HIPAA security awareness
A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 7 details that are specific to your organisation.
- Length
- 30 min
- Lessons
- 6 lessons
- Frequency
- At onboarding + periodic security reminders
- Last reviewed
- 8 Oct 2026
Clinic nurse enters credentials on a fake "badge renewal" page
Try it: this is one of 14 interactive activities in the course.
What's included
Three pieces that work together
Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.
Self-paced course
Short lessons with real workplace scenarios, not walls of text.
- 6 lessons, about 30 minutes
- 2 video slots (you add the videos)
- Accordion, scenario, tabs, timeline and quizzes
- 12-question final check, 80% to pass
Live session deck
An AhaSlides presentation to run after the course, in person or online.
- 11 slides
- Quiz, poll, word cloud, scale slides
- A closing slide for your contacts
Two surveys
Find out what landed, and whether people use it on the job.
- Post-course feedback, about 2 minutes
- 30-day check-in
- Anonymous by default
- Results feed your next refresher
Learning objectives
At the end of this course, learners can
Built to the law Each objective names the requirement it comes from and the lesson that covers it.
| ID | Objective | Required by | Where it's covered |
|---|---|---|---|
| TO 1.0 | Achieve ≥ 80% on the final assessment | - | Whole course |
| LO 48.1.1 | Explain why healthcare is a top target and what ePHI is | §164.308(a)(5)(i) | Lesson 1: The threat today |
| LO 48.2.1 | Describe how a ransomware attack unfolds from a phishing email | (a)(5)(ii)(B) | Lesson 2: Anatomy of an attack |
| LO 48.3.1 | Spot red flags in emails, texts, calls and log-in alerts | (a)(5)(ii)(B), (C) | Lesson 3: Spot the red flags |
| LO 48.4.1 | Use strong passwords/passphrases, MFA and safe device habits + your info | (a)(5)(ii)(D) | Lesson 4: Protect yourself |
| LO 48.5.1 | Report a suspected security incident immediately + your info | §164.308(a)(6) | Lesson 5: Respond & report |
Your part: what a template can't do for you
- Your workplace details: fill in the 7 highlighted fields so the course describes your own policies, contacts and locations.
- Records: record completion in your own LMS or record system.
Course outline
6 lessons, about 30 minutes
Minutes per lesson are an estimate, shared out by page count.
1The threat today
3 pages
6 min
The threat today
3 pages
2Anatomy of an attack
2 pages
4 min
Anatomy of an attack
2 pages
3Spot the red flags
3 pages
6 min
Spot the red flags
3 pages
4Protect yourself
3 pages
5 min
Protect yourself
3 pages
5Respond & report
3 pages
5 min
Respond & report
3 pages
6Final assessment
Assessment
4 min
Final assessment
Assessment
Live deck and surveys
11 slides to run live, two surveys to close the loop
Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.
Post-course feedback: 11 questions, about 2 min
- Overall rating 5 stars
- Relevant, realistic, right length, helpful activities agree/disagree grid
- What was most useful? multi-select
- Confidence before this course, and now 1-5 scale
- Is MFA turned on for your work email and EHR access? multiple choice
- Which threats should we practise more? ranking
- How easy is it to report a suspicious message here? 1-5 scale
- I'd feel comfortable reporting that I clicked a bad link, without fear of blame. 1-5 scale
- One thing we should change or add open text
- Would you recommend this course? NPS
30-day check-in
- Have you used what you learned since the course? multiple choice
- How confident are you today? Compare with day 1 1-5 scale
- Do you know where to find how to report a suspicious email or security incident? yes / no / not sure
- A moment where the training helped, or where you weren't sure open text
- Which topics should the next refresher focus on? ranking
Results show whether people use the training on the job, not just whether they finished it.
Make it yours
7 fields to fill in, and you're ready
Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.
- Password policy
{{PASSWORD_POLICY}} - Approved tools
{{APPROVED_TOOLS}} - Security incident contact
{{SECURITY_INCIDENT_CONTACT}} - Phish report button howto
{{PHISH_REPORT_BUTTON_HOWTO}} - Security officer name
{{SECURITY_OFFICER_NAME}} - LMS or record system
{{LMS_OR_RECORD_SYSTEM}}
Show all 7 fields
- Survey URL
{{SURVEY_URL}}
FAQ
Common questions
Can I run HIPAA security awareness training online?
The course itself is self-paced and online, and the live deck lets you add a live session. Whether online delivery meets your local rules depends on the law that applies to you, so check 45 CFR §164.308(a)(5) or ask your own counsel.
How often is this training needed?
At onboarding + periodic security reminders; annual refresher is industry best practice (would become explicit under the proposed rule - see Notes).
Who needs this training?
All workforce members (including management) of covered entities and business associates - hospital nurses, clinic staff, billing/IT, remote coders.
What records should I keep?
Record completion in your own LMS or record system, so you can show who finished the course and when. Check the retention period that applies to you in 45 CFR §164.308(a)(5).
Can I edit the content?
Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply. Keep anything your own law requires you to cover.
Related templates
Often taught together
HIPAA privacy rule essentials
All workforce members · Healthcare
Medicare fraud, waste & abuse (FWA)
Employees · Healthcare
Infection control & standard precautions
Clinical and support staff · Healthcare
Elder & dependent adult abuse - Mandated reporting
Mandated reporters · Healthcare
Ready to run it?
Open the live deck to see how the session runs alongside the course and both surveys.