The topics to include in basic HIPAA training will vary according to the nature of the organization´s operations. For example, healthcare facilities with large public-facing workforces may find it necessary to include more content related to physical threats to patient data than a Business Associate with a small office-based workforce. The way to determine which topics should be included in basic HIPAA training is to conduct a risk assessment and analyze the results to identify where potential HIPAA violations may originate – bearing in mind that the objectives of basic HIPAA training should be to mitigate the risk of HIPAA violations, rather than to check the boxes on a HIPAA compliance checklist.