HIPAA proof

HIPAA training proof for the curriculum you already have

You already have HIPAA content — a video refresher, a BA orientation pack, a client-mandated module. The hard part is proving this person finished this pack when a client or auditor asks, months later, without emailing PDFs or provisioning another LMS seat. Elumio is the delivery and proof layer for HIPAA-style training you author (or already own). We do not sell a packaged HIPAA course. If you need a content library, that is a different category of product.

What "proof" means for HIPAA programmes

HIPAA programmes usually fail at verification time: a client questionnaire, a BA onboarding checklist, an audit, a renewal. A checkbox that someone opened a module is not evidence. Elumio makes completion mean something:

  • Server-side watch credit — intervals actually reached; a dragged slider or idle tab banks nothing.
  • Strict mode (per course) — cannot finish faster than the video is long; rewinding stays free.
  • Exam gated until required lectures are complete; grading stays on the server.
  • QR certificate — public page reports valid, revoked, or expired. No Elumio account required to check.
  • Email reminders before a certificate expires when enabled for the course.
  • Optional client view — scoped to that client's people (Business and Scale only).

Your content, your policies

Bring your own curriculum: video lectures and your assessment (or AI-drafted questions from the transcript — every question still needs trainer approval before trainees see it). Elumio enforces completion and verification. It does not replace your HIPAA policies or procedures, legal advice, Business Associate Agreements, or a packaged course vendor if that is what you want.

Who this is for

Ops and compliance leads running BYO HIPAA refreshers for staff or contractors; healthcare staffing and VA agencies that must show clients training happened; organisations that already bought content elsewhere and need proof, not another catalog.

Not for buyers shopping for a packaged "HIPAA training course online" as a content purchase — we will not out-catalog EasyLlama or enterprise LXPs.

What we do not claim

We do not hold SOC 2 or ISO 27001 today — stated plainly on our FAQ. We are not a DOLE-accredited body and do not issue government credentials. Elumio is not a substitute for your BAAs or counsel. If procurement requires formal security certification before any tool, we are not yet the right fit — and we would rather say so.

How it works

Five steps that stay inside the product:

  • Upload your HIPAA (or privacy) lectures.
  • Invite trainees by email (OTP sign-in).
  • They watch under your rules — then the exam unlocks.
  • Pass — PDF with serial number and QR.
  • Client or auditor scans — valid, revoked, or expired.

Related questions

Is it free to try?

Yes — there is a free plan, not a time-limited trial. It carries one course, a small group of trainees, an allowance of stored video and a monthly allowance of AI credits, and it does not expire. The pricing table above gives the exact figures.

You can stay on it indefinitely. Nothing is deleted if you decide not to upgrade.

How do you know a trainee actually watched the video?

Watch credit is calculated on the server, from intervals actually reached — not from where the playhead sits. A dragged slider or an idle tab banks nothing.

Rewinding is always free; it is skipping ahead that is restricted. Strict mode is a per-course switch, so optional material can stay freely browsable while mandatory training is locked down. Watching faster than the permitted rate earns no extra credit.

How does certificate verification work?

Every pass issues a PDF containing the holder's name, the course, the dates, a serial number and a QR code.

Scanning the QR opens a public page that reports one of three states — valid, revoked, or expired — checked against the issuing organisation's records. No login and no Elumio relationship is required for whoever is checking.

Expired is deliberately not the same as fake: the page says the training happened and is due to be retaken.

On a custom training address the verification page may wear that organisation's theme, and it answers only for certificates that organisation issued. elumio.io/verify stays the global check, in Elumio's theme, for any certificate.

Can I show a client how their own staff are doing?

Yes, with a client view: a read-only page covering the trainees you choose, which you publish and can revoke at any time.

It is the one feature that discloses a named person outside your organisation, so it is deliberate at every step — you pick who is included rather than sharing a whole roster, and revoking kills the link for anyone holding it.

Client views are available on Business and Scale only.

Do certificates survive if we stop paying?

Yes. Certificates already issued stay valid and stay publicly verifiable. A certificate records that somebody completed training; it does not depend on whether their employer is still subscribing.

Is Elumio SOC 2 or ISO 27001 certified?

No. We hold no third-party security certifications at this time, and we would rather say so than imply otherwise.

What we can describe is what the platform actually does: encrypted transport, daily backups, authorisation re-derived on the server for every request, rate limiting on authentication, and an audit trail of trainer actions. If your procurement process requires a formal certification, we are not yet the right fit.