HIPAA Training for Employees, Plus PCI DSS, OSHA and CMMC
Courses mapped to more than 20 laws and standards. For your team, more than 500 come with every Empath Learn seat. For your clients, premium catalogs in Empath Grow.
20+
Laws and Standards, Including HIPAA, PCI DSS and CMMC
8
Empath Courses for MSPs
40+
Courses Mapped to HIPAA
250+
OSHA Courses and Lessons
Start Here: Start Compliance Training by Client Obligation
Choose the branch that matches the client's data and contract; the client's compliance owner confirms requirements.
- For defense-contract work CMMC 2026: What Every MSP Needs to Know Empath, 20 min Understand the MSP's role.
- For healthcare data HIPAA Toolkit: Business Associates Curated Collection, 10 min Review business-associate duties.
- For payment cards Payment Card Industry Data Security Standard (PCI DSS) Compliance Curated Collection, 24 min Introduce card-data controls.
A designated MSP security lead can use the security and compliance pathway to plan follow-up work.
“There's something for everyone here. Every employee needs to speak Cybersecurity.
This includes techs, marketing, finance. I have my whole team signed up as it's great for onboarding new employees. Empath saves us time by unraveling the latest cyber news, like the new FTC safeguard rules. Empath demystifies topics like the NIST Cybersecurity Framework and cyber insurance so newcomers can get into the club.”
What Does HIPAA Training for Employees Cover?
HIPAA training for employees teaches staff how to handle protected health information under their employer's privacy and security policies. Both the HIPAA Privacy Rule and the Security Rule call for workforce training.
HIPAA is one of more than 20 laws and standards in the Compliance Obligations list of the Empath course catalog. More than 500 courses on the list map to the main ones like this:
- More than 40 courses mapped to HIPAA and HITECH. Over 30 with HIPAA in the title cover the Privacy, Security and Breach Notification rules, including courses for business associates and security officers
- 20+ mapped to PCI DSS, 8 of them PCI compliance training for staff who handle card data
- Over 20 mapped to GDPR, plus other privacy laws such as California's CPRA and Canada's PIPEDA
- More than 20 mapped to NIST, plus Empath's own courses on CMMC and SOC 2 for MSPs
- 20+ mapped to the ADA and 20 to FMLA, plus EEOC and Title VII
- More than 250 mapped to OSHA, such as hazard communication, bloodborne pathogens, forklifts and recordkeeping
- Over 100 mapped to DOT and FMCSA, such as hours of service and hazmat awareness
- 60+ mapped to HAZWOPER
The other laws and standards on the list include EPA, Sarbanes-Oxley, FERPA, GLBA and ISO 27001.
For harassment prevention and other HR topics, see the compliance and HR courses. Security skills sit with the cybersecurity courses, and safety by topic with the workplace safety courses.
Counts from the full course list. One course can be mapped to several laws and standards, so the counts overlap.
Courses Included in Every Empath Learn Seat
Every seat on every plan includes these. Titles appear exactly as they do in Empath.
Built for MSPs by Empath
8 courses in this category come from Empath's own catalog for MSPs. Three of them:
- CMMC 2026: What Every MSP Needs to Know, Empath. The 2026 CMMC changes, for MSPs with US defense clients. 20 minutes.
- SOC2 Compliance for MSPs, Empath. How to run SOC 2 projects for clients, audits included. 39 minutes.
- Introduction to the NIST Cybersecurity Framework, Empath. NIST training from the foundations, taught by an Empath co-founder. 76 minutes.
The other five include whether to take on CMMC clients, FTC Safeguards, mapping Microsoft 365 to NIST CSF 2.0 and incident response.
The Curated Collection
More than 500 Curated Collection courses in this category, from 13 publishers, most of them from BizLibrary Productions and The MARCOM Group. Four of them:
- HIPAA Basics, BizLibrary Productions. An overview of the Privacy, Security and Breach Notification rules. 35 minutes.
- HIPAA Toolkit: Business Associates, BizLibrary Productions. HIPAA for business associates, the role an MSP often holds for a healthcare client. 10 minutes.
- Payment Card Industry Data Security Standard (PCI DSS) Compliance, BizLibrary Productions. PCI compliance training for staff who handle card data. 24 minutes.
- Introduction to OSHA, The MARCOM Group. OSHA training for employees who are new to it. 21 minutes.
The full course list also has GDPR courses, ADA training, HIPAA for managers, HIPAA Security Rule safeguards and much more.
Is Compliance Training Included or Premium?
Included for your team in Empath Learn. Premium for your clients in Empath Grow.
Empath Learn
Included with every seat on every plan: more than 500 courses, from Empath, Microsoft Learn and the Curated Collection.
Empath Grow
Premium catalogs: the Curated Collection, with most of these courses, plus Bigger Brains for HIPAA and Inspired eLearning for HIPAA and PCI DSS. In Empath Grow, each client has the Curated Collection or Bigger Brains, not both.
The Bigger Brains catalog has HIPAA courses for business associates and for covered entities. It is for Grow only, because the Curated Collection in Learn already includes Bigger Brains courses.
Inspired eLearning adds HIPAA/HITECH, PCI DSS 4.0, GDPR and CCPA titles. You can add it for your team in Learn or for your clients in Grow.
One course from each of these catalogs:
- Intro to HIPAA for Covered Entities, Bigger Brains. HIPAA for the staff of a covered entity, such as a healthcare client. 168 minutes.
- PCI Overview for IT Professionals - DSS 4.0, Inspired eLearning. A PCI DSS 4.0 overview for IT staff. 35 minutes.
Premium catalogs work the same on Grow and Grow Lite. For costs, see plans and pricing.
Who Is Compliance Training For?
Your own team first, then your clients' staff.
- Your security and compliance leads, for client CMMC and SOC 2 work
- Your technicians, who work on client systems with health and payment data
- Your clients' HR and compliance owners, who assign HIPAA and HR law courses
- Your clients' frontline and safety staff, for OSHA and DOT courses
Courses help meet training requirements and do not replace the hands-on evaluations some safety rules ask for. No course makes anyone compliant or certified. Check with your own counsel. In Empath Learn, admins assign courses and see who finished them.
Questions About HIPAA and Compliance Training
Short answers for MSP owners choosing compliance training for their team or their clients.
What are the training requirements for HIPAA employees?
HIPAA's Privacy Rule requires a covered entity to train every workforce member on its privacy policies, as their jobs require, and to document it; new staff are trained within a reasonable time. The Security Rule adds security awareness training for everyone, management included. Empath Learn's HIPAA courses support that training; check your own duties with counsel.
How often should employees get HIPAA training?
HIPAA's training rules set no fixed interval. The Privacy Rule calls for training new workforce members within a reasonable time, and again when a material policy change affects their jobs. The Security Rule calls for periodic security updates. In Empath Learn, an admin can assign courses with due dates, and learners get reminders.
What is the new HIPAA rule in 2026?
HHS proposed an update to the HIPAA Security Rule in January 2025 to strengthen the cybersecurity of electronic protected health information. A proposal changes nothing until HHS publishes a final rule and it takes effect; until then, the current training rules apply. Separately, since February 16, 2026, covered entities that hold 42 CFR Part 2 substance use disorder records must describe them in their Notice of Privacy Practices.
Is HIPAA training for employees included in Empath Learn?
Yes. Every Empath Learn seat includes HIPAA training for employees, on every plan. The Compliance Obligations list has more than 30 courses with HIPAA in the title, among more than 500 courses mapped to laws and standards such as PCI DSS, GDPR, OSHA and CMMC. Inspired eLearning is a premium catalog you can add on top for your team.
Which HIPAA courses can my clients get in Empath Grow?
In Empath Grow, you can offer your clients HIPAA courses from three premium catalogs. The Curated Collection has HIPAA Basics and the HIPAA Toolkit series, Bigger Brains has Intro to HIPAA for Covered Entities and Inspired eLearning has HIPAA/HITECH privacy titles. In Empath Grow, each client has the Curated Collection or Bigger Brains, not both.
How do I get a HIPAA certification?
HIPAA has no certification to earn. It asks for workforce training and a record that the training happened. Empath courses help meet those training requirements, and an Empath admin can see who finished them. Empath does not issue certifications, and no course makes a person or a company HIPAA compliant.