HIPAA Security Training Checklist for Reno Medical and Dental Offices

If you run a medical, dental, or other healthcare practice in Reno, Sparks, or Carson City, HIPAA probably comes up every time someone mentions cybersecurity. The rule sounds intimidating, but the training requirement is one of the more approachable parts. It is also one of the first things a regulator asks to see after a breach.

This post explains what HIPAA actually says about security training, who needs it, what to cover, and what paperwork to keep. It is written for practice managers and owners, not lawyers.

What HIPAA requires

The HIPAA Security Rule, at 45 CFR 164.308(a)(5), requires every covered entity and business associate to “implement a security awareness and training program for all members of its workforce (including management).”

Three details matter here:

• All workforce members. That includes doctors, hygienists, front desk staff, billers, part-timers, temps, volunteers, and the owner. Management is named explicitly.
• It is a program, not an event. The rule does not set a number of hours or a required frequency. It expects an ongoing program that fits your risks.
• It has named components. The rule lists four implementation specifications: periodic security reminders, protection from malicious software, log-in monitoring, and password management. These are labeled “addressable,” which means you must implement them or document why an equivalent alternative is reasonable. It does not mean optional.

Separately, the HIPAA Privacy Rule requires you to train your workforce on your privacy policies and procedures, and to keep documentation of that training. Most practices cover privacy and security together in one program.

Why regulators care

The HHS Office for Civil Rights (OCR) investigates breaches and complaints. In recent years it has announced a run of settlements through its Risk Analysis Initiative, many of them involving small practices, where the central failure was never completing an accurate, organization-wide risk analysis. Ransomware and phishing are the most common ways patient data gets exposed, and both depend on staff behavior.

HHS also proposed updates to the Security Rule in early 2025 that would tighten requirements, including removing the distinction between “required” and “addressable” specifications. As of this writing the proposal has not been finalized and its timing is uncertain, so build to the current rule but do not be surprised if expectations rise.

The checklist

1. Decide who is in the workforce

Make a list of everyone with access to patient information, including part-time and contract staff, and note their role. Anyone new gets training before or right when they receive system access, not months later.

2. Train at hire, then on a schedule

HIPAA does not dictate a schedule, but a common and defensible pattern is:

• At onboarding, before they use patient systems
• At least annually for everyone
• Short reminders throughout the year (a few minutes at a staff meeting, a one-page tip sheet, a real scam example)
• Whenever something meaningful changes, such as a new EHR, a new imaging system, new policies, or after an incident

3. Cover the topics that actually cause breaches

Tailor content to your practice. The essentials:

• Phishing and fake requests. Fake patient portal messages, fake insurance or vendor emails, “urgent” requests from the doctor or owner, and malicious attachments. Teach staff what to do when they are unsure: report it, do not click.
• Passwords and multi-factor authentication. Unique passwords, no sharing logins, no passwords on sticky notes near the chairside computer. Explain why MFA is on.
• Shared workstations and screens. Locking screens when stepping away, positioning monitors away from waiting areas, and logging out of shared exam room and operatory computers.
• Texting, email, and messaging patients. What is allowed, what is not, and how to send patient information securely.
• Devices and remote work. Lost or stolen phones and laptops, personal devices, home Wi-Fi, and never using unapproved apps for patient information.
• New tools, including AI. Do not paste patient information into public AI chatbots or unapproved transcription tools. If your practice adopts an AI scribe or note tool, it should be covered by a business associate agreement first.
• Social engineering by phone. Callers claiming to be insurers, labs, pharmacies, or “IT support” who ask for patient details or remote access.
• How to report. A single, easy, no-blame way to report a mistake or a suspicious message immediately. Fast reporting is the single biggest factor in limiting the damage of an incident.
• Breach basics. What counts as a possible breach and why it must be escalated the same day.

4. Test with phishing simulations

Training that is never tested tends to fade. Realistic simulated phishing messages show you which scams your team is vulnerable to, give staff safe practice, and produce dated results you can point to as evidence that your security reminders are working. Done well, simulations coach people instead of punishing them. See our approach to phishing simulation.

5. Have a sanction policy and actually communicate it

The Security Rule requires a sanction policy for workforce members who violate your security policies. Staff should know it exists. Keep it fair and consistent, and separate honest mistakes and prompt reporting (which you want to encourage) from deliberate misuse.

6. Connect training to your risk analysis

Your annual security risk analysis should drive your training topics. If the analysis shows shared logins in the front office or unencrypted laptops, put those issues in the next training session. Also confirm that your business associates, such as billing companies, IT providers, and cloud vendors, have signed business associate agreements and handle staff training on their side.

7. Know the breach notification timeline

Under the HIPAA Breach Notification Rule, you must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. Breaches affecting 500 or more people must also be reported to HHS at the same time, and generally to the media in the affected state. Smaller breaches are logged and reported to HHS annually. Staff cannot help you meet these deadlines if they do not tell you about problems, so the reporting culture from step 3 matters.

Nevada has its own breach notification law for personal information, NRS 603A.220, which may apply alongside HIPAA. Ask your attorney how the two interact for your practice.

8. Keep the records

HIPAA requires that documentation of policies, procedures, and required actions or activities be kept for six years (45 CFR 164.316(b)(2)). For training, keep:

• The date and format of each session
• Attendee names and roles, with sign-in sheets or completion records
• The materials or agenda used
• Phishing simulation results and follow-up actions
• Records for new hires showing training was completed at onboarding

If OCR or an insurer ever asks whether your staff are trained, you want to answer with a folder, not a memory.

A simple annual calendar

Adjust for your size. A five-person dental office might combine sessions. A multi-provider medical group may need role-specific tracks for clinical, front desk, and billing staff.

What training will not do

Training is one layer. It does not replace a risk analysis, encryption, MFA, backups, patching, access controls, or a written incident response plan. It is, however, the layer that addresses the way most attacks begin: a person receiving a convincing message.

Getting help

High Sierra Cyber provides plain-language security awareness sessions for Northern Nevada healthcare practices, along with phishing simulations and the dated records described above. See our compliance-ready training service or contact us for a free consultation.

This article is general information, not legal advice, and High Sierra Cyber is not a law firm. Confirm your specific HIPAA obligations with your compliance officer or healthcare attorney.