Security Rule
The Inbox
Defending against phishing: the fake message, its tells, and what to do after someone clicked.
Escape the Breach · HIPAA training for healthcare workers
HIPAA compliance training online
HIPAA requires covered entities and business associates to train every workforce member: security awareness and training (45 CFR 164.308(a)(5)) and training on their own privacy policies (164.530(b)), for new staff within a reasonable time and after material policy changes. Escape the Breach is a 30-minute game in your brand for the security part: phishing, passwords and MFA, devices, reporting. Passing the quiz (9 of 11) gives a record of completion.
Escape the Breach supports your training requirement under 45 CFR 164.308(a)(5) (security awareness and training).
Try it with your logo
Type your organization’s website: we read your logo and colors and open a free 5-minute game in your brand. The training games use the same branding.
- Reading your website
- Finding your logo
- Your brand: name, colours, values
- Building your world
Lots of people are making their games right now.
You're in line. Keep this page open: yours starts by itself.
This taste is one of our team games in your colors. Your staff’s training games carry the same logo and colors.
Works on your phone too: turn it sideways. Or send yourself the link for a bigger screen.
The demos are set at companies we made up (Harborview Software, Bayside Family Dental); your games use your organization’s brand and details.
What the rules require
The HIPAA Security Rule requires a covered entity or business associate to run a security awareness and training program for all members of its workforce, including management (45 CFR 164.308(a)(5)(i)). Its implementation specifications are security reminders, protection from malicious software, log-in monitoring and password management (164.308(a)(5)(ii)(A)–(D)).
The HIPAA Privacy Rule requires a covered entity to train all members of its workforce on its own policies and procedures for protected health information, as needed for each person’s job (45 CFR 164.530(b)(1)).
The workforce includes employees, volunteers and trainees under the organization’s direct control, whether or not they are paid.
Paraphrased from 45 CFR Part 164. Read the full text on eCFR.
HIPAA training for healthcare workers: who and how often
- Who: every member of the workforce (164.308(a)(5)(i) and 164.530(b)(1)), not only clinical staff.
- New staff: within a reasonable period after they join (164.530(b)(2)(i)(B)).
- After a material change in your privacy policies or procedures, the people whose jobs it affects, within a reasonable period (164.530(b)(2)(i)(C)).
- How often: HIPAA sets no fixed yearly schedule; the Security Rule asks for an ongoing program with periodic reminders. Many practices train everyone every year as their own policy, and the dashboard keeps that due date.
What records must be kept
The covered entity must document that the training was provided (164.530(b)(2)(ii)) and keep that documentation for six years from when it was created or last in effect (164.530(j)(2)); the Security Rule’s documentation has the same six years (164.316(b)(2)(i)).
Each person who passes gets a record of completion with their name, the date and the score; the report and the roster PDF list everyone, with job titles and due dates. Export them as CSV and PDF and keep them with your HIPAA documentation for six years.
What the game covers, element by element
| Section | What it asks for | Where in the game |
|---|---|---|
| 164.308(a)(5)(i) | A security awareness and training program for all workforce members | All four security rooms, played by every person |
| 164.308(a)(5)(ii)(A) | Security reminders | The day-30 refresher: five questions, 30 days after a person finishes. Your own reminders still count. |
| 164.308(a)(5)(ii)(B) | Protection from malicious software | The Inbox (phishing) and The Desk (updates, a found USB stick, apps) |
| 164.308(a)(5)(ii)(C) | Log-in monitoring | Not covered: a practice procedure; The Phone covers reporting anything unusual |
| 164.308(a)(5)(ii)(D) | Password management | The Vault (strong passwords, one key for two doors, multi-factor authentication) |
| 164.530(b)(1) | Training on your own privacy policies and procedures | Not covered by the standard edition: your policies are your own. Dental practices: the dental edition adds the Reception Desk room. |
| 164.530(b)(2) | Documenting that the training was provided | The record of completion per person, the CSV and the PDF report |
The four rooms
Security Rule
The Vault
Strong passwords and multi-factor authentication.
Security Rule
The Desk
Securing devices: updates, a found USB stick, app permissions, public Wi-Fi.
Security Rule
The Phone
Reporting incidents: what to do first, who to call, why staying quiet is the trap.
Dental practices: the dental edition of Escape the Breach covers security awareness training (45 CFR 164.308(a)(5)) and a Privacy Rule basics room (164.530(b)); your policies and role-specific procedures remain yours.
About 30 minutes, solo or with a few colleagues, on a laptop or a phone. A wrong move shows why it was wrong and never locks anyone out. Based on guidance published by CISA (Secure Our World) and NIST. ReMotivator is not affiliated with or endorsed by any U.S. government agency.
What the game does not cover
- Your risk analysis and risk management (164.308(a)(1)): the game is training, not an assessment.
- Writing your policies and procedures. Training on your own privacy policies (164.530(b)) is yours; the dental edition adds a front-desk Privacy Rule room.
- Naming your privacy and security officials (164.530(a), 164.308(a)(2)) and your business associate agreements.
- Breach notification itself. The game teaches staff to report a possible breach inside the practice; the notices to patients and HHS are your privacy officer’s job.
What you give us (about 5 minutes)
- Your brand: company name, logo and colors (read from your website; you check them).
- Where to report: the address or person for a suspicious message or a possible breach, and your IT contact.
- Nothing else: no patient information, no logins, no user lists. You type every name.
Price
Prices in US dollars.
Single seat
$29
One person, one game: Clean Hands (bloodborne pathogens) or Label Reader (HazCom). A completion certificate when you pass; checkout by card, only an email address needed. A single seat uses the industry example set, not your workplace’s own list, and the certificate says so.
Pair
$49
One person, both games: bloodborne pathogens and HazCom, a certificate for each.
Practice or team
from $349/yr
The Practice Compliance Pass: four games, $29 per staff member per year, minimum $349 per practice, with your own chemical list, the dashboard, due dates and the roster. The Practice Compliance Pass
For one organization, Escape the Breach in your brand: setup, branded $500 once, then $19 per person, from $199 per run. Running it again costs the per-person price only.
Single-seat checkout opens soon: leave your email and we send you the link.
A sample record of completion and the roster
Sample: a fictional practice and person
Security Awareness Training — Record of Completion
- Name
- Jane Doe
- Job title
- Front desk coordinator
- Practice
- Bayside Family Dental (fictional)
- Date
- November 3, 2026
- Score
- 10 / 11 (passed)
- Contents
- Security awareness: phishing, passwords and MFA, devices, reporting
- Trainer of record
- named on your certificate
- Edition
- Escape the Breach, 2026
- Next training due
- by November 3, 2027
The roster
One row per person: the job title, the date completed, the score, the trainer of record and the next due date, with a summary at the top. Export as CSV or PDF.
| Name (sample) | Job title | Completed | Score | Next due |
|---|---|---|---|---|
| Jane Doe | Office manager | Nov 3, 2026 | Passed | Nov 3, 2027 |
| John Doe | Coordinator | Nov 4, 2026 | Passed | Nov 4, 2027 |
| Sam Doe | Assistant | — | — | Not started |
Sample only: Bayside Family Dental, Jane Doe, John Doe and Sam Doe are made up. The data we keep: staff names, job titles, scores and dates; no patient information is ever stored.
Questions
What does HIPAA compliance training mean?
In the rules it is two requirements: a security awareness and training program for the whole workforce (45 CFR 164.308(a)(5)) and training on the organization’s own privacy policies and procedures (164.530(b)). No course makes an organization meet HIPAA by itself; training is one part of the program.
Which part does Escape the Breach cover?
The security awareness part: phishing, malicious software, passwords and multi-factor authentication, securing devices and reporting incidents. It supports your training requirement under 45 CFR 164.308(a)(5). Training on your own privacy policies is yours. For dental practices, the dental edition covers security awareness training (45 CFR 164.308(a)(5)) and a Privacy Rule basics room (164.530(b)); your policies and role-specific procedures remain yours.
How often is HIPAA training required?
HIPAA names no fixed yearly schedule. New workforce members train within a reasonable period after joining, and the people affected by a material policy change after that change (164.530(b)(2)); the Security Rule asks for an ongoing program with periodic reminders.
What records do we get?
A record of completion (“Security Awareness Training — Record of Completion”) for everyone who passes the quiz (9 of 11), with the name, the date and the score, and the report as CSV and PDF. Keep the documentation six years (164.530(j)(2)).
What does it cost?
Setup, branded: $500 once. Then $19 per person, from $199 per run. Running it again costs the per-person price only. For dental and medical practices it is part of the Practice Compliance Pass.
Is there HIPAA training online free?
The full training is not free, but you can try it free: play the Escape the Breach demo (no sign-up), or type your website at the top of this page for a free 5-minute game in your own logo and colors.
Is this HIPAA training for healthcare workers?
Yes: every member of the workforce of a covered entity or business associate, clinical or not, needs HIPAA training. Escape the Breach covers the security awareness part for everyone; dental practices can add the Reception Desk room for the front desk.
Does finishing the game cover everything the rule asks of us?
No. Your organization, as the covered entity or business associate, remains responsible for its HIPAA program: its policies and procedures, its risk analysis, the training each role needs, and keeping the documentation. No course makes an organization meet HIPAA by itself. The game delivers and records the training part.
Can we try it first?
Yes. Type your website at the top of this page to see a free 5-minute game in your logo and colors, or play the demo of a game (it opens the game itself). Harborview Software and Bayside Family Dental are companies we made up to show the games.
Your program stays yours. Your organization, as the covered entity or business associate, remains responsible for its HIPAA program: its policies and procedures, its risk analysis, the training each role needs, and keeping the documentation. No course makes an organization meet HIPAA by itself.
Escape the Breach supports your training requirement under 45 CFR 164.308(a)(5) (security awareness and training). The regulations on this page are paraphrased; read the full text before you rely on it. This page is general information, not legal advice. ReMotivator is not affiliated with or endorsed by the U.S. Department of Health and Human Services.
Bloodborne pathogens certification · Bloodborne pathogens training · HazCom training · OSHA training online · Emergency action plan training · Dental practice training · All training games
Get a quote
Tell us how many staff and locations, and when your training is due. We reply within one working day.