Does HIPAA apply to cranial prosthesis specialists?
HIPAA applies to a cranial prosthesis specialist from the moment the practice bills insurance electronically. That transaction makes it a covered entity under 45 CFR Parts 160 and 164, carrying the same privacy, security and breach-notification duties as any other healthcare provider — whether the practice operates from a clinic, a studio or a chair inside someone else's salon.
- Billing a claim electronically is what triggers covered-entity status, not the size of the practice.
- Protected health information includes a physician's letter of medical necessity, a diagnosis code, and a client photograph connected to their care.
- The Security Rule requires a documented risk analysis and a workforce training program you can evidence.
- A breach of protected health information must be reported without unreasonable delay and no later than 60 days after discovery.
- HIPAA is the floor. More stringent state privacy laws stack on top of it and are not preempted.
Built for this profession, not adapted from a hospital handbook
Generic HIPAA training was written for a clinic front desk
It will teach you the Privacy Rule. It will not tell you what to do when a client's physician letter arrives by text message, when her sister sits in on the consultation, or when the before-and-after you want to post is a patient photograph.
Cranial prosthesis practice creates compliance situations that standard healthcare training never anticipated, because most providers in this field work in retail-adjacent spaces, market visually, and sit in the middle of a long chain of people who all handle the same patient's information. Each of those realities has a rule attached to it.
- The salon environment.You often work in a semi-public space you do not own. The Security Rule's physical safeguards still apply to your workstation, your paper files and the conversations people can overhear.
- Multi-party information flow.Patient to physician to you to supplier to insurer. Every hand-off is a disclosure, and each one has its own rule about what may be shared and how much.
- Marketing photographs.A treatment consent form does not cover posting a client's before-and-after. Marketing use requires a separate, specific written authorization that the client can revoke.
- Vendor chains.Your billing service, cloud storage and email provider are business associates. So are their subcontractors. Every link in that chain needs an agreement.
- Family and caregivers.Spouses, adult children and friends come to appointments. There are rules governing who you may speak to, about what, and when you need permission first.
- Minors and pediatric cases.Pediatric hair loss brings parental access rights and state-law variations that generic training skips entirely.
Training, not legal advice
This course teaches HIPAA as it applies to cranial prosthesis practice. It is not legal advice, and the included documents are starting points to review with your own attorney before you put them into service.
Ten modules, 55 lessons
Roughly 7-10 hours, self-paced. Every module closes with a scenario-based quiz.
| Module | What it covers | Lessons |
|---|---|---|
| 1. HIPAA Foundations | What HIPAA actually is, the moment billing insurance made you a covered entity, business associates and subcontractors, what counts as PHI in this practice, and what OCR penalties have actually cost people. | 6 |
| 2. The Privacy Rule | Minimum necessary in plain English, permitted disclosures, when written authorization is required, patient rights, your Notice of Privacy Practices, and who you may talk to about a client. | 6 |
| 3. The Security Rule | Administrative, physical and technical safeguards, walking through a security risk assessment, access controls and MFA, encryption at rest and in transit, mobile devices, and choosing compliant software. | 6 |
| 4. The Salon Environment | Privacy in semi-public space, safeguards when you do not own the building, storing paper records and physician documentation, overheard conversations, and locking down your workstation and phone. | 5 |
| 5. Business Associate Agreements | What a BAA is and when you need one, auditing your own vendors, agreements with billing services, cloud storage and email, required provisions, and subcontractor chains. | 5 |
| 6. Photo, Video and Marketing | Why marketing photos are a minefield, treatment consent versus marketing authorization, building a compliant form, Instagram and TikTok rules, testimonials and before-and-afters, and revocation. | 6 |
| 7. Multi-Party PHI Flows | Mapping the journey from patient to physician to you to insurer, receiving physician documentation safely, what may and may not be shared with wig suppliers, and the PHI inside a claim. | 5 |
| 8. Breach Notification | What counts as a breach and what does not, the four-factor risk assessment, the 60-day notification timeline, common scenarios like lost phones and misdirected email, and your incident response plan. | 5 |
| 9. State Laws and Edge Cases | How state laws stack on top of HIPAA, a 50-state quick reference, minor patients and pediatric hair loss, deceased patients, and telehealth consultations across state lines. | 5 |
| 10. Building Your Compliance Program | The written policies you are required to hold, workforce training documentation, sanctions and reporting, your annual compliance calendar, preparing for an OCR audit, and a final checklist. | 6 |
Reviewed every 12 months
HIPAA guidance and state privacy law both move. This course is on a documented annual review cycle so the material you train on stays current.
Ten documents you will actually use
Most HIPAA courses leave you knowing what you are supposed to have. This one hands you the paperwork.
Alongside the templates: ten module quizzes built on real practice scenarios rather than vocabulary, and a final exam of roughly 50 questions with an 80% pass mark. Pass it and you earn a Wig Medical Certificate of Completion, plus a training log you can produce if anyone ever asks for evidence.
- Notice of Privacy Practices
- Business Associate Agreement
- Photo and Video Marketing Authorization
- Breach Response Checklist
- Annual Security Risk Assessment Worksheet
- Workforce Training Log
- Incident Response Plan
- Vendor and Business Associate Audit Worksheet
- 50-State Quick Reference Guide
- Annual Compliance Calendar
From checkout to certificate
-
Enroll and get access
Checkout gives you access on the Wig Medical course platform. Work through it on desktop or in the mobile app, at your own pace.
-
Work through the ten modules
Roughly 7-10 hours in total. Each module ends with a short quiz built on situations you will recognize from your own consultation room.
-
Download and adapt your templates
Ten documents drafted for cranial prosthesis practice. Review anything you adopt with your own attorney before you put it into service.
-
Pass the final exam
About 50 questions with an 80% pass mark. Retakes are included, because the point is that you know the material.
-
Earn your Certificate of Completion
Issued by Wig Medical and dated, so you have documented evidence of current HIPAA training. It records completed training and is not a state or federal license.
Frequently asked questions
Do I need HIPAA training if I do not bill insurance?
HIPAA obligations attach when you conduct covered electronic transactions, which in this field usually means submitting insurance claims. A strictly cash practice that never transmits claims electronically may not be a covered entity — but it may still be a business associate of one, state privacy laws still apply, and clients still expect their medical information to be handled properly. Module 1 covers exactly where that line sits so you can tell which side of it you are on.
Is this a certification or a certificate?
You earn a Wig Medical Certificate of Completion. There is no government HIPAA certification and no federally recognized body that certifies individuals — anyone claiming otherwise is overstating it. What regulators actually look for is documented, current workforce training, and that is precisely what this course produces, along with the log to evidence it.
How long does it take?
Roughly 7 to 10 hours across ten modules. It is self-paced, so most people spread it across one or two weeks rather than sitting it in a single stretch.
Do I have to complete the CPS Certification course first?
No. This is a standalone course, open to Wig Medical graduates, current students, and any healthcare or beauty professional working with cranial prosthesis patients. It is also included as a required module inside the main Cranial Prosthesis Specialist Certification.
Are the templates ready to use as they are?
They are drafted for cranial prosthesis practice and considerably closer to usable than a generic download, but they are starting points, not finished legal instruments. Have your own attorney review anything you adopt. This course is professional training, not legal advice.
Does this satisfy an annual HIPAA training requirement?
HIPAA requires covered entities to train their workforce and to document that training. It does not name a fixed renewal interval, though annual retraining is the widely accepted standard and some state laws and payer contracts do require it. This course gives you both the training and the documentation to show for it.
What if I work inside someone else's salon?
Module 4 exists for that situation. You remain responsible for safeguarding the information in your care even where you do not control the premises, and the module works through what that looks like in practice — storage, screens, phone calls and the people within earshot.
Will this be required to join the Wig Medical Provider Network?
The Provider Network is in development. HIPAA training will be a prerequisite for the specialists who join it, so completing it now puts you ahead of that requirement. It does not, on its own, make you a network provider — certification and network membership are separate things.
Get your compliance program in order
Ten modules, ten templates, and a dated Certificate of Completion you can point to. Self-paced, and written for the way you actually work.
This course is professional training, not legal advice.