HIPAA security awareness training for small practices
See who on your team would click, for free Request a free baseline phishing test for up to 25 staff, or start a free trial of the training platform. Request the free test → If you run a dental office, a clinic, or any small practice that handles patient records, one email can put patient data at risk. HIPAA expects your staff to know how to handle that.
This is a plain-words guide, not legal advice.
Is security awareness training required by HIPAA?
Yes. The HIPAA Security Rule has a standard called security awareness and training, 45 CFR 164.308(a)(5). It says you must “implement a security awareness and training program for all members of its workforce (including management).”
That means the front desk, the hygienist, the doctor and the owner. Not just IT.
What are the four items the rule names?
The rule lists four parts of a training program. Here they are in plain words.
| Item | The rule’s words | Example for your team |
|---|---|---|
| Security reminders | Periodic security updates | A short monthly tip |
| Protection from malicious software | Procedures for guarding against, detecting and reporting malicious software | Do not open unknown attachments; report odd pop-ups |
| Log-in monitoring | Procedures for monitoring log-in attempts and reporting discrepancies | Report “someone tried to sign in” alerts |
| Password management | Procedures for creating, changing and safeguarding passwords | Use a password manager; no shared logins |
The rule marks all four as “addressable.” That does not mean optional. It means you decide, based on your own risk, how to meet it, and you write down why.
How does training fit with the risk analysis?
Training works best when it matches your real risks. The same section of the rule requires a risk analysis: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (164.308(a)(1)(ii)(A)). If your analysis finds that phishing is your top risk, your lessons should start there.
What should HIPAA training cover in a small practice?
Cover six things, in short lessons.
- Phishing and texts. The most common way in. See how to train employees to spot phishing.
- Passwords and MFA. Everyone gets their own login.
- Patient data handling. No patient details in personal email, text or WhatsApp.
- Lost devices. Who to tell, and how fast.
- How to report. One person, one way, no blame. Use our what to do after a bad click steps as a script.
- Visitors and vendors. Who can see screens and records.
How do I prove I did it?
Auditors and partners ask for evidence. Keep:
- A list of staff and their start dates.
- The training content and the date each person finished.
- Quiz results or sign-offs.
- Your reminders and refreshers through the year.
- Phishing test results, if you run them.
Our post on what auditors ask for as proof of training has a simple record you can copy. Your cyber insurer may ask for the same records. See does cyber insurance require training?
What does a simple training year look like?
A year plan is short. Pick a rhythm you can keep.
- At hire: the core lesson in the first week.
- Every month: one short reminder (this supports the rule’s “periodic security updates”).
- Twice a year: a practice phishing test.
- Whenever something changes: a quick note to everyone.
- Always: save the records.
For more on timing, read how often should employees do security awareness training?
A worked example
A five-chair dental office hires a new front-desk person on Monday. By Friday she finishes the core lesson, creates her own login with MFA, signs the training log and learns the one way to report a strange email. In the next months she gets a short monthly tip. In the spring the office runs a practice phishing email, and the owner saves the report with the staff list. At audit time, the folder is ready.
Where do we fit?
We built an add-on for healthcare, plus a page for dental and medical practices. You can start with a free phishing risk test for up to 25 staff to see where you are today, or book a free demo.
Questions people ask
Is security awareness training required by HIPAA?
Yes. 45 CFR 164.308(a)(5) says covered entities and business associates must implement a security awareness and training program for all members of the workforce, including management.
What does 'addressable' mean in HIPAA?
It does not mean optional. You must look at the item, decide if it is reasonable and appropriate for your practice, and either do it or document an equivalent measure and why.
What should HIPAA training for a small practice cover?
The rule lists security reminders, protection from malicious software, log-in monitoring and password management. In practice that means phishing, safe passwords and MFA, reporting problems, and handling patient data.
How often must we train?
The rule asks for a program and periodic security updates, but does not give a fixed number of days. Many practices train at hire and then run short refreshers during the year. Ask your compliance adviser for your case.
Does HIPAA training count for new hires too?
Yes. The rule covers all members of the workforce, so new staff, part-timers and managers are included. Many practices give the core lesson in the first week.