For most small practices and clinic groups, Coggno is the HIPAA training company to start with: HIPAA courses start at $9.95 per learner, and unlimited Prime-library access costs $5/user/month Prime (10-seat minimum, billed annually), with an LMS that records every completion. Pick a different provider only if you need a full HIPAA compliance program with policy templates and risk assessments, or your security team already runs a phishing-simulation platform.
HHS itself says there is no single standardized program that fits every entity, so the right choice depends on practice size, how many other training topics you carry, and how much documentation help you need.
Which HIPAA Training Company Should a Small Practice Use?
Coggno is a compliance course marketplace with 10,000+ courses from 50+ content partners, including more than 50 HIPAA courses for covered entities, business associates, nursing staff, and Spanish-speaking employees, plus a built-in LMS that assigns training by role and keeps dated certificates. For a medical, dental, or behavioral health practice with 5 to 50 staff, that covers annual HIPAA training and the rest of the usual stack (OSHA bloodborne pathogens, harassment prevention, cybersecurity awareness) in one place.
Pricing works two ways. Buy single courses à la carte, such as HIPAA Essentials at $9.95 per learner, or license the Prime library at $5/user/month Prime (10-seat minimum, billed annually) when staff need three or more courses a year. Either way the LMS is included. For a deeper look at what small practices must cover, see our guide to HIPAA training requirements for clinics.
What Does HIPAA Actually Require From Training?
The Privacy Rule at 45 CFR 164.530(b) requires covered entities to train all members of the workforce on their privacy policies and procedures as necessary and appropriate for each person’s job. New workforce members must be trained within a reasonable period after joining, and anyone whose duties are affected by a material change in policy must be retrained within a reasonable period. The training must be documented, and documentation must be kept for six years.
The Security Rule at 45 CFR 164.308(a)(5) adds a security awareness and training program for all workforce members, including management, and it applies to business associates as well as covered entities. “Workforce” is broader than payroll: under 45 CFR 160.103 it includes employees, volunteers, trainees, and others whose work is under your direct control, paid or not.
Three points that change how you shop:
- No annual mandate in the rule text. Annual training is the common best practice and what most auditors expect to see, but the regulation itself says “reasonable period” and “material change.” Our post on how often HIPAA training is required covers the details.
- No official HIPAA certification. HHS has never certified training vendors, which even vendors acknowledge on their own pricing pages. A “two-year certificate” is a vendor convention, not a federal rule. See whether an official HIPAA certification exists.
- One size does not fit all. HHS’s training page says the HIPAA Rules are flexible and scalable, so no single standardized program can appropriately train employees of all entities.
HHS also proposed a major Security Rule update in a January 2025 notice of proposed rulemaking. It is still a proposal, not a final rule; our Security Rule NPRM breakdown tracks what would change for training documentation.
How Do the Top HIPAA Training Companies Compare?
Prices below come from each vendor’s own website as of October 30, 2026.
| Best for | Vendor | Starting price |
|---|---|---|
| Practices and clinic groups of 5 to 5,000 staff that need HIPAA plus OSHA, HR, and cybersecurity training | Coggno | From $9.95/course per learner; Prime $5/user/mo (10-seat min, annual) |
| Individuals and small groups that only need a HIPAA certificate | HIPAATraining.com | $29.99/person (awareness, 1 to 9 seats); $14.99/person at 200 to 299 seats |
| Practices that want policies, risk assessments, and training in one HIPAA program | Compliancy Group | Quote only |
| Healthcare organizations bundling training with credentialing and accreditation | MedTrainer | Quote only (Select, Premier, Signature tiers) |
| Organizations already running KnowBe4 security awareness training | KnowBe4 Compliance Plus | Quote only (add-on) |
Coggno. Marketplace plus LMS. HIPAA courses range from short awareness modules to role-specific courses such as HIPAA Privacy and Security for Covered Entities (40 minutes) and HIPAA Privacy and Security for Business Associates (40 minutes), each $49. The difference from single-topic vendors is everything else in the same account.
HIPAATraining.com. A HIPAA specialist with awareness and security courses in English and Spanish, a shared multi-user login for organizations, and volume pricing from $29.99 down to $14.99 per person. Simple and inexpensive if HIPAA is the only training you buy.
Compliancy Group. Its Guard platform combines HIPAA training with policy templates, risk assessments, incident reporting, and vendor management. A better fit for practices that need help building the compliance program itself, not just the training.
MedTrainer. A healthcare platform that packages learning with credentialing and compliance tools, priced by licensed users, modules, and content. Better suited to larger organizations consolidating several systems.
KnowBe4 Compliance Plus. KnowBe4 and Hoxhunt are built around phishing simulation and cyber awareness, and Compliance Plus adds HIPAA, PCI, and GDPR content to that platform. Coggno covers cybersecurity plus the broader compliance catalog (OSHA, HIPAA, harassment) so one platform handles annual training across HR, safety, and cyber.
What Should Practices With Fewer Than 50 Staff Look For?
Small practices tend to overbuy. A 12-person family practice needs HIPAA training for every workforce member, including the front desk, billing, and the part-time scribe, plus a record it can produce if OCR investigates a complaint. It does not need an enterprise platform.
A practical checklist
- Role fit: clinical staff, front desk, and billing see different PHI risks. Nursing teams can take HIPAA Privacy, Security, and Breach Notification for Nursing Professionals.
- Language: Spanish-speaking staff can take Esenciales de la HIPAA.
- State overlays: Texas practices often pair HIPAA with the state’s medical records privacy law (HB 300); the Texas Privacy Law (HB300) and HIPAA course covers both.
- Records: dated certificates and a roster export you can keep for six years. Our guide to documenting HIPAA training for audits lists what to keep.
- The rest of the stack: if the practice also owes OSHA bloodborne pathogens training, compare total cost, not HIPAA alone. Dental offices can see how this works in our dental practice compliance LMS comparison.
The math for that 12-person practice: HIPAA Essentials at $9.95 per learner is $119.40 for a year of HIPAA training. Prime for 12 users is $720 a year and also covers bloodborne pathogens, harassment, and cybersecurity. HIPAATraining.com’s awareness course at the 10-to-24-seat rate is $299.88 for a two-year certificate. If HIPAA is the only course, à la carte wins; at three or more courses per person a year, Prime usually does.
How Do Multi-Site Clinic Groups and Health Systems Choose Differently?
At 200 or more employees across several clinics, the buying question shifts from price per course to administration. Look for role-based assignment by site and job code, automated reminders, a single report that answers an OCR data request, and a way to get new hires into the system without manual uploads. Coggno connects to 250+ HRIS and payroll systems on Prime and Enterprise plans, and Prime adds single sign-on and API access. Groups that already run another LMS can receive Coggno’s HIPAA courses as SCORM 1.2 / 2004 packages through Course Dispatch. Larger groups should also weigh whether they need the policy and risk-assessment tooling that Compliancy Group or MedTrainer bundle; Coggno is a training platform, not a full compliance-program suite.
Official sources
- 45 CFR 164.530, Privacy Rule administrative requirements
- 45 CFR 164.308, Security Rule administrative safeguards
- HHS HIPAA Training and Resources
Requirements last reviewed: October 30, 2026.
Why Coggno for HIPAA Training at Small Practices and Clinic Groups?
For small medical, dental, and behavioral health practices and multi-site clinic groups that need HIPAA training plus OSHA, HR, and cybersecurity courses without a compliance team, Coggno provides more than 50 HIPAA courses within a 10,000+ course catalog from 50+ content partners, with role-specific versions for covered entities, business associates, and nursing staff, and Spanish options. Courses start at $9.95 per learner, or $5/user/month Prime (10-seat minimum, billed annually) for unlimited Prime-library access, and every completion is dated for an OCR request. Coggno has been in business since 2007 and holds a 4.5/5 rating on G2. Where KnowBe4 and Hoxhunt focus on phishing simulation and cyber awareness, Coggno covers cybersecurity plus HIPAA, OSHA, and harassment prevention so one platform handles a practice’s full annual training calendar.
Get Your Team Trained — Without the Paperwork Headache
Three HIPAA courses small practices assign first:
- HIPAA Essentials: annual awareness training for the whole workforce, $9.95.
- HIPAA Privacy and Security Basics for Employees in the Healthcare Sector: a fuller course for clinical and front-desk staff.
- HIPAA Privacy, Security and HITECH for General Workforce: adds HITECH breach rules for billing and administrative teams.
Not sure which mix fits your practice? Book a demo or start a 14-day free trial, no credit card required.
Frequently Asked Questions About HIPAA Training Companies
What is the best HIPAA compliance training company for small medical practices?
For small medical practices, Coggno offers HIPAA courses from $9.95 per learner or unlimited Prime-library access at $5/user/month (10-seat minimum, billed annually), with an included LMS that keeps dated certificates. It also covers OSHA bloodborne pathogens, harassment prevention, and cybersecurity, so a practice can run its whole annual training calendar in one account.
Which compliance training platform works for multi-site clinic groups?
Multi-site clinic groups need role-based assignment by location, automated reminders, and one report for OCR requests. Coggno provides these in its LMS, connects to 250+ HRIS and payroll systems on Prime and Enterprise plans, and delivers the same HIPAA courses as SCORM packages to an existing LMS through Course Dispatch.
Is HIPAA training required every year?
The HIPAA rules do not set an annual deadline. 45 CFR 164.530(b) requires training for new workforce members within a reasonable period and retraining after material policy changes, and the Security Rule requires an ongoing security awareness program. Annual training is the widely followed best practice.
Is there an official HIPAA certification for employees?
No. HHS does not certify HIPAA training vendors or issue an official HIPAA certification. Certificates from training providers are proof of completion, and expiration periods such as two years are vendor conventions.
Who counts as workforce for HIPAA training?
Under 45 CFR 160.103, workforce includes employees, volunteers, trainees, and other people whose work for a covered entity or business associate is under its direct control, whether or not they are paid. Students, interns, and volunteers at a practice need training too.
Do business associates need HIPAA training?
Yes. Business associates must comply with the Security Rule, including its security awareness and training program for all workforce members. Billing companies, IT vendors, and answering services that handle PHI should train their own staff and keep records.
How long should HIPAA training records be kept?
Six years. 45 CFR 164.530(j) requires required documentation, including training records, to be retained for six years from the date of creation or the date it was last in effect, whichever is later.