Home › Guides

HIPAA Training for Nursing and Allied Health Students

HIPAA applies to you as a student. The rule defines a covered entity's workforce to include trainees, paid or not, and covered entities must train their workforce on their privacy policies. In practice, many hospitals and clinics have students complete the site's own HIPAA module before a rotation. Some programs instead ask students to bring a certificate from an outside course. This guide explains the rule, what to ask your program, and where an online course fits.

Updated October 14, 2026 · Checked against the official sources listed at the end

Why HIPAA counts students as workforce

HIPAA's definitions (45 CFR 160.103) say workforce means employees, volunteers, trainees, and other persons whose work for a covered entity or business associate is under its direct control, whether or not they are paid.

A student on a clinical rotation is often a trainee under the site's direct control. That puts you inside the site's HIPAA program. You are expected to follow its privacy policies like any staff member.

Who is responsible for training you

The training duty sits with the covered entity. Under 45 CFR 164.530(b)(1), a covered entity must train all members of its workforce on its policies and procedures for protected health information, as needed for them to do their jobs.

The rule says each new workforce member must be trained within a reasonable period of time after joining. Workforce members affected by a material change in policies must be trained within a reasonable period after the change. The covered entity must document the training (164.530(b)(2)).

So the hospital or clinic decides how students are trained on its policies. Your program may add its own requirement on top.

Many sites use their own module

UNC Health's Advanced Practice Provider Center is one example. Its checklist says all students, clinical and non-clinical, must complete its regulatory compliance modules before the rotation starts. Those modules include a confidentiality statement, HIPAA training and OSHA training, and students must send their completion transcript.

If your site works this way, an outside course won't replace the site's module. Ask your clinical coordinator two questions before you buy anything: will the site train me, and does the program also need a certificate from me?

There is no official HIPAA certification

HHS warns about misleading marketing on this point. It says HHS and its Office for Civil Rights do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant." It also says the Privacy Rule does not require attendance at any specific seminars.

A course certificate shows you finished a course. It is not a government credential. Any course seller who says otherwise is overstating it.

What HIPAA training usually covers

HIPAA protects protected health information: individually identifiable health information held or sent by a covered entity, in any form (160.103). That includes what you see on a chart, hear at a nurses' station or read on a screen.

One core idea is "minimum necessary." When using or disclosing protected health information, a covered entity must make reasonable efforts to limit it to the minimum necessary for the purpose (45 CFR 164.502(b)). The rule has exceptions, including disclosures to a health care provider for treatment. Your site's policies tell you how it applies to your role.

Two other parts of the training rule matter to students. Training must match what your role needs, so a nursing student and a registration clerk may get different content. And the site must document it, so keep a copy of anything you complete.

Practical habits follow from that. Look up only the patients you are assigned to. Don't discuss patients where others can hear. Keep identifying details out of class papers, group chats and social media unless your program's rules allow it. Ask your preceptor when you're unsure.

Is it required every year?

Section 164.530(b) doesn't set a yearly schedule. It ties training to joining the workforce and to material policy changes. Sites and programs often set their own refresher schedule, so a new rotation or a new school year may mean new training. Follow what your program and site require.

Where Pact's HIPAA course fits

Pact sells the HIPAA course for $34.95. HIPAA is an online certification course from ProTrainings. Confirm with your program or clinical site that this course meets its requirements before you enroll. ProTrainings makes and runs the course. Pact sells it and handles your order and support.

Buyers must be 18 or older. After you pay, Pact enrolls you and emails your login instructions, usually within one business day (Monday to Friday). All sales are final.

A general course can explain HIPAA. Only the site can teach you its own policies, so expect to complete site training too.

Common questions

Do nursing students need HIPAA training?

Usually, yes. HIPAA counts trainees as part of a covered entity's workforce, and covered entities must train their workforce. Many sites assign their own module before a rotation.

Is there an official HIPAA certification for students?

No. HHS says it does not certify any persons or products as "HIPAA compliant." A course certificate shows you completed that course.

Will an online HIPAA course count for my program?

Only your program or site can say. Ask before you buy. Some sites require their own module no matter what other training you have.

How often do students need HIPAA training?

HIPAA's training rule doesn't set a yearly schedule. Programs and sites often do, so follow theirs.

How much is Pact's HIPAA course?

$34.95. It is made by ProTrainings and sold by Pact, for buyers 18 and older. All sales are final.