HIPAA Security Awareness
Training for Small
Practices, No IT Staff Required.
If you run a dental practice, medical clinic, chiropractic office, or physical therapy center with fewer than 50 employees, HIPAA still applies, and OCR still enforces. This training supports the workforce training requirement in §164.308(a)(5) and gives you dated completion records you can provide when asked.
Your regulatory requirements
HIPAA applies to your practice, regardless of its size.
There is no small-practice exemption. The Security Rule, Privacy Rule, and Breach Notification Rule all apply to covered entities and business associates of every size. Below are the specific provisions that require your team to complete annual training.
| Framework | Citation | What it requires |
|---|---|---|
| HIPAA Security Rule | §164.308(a)(5) | Requires covered entities and business associates to implement a security awareness and training program for all members of the workforce, including management. |
| HIPAA Privacy Rule | §164.530(b) | Requires training on policies and procedures with respect to protected health information as necessary and appropriate for members of the workforce. |
| HITECH Act | Breach Notification | Strengthened HIPAA enforcement. Breaches affecting 500+ individuals require notification to HHS, affected individuals, and in many cases the media, within 60 days of discovery. |
| State Breach Notification Laws | Varies by state | All 50 states have breach notification laws. Most require notification within 30–60 days. Small practices are often unaware of their state's specific timeline and content requirements. |
This table summarizes key training-adjacent provisions. Consult qualified counsel for a complete compliance assessment specific to your practice.
Why this matters for small practices
Small practices are not too small to be breached, they are the primary target.
Attackers know that small healthcare organizations often lack dedicated security staff. The numbers make it clear: a breach can cost a small practice far more than it can absorb. Training your staff is the most effective, lowest-cost control you can implement this year.
Average healthcare breach cost
IBM Cost of a Data Breach Report, 2024
Percentage of breaches involving small organizations
Verizon 2024 Data Breach Investigations Report
Average per-record cost in healthcare
IBM / Ponemon Institute, 2024 benchmark
What the training covers
Designed for the scenarios your staff actually encounter, not generic corporate policy.
This is not enterprise training shoehorned into a small-practice context. Every scenario is written for the people who answer the phone, check in patients, file insurance claims, and manage the schedule, not for a CISO at a hospital system.
Protected Health Information (PHI) Identification
What counts as PHI under HIPAA, including data points most staff do not realize are individually identifiable. Scenarios drawn from real small-practice incidents.
PHI on Mobile Devices
Text messages, personal phones, tablets, and home computers, all common in small practices and all within the scope of HIPAA security requirements. Practical steps that work without an MDM.
Email and Messaging Risks
When email containing PHI is permissible and when it is not. Encrypted patient portal alternatives. Avoiding the common mistake of forwarding PHI to a personal account.
Business Associate Agreements
What a BA is, why the agreement matters, and how staff-level actions (uploading patient files to an unapproved cloud service) can violate BA obligations even if management signed the right paperwork.
Access Control and Authentication
Shared logins, sticky-note passwords, and accounts left logged in at the front desk, the most common causes of small-practice PHI exposure. Simple fixes that do not require IT staff.
Recognizing and Reporting Incidents
How to recognize a potential breach scenario in a small practice (lost phone, misdirected fax, email to wrong patient), and who to tell within the required notification window.
Recommended for your industry
Recommended training for healthcare teams
Not every employee needs every cybersecurity course. Start with the training that addresses your industry's biggest risks and regulatory responsibilities, then add specialized courses where needed.
Related, but not interchangeable
HIPAA Privacy & Security and Cybersecurity Awareness are related but not interchangeable. HIPAA Privacy & Security is fundamentally about protecting PHI/ePHI and complying with HIPAA rules: it teaches what PHI is, when information can be used or disclosed, minimum necessary access, patient privacy rights, and safe everyday handling of patient information. Cybersecurity Awareness is broader, building the everyday security habits (spotting phishing, choosing strong passwords, and handling suspicious links) that protect every kind of data, not just patient information. In short: privacy asks whether someone should have access, while security asks how that access is protected.
Not sure where to start? For most healthcare organizations, HIPAA Privacy & Security and Cybersecurity Awareness are the two related but distinct courses that together cover both your patient-data obligations and everyday security habits.
Certificates and training records
When OCR or an auditor asks for proof, you have it.
Every learner gets a certificate that lists their name, the date of completion, the frameworks mapped (including HIPAA Security Rule §164.308(a)(5)), and a public verification URL. An OCR investigator, cyber insurance underwriter, or state licensing board can type that URL into any browser and confirm the certificate is genuine, no login, no account, no phone call.
Manager reports show who completed training, who has not, and when each certificate expires. Export as a PDF. Hand it to your auditor. Done.
Also applies to your profession
See how this training applies to other regulated small businesses.
Accounting Firms
FTC Safeguards Rule, IRS Pub 4557, SOC 2, for CPA firms and tax preparers without dedicated IT staff.
View accounting guideMortgage & Real Estate
GLBA training expectations and wire fraud prevention for independent originators and small brokerages.
View mortgage guideLegal Practices
ABA Model Rules 1.1 and 1.6, technology competence and confidentiality for small and solo firms.
View legal guideManaged Service Providers
CMMC, NIST CSF, ISO 27001, supply chain security training for small MSP teams.
View MSP guideInsurance Agencies
State regulation and NAIC model law training for independent agents and small brokerages.
View insurance guideFinancial Advisors
SEC and FINRA-aligned training for RIAs and independent advisors handling sensitive client financial data.
View financial advisor guideNonprofits
Donor data protection and grant compliance training for small charities and foundations without IT staff.
View nonprofit guide
Set up HIPAA training for your entire practice in four minutes. No IT staff, no sales call, no contract.
Your front desk, your hygienists, your billing staff, and every other workforce member completes the same program. Certificates issued instantly. Publicly verifiable. Completion records you can download as soon as people finish.
Fixed annual pricing per person. Cancel any time. Certificates remain valid and verifiable for 12 months. Training and documentation support compliance, consult qualified counsel for HIPAA-specific legal interpretation.