HIPAA Training Cost in 2026: What Vendors Actually Publish

HIPAA training is sold three different ways, on three meters that are not comparable: a one-off per-course purchase, a platform subscription with training bundled and no per-user line at all, or free from the regulator. Comparing them on a single per-user-per-year figure, as most guides do, requires inventing one. This page keeps them apart.

Vendor figures read off each vendor's own pricing page, checked July 2026. Regulatory text verified against the official CFR.

HIPAA does not require annual training

Neither training provision states an interval. 45 CFR 164.308(a)(5) says: “Implement a security awareness and training program for all members of its workforce (including management).” All four of its implementation specifications are Addressable rather than Required, and the only temporal word in the standard is “Periodic”, which attaches to security reminders rather than to the training and is undefined.

45 CFR 164.530(b) sets timing by event: train by the compliance date; train each new workforce member “within a reasonable period of time after the person joins”; and retrain members whose functions are affected by a material change “within a reasonable period of time after the material change becomes effective”. It also requires you to document that training was provided.

Annual training is common practice, it is a defensible way to evidence that a periodic programme exists, and it is genuinely required by other frameworks and by many payer and client contracts. It is not what HIPAA says. The distinction matters when a vendor tells you the law mandates a yearly renewal it happens to sell.

Model one: the per-course purchase

The two vendors that publish real HIPAA training prices both sell this way. Read the unit carefully, because it is the thing most often misreported: these are one-off purchases per person, not annual seats. hipaatraining.com states plainly that there is no yearly subscription and describes its certificate as valid for two years, so restating its price as a per-user-per-year rate would invent a recurring cost the vendor does not charge.

Vendor	Course	Published price	Unit
HIPAA Exams	HIPAA Training for Healthcare Workers	$28.99	per person, per course, one-off
HIPAA Exams	HIPAA for Business Associates	$28.99	per person, per course, one-off
HIPAA Exams	HIPAA + OSHA bundle	$45.00	per person, one-off
hipaatraining.com	HIPAA Awareness	$29.99	per seat, one-off
hipaatraining.com	HIPAA Awareness, 10-24 seats	$24.99	per seat, one-off
hipaatraining.com	HIPAA Awareness, 100-199 seats	$19.99	per seat, one-off
hipaatraining.com	HIPAA Awareness, 200-299 seats	$14.99	per seat, one-off

hipaatraining.com also publishes a bundled Awareness plus Security price of $49.99, a $20 rate for Security when bought with Awareness, custom pricing above 300 seats, and documentation kits at $499.99 per organisation with a year of free updates and no yearly subscription. HIPAA Exams publishes a separate HIPAA for Medical Office Staff course at $28.99.

What the published volume tiers work out to

Our arithmetic, not a vendor price

Our arithmetic, not a vendor price. Both inputs are published figures from the table above. The multiplication is ours: neither vendor publishes a total for a workforce of this size, and the seat tier you land in depends on a headcount only you know.

A practice with 120 workforce members

120 seats lands in hipaatraining.com's published 100 to 199 band at $19.99 per seat, so our arithmetic is 120 × $19.99 = $2,398.80, once. Because the vendor states there is no yearly subscription and describes the certificate as valid two years, that is not an annual figure and this site does not turn it into one. The same 120 people bought at the single-seat rate of $29.99 would be $3,598.80, so the published volume break is worth $1,200 at this headcount. Count workforce rather than clinicians or employees: under 45 CFR 160.103 workforce includes volunteers, trainees and others under your direct control, whether or not they are paid, and that is the population the seat count meters.

Compare that against the bundled model below rather than against a per-user rate, because the bundled model does not have one.

Model two: bundled into a compliance platform

This is the dominant model in the category, and it has no per-user training price at all. Training is a module inside a subscription, so the training line on your invoice is zero and the cost is embedded in a platform fee that also buys policy templates, BAA tracking and an evidence store. The comparison against per-course purchase is not a like-for-like one.

Accountable HQ

Basic $199/mo ($169 billed annually), Plus $299/mo ($254), Pro $799/mo ($679). HIPAA and security training is an included feature in all three tiers, not a separate per-user line.

Compliancy Group

Plans from $99/mo billed annually (Foundation), $249 (Growth), $449 (Advanced and Elite), each plus a separate per-employee fee from $8/mo on Foundation and $10/mo on higher plans. Every plan figure is worded "Starting At". The per-employee fee is the line that meters your workforce.

Total HIPAA

DIY $199/mo plus a $999 onboarding fee; Prime $485/mo billed annually; Concierge is custom. Training is bundled and carries no separate per-user price.

Model three: free, from the regulator

OCR states that all of its materials are available free on its website. Its resources include the HIPAA Security Information Series and a video module on the Privacy Rule right of access. CMS publishes HIPAA Basics for Providers, and HealthIT.gov publishes a privacy and security guide. The floor for HIPAA training content is therefore $0, set by the regulator itself.

The line worth reading before you buy: OCR states that it provides materials free of charge and does not certify any materials or services provided by private sector entities as HIPAA compliant. No commercial course carries an official stamp. What a paid platform genuinely adds is delivery, tracking and completion records, which is what 164.530(b)(2)(ii) asks you to document, and free materials leave you to evidence yourself.

OCR's training materials →

Adjacent: general compliance and security training

Three platforms publish genuine per-learner annual rates, but none of them prices HIPAA specifically, and quoting them as HIPAA training prices would misattribute the product. They are included because they are real published rates for the catalogue a HIPAA course often sits inside, and because they are the closest thing this category has to a per-seat market rate.

Vendor	Published rate	What it is, and the catch
Traliant	from $15.95 per learner / annually	Whole-catalogue compliance training. Its own page states the rate assumes a 3-year plan of 100 learners and that smaller or larger teams and shorter terms are priced differently. Its HIPAA course page publishes no price.
ProProfs	$1.99 per active learner/month, or $23.88 annually per learner	A generic LMS rather than a HIPAA product. The meter is active learners, so a dormant seat is not billed, which is a different meter again.
KnowBe4	$2.40 down to $1.63 per seat/month	Security awareness training, not HIPAA training. Published on a 3-year term, with the rate falling by seat band from 25-50 up to 501-1000. Its Advanced tier is $3.75 down to $2.79 on the same basis.

These sit here rather than in the tables above deliberately. A security awareness subscription and a HIPAA course are different products, and the habit of blending them is how a per-user HIPAA training rate gets manufactured out of prices that were never for HIPAA training.

The vendors that publish nothing

Several of the best-known names in healthcare training quote per organisation and publish no rate. That is their prerogative, and this site records it rather than estimating around it.

MedTrainer

Three tiers named on its pricing page (Select, Premier, Signature) with no dollar figures. Explicitly quoted by user count.

Relias

No pricing page exists. Quote only.

HealthStream

No public pricing page.

HIPAA Secure Now

Its pricing path returns a 404 and its store is password-protected.

What HIPAA training has to cover

The rule requires training on your policies and procedures, as necessary and appropriate for workforce members to carry out their functions. That last clause is the regulatory basis for training people differently by role. The topics below follow from the standard; the depth and duration are your judgement, and this site publishes no recommended minute count because no source establishes one.

Role	Topics that follow from the rule
All workforce (baseline)	Your PHI handling policies, your breach reporting route, your sanctions policy under 164.308(a)(1)(ii)(C)
Clinical staff	Minimum necessary, patient rights, verbal disclosures, your EHR access rules
Administrative staff	Authorisations, directory listings, your release-of-records process, fundraising and marketing rules
IT and security	Security Rule safeguards, access controls, encryption, audit log review, incident response
Leadership	Programme oversight, the risk analysis obligation, liability, the security official role under 164.308(a)(2)

When training is actually required

NEW HIRE“Within a reasonable period of time after the person joins the workforce”, per 164.530(b)(2)(i)(B). The rule sets no day count, and any specific deadline you have seen is somebody's policy rather than the regulation.

MATERIAL CHANGEFor workforce members whose functions are affected, “within a reasonable period of time after the material change becomes effective”, per 164.530(b)(2)(i)(C). This is the trigger organisations most often miss, because it arrives with a policy update rather than on a calendar.

PERIODIC164.308(a)(5) requires a security awareness and training programme, with “periodic security updates” as an Addressable specification. Undefined interval. Annual is the common answer and a defensible one; it is your choice to make and document, not a rule to comply with.

DOCUMENT164.530(b)(2)(ii) requires you to document that the training was provided. This is the part that actually costs you something, and it is the main thing a paid platform sells over free materials.

Frequently Asked Questions

Is annual HIPAA training required?

No, and this is one of the most widely repeated errors about the rule. Neither HIPAA training provision states any interval. 45 CFR 164.308(a)(5) requires a covered entity to implement a security awareness and training program for all members of its workforce, including management. All four of its implementation specifications are Addressable rather than Required, and the only temporal word in the whole standard is "Periodic", which attaches to security reminders rather than to the training itself and is left undefined. 45 CFR 164.530(b) sets timing by event rather than by calendar: train by the compliance date, train each new workforce member within a reasonable period of time after the person joins, and retrain members whose functions are affected by a material change within a reasonable period of time after that change takes effect. So the triggers are hiring and material change, not the anniversary. Annual training is common practice, it is a sensible way to evidence that a periodic programme exists, and other frameworks and many payer contracts do require it. But it is not what HIPAA says, and a vendor telling you the law mandates annual training is selling rather than citing.

How much does HIPAA training cost per employee?

It depends on which of the three models you buy, and they are not comparable on a per-user-per-year basis. Per-course purchase: HIPAA Exams publishes HIPAA Training for Healthcare Workers at $28.99 per person per course, a one-off purchase, and hipaatraining.com publishes HIPAA Awareness at $29.99 with volume tiers per seat falling to $24.99 at 10 to 24 seats, $19.99 at 100 to 199 and $14.99 at 200 to 299. Those are one-time purchases and hipaatraining.com states there is no yearly subscription, issuing a certificate it describes as valid two years. Bundled into a platform: Accountable HQ includes HIPAA and security training in all three of its published tiers at $199, $299 and $799 per month, and Total HIPAA publishes DIY at $199 per month plus a $999 onboarding fee and Prime at $485 per month billed annually. There is no per-user meter in that model at all. And free: OCR publishes its own training materials at no charge. Most vendors in this category, including MedTrainer, Relias, HealthStream and HIPAA Secure Now, publish nothing and quote per organisation.

Is there free HIPAA training?

Yes, from the regulator. OCR states that all of its materials are available free on its website, and its resources include the HIPAA Security Information Series and a video module on the Privacy Rule right of access. CMS publishes HIPAA Basics for Providers and HealthIT.gov publishes a privacy and security guide, both free. One caveat worth reading carefully before you buy anything: OCR states that it provides materials free of charge and does not certify any materials or services provided by private sector entities as HIPAA compliant. That is the same position it takes on certification generally, and it means no vendor's training carries an official stamp, whatever its marketing says. What you are buying from a commercial vendor is not compliance; it is content, tracking and the completion records you will want to produce if OCR ever asks.

What does HIPAA training have to cover?

The rule is less prescriptive than the market implies. 45 CFR 164.530(b) requires training on the covered entity's policies and procedures with respect to protected health information, as necessary and appropriate for the members of the workforce to carry out their functions, and requires that you document that the training was provided. The operative phrase is your policies and procedures: the obligation is to train people on how your organisation handles PHI, which is why generic off-the-shelf content satisfies the letter of the rule while often missing its point. A workforce member who can pass a quiz on the Privacy Rule but does not know your own release-of-records process has been trained in the sense the vendor sells and not in the sense the rule intends. Role relevance is built into the standard through "as necessary and appropriate for the members of the workforce to carry out their functions", which is the regulatory basis for training clinical, administrative and IT staff differently.

Who counts as workforce for training purposes?

More people than the payroll. HIPAA's definition of workforce at 45 CFR 160.103 covers employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of that entity, whether or not they are paid. So volunteers, students on placement and contractors under your direct control are in scope, and they are the population most often missed when an organisation counts seats for a training platform. This matters commercially as well as legally: per-employee platform fees and per-seat course purchases both meter on the number of people you have to train, so an undercount of workforce is an undercount of the bill. Note also that someone under your direct control is workforce, while a vendor acting on your behalf is a business associate needing a BAA instead. The two routes are different and confusing them is a common finding.

Does training actually prevent anything?

It is cheap relative to the failures it addresses, and this site declines to put a ratio on that, because the honest answer is that nobody has published one worth quoting. What the published record does show is where OCR keeps finding problems, and the recurring findings are process failures rather than knowledge failures: risk analyses that were never done, BAAs that expired, audit logs nobody reviewed. In OCR's May 2025 settlement with BayCare Health System at $800,000, a non-clinical staff member improperly accessed and shared a patient's ePHI and the findings included no role-based access limits, no routine log review and no risk analysis. Training is a reasonable control and a required one; it is not a substitute for the access limits and log review that appear next to it in nearly every one of those findings.

Cost Calculator Requirements Checklist Tools Comparison Accountable HQ Cost Compliancy Group Cost Small Practice Guide