In December 2025, the HHS Office for Civil Rights settled its 54th case under the Right of Access Initiative. A Texas occupational health provider paid $112,500 because one patient asked for his own records six times and waited more than a year to get them. No hacker was involved, and no system was breached. A request came in, and the people who were supposed to act on it didn't, on time.
That case is closer to the typical HIPAA problem than the headlines suggest. Since 2019, nearly every settlement in that initiative has turned on the same thing: a patient's right to their own information, and a staff member who didn't handle the request the way the rule requires.
HIPAA was written around what staff do
Both rules that govern protected health information put training at the center. The Privacy Rule requires a covered entity to train every workforce member on its PHI policies (45 CFR 164.530(b)). The Security Rule adds a separate security awareness and training requirement for everyone who touches electronic records, management included (45 CFR 164.308(a)(5)).
Neither rule lets you train everyone the same way. The standard is training that's "necessary and appropriate" for each person's job, which means a front-desk scheduler and a privacy officer need very different things. OCR has flagged generic, one-size-fits-all training as a shortcoming in its enforcement actions. Under HIPAA, that training functions as a security control in its own right, not just paperwork filed beside the real work.
Most violations are ordinary, and most are preventable
The privacy failures OCR documents rarely look criminal. An employee opens a coworker's chart out of curiosity. A nurse checks the record of a patient she saw on the news. Someone discusses a case where it can be overheard, or pulls up a neighbor's file with no clinical reason. Each of those is a federal privacy violation, even when nothing gets shared and no harm is intended.
It happens more than most organizations admit. In one survey of medium and large providers, 35 percent had an incident caused by an employee viewing a colleague's records, and 27 percent involved staff looking at the files of friends or family. The HIPAA "minimum necessary" standard exists for exactly this reason: people should reach only the information their role requires. Training is where staff learn where that line sits, why curiosity isn't a work reason, and that every access is logged. When patients find out their records were opened without cause, the trust that lets them speak honestly with a clinician is hard to win back.
The rules move, and training has to move with them
HIPAA has a way of evolving over time, and the law builds accounts for that. When a policy changes in a way that affects someone's job, that person has to be retrained (45 CFR 164.530(b)). Many changes are recent. A 2024 final rule aligned the Part 2 protections for substance use disorder records more closely with HIPAA, with compliance required by early 2026. OCR has also proposed the first major Security Rule update since 2013.
Canvas Career, the professional and continuing-education product built on Canvas by Instructure, lets an administrator revise a module once, send the current version to the whole workforce, and see who has opened it. Someone hired next week gets the same current training as everyone else, not whatever handout happened to be in the binder at orientation.
You have to prove the training happened
This is the part organizations might underestimate until a review starts. When OCR investigates, the covered entity has to show that training was provided, to whom, and when. The right-of-access settlements make the expectation plain: regulators want dated documentation, not a verbal assurance that training runs every year. A completion record for each employee is what holds up. Healthcare orgs need data and insights from their learning platforms that give compliance leaders that record as a live view, so the proof is ready before the request lands rather than assembled in a scramble after it does.
The same question runs through every part of a team's learning
Whether it's the communication training that prevents handoff errors or the broader patient-safety and compliance work that keeps a team ready for review, it comes down to one question: do the right people know the current expectation, and can the organization show it? For staff earning continuing-education credit along the way, Parchment by Instructure issues verifiable records of what they completed.
The fixable part is the human part
No training program stops a determined attacker, and no honest one claims to. What training reaches is everything else, which is most of what HIPAA actually governs: the request that needs a timely answer, the record nobody should have opened, the disclosure made without thinking. Those are habits, and habits respond to instruction that's specific to the role, current with the rules, and documented well enough to prove. For a law built around what people do on an ordinary shift, that's one of the most useful thing a healthcare organization can put in place.
See how Instructure supports business and government organizations with training and certification built for regulated work and compliance-heavy teams like healthcare.
