Free Cybersecurity Awareness Training for Healthcare Teams

The sample above is three of the nine rooms in One Guy Consulting’s Cybersecurity Awareness course: The Inbox (phishing), Server Room (ransomware) and Key Vault (passwords and MFA). After the rooms, you answer three questions taken from the real knowledge check. It runs in your browser, needs no signup, and saves nothing, so you can walk it as often as you like or send the link to a colleague.

• Command Deck: Why it matters and your role. Why healthcare is one of the most targeted industries: a stolen credit card can be cancelled, but a stolen medical identity is permanent. Attackers go after people, not just firewalls, so every person with a login is part of the defense.
• Threat Gallery: The threats a practice faces. The four threats staff will meet: phishing, ransomware, malware hidden in downloads and attachments, and social engineering, which manipulates people into handing over access with no technology required.
• The Inbox: Phishing (in this sample). The anatomy of a real-looking phishing email, and the habits that catch one: pressure or urgency, unexpected attachments even from known contacts, and links whose real destination does not match the text.
• Server Room: Ransomware (in this sample). How ransomware arrives and spreads from one computer across a network, and the first moves if it hits: unplug the network cable, turn off Wi-Fi, do not restart, do not pay, and report fast.
• Call Center: Social engineering by phone. A scenario call from someone posing as IT support who needs a password right now. The rule: when a request feels unusual, verify it through a separate channel you look up yourself.
• Key Vault: Passwords and MFA (in this sample). Unique passwords for every account, never reused between work and personal, a password manager where the organization provides one, and why MFA means a stolen password alone is not enough.
• Remote Desk: Devices and remote work. Locking the screen every time you step away, keeping patient data on encrypted, managed devices, never plugging in a found USB drive, and using the organization’s VPN before reaching patient systems.
• Secure Entrance: Physical security. Not holding secured doors for people you cannot verify, clearing printouts, positioning monitors away from patients, and how access logs show who opened which record and when.
• Response Room: Reporting incidents. What counts as a security incident, why over-reporting beats silence, and what to do first: disconnect if malware is suspected, do not delete anything or cover it up, and report immediately.

The full course ends with the complete knowledge check and records each person’s completion in the portal. Nothing in this sample is saved.

Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone.

One Guy Consulting

One Guy Consulting explains complex healthcare compliance regulations in plain language for practice managers, office managers, and practitioners.

Course logistics

• Course length: nine rooms holding 18 short lessons, then an 8-question knowledge check. Each person goes at their own pace.
• Enrollment steps: (1) your practice signs up for Full-Scope; (2) your privacy officer adds staff in the One Guy Consulting portal; (3) the privacy officer assigns Cybersecurity Awareness, and each person gets an email; (4) staff sign in, walk the nine rooms and take the knowledge check.
• Pricing: included with Full-Scope, a flat rate per location of $1,300 a year, or $120 a month. See plans and pricing.
• Assessment scoring: 8 questions; a pass is at least 7 correct (80%). Anyone below that reviews the material and tries again, and completion is saved only after a pass.
• Tracking: the portal records each person’s completion, and annual training reminder emails go out when a person’s training comes due again.

Anonymized outcome: a health group with more than 100 offices lifted take-up of its compliance program by about 17%, and more staff finished their required training.

What the rule and official guidance say

The HIPAA Security Rule requires covered entities and business associates to “implement a security awareness and training program for all members of its workforce (including management)” (45 CFR 164.308(a)(5)(i)). For more, see the HHS Office for Civil Rights Security Rule guidance, NIST’s training guidance in SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program, and CISA’s Teach Employees to Avoid Phishing.

Sources

• HHS Office for Civil Rights: Security Rule guidance
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program
• CISA: Teach Employees to Avoid Phishing
• 45 CFR 164.308, Administrative safeguards (eCFR)

Is this sample saved?

Nothing in this sample is saved.

Is signup required for this sample?

No signup required for this free sample.

What rooms are included in this sample?

The sample walks three rooms: phishing (Inbox), ransomware (Server Room), and passwords/MFA (Key Vault).

Does the full course record staff completion?

Yes. The full course ends with the complete knowledge check and records each person’s completion in the portal.

Chuck Weiselberg, Founder, One Guy Consulting; 10 years of HIPAA compliance experience; Certified HIPAA Professional (CHP). Full author bio.