This is because if a person with no access to ePHI reveals their login credentials to a cybercriminal (i.e., via a phishing email), the cybercriminal may still be able to gain access to databases containing ePHI by using the person´s login credentials to navigate laterally through the Business Associate´s network. Consequently, it is just as important for people with no access to ePHI receive security awareness training as it is for people with access to receive security awareness training.