Healthcare Compliance Training and Certification

Get a Demo

CYBERSECURITY TRAINING

Cybersecurity Training For Healthcare Organizations

Take your Cybersecurity training to the next level in your organization.

Don’t cut corners on Cybersecurity training. Give your staff the level of training that your patients and customers deserve.

Start Your Compliance Training Now
Healthcare staff completing cybersecurity training at a hospital workstation

COURSE OVERVIEW

FORMAT

Online Course

LEVEL

Healthcare Professionals

AUTHOR

ComplianceJunction

CONTENTS

Videos Quizzes

DURATION

2 hours 10 mins

AWARD

Certificate of Completion

Start Your Compliance Training Now

WHAT’S INCLUDED

What’s included?

This comprehensive Cybersecurity training is designed by ComplianceJunction for covered entities.

The purpose of this course is to enhance the security posture and protect the sensitive information of organizations in the healthcare industry. It aims to educate healthcare professionals and staff about potential cyber threats, best practices for safeguarding data, and the necessary steps to mitigate risks.

This course has been designed specifically for front-line staff who work at covered entities, and we believe that this training approach is unique in the healthcare industry.

The target learner is non-IT professionals who directly handle medical records/PHI.

Analytics dashboards

Keep a close eye on your staff training progress throughout the year.

Our dashboards provide a comprehensive overview of who has completed their HIPAA training, how and when.

Learner-friendly content

Learner-friendly content that helps you to get your staff to buy into the HIPAA training process. Avoid push back from your staff about completing their HIPAA training. See your staff members enjoy the HIPAA training process.

Keep up-to-date

Keep your staff up-to-date on the latest HIPAA regulation changes.

We regularly refresh our HIPAA training content on an annual basis and throughtout the year.

CASE STUDIES

Training Case studies

Download

Downloadable case studies within your course that clearly illustrate real-world examples of HIPAA breaches

Theory plus practical

Make it easy for the learner to link this course theory with practical, real-world examples

Learner Friendly

Help the learner to understand and remember what this training means in the real world

LEARNING DASHBOARD

Learning Dashboard

Management Reports

Easily issue management reports on HIPAA training for audit reporting purposes.

Learner Analytics

Quickly view the progress analytics of all your learners in your organization.

Training Champions

Quickly identify the HIPAA training champions in your organisation.

Identify learners in your organization that require extra help with their HIPAA training.

This self-paced program delivers cybersecurity training built exclusively for healthcare professionals. Unlike generic security courses, it focuses on the unique threats, risks, and compliance requirements of the healthcare environment—where safeguarding protected health information (PHI) is both a regulatory obligation and a patient-care priority. The course equips participants with the practical knowledge and tools needed to protect PHI, comply with HIPAA’s privacy, security, and breach notification rules, and minimize the risk of costly violations.

We enable management teams to monitor the training progress of their staff throughout the year with a training dashboard.

TRAINING DASHBOARD

Training dashboard showing staff progress

GRADEBOOK

Gradebook record of learner completions

15 MODULES

Course Curriculum

01. Healthcare Cybersecurity Training
The introduction to healthcare cybersecurity training explains that, although the provision of training is a regulatory requirement, its objectives are to reduce the likelihood of data breaches and the real consequences of data breaches. To encourage staff participation, the introduction suggests benefits of being more cybersecurity aware – such as enhanced job satisfaction and the avoidance of sanctions. Staff are also invited to apply best practices learned in the training to their personal online activities, and advised to seek advice from a person in authority if they have any questions about the training or how it applies to their roles.
02. Healthcare Cybersecurity Fundamentals
This module sets the tone for the training inasmuch as it acknowledge that different staff members have different levels of cybersecurity awareness, different levels of HIPAA knowledge, and different ideas about the consequences of HIPAA violations and data breaches. To address some of the imbalances, the module explains why it is important staff understand and apply security best practices, provides examples of the difference between a HIPAA violation and a data breach, and summarizes the consequences of cybersecurity failures for patients, healthcare organizations, and staff.
03. HIPAA, the HIPAA Rules, and PHI
This module is included to educate staff members whose roles do not ordinarily involve uses and disclosures of Protected Health Information, and to refresh the memories of those that use and disclose it every day. It recaps HIPAA and the main HIPAA Rules, and explains why some organizations implement more stringent requirements than HIPAA. It also explains why cybersecurity awareness has to be provided in the context of HIPAA. The module concludes with clarification of what is considered Protected Health Information under HIPAA, as this will be relevant to understanding several compliance concepts in later training modules.
04. Physical Safeguards: Workstations, Personal Devices, and Removable Media
This module starts by explaining that although HIPAA Security Officers are responsible for ensuring physical safeguards are implemented that comply with the requirements of the Security Rule’s Physical Safeguards, staff members are responsible for using the safeguards in compliance with HIPAA. The module focuses on the security of workstations, carts, and connected system accessories, application security, and using a personal device to create, receive, store, or transmit Protected Health Information. Additional advice is provided on the security risks of USB drives, and why it is important that any USB drive that has been used to store PHI is purged before being disposed of.
05. Password Security for Accessing ePHI
This module discusses why staff members are issued with unique passwords, and why it is important to keep passwords secure in the context of tracking user activities and tracing interactions with electronic PHI back to specific individuals. The discussion helps explain why passwords should never be shared, and primes staff members for later modules relating to phishing emails and social engineering. There are also lessons dedicated to how staff members should respond when they believe their password has been compromised – including one for staff members who re-use work-issued passwords to protect personal online accounts.
06. Why Phishing Attacks Target Healthcare Records
This module explains what phishing is, why it is a major threat to organizations in the healthcare industry, and the options available to cybercriminals once they have accessed PHI via a phishing attack. The module also explains why stolen PHI has a high value and a long shelf life in terms of what it can be misused for, and the length of time it can take before the misuse of PHI is identified. Specific lessons focus on misusing PHI to commit medical identity theft, tax fraud, and Medicare fraud; and it is noted that the same medical records can be resold – and misused – many times over to maximize profit and harm.
07. Social Engineering in Healthcare
This module helps staff members better understand the different types of social engineering by explaining the difference between widespread phishing attacks, spear phishing attacks, and business email compromise attacks. The objective of the module is to raise staff awareness of how socially engineered communications can be delivered so they do not fall into common traps set by cybercriminals. Sections of the module also discuss how to recognize socially engineered communications, adopting a zero-trust approach for out-of-band requests from trusted sources, and what to do if they receive suspicious communications and are unable to verify the authenticity of the communication.
08. Safe Use of Email, Messaging, and Social Media in Healthcare
This module discusses the safe use of popular communication tools to ensure that, when staff members use an authorized channel of communication, they do so safely. Best practices for using email cover disclosures of PHI in email subject lines, maintaining a tidy inbox, and ensuring emails are sent to the correct recipients. The section on messaging services explains that not all messaging services are HIPAA compliant and that even when they are, it is still necessary for a Business Associate Agreement to be in place before a service can be used to transmit PHI. Social media best practices include never interacting with a patient via social media and being careful about what is included in personal social media profiles.
09. PHI in Email Subject Lines, Document Names, and Contact Lists
This module is designed to help staff members better understand the rationale behind certain security policies. For example, many organizations have policies stating PHI should not be stored in contact lists. This module explains why, and provides examples of what information can be stored in contact lists when it is necessary to add identifying information to distinguish between contacts with the same name. The objective of this module is to encourage staff members to be more thoughtful when creating emails, documents, and contacts, or performing other administrative activities in which the risk exists that Protected Health Information may be exposed impermissibly or in violation of a security policy.
10. HIPAA Security Rule Technical Safeguards for Staff
This module emphasizes that all staff members must comply with security policies developed to comply with the HIPAA Security Rule Technical Safeguards by explaining how cybercriminals can remotely elevate account access permissions to move laterally through healthcare networks. It also cautions against providing malicious insiders with access to login credentials, and suggests best practices for password security, manually logging out of systems, and paying attention to security pop-ups. The module concludes with a warning that staff members who undermine the Technical Safeguards – or who disclose login credentials through carelessness – will be sanctioned for violating a security policy.
11. Your Security Responsibility and HIPAA Compliance
This module explains that staff members’ compliance responsibilities extend beyond complying with security policies, and that they have to be conscious of any activity that could threaten the security of PHI – in any format. The module discusses why 80 percent of healthcare data breaches involve a human element, and covers topics such as over-eagerness, carelessness, negligence, and snooping. It also reminds staff members that their responsibilities for data security and HIPAA compliance do not end when they leave the workplace, and that these responsibilities still exist in interactions with friends, family members, and online communities.
12. Recognizing and Reporting Healthcare Security Incidents
This module focuses on the threats from brute force attacks on passwords, malicious emails, and malware deployments – highlighting that some threats of this nature can avoid detection by front line defenses. The module explains that a threat does not necessarily need to be successful in order to qualify as a HIPAA security incident, and provides advice on how staff members can recognize attempted security incidents that are yet to breach front line defenses. It also notes that different reporting procedures may apply depending on whether a security incident is suspected, or whether it is known to have been responsible for a data breach.
13. Consequences of HIPAA Violations & Data Breaches
This module explains that HIPAA violations and data breaches have consequences, even if the HHS Office for Civil Rights declines to take enforcement action. Common consequences discussed in the module that affect patients include risks to patients’ health during and following a cyberattack, a loss of trust in healthcare providers, and medical identity theft. The consequences for organizations discussed in the module include indirect remediation costs and reductions in revenue – which can have an impact on the resources available for patient care. Staff members are also alerted to mandatory internal sanctions and the risk of external penalties, plus the risk that the consequences of HIPAA violations and data breaches can result in staff burnout and a reduction in workforce numbers.
14. Case Studies
This module provides case studies from multiple events that resulted in consequences for patients, healthcare organizations, or staff members. The case studies include the consequences for patients both during and following a cyberattack, and when a patient’s medical record is corrupted due to medical identity theft. There are also examples of when organizations are subject to state penalties and civil lawsuits – despite HHS Office for Civil Rights declining to take enforcement action – and the indirect impact cyberattacks can have on organizations’ finances. The module concludes with examples of professional, criminal, and employment consequences for staff members who carelessly disclosed PHI, or who misused it to commit theft and fraud.
15. Healthcare Cybersecurity Training Summary
The summary module contains a combination of key security takeaways from preceding modules and reminders of topics such as the purposes of the HIPAA Rules, staff responsibility for security, and the consequences of HIPAA violations and data breaches. The module concludes with a brief selection of statistics intended to focus staff members on absorbing and applying the information provided in the cybersecurity training.
Start Your Compliance Training Now

Trusted By Over 1,000 Healthcare Organisations

Healthcare organizations trained by ComplianceJunction

Trusted By Over 100 Universities

Universities trained by ComplianceJunction

Compliance Junction has been a wonderful partner in our HIPAA Training Program. The platform’s robust features and intuitive interface have streamlined our training process, ensuring that all staff members are well-informed and up-to-date on HIPAA regulations. The customizable options allowed us to tailor the software to our specific needs, resulting in a more efficient and effective compliance program. Overall, I highly recommend Compliance Junction to any organization seeking a professional and comprehensive solution for HIPAA training and compliance.

Samantha Sanders

Business Operations Manager · Wells Family Dental Group

Wells Family Dental Group

WHAT CLIENTS SAY

What Our Clients Say About Us

York College of Pennsylvania, School of Nursing and Health Professions

"Our students at York College of Pennsylvania found ComplianceJunction training to be both comprehensive and engaging. They appreciated how easy it was to pause and resume the modules, as well as the simple process for managing their certificates of completion. The practical examples kept the content interesting and relevant to real-world situations. ComplianceJunction made compliance training not just a requirement, but a genuinely valuable learning experience”.

Amy Mascolo-Palmer MSHA CPRPDirector of Clinical Placement
York College of PA
Dr. Donald E. and Lois J. Myers
School of Nursing and Health Professions
Clark College

"We are responsible for ensuring that all our students maintain patient privacy. We had been looking for a solution to train students and came upon ComplianceJunction. We have found this to be a very user-friendly platform with a team that is easy to work with. Our students commented that the whole process was easy to follow and complete”.

Kristi Taylor RDH, MSEdDepartment Chair/Program Director Dental Hygiene
Clark College
New York Tech

"The HIPAA training provided by ComplianceJunction is comprehensive, current, and highly practical. The platform is intuitive and easy to navigate, making the learning experience smooth and efficient. Integration into our existing compliance management system was seamless, saving time and reducing administrative burden. The inclusion of real-world examples and detailed case studies offers meaningful context and deeper insights into HIPAA regulations, making the material highly relevant for healthcare students”.

Lori Hochman, PT, PhDDirector of Clinical Education
Associate Professor, Department of Physical Therapy
New York Tech
Texas Woman's University

"We have now been working with ComplianceJunction since 2021, and the training has continued to evolve alongside changes in healthcare practice, technology, and regulatory expectations. I’ve spent my entire career in the healthcare sector, and even so, I learned important and practical aspects of HIPAA through their training — they truly taught an old dog new tricks".

Damon B. Cottrell,Ph.D., DNP, APRN, FNP-C, CCNS, ACNS-BC
Professor Nursing
Texas Woman's University

GET STARTED

Start Your Compliance Training Now

This professional training is ideal for full annual training and onboarding of new staff. Multi-choice Testing and Certificate of Completion awarded.

Start Your Compliance Training Now
Healthcare compliance administrator reviewing staff training progress