24 people, $79 at 25+.

See Complete pricing

See pricing and buy Certificate of completion. Not continuing-education (CE) credit.

FAQ

Common questions

Is PCI training required for dental offices?

If your office accepts cards, your merchant agreement requires you to follow PCI DSS, and requirement 12.6 calls for security awareness training at hire and at least every 12 months.

Is PCI DSS a law?

No. It is a card-industry standard you agree to through your processor. Separate state laws, such as California’s breach notification law, can also apply when card data is exposed.

Does this make our practice PCI compliant?

No single course does. Training is one part. Your office also completes its annual self-assessment and follows its processor’s requirements.

What proof do we get?

A dated certificate with a serial number for each person who passes, verifiable online. It is a certificate of completion, not a PCI certification and not CE credit.

Related programs