ecfirst / HIPAA Academy · CHP examination HIO-201: issuer's current six-area examination distribution and linked CHP Certification 2P_26A brochure, copyright 2026, reviewed 2026-10-19. Neither source states an examination-outline effective date. The workbook label matches the official credential name.

This original 20-question sample covers selected topics across the outline. It does not reproduce official exam questions or cover every tested topic.

• ecfirst — CHP Certification Online
• ecfirst — Virtual Certified HIPAA Professional
• ecfirst — CHP Certification, 26A brochure
• HHS — Covered Entities and Business Associates
• HHS — Summary of the HIPAA Privacy Rule
• HHS — Guidance on HIPAA and Cloud Computing
• 42 U.S.C. 17941 — Recognition of security practices
• 45 CFR 160.316 — Refraining from intimidation or retaliation
• 45 CFR 160.306 — Complaints to the Secretary
• HHS — Minimum Necessary Requirement
• 45 CFR 164.524 — Access of individuals to protected health information
• 45 CFR 164.526 — Amendment of protected health information
• 45 CFR 164.522 — Rights to request privacy protection
• 45 CFR 164.402 — Breach definitions
• HHS — Breach Notification Rule
• CMS — Adopted Standards and Operating Rules
• CMS — National Provider Identifier Standard
• HHS — Guidance on Risk Analysis
• HHS — Addressable and Required Implementation Specifications
• HHS — Summary of the HIPAA Security Rule
• 45 CFR 164.308 — Administrative safeguards
• 45 CFR 164.310 — Physical safeguards
• NIST — Release of Cybersecurity Framework 2.0
• HHS — Direct Liability of Business Associates
• HHS — Business Associates
• 45 CFR 160.404 — Amount of a civil money penalty
• HHS — State Attorneys General
• 45 CFR 164.520 — Notice of privacy practices
• 45 CFR 164.514 — Other requirements relating to uses and disclosures
• 45 CFR 164.528 — Accounting of disclosures
• 45 CFR 164.508 — Uses and disclosures requiring authorization
• CMS — HPID
• 45 CFR 164.316 — Policies, procedures and documentation
• NIST CSWP 29 — The NIST Cybersecurity Framework 2.0
• 45 CFR 160.203 — General rule and exceptions
• 45 CFR 164.530 — Administrative requirements
• 45 CFR 164.512 — Specified uses and disclosures without authorization
• 45 CFR 164.410 — Notification by a business associate
• HealthIT.gov — Information Blocking