Does HIPAA require workforce training?

Yes. The Privacy Rule (45 CFR §164.530(b)) requires covered entities to train workforce members on applicable policies and procedures concerning protected health information as necessary and appropriate to their functions. The Security Rule (45 CFR §164.308(a)(5)) requires a security-awareness and training program for all workforce members, including management.

Does HIPAA require annual training?

Federal HIPAA does not prescribe one universal annual course or government-issued certification. The Privacy Rule requires training for workforce members, for new members within a reasonable period after joining, and for personnel affected by a material policy or procedure change. The Security Rule requires an ongoing security-awareness program with periodic security updates. Many organizations also adopt annual refresher training as a reasonable operational standard on top of those event-driven requirements.

Is Patient Protect issuing a government-recognized HIPAA certification?

No. There is no government-issued HIPAA compliance certification. Patient Protect issues a Certificate of Completion that documents successful completion of the assigned training series. The certificate carries a unique identifier and QR code that opens its verification record.

How is completion verified?

Every certificate includes a unique identifier and a QR code that opens the certificate's attribution and verification record. Office administrators can also see per-learner assessment scores and workforce-wide completion status.

What is included for free?

The first five modules — HIPAA Fundamentals, the Privacy Rule, the Security Rule, the Breach Notification Rule, and Real-World Breach Scenarios & Best Practices — are free and hosted on YouTube on the Patient Protect channel. Together they include ~30 min of instruction and 25 assessment questions. No credit card is required for free access.

What does the full HIPAA Foundations series cover?

The complete Foundations series is 19 modules totaling about 1 hour, 45 minutes of instruction with 95 knowledge-assessment questions. It covers Privacy, Security, Breach Notification, real-world breach scenarios, risk assessments, all three safeguard categories (administrative, physical, technical), policies and procedures, workforce training, BAAs, incident response, auditing, backup and recovery, device and media controls, facility access, continuous improvement, and HIPAA enforcement.

Is HIPAA training the only thing Patient Protect provides?

No. HIPAA training is included inside a broader compliance platform covering risk assessments, policies, workforce management, vendor oversight, incident readiness, secure workflows, and compliance evidence. Training is one administrative safeguard within a larger operating program.

How is Patient Protect priced?

Patient Protect is priced by office rather than by seat. Basic is $39 per office per month and includes up to 25 personnel (+$10/month per additional five). Pro is $99 per office per month and includes up to 50 personnel (+$5/month per additional five). At 25 personnel, Basic works out to $18.72 per person for a full year of access — and training is only one part of the subscription.

HIPAA workforce training

HIPAA training for the whole practice.

Patient Protect provides online HIPAA training for healthcare employees, office personnel, managers, and compliance officers. Start with 5 free modules. Unlock the full 19-module HIPAA Foundations series — about 1 hour, 45 minutes of instruction, 95 knowledge-assessment questions, administrator tracking, and QR-verifiable Certificates of Completion.

Start 5modules free →Train my office ($39/mo)

No credit card for free access · Self-paced · Built for healthcare workforces

Focused training modules

~1h 45m

Expert-led instruction

Knowledge-assessment questions

Personnel included with Basic

Why the training is this deep — and this affordable

HIPAA is not a short subject. Training for it shouldn’t be either.

Most HIPAA training available to a small practice runs 20 to 30 minutes total. That is not enough time to meaningfully cover the Privacy Rule, the Security Rule, the Breach Notification Rule, and the operational workflows that actually put patient information at risk. And practices know it — which is why so many workforces treat annual training as an event to survive rather than an obligation to master.

The Patient Protect HIPAA Foundations series is 19 focused modules totaling about 1 hour, 45 minutes, with 95 knowledge-assessment questions across the series. Each module is short by design. Together they cover the full operational surface of HIPAA a healthcare workforce actually encounters — the vocabulary and regulatory framework, the Privacy Rule, the Security Rule, business associates, breach notification, incident handling, auditing, enforcement, and the workforce decisions that lead to breaches in practice.

The philosophy behind that breadth: breadth belongs in the program, precision belongs in the assignment. The HIPAA officer gets enough content in scope to assign the right depth to the right person — a receptionist, a clinician, a biller, an office manager, and the compliance officer do not need identical training. When the library is broad enough, precision becomes an assignment choice rather than a content limitation.

“Every practice I worked in had a compliance binder on the shelf. Not one of them could have survived a real audit — and none of them knew it. Training that closes that gap has to be written from inside the treatment room, not from a policy outline.”
— Angie Perrin, RDH · Chief Security Officer · adjunct dental instructor, in offices since 2011

The economics

What most offices pay for HIPAA training vs. what an office actually needs to pay.

Industry norm · per-seat pricing

$625–$875/office/year

25 personnel × $25–$35 per seat, per year. Training only. Nothing else included.

Patient Protect Basic · office pricing

$468/office/year

25 personnel included. Full 19-module Foundations series, 95 assessment questions, per-learner scoring, verifiable Certificates of Completion, workforce roster — plus the broader Patient Protect compliance platform.

At 25 personnel, Basic works out to $18.72 per person for a full year of training access. The point is not to make HIPAA training cheap by making it thin. The point is to make extensive, accountable training economically realistic for the practices expected to provide it.

Start with substance

The first five modules are completely free.

Not trailers. Not fragments. about 30 minutes covering the laws and responsibilities every healthcare workforce needs to understand — plus 25 assessment questions.

Each module page includes an original educational companion alongside the video — concepts, practical application, common questions, and links to primary CFR and HHS sources. The pages are not summaries. They exist to make the training material easier to retain and apply after the video ends.

5:33

Module 01· Free

HIPAA Fundamentals

Vocabulary + regulatory framework

The history of HIPAA, the two federal bodies that enforce it, the two main Rules, and the vocabulary every workforce member should be able to define — PHI, ePHI, encryption, breach, covered entity, business associate.

Open module

4:55

Module 02· Free

HIPAA Privacy Rule

Use, disclosure + patient rights

The Privacy Rule, Privacy Officer designation, workforce confidentiality practices, the 30-day patient access right, state-varying record retention (6–10 years), and the penalty tiers for non-compliance.

Open module

5:30

Module 03· Free

HIPAA Security Rule

ePHI protection + safeguards

The Security Rule, mandatory risk assessment, Security Officer designation, secure networks, BAAs, MFA, encryption, secure device use (registered devices, screen time-outs, password rotation), and staff-training cadence.

Open module

7:56

Module 04· Free

HIPAA Breach Notification Rule

Incident analysis + notification

The definition of a breach and the three exceptions to it, what unsecured PHI is, the individual/media/HHS notification timelines, business associate notification, and the administrative documentation the rule requires.

Open module

5:23

Module 05· Free

Real-World Breach Scenarios & Best Practices

Applied workforce decision-making

Six real-world scenarios — lost unencrypted laptop, public discussion of patient info, misdirected email, improper record disposal, unauthorized employee access, unlocked workstation — and the specific workforce practices that prevent each one.

Open module

~30 min of free instruction · 25 assessment questions

Unlock free training →

Breadth with structure

From the law to the moment something goes wrong.

Each module is concise by design. Together, the 19 build a working understanding of privacy, security, safeguards, response, resilience, and accountability.

HIPAA FundamentalsFree