Last reviewed 9 November 2026 against the sources linked in this post.
Health information management training for a working team starts with one question: who is allowed to see this record? The HHS Office for Civil Rights says on its HIPAA enforcement highlights page that it received more than 374,000 HIPAA complaints between April 2003 and 31 October 2024, its latest published figure, and that the issue most often alleged is impermissible uses and disclosures of protected health information. Records teams handle that information every day.
This is a list of 9 ready-made courses for HIM directors, privacy officers and records managers who train their own teams. Degrees and certifications sit elsewhere; this list covers what the department itself should teach: privacy, security, system downtime and a safe, respectful workplace. Several courses rest on US federal rules, so check your own market. Each group ends with an Our pick.
All 9 courses at a glance
| Course | What it covers | Length | US rule behind the topic |
|---|---|---|---|
| HIPAA privacy rule essentials | When health information may be used or shared | 35 min | Covered entities must train their workforce |
| Handling personal data day to day | Consent, minimisation, retention and sharing | 40 min | None cited here |
| HIPAA security awareness | Phishing, passwords and reporting incidents | 30 min | Covered entities need a security awareness programme |
| Safe EHR use and clinical system downtime | Accurate records, and what to do when systems fail | 35 min | None cited here |
| Workplace violence prevention in healthcare | Warning signs, de-escalation and reporting | 40 min | None cited here |
| Harassment prevention: employees (US federal) | What harassment is and how to report it | 45 min | Harassment can be unlawful (EEOC) |
| Respectful workplace & anti-bullying | Naming and responding to everyday disrespect | 35 min | None cited here |
| Emergency action & fire prevention plans | Raising the alarm and getting out safely | 30 min | OSHA emergency action plan rules |
| Resilience, stress and wellbeing at work | Recognising strain and where to get support | 35 min | None cited here |
Privacy and data protection
Release of information requests make privacy rules the daily core of HIM work, so these two come first.
HIPAA privacy rule essentials
HIPAA's Privacy Rule says a covered entity must train all members of its workforce on the policies and procedures with respect to protected health information, as necessary and appropriate for their functions. This 35-minute course teaches what counts as protected health information, when it may be used or disclosed, the minimum necessary standard and how to report an incident. Records staff handle access requests all day, and the rule says a covered entity must act on a request for access no later than 30 days after receipt, with one 30-day extension allowed if it sends written reasons in time. Open the session with the course's question: a coworker is also a patient, so can you open her chart to see how she is doing?
Handling personal data day to day: consent, minimisation, retention and sharing
This 40-minute course covers what counts as personal data, collecting only what you need, keeping it only as long as needed and sharing it safely. Those four habits shape how a records department stores, retains and releases files, and the course is global rather than tied to one country's law. Its sharing lesson covers approved routes and includes a sorting activity, which suits a team that fields calls from insurers, solicitors and relatives.
Our pick: Handling personal data day to day. Its retention lesson answers the question every records team gets asked, which is how long to keep things and when to let go.
If you want a deeper look at the rule itself, see our guide to HIPAA training.
Security and system continuity
Records teams manage access to systems that attackers want, and keep records accurate when those systems go down.
HIPAA security awareness
The HIPAA Security Rule says a covered entity must implement a security awareness and training program for all members of its workforce (including management). This 30-minute course traces how a ransomware attack starts with a phishing email, then covers red flags in emails, texts and calls, strong passphrases, a second sign-in check and reporting an incident straight away. Records systems hold sensitive data, so one stolen password goes a long way. Ask the room, by poll, which step a second sign-in check could have blocked.
Safe EHR use and clinical system downtime procedures for nurses
This 35-minute course is written for nurses, so adapt its examples for a records team. It covers using the record accurately, privately and safely, then a downtime routine and recovery in order. Downtime procedures keep records accurate when electronic systems fail, and paper notes taken during an outage need to be reconciled with the record afterwards. Its opening scene, a screen going blank on a ward, makes a good scenario slide: ask what the first three actions should be.
Our pick: Safe EHR use and clinical system downtime procedures for nurses. A downtime plan nobody has rehearsed is the one that fails, and this course gives you the rehearsal.
Safe and respectful workplace
Records staff meet walk-in requesters, clinicians and colleagues under deadline pressure. These five keep that workplace safe and fair.
Workplace violence prevention in healthcare
Walk-in requesters can be angry or distressed, so staff need response skills. This 40-minute course teaches early warning signs of escalation, verbal and non-verbal de-escalation, environmental controls, calling for help early and reporting every incident, including verbal abuse. Run its scenario and let the team choose each step before the answer appears. Our guide to workplace violence in healthcare goes further for managers.
Harassment prevention: employees (US federal)
The EEOC says harassment becomes unlawful where enduring the offensive conduct becomes a condition of continued employment, or where the conduct is severe or pervasive enough to create a work environment that a reasonable person would consider intimidating, hostile, or abusive. This 45-minute course teaches what unlawful harassment is, how to spot it, how to respond as a bystander or target and how to report it. Records teams need it like any hospital staff. Ask learners to sort examples into unlawful harassment, policy violation or acceptable behaviour.
Respectful workplace & anti-bullying
This 35-minute course separates bullying, incivility and tough-but-fair management from unlawful harassment, then gives simple scripts to respond and repair. Respectful communication with clinicians and requesters keeps requests moving. Use its quiz in the session: which of these best describes bullying?
Emergency action & fire prevention plans
OSHA's rule says an employer's emergency action plan must be in writing, kept in the workplace, and available to employees for review, although an employer with 10 or fewer employees may communicate it orally. This 30-minute course teaches how to raise the alarm, follow an evacuation route and shelter, and how major fire hazards are controlled. Records areas hold paper and equipment, so the plan matters there. OSHA's rule applies only where a standard in that part requires a plan, so check with your safety lead.
Resilience, stress and wellbeing at work
This 35-minute course teaches how to recognise strain in yourself and others, a five-step recovery process and where to get support. Backlogs and deadlines make workload and stress management worthwhile. Ask the team, in a Word Cloud, what a release-of-information backlog feels like on a Monday.
Our pick: Workplace violence prevention in healthcare. The first sign of trouble often arrives at the counter, and a team that has rehearsed its words stays calm.
If you also train the front desk, see our 9 medical receptionist training courses.
How to roll the plan out
Start with the courses tied to a US rule: HIPAA privacy, HIPAA security, harassment prevention and the emergency action plan. Add the personal data and respect courses to onboarding. Then schedule annual refreshers, and finish with role-specific depth such as downtime drills and de-escalation practice for the people who work the counter.
Anchor each session to the same fact: the HHS Office for Civil Rights had received more than 374,000 complaints by October 2024, and impermissible uses and disclosures of protected health information are the issue most often alleged. These courses are built on US federal rules. A department in another country, or in a US state with extra duties, should add its own regulator's requirements. No source cited here sets how often HIPAA training must be repeated, so ask your compliance lead and set a frequency in your own programme.
Ways to run these courses on AhaSlides
You can offer all 9 in three formats:
- Self-paced courses. Use the AhaSlides course creator to send each new team member a course to complete before they handle requests.
- A live Q&A deck. Collect questions from the team ahead of the session, then answer them in the room. For running it well, see our 9 tips for a successful Q&A session.
- Pre and post surveys. Measure what changed in the same session, and see how to track employee training completion.
Four slide types do most of the work:
- Pick Answer. Ask: "A coworker is also a patient. Can you open her chart to see how she is doing?" Show the split before you reveal the answer.
- Word Cloud. Ask: "What does a release-of-information backlog feel like?" The biggest words show where the team needs support.
- Rating Scale. Ask, before and after: "How confident are you verifying who is asking before you release a record?" Rate from 1 to 5 and compare the averages.
- Open Ended. Ask: "What would you say to a requester who is upset about waiting?" Answers can be anonymous, so people say what they think.
FAQ
What training do health information staff need?
Privacy and security rules, release of information, retention and system downtime procedures. The nine courses above cover those, plus workplace safety and respect; qualifications and coding credentials come from schools and bodies such as AHIMA.
What is health information management?
Managing patient records so they are accurate, accessible, secure and compliant with privacy law. AHIMA describes it as the practice of acquiring, analyzing, and protecting digital and traditional medical information vital to providing quality patient care.
How long should patient records be kept?
It varies by jurisdiction and record type, so follow your legal retention schedule. The personal data course includes a lesson on keeping data only as long as needed, which helps a team apply that schedule.
Who should take these courses?
Records staff, release of information clerks and the HIM directors and privacy officers who supervise them. The groups above let a department split the nine courses by role.
This post is general information, not legal advice. For a decision about your own workplace, speak to a qualified lawyer or the regulator.
