Healthcare Administration & Management · Independent exam preparation
Certified HIPAA Professional (CHP) Study Guide
Practise HIPAA disclosure decisions, individual rights, breach analysis and security safeguards through 60 focused concepts and 20 original CHP learning questions.
By CertMedbry · Updated 3 November 2026
Decide when HIPAA applies, distinguish permitted disclosures from individual rights, assess potential breaches, and connect security risks to defensible safeguards. This guide prepares learners for ecfirst / HIPAA Academy’s Certified HIPAA Professional examination, HIO-201. Its 60 substantive concepts selectively follow the issuer’s six published examination areas; the complete official outline defines the full scope, including topics beyond this selection. Use the linked 2026 CHP brochure alongside these independently authored explanations, practice questions and flashcards.
Try 20 free practice questionsWhat is the exam format?
Check the question types, timing and outline before planning your revision.
Which credential and examination does this guide address?
This guide addresses Certified HIPAA Professional (CHP), examination HIO-201, offered by ecfirst / HIPAA Academy. The issuer describes its scope as HIPAA Administrative Simplification, transactions and code sets, privacy, security and related audit requirements.
How many questions and how much time does the issuer publish?
The issuer publishes 60 questions and a 60-minute examination duration. The available issuer information does not establish a scored-versus-pretest question breakdown.
How is the examination delivered, and are adaptivity or item styles specified?
The issuer states that the examination is delivered online and can be taken worldwide, 24 hours a day. The available issuer information does not establish whether delivery is adaptive or specify the examination’s item styles. This guide’s four-option questions are a learning format.
Which examination distribution governs this guide?
The issuer’s published distribution is HIPAA /HITECH Act/Final Rule/Safe Harbor 22%; Enforcement 10%; HIPAA Privacy 28%; HIPAA Transactions and Code Sets 10%; HIPAA Security 25%; and Other Security Requirements 5%. Concepts are allocated 13, 6, 17, 6, 15 and 3 respectively. Questions and flashcards each use 4, 2, 6, 2, 5 and 1 respectively, approximating those weights.
What dates and outline limitations should candidates recognize?
The distribution was confirmed on October 19, 2026. The linked brochure bears copyright 2026 and filename designation 26A; its availability was confirmed on November 3, 2026. Neither establishes an examination-outline effective date. The complete brochure is the scope reference: it also names collective actions, whistleblowers, False Claims Act accountability, CMMC, HITRUST and HISAA discussion. Inclusion in a course outline does not establish a topic’s legal status or a separate compliance obligation.
ecfirst — Virtual Certified HIPAA Professional · ecfirst — CHP Certification, 26A brochure
Do online and instructor-led offerings represent different CHP examination pathways?
The issuer advertises online study without a live instructor and virtual instruction with a live instructor, while identifying the CHP examination as HIO-201. This guide follows that single credential and examination identity. Course delivery choices should not be treated as evidence of separate examination blueprints.
What passing-score and fee information is established here?
The issuer’s [CHP examination table](https://ecfirst.biz/cyber_ai_bundle) publishes a 75% passing score alongside 60 questions and 60 minutes. It does not establish a scored-versus-pretest question breakdown. Fees depend on the offering; consult the issuer’s current purchasing information for the selected course, examination or renewal package.
CHP is ecfirst / HIPAA Academy’s professional credential addressing United States HIPAA requirements. It is not a government determination that an individual or organization complies with HIPAA. Online and instructor-led course offerings prepare for the same identified CHP examination, HIO-201. The practice questions are independent learning drills and do not predict an examination result.
Outline used: CHP examination HIO-201: issuer's current six-area examination distribution and linked CHP Certification 2P_26A brochure, copyright 2026, reviewed 2026-10-19. Neither source states an examination-outline effective date. The workbook label matches the official credential name.
60 key concepts: understand, apply and avoid the traps
Work through the questions by exam domain. Explain the answer in your own words, try the example, then check the common pitfall.
HIPAA /HITECH Act/Final Rule/Safe Harbor22%
1.When does a health care provider become a HIPAA covered entity?
A health care provider is a covered entity when it transmits health information electronically in connection with a transaction for which HHS has adopted a standard. Providing health care alone does not satisfy this particular coverage test. Electronic billing through a billing service can satisfy it because the service transmits on the provider’s behalf. Distinguish a covered electronic transaction from ordinary electronic communication, such as arranging an appointment by email.
Apply it
A small practice accepts cash but occasionally has its billing company submit electronic insurance claims. Assess the claims transmitted on its behalf when determining coverage; the practice’s preference for cash does not resolve its status.
Common pitfall: Assuming every clinician is automatically covered overlooks the standard-transaction criterion. Assuming outsourced billing avoids coverage overlooks electronic transactions performed on the provider’s behalf.
2.Which organizations qualify as health plans or clearinghouses?
HIPAA identifies health plans and health care clearinghouses as covered-entity categories alongside qualifying providers. Health plans generally provide or pay the cost of medical care, subject to statutory exclusions. Clearinghouses process health information received in a nonstandard format into a standard transaction, or perform the reverse conversion. Classify the organization by its actual function: paying for care, converting transaction formats, and providing treatment are distinct routes into the coverage analysis.
Apply it
A company translates proprietary claim files into standard electronic transactions for several clinics. Its conversion function points toward clearinghouse status. Merely hosting the clinics’ files would require a different analysis of the company’s role.
Common pitfall: Treating every health technology vendor as a clearinghouse confuses handling health information with converting transactions between standard and nonstandard formats for covered-entity purposes.
HHS — Covered Entities and Business Associates · HHS — Summary of the HIPAA Privacy Rule
3.What makes information protected health information?
Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate, subject to defined exclusions. It concerns health status, health care, or payment and identifies the individual or provides a reasonable basis for identification. Protection is not confined to diagnoses or electronic records. A patient-linked billing balance, appointment discussion, or paper referral can be PHI even when it contains little clinical detail.
Apply it
A receptionist leaves a printed list showing patient names and scheduled oncology visits near a public printer. The combination links identifiable people with health care, so evaluate it as PHI despite the absence of diagnoses.
Common pitfall: Looking only for medical results misses identifiable payment and care information. Conversely, HIPAA does not automatically govern every health-related fact held by any organization.
4.How do employment records differ from patient records?
Employment records maintained by a covered entity in its role as employer are excluded from PHI. The same organization can also hold protected patient records about its employees in its role as health care provider. Identify why the record is held and which organizational function maintains it. Health-related content does not alone determine HIPAA status; an occupational personnel file and a treatment chart may receive different legal treatment.
Apply it
A hospital employee receives care in the hospital’s clinic and separately submits a work restriction to human resources. Evaluate the treatment chart as patient information and the employer-maintained restriction as an employment record in context.
Common pitfall: Assuming an employee’s entire record is excluded confuses the hospital’s employer role with its provider role. Other laws may still protect employment information.
5.How do Privacy Rule and Security Rule coverage differ?
The Privacy Rule governs PHI in electronic, paper and oral forms, including permissible uses, disclosures and individual rights. The Security Rule specifically protects electronic PHI through administrative, physical and technical safeguards. Determine the information’s form and the decision being made. A paper disclosure can violate privacy requirements without implicating the Security Rule’s ePHI standards, while an electronic system may require both privacy permissions and security protections.
Apply it
A clinic evaluates an overheard hallway discussion and an exposed electronic patient portal. Apply privacy safeguards to both situations, then examine the portal’s electronic access and security controls under the Security Rule as well.
Common pitfall: Equating HIPAA with cybersecurity overlooks paper and spoken PHI. Equating privacy permission with adequate security overlooks the safeguards required for electronically maintained information.
HHS — Summary of the HIPAA Privacy Rule · HHS — Summary of the HIPAA Security Rule
6.Which service relationships create business-associate status?
A business associate performs covered functions or specified services for a covered entity involving PHI, such as claims processing, billing or certain consulting services. The relationship depends on the work and information involved, rather than the vendor’s preferred label. A business-associate agreement supplies required contractual assurances but does not create permission for unrelated disclosures. First identify the function, then determine whether PHI is created, received, maintained or transmitted for it.
Apply it
A consultant receives identifiable claim records to analyze reimbursement performance for a medical group. Identify the service and PHI access before contracting; calling the consultant an independent contractor does not settle business-associate status.
Common pitfall: A confidentiality clause alone may omit required business-associate terms. A signed agreement also cannot justify sharing PHI for a purpose HIPAA otherwise prohibits.
7.When is a treating provider outside the business-associate relationship?
A covered entity does not need a business-associate agreement merely to disclose PHI to another health care provider for the individual’s treatment. The receiving provider is furnishing care, rather than performing a delegated business service for the sender. Distinguish the purpose of the relationship from the recipient’s professional title. A clinician could separately perform consulting or administrative services that require a different business-associate analysis when PHI is involved.
Apply it
A primary care practice sends relevant records to a specialist treating the patient. Evaluate the treatment disclosure under HIPAA’s treatment provisions. Do not delay solely to obtain a business-associate agreement between the treating providers.
Common pitfall: Requiring agreements for every recipient of PHI creates the wrong boundary. The treatment exception does not automatically cover a provider’s unrelated administrative consulting work.
8.Why can encrypted cloud storage create business-associate obligations?
A cloud service provider that maintains ePHI for a covered entity or business associate is generally a business associate even when the information is encrypted and the provider lacks the decryption key. Maintaining ePHI is enough; the ability to read it is not the decisive criterion. Encryption can reduce confidentiality risk, but availability, integrity, contractual assurances and other applicable Security Rule obligations remain relevant to the cloud arrangement.
Apply it
A clinic encrypts backup files locally and uploads them to a storage vendor that never receives the key. Arrange the required business-associate assurances and assess restoration and availability risks rather than treating encryption as an exemption.
Common pitfall: Confusing unreadability with absence of business-associate status ignores the maintenance function. Encryption addresses particular risks; it does not eliminate the underlying service relationship or obligations.
9.How does the conduit exception differ from persistent storage?
The conduit distinction applies narrowly to transmission services involving only transient access or storage incidental to moving information. A service that persistently maintains ePHI generally cannot rely on that distinction merely because it transports data or rarely views it. Examine the duration and nature of custody. Persistent cloud storage supports business-associate status, while temporary transmission handling may fit the conduit analysis when the service’s actual functions support it.
Apply it
Compare a network carrier forwarding encrypted packets with a vendor retaining patient files for months. The carrier’s transient transport and the vendor’s continuing storage present different relationships, even though both services move electronic information.
Common pitfall: Accepting a vendor’s claim that it is only a conduit overlooks persistent storage. Lack of routine human viewing does not convert maintenance into transient transmission.
10.How do business-associate obligations extend to subcontractors?
A business associate that delegates functions involving PHI to a subcontractor must obtain appropriate assurances through a downstream agreement. The subcontractor’s role is assessed by whether it creates, receives, maintains or transmits PHI for the delegated work. The covered entity ordinarily contracts with its business associate, which manages its own subcontractor relationship. Following the information flow helps identify obligations that a list of direct vendors alone would miss.
Apply it
A billing company hires another firm to store its clinic clients’ identifiable claim archives. Map that storage function and require the billing company’s downstream agreement; the clinic’s original agreement does not automatically cover the subcontractor.
Common pitfall: Stopping the review at the covered entity’s direct vendor misses downstream PHI handling. Subcontracting does not remove the business associate’s responsibility to secure required assurances.
11.What changed when business associates became directly liable?
HITECH and the 2013 Final Rule made business associates directly liable for specified HIPAA duties, including applicable Security Rule requirements, impermissible uses and disclosures, and breach reporting to covered entities. Their exposure is therefore not limited to contractual disputes with customers. Distinguish direct regulatory duties from duties assigned through an agreement. Business associates do not simply inherit every covered-entity Privacy Rule obligation in exactly the same manner.
Apply it
A service provider argues that only its hospital customer can face HIPAA enforcement after the provider exposes ePHI. Evaluate the provider’s own applicable duties and conduct rather than treating the contract as the sole accountability mechanism.
Common pitfall: Treating business associates as contractually accountable only overlooks direct liability. Assuming every covered-entity duty automatically transfers also ignores the specific obligations applicable to business associates.
12.How do recognized security practices affect enforcement?
The recognized-security-practices provision requires HHS to consider qualifying practices adequately demonstrated to have been in place for the preceding 12 months in specified enforcement and audit decisions. Relevant practices include qualifying NIST approaches and other identified cybersecurity practices. The mechanism is consideration of actual implementation, rather than automatic immunity. The statute does not authorize increasing liability simply because an entity did not implement recognized practices or treat a framework document as sufficient implementation.
Apply it
An organization responding to an investigation has dated risk reviews, control records and training evidence showing sustained implementation of qualifying practices. Assemble that evidence for consideration instead of relying only on a recently purchased framework manual.
Common pitfall: Calling this provision complete safe-harbor immunity overstates its effect. A policy adopted after an incident cannot establish that practices operated throughout the preceding 12 months.
13.When can state law remain applicable despite HIPAA preemption?
HIPAA generally preempts contrary state requirements, but important exceptions preserve certain state laws. These include more stringent health-information privacy protections and specified public-health reporting provisions. Analyze whether the requirements actually conflict before applying an exception. HIPAA permission to disclose does not necessarily compel disclosure or displace a more protective applicable state rule. The useful decision sequence is to identify both requirements, determine conflict, and assess the relevant preemption exception.
Apply it
A records office finds that HIPAA permits a proposed disclosure but an applicable state confidentiality rule imposes an additional restriction. Compare the requirements and preemption exceptions before treating the federal permission as the final answer.
Common pitfall: Assuming federal law always erases state privacy rules skips the exceptions. Assuming every state provision controls skips the initial question of conflict and applicable preservation.
Enforcement10%
14.How do civil penalty categories distinguish culpability?
HIPAA civil money penalty categories distinguish lack of knowledge despite reasonable diligence, reasonable cause without willful neglect, and willful neglect with different correction outcomes. The central cues concern what the entity knew or should have known, whether its failure reflected conscious disregard, and whether correction occurred within the applicable period. A harmful outcome alone does not identify the category. Avoid memorizing dollar amounts without accounting for adjustments and the governing penalty framework.
Apply it
Two organizations experience similar disclosures, but one documents reasonable diligence while the other ignored repeated warnings. Analyze their knowledge and conduct separately; similar numbers of affected patients do not establish the same culpability category.
Common pitfall: Classifying solely by incident size confuses consequence with culpability. An absence of actual awareness does not establish the lowest category when reasonable diligence was missing.
15.Why does timely correction matter in willful-neglect cases?
The civil penalty structure distinguishes willful neglect corrected within the applicable 30-day period from willful neglect not corrected within that period. The period is tied to when the entity knew, or through reasonable diligence would have known, of the violation. Correction therefore matters, but it does not transform willful neglect into an innocent mistake. Identify both the original culpability and the correction timeline when reasoning through the applicable category.
Apply it
An organization discovers that managers deliberately left a known compliance failure unresolved. It now documents discovery and corrective action dates. Those dates help distinguish correction categories without erasing the earlier evidence of willful neglect.
Common pitfall: Assuming any eventual repair eliminates penalty exposure ignores the category structure. Measuring only from an investigator’s letter can overlook earlier actual or constructive knowledge.
16.What makes a HIPAA complaint timely and sufficiently specific?
A complaint to the Secretary must identify the person believed to have violated applicable requirements and describe the acts or omissions at issue. It generally must be filed within 180 days after the complainant knew or should have known of the conduct. The Secretary may extend that period for good cause. Distinguish a specific complaint describing conduct and timing from a general expression of dissatisfaction that does not identify an alleged violation.
Apply it
A patient reports that a named clinic disclosed records to an unauthorized recipient four months earlier. Include the recipient, conduct and discovery timing in the complaint rather than submitting only a statement that the clinic is untrustworthy.
Common pitfall: Treating 180 days as an absolute bar overlooks good-cause extensions. Treating any service complaint as a HIPAA complaint overlooks the need to identify relevant conduct.
17.Which complaint-related activities receive protection from retaliation?
A covered entity or business associate may not intimidate, threaten, coerce, discriminate against or take other retaliatory action against a person for protected HIPAA activities. These include filing a complaint, assisting an investigation or proceeding, and reasonable good-faith opposition to unlawful practices under the regulation’s conditions. Separate legitimate workforce management from adverse action motivated by protected participation. A complaint’s inconvenience to the organization does not justify interference with the reporting process.
Apply it
A manager proposes removing an employee from a desirable assignment because the employee supplied information to a HIPAA investigator. Assess the proposed action’s retaliatory motive rather than accepting operational inconvenience as a sufficient justification.
Common pitfall: Protecting only patients overlooks employees and other participants. Protection for reporting also does not authorize unrelated impermissible disclosures of PHI when opposing a practice.
45 CFR 160.316 — Refraining from intimidation or retaliation
18.How can state attorneys general enforce HIPAA?
HITECH authorizes state attorneys general to bring civil actions on behalf of state residents for certain HIPAA violations. This provides an enforcement route in addition to HHS oversight. Distinguish the public official’s statutory authority from a private individual’s assumption that HIPAA automatically supplies a personal damages action. When identifying an enforcement mechanism, focus on who is authorized to act and the legal authority supporting that particular proceeding or remedy.
Apply it
Residents report a provider’s improper disclosures to their state attorney general. Recognize the attorney general’s potential HITECH enforcement authority while separately evaluating any proposed private lawsuit under the legal basis asserted for that lawsuit.
Common pitfall: Assuming HIPAA enforcement belongs exclusively to HHS misses state authority. Assuming that authority automatically creates an equivalent private damages claim confuses different enforcement mechanisms.
19.How can continuing violations affect civil penalty analysis?
Civil penalty analysis considers violations of applicable requirements rather than treating every incident as one undifferentiated event. The regulation addresses repeated violations of an identical requirement and annual limits, with continuing failures potentially producing violations across days. Determining the violated requirement and duration is therefore separate from selecting the culpability category. An organization should document what failed, when the failure began, and when correction occurred instead of assuming one discovery means one violation.
Apply it
A required compliance process remains absent for an extended period before discovery. Build a timeline of the continuing failure and correction; do not assume the matter is counted solely as one event on discovery day.
Common pitfall: Counting affected people alone may miss continuing regulatory failures. Conversely, multiplying every incident feature without identifying the applicable requirement produces unsupported penalty conclusions and estimates.
45 CFR 160.404 — Amount of a civil money penalty · Federal Register :: Request Access
HIPAA Privacy28%
20.When does the minimum necessary standard apply?
The minimum necessary standard generally requires reasonable efforts to limit PHI uses, disclosures and requests to what the purpose requires. Role-based policies can govern routine activity, while nonroutine disclosures need appropriate review criteria. Important exceptions include disclosures to, or requests by, a health care provider for treatment and disclosures to the individual. The treatment exception does not erase reasonable safeguards or give every employee unrestricted internal access to the entire record.
Apply it
A payment analyst requests an entire chart to reconcile one disputed charge. Identify the payment purpose and relevant information before granting access. A separate provider-to-provider treatment request requires a different minimum-necessary analysis under HIPAA.
Common pitfall: Applying minimum necessary identically to treatment disclosures misses an exception. Treating that exception as permission for unrestricted workforce browsing overlooks internal access controls and safeguards.
21.What records and deadlines define the individual access right?
An individual generally may inspect or obtain PHI in a designated record set, including medical and billing records and other records used to make decisions about individuals. Specified exclusions include psychotherapy notes and information compiled for certain legal proceedings. Action is generally required within 30 days of receipt. One extension of up to 30 days requires timely written reasons and a completion date; it is not an automatic second processing period.
Apply it
A patient requests billing records as well as the clinical chart. Include both within the designated-record-set analysis and track receipt. If a qualifying extension is needed, send the required written explanation before the initial deadline.
Common pitfall: Limiting access to the electronic chart can omit covered billing records. Assuming every request automatically allows 60 days ignores the written conditions for a single extension.
45 CFR 164.524 — Access of individuals to protected health information
22.Which costs may be included in an individual’s copying fee?
An individual’s requested copy may carry a reasonable, cost-based fee limited to permitted copying labor, applicable supplies and postage when mailing is requested. An agreed explanation or summary may include preparation costs. Searching for and retrieving records are not permitted copying-fee components under this provision. Distinguish the cost of producing the requested copy from the organization’s general records-management expenses, and match the calculation to the actual format and delivery requested.
Apply it
A clinic proposes charging for locating archived records, copying them and mailing them at the patient’s request. Exclude search and retrieval labor from the access-copy fee while assessing permitted copying and postage costs for reasonableness.
Common pitfall: A state fee schedule does not automatically establish a permissible HIPAA access fee. Adding general administrative overhead can exceed the specific cost components the rule allows.
45 CFR 164.524 — Access of individuals to protected health information
23.How should an entity evaluate and respond to amendment requests?
An individual may request amendment of PHI in a designated record set. Denial grounds include information that is accurate and complete, outside the designated record set, unavailable for inspection under the access rule, or not created by the entity unless the originator is unavailable to act. Respond within 60 days, with one qualifying 30-day extension. A denial requires written information about disagreement and complaint rights; amendment does not mean silently deleting the original record.
Apply it
A patient disputes a note that the clinic determines is accurate and complete. Issue a compliant written denial and explain the statement-of-disagreement process. Do not simply reject the request verbally or erase the contested entry.
Common pitfall: Assuming disagreement guarantees amendment overlooks valid denial grounds. Assuming a denial ends all obligations overlooks written explanations, disagreement procedures and relevant future-disclosure requirements under the rule.
24.When must a paid-in-full restriction be honored?
Covered entities generally need not agree to every requested restriction, but a specific health-plan restriction is mandatory when its conditions are met. The disclosure must be for payment or health care operations, not otherwise required by law, and concern solely an item or service paid in full out of pocket by the individual or someone other than the health plan on the individual’s behalf. The restriction does not automatically prohibit disclosures for treatment.
Apply it
A patient pays a service’s full charge personally and asks the provider not to send that service to the health plan for payment. Confirm the conditions and flag the restricted information before routine billing occurs.
Common pitfall: Treating every restriction as discretionary misses this mandatory case. Treating the restriction as a universal ban overlooks its specific recipient, purpose and service-related conditions under HIPAA.
25.How do confidential communication requests differ for providers and plans?
A covered health care provider must accommodate reasonable requests to communicate by alternative means or at alternative locations. It may not require an explanation of the request’s basis, although appropriate conditions can address payment and contact arrangements. A health plan must accommodate reasonable requests when the individual clearly states that ordinary disclosure could endanger them. Distinguish the provider rule from the plan’s endangerment condition instead of applying a single justification requirement to both.
Apply it
A patient asks a clinic to send appointment correspondence to a post-office box instead of home. Evaluate reasonableness and workable contact arrangements; do not demand an explanation of family circumstances as a condition of accommodation.
Common pitfall: Demanding proof of danger from every provider patient imports the plan-specific condition. A communication preference also differs from restricting whether an otherwise permitted disclosure may occur.
26.What makes an authorization valid and revocable?
A valid authorization identifies the information, authorized discloser, recipient, purpose, expiration and individual’s signature, together with required notices such as revocation rights and potential redisclosure. It must be sufficiently specific to support the proposed use or disclosure. Individuals generally may revoke in writing, subject to exceptions such as action already taken in reliance on it. An authorization is different from a notice acknowledgment and cannot be replaced by a generic permission statement.
Apply it
A records office receives a signed request allowing release to a named insurer but containing no expiration date or event. Obtain a compliant authorization before relying on it for a disclosure that requires authorization under HIPAA.
Common pitfall: A signature alone does not cure missing required elements. Revocation ordinarily affects future reliance and does not undo a disclosure already lawfully made in reliance.
45 CFR 164.508 — Uses and disclosures requiring authorization
27.Which psychotherapy-note and marketing uses require special authorization analysis?
Psychotherapy notes receive special protection and generally require authorization for use or disclosure, subject to defined exceptions such as the originator’s treatment use. They are not synonymous with every mental health entry in the ordinary record. Marketing involving PHI also generally requires authorization, with specified exceptions including face-to-face communications and nominal promotional gifts. Where qualifying third-party financial remuneration is involved, the marketing authorization must state that remuneration is involved.
Apply it
A clinic plans a sponsored patient mailing and separately receives a request for a therapist’s separately maintained session notes. Analyze the marketing remuneration and psychotherapy-note rules individually rather than applying ordinary treatment permissions to both activities.
Common pitfall: Labeling every behavioral health record psychotherapy notes overextends the category. Treating all patient communications as treatment overlooks marketing conditions and any required remuneration disclosure in authorization.
45 CFR 164.508 — Uses and disclosures requiring authorization
28.How does a notice of privacy practices differ from consent?
A notice of privacy practices explains permitted uses and disclosures, individual rights and the covered entity’s duties. A direct-treatment provider generally supplies it no later than first service delivery, with emergency treatment handled as soon as reasonably practicable afterward. The provider makes a good-faith effort to obtain written acknowledgment and documents unsuccessful efforts and reasons. Acknowledgment records receipt; it does not function as blanket authorization for otherwise impermissible uses.
Apply it
A new patient accepts the privacy notice but declines to sign its acknowledgment. Document the good-faith effort and reason if known. Do not recast the acknowledgment as authorization for research, marketing or unrelated disclosures.
Common pitfall: Treating an unsigned acknowledgment as an automatic bar to care misreads the good-faith requirement. Treating a signed acknowledgment as broad consent misstates the notice’s purpose.
29.How can information be de-identified under HIPAA?
HIPAA provides two de-identification methods: a qualified expert’s determination of a very small identification risk, or removal of specified identifiers under the safe-harbor method together with no actual knowledge that remaining information can identify an individual. Removing names alone is insufficient. Dates, geographic detail and other identifiers can preserve identifiability. Distinguish this privacy de-identification safe harbor from the separate recognized-security-practices enforcement provision, which serves a different purpose.
Apply it
An analyst removes patient names but leaves full birth dates, street addresses and record numbers in a research extract. The file has not satisfied the safe-harbor method merely because its most obvious name field is gone.
Common pitfall: Calling a coded dataset anonymous without evaluating retained identifiers overstates protection. A re-identification code must meet applicable conditions rather than embed identifying information in its value.
45 CFR 164.514 — Other requirements relating to uses and disclosures
30.When may a limited data set support a disclosure?
A limited data set excludes specified direct identifiers but may retain information, such as certain dates and geographic elements, that prevents it from being fully de-identified. It remains PHI. HIPAA permits its use or disclosure for research, public health or health care operations with a compliant data use agreement. The agreement restricts uses, recipients, safeguards and identification efforts. Match both the dataset’s contents and the proposed purpose to this distinct pathway.
Apply it
Researchers need service dates and city-level location but no direct identifiers. Assess whether a limited data set and data use agreement meet the project’s needs rather than describing the extract as unrestricted, fully de-identified information.
Common pitfall: A data use agreement cannot authorize arbitrary purposes. Confusing limited data sets with de-identified information overlooks continuing PHI status and the agreement’s restrictions on recipients and uses.
45 CFR 164.514 — Other requirements relating to uses and disclosures
31.Which disclosures belong in an individual’s accounting?
The accounting right generally covers qualifying disclosures during the preceding six years, subject to exclusions such as treatment, payment and health care operations, disclosures to the individual, and authorized disclosures. It is not a complete log of every internal access. Respond within 60 days, with one qualifying 30-day extension. The first accounting in a 12-month period is free; later requests may carry a reasonable cost-based fee after required notice and choice.
Apply it
A patient requests every chart access and disclosure from the past year. Distinguish internal access logs from the HIPAA accounting obligation, identify qualifying disclosures, and provide the required accounting without charging for the first annual request.
Common pitfall: Including every routine treatment disclosure overstates the accounting requirement. Excluding all external disclosures understates it, particularly where disclosures fall outside the rule’s specified exceptions and exclusions.
32.When may PHI be disclosed for public health purposes?
HIPAA permits disclosures to public-health authorities authorized by law to collect information for preventing or controlling disease, injury or disability. Determine the recipient’s authority and the public-health purpose before releasing information. A HIPAA permission is distinct from a separate reporting mandate: the Privacy Rule may permit a disclosure while another law requires it. Apply the relevant minimum-necessary analysis and any applicable legal limits rather than assuming all requests labeled public health qualify.
Apply it
A local health department requests specified information for an authorized disease investigation. Confirm its collection authority and the requested purpose, then assess the appropriate scope instead of sending the clinic’s entire unrelated patient database.
Common pitfall: A requester’s public-health label does not establish authority. Conversely, demanding patient authorization for every authorized public-health report overlooks a specific disclosure pathway permitted by the Privacy Rule.
45 CFR 164.512 — Specified uses and disclosures without authorization
33.How do court orders and subpoenas support different disclosure decisions?
A court or administrative tribunal order permits disclosure of PHI expressly authorized by that order. A subpoena, discovery request or other lawful process without such an order requires the applicable satisfactory assurances concerning notice to the individual or a qualified protective order, or qualifying efforts by the covered entity itself. Identify the document’s legal character and conditions. A subpoena’s formal appearance does not automatically supply the same disclosure authority as a court order.
Apply it
A hospital receives an attorney-issued subpoena without patient authorization, a court order or supporting assurances. Route it for the required notice or protective-order analysis rather than releasing the requested chart solely because the document states a deadline.
Common pitfall: Treating every subpoena as a court order skips HIPAA’s additional conditions. An actual order also does not justify disclosing information beyond what it expressly authorizes.
45 CFR 164.512 — Specified uses and disclosures without authorization
34.What findings support a research authorization waiver?
An IRB or Privacy Board waiver requires documented findings that use or disclosure presents no more than minimal privacy risk, the research could not practicably proceed without the waiver, and it could not practicably proceed without PHI access. Privacy-risk findings include adequate identifier protection, appropriate destruction planning and assurances against improper reuse or disclosure. Scientific value alone is insufficient. Evaluate the privacy findings and both practicability requirements as separate necessary elements.
Apply it
A retrospective study needs identifiable historical records because linking repeated visits is essential. Review documented privacy safeguards and why obtaining authorization and conducting the study without PHI are impracticable before accepting a waiver as the disclosure basis.
Common pitfall: IRB approval of a study does not automatically establish a HIPAA authorization waiver. Convenience or scientific interest alone does not replace the documented waiver criteria.
45 CFR 164.512 — Specified uses and disclosures without authorization
35.How is a potential breach assessed after an impermissible disclosure?
An impermissible use or disclosure of PHI is presumed a breach unless a defined exception applies or a documented assessment demonstrates a low probability that PHI was compromised. Assess the information’s nature and extent, the unauthorized recipient, actual acquisition or viewing, and mitigation. Three exceptions require distinct findings. First, unintentional acquisition, access or use by a workforce member or person acting under a covered entity’s or business associate’s authority must occur in good faith, within that authority, and without further impermissible use or disclosure. Second, an inadvertent disclosure must pass from a person authorized to access PHI at a covered entity or business associate to another authorized person at the same entity or business associate, or within an organized health care arrangement in which the covered entity participates; the information must not be further used or disclosed impermissibly. Third, the covered entity or business associate must have a good-faith belief that the unauthorized recipient could not reasonably have retained the information. Absence of reported harm alone does not establish an exception or low probability of compromise.
Apply it
An authorized billing worker unintentionally opens the wrong account while performing assigned work, acts in good faith within authority, and makes no further impermissible use or disclosure; the first exception can apply. Deliberately opening a neighbor’s record out of curiosity fails that exception’s unintentional, good-faith and authority criteria. For a file sent to the wrong external business, evaluate the exceptions and all four compromise factors; a deletion promise alone is not conclusive.
Common pitfall: Accidental access alone does not establish an exception. A recipient’s promise to delete information differs from a good-faith basis to believe the recipient could not reasonably retain it.
36.Which notifications follow a breach of unsecured PHI?
Covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovery, subject to applicable provisions. Breaches affecting 500 or more individuals require Secretary notification without unreasonable delay and no later than 60 days after discovery. For breaches affecting fewer than 500 individuals, Secretary reports are due no later than 60 days after the end of the calendar year in which discovery occurred; individual notification still follows its discovery-based deadline. Media notice applies when more than 500 residents of a state or jurisdiction are affected. A business associate notifies the covered entity without unreasonable delay and within 60 days after discovery, with required available information.
Apply it
A breach affects exactly 500 individuals, all in one state. Plan individual notification and the larger-breach Secretary reporting route. The media threshold uses more than 500 residents, so that separate threshold is not met. If 499 individuals were affected, individual notice would still follow the discovery-based deadline, while Secretary reporting would be due within 60 days after the discovery year ends.
Common pitfall: Treating 60 days as permission to wait ignores unreasonable delay. Annual Secretary reporting for smaller breaches does not postpone individual notice. Secretary and media notices also use different thresholds.
HHS — Breach Notification Rule · 45 CFR 164.410 — Notification by a business associate
HIPAA Transactions and Code Sets10%
37.Which adopted transaction standards correspond to claims, eligibility, claim status and remittance?
Distinguish these ASC X12N transactions by their business purpose: 837 submits health care claims or equivalent encounter information; 270 requests eligibility and benefit information, and 271 returns the response; 276 requests the status of a submitted claim, and 277 returns claim-status information; 835 communicates health care payment and remittance advice. A claim requests payment, an eligibility exchange checks coverage and benefits, a status exchange follows claim processing, and remittance advice explains payment or adjustments. These mappings concern ASC X12N transactions; retail pharmacy transactions have separately adopted standards.
Apply it
A biller has already submitted a claim and needs its processing status. Which exchange fits: 270/271, 276/277 or 835? Choose 276/277 because the question concerns an existing claim's status. Before a visit, use 270/271 to inquire about eligibility and benefits. Use 837 to submit the claim, and use 835 remittance information to reconcile the payer's payment and adjustments.
Common pitfall: Shared patient and provider identifiers do not make transaction standards interchangeable. A 271 eligibility response does not guarantee payment for a future claim. A 277 claim-status response answers a processing inquiry; an 835 provides payment and remittance information. Identify the business question before selecting the transaction.
38.How do payment, remittance and claim-status transactions differ?
Health care payment and remittance functions concern payment movement and explanation of how a claim was paid or adjusted. Claim-status functions concern where a claim stands in processing. The transaction standards and operating rules support consistent electronic exchange, but the business purposes remain distinct. A provider investigating an adjustment needs the remittance information rather than merely confirmation that processing finished. Identify whether the problem concerns funds, adjudication detail or processing status.
Apply it
A practice receives a deposit smaller than the amount billed and needs the reasons for adjustments. Review the remittance information for the adjudication explanation rather than repeatedly submitting a claim-status inquiry to explain the difference.
Common pitfall: A deposit alone does not explain every claim adjustment. A status response may describe processing progress without providing the remittance detail needed to reconcile payment.
39.Which code sets describe diagnoses, procedures and other claim content?
Adopted code sets standardize the meaning of health information within transactions. ICD-10-CM describes diagnoses, ICD-10-PCS addresses inpatient hospital procedures, and CPT and HCPCS serve relevant procedure, service and supply coding functions. Other adopted sets address areas such as dental services and drugs. Distinguish the code set from the transaction format carrying it. Correct selection depends on what is represented and the care setting, rather than using one coding system for every purpose.
Apply it
An inpatient hospital claim requires diagnosis and inpatient procedure representation. Distinguish ICD-10-CM diagnosis coding from ICD-10-PCS procedure coding instead of treating the shared ICD-10 name as evidence that the systems are interchangeable.
Common pitfall: Confusing a transaction format with a code set mixes message structure with clinical meaning. Confusing diagnosis and procedure systems can produce structurally valid but substantively incorrect claims.
40.What information does a National Provider Identifier convey?
The National Provider Identifier is a unique, 10-position numeric identifier used to identify health care providers in adopted standard transactions. It is intelligence-free: the number itself does not encode specialty, location or other provider characteristics. Identify the provider through the assigned identifier and use appropriate accompanying data for attributes. Possessing an NPI does not by itself establish licensure, credentialing, participation in a payer network or entitlement to payment for a service.
Apply it
A payer analyst tries to infer a provider’s specialty from digits in the NPI. Use appropriate provider information instead; the NPI identifies the provider but its numeric structure does not supply the specialty classification.
Common pitfall: Treating an NPI as a professional license or specialty code assigns meanings the identifier does not carry. A valid identifier alone does not resolve claim coverage.
41.How should historical health-plan identifier terminology be interpreted?
Identifier terminology in an outline can include historical initiatives as well as current requirements. CMS eliminated the Health Plan Identifier requirement, so seeing HPID in training materials does not establish a present obligation to obtain or use one. Distinguish the entity being identified from the legal status of the identifier initiative. Provider identification through NPI and the former HPID requirement concern different entities and must not be treated as interchangeable systems.
Apply it
A project manager adds mandatory HPID collection to a new transaction project because an older workbook lists it. Check the eliminated requirement and distinguish current provider-identifier needs before making that historical term a system prerequisite.
Common pitfall: An outline’s inclusion of an acronym does not prove a current mandate. Substituting an NPI for a health-plan identifier also confuses the entity each identifies.
42.How do information-blocking knowledge standards and exceptions operate?
Information blocking concerns certain practices likely to interfere with access, exchange or use of electronic health information, subject to the rule’s elements. Health care providers have a knowledge standard involving knowing that a practice is unreasonable and likely to interfere. Developers of certified health IT and health information networks or exchanges use a knows-or-should-know standard. Satisfying an exception provides assurance, but failure to satisfy one does not alone establish every element of a violation.
Apply it
A provider restricts electronic exchange and cannot demonstrate an exception. Evaluate the practice, interference and applicable knowledge standard rather than concluding that an unavailable exception automatically proves information blocking or automatically makes the conduct permissible.
Common pitfall: Applying one knowledge standard to every actor misses a key distinction. Treating exceptions as the entire liability test ignores the underlying definition and required elements.
HIPAA Security25%
43.What information belongs within an enterprise-wide risk analysis?
Risk analysis must address all ePHI the organization creates, receives, maintains or transmits, across relevant locations, systems and workflows. The scope is broader than the primary electronic health record or the systems managed directly by central IT. Inventorying ePHI flows helps identify overlooked cloud services, portable devices, backups and departmental applications. Scope is the first discriminating issue: an elegant assessment cannot adequately characterize risk if important ePHI environments were excluded.
Apply it
A hospital’s assessment covers its main record system but omits a department’s cloud scheduling export containing patient details. Add that ePHI environment and its information flows before treating the analysis as enterprise-wide or complete.
Common pitfall: Equating an EHR assessment with the organization’s full risk analysis overlooks other ePHI. Outsourcing a system also does not remove its information flow from consideration.
44.How do threats, vulnerabilities, likelihood and impact form risk?
A threat is a potential cause of an adverse event, while a vulnerability is a weakness that a threat can exploit or trigger. Risk analysis considers the likelihood of the event and its potential impact on ePHI confidentiality, integrity or availability. Merely listing weaknesses does not complete the reasoning. Connect each weakness to plausible events, existing controls and consequences so that resulting risk determinations support defensible priorities and corrective actions.
Apply it
An unpatched server supports patient access. Identify exploitation as a threat event, the missing patch as a vulnerability, and potential disclosure or outage as impacts. Consider existing controls when assessing likelihood and prioritizing remediation.
Common pitfall: Treating every weakness as equally urgent ignores likelihood and impact. A clean vulnerability scan also cannot establish that all administrative, physical and operational risks are controlled.
45.How does risk management convert analysis into safeguards?
Risk management implements security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. The analysis identifies and evaluates risk; management selects, implements and follows through on responses. Decisions should reflect the organization’s circumstances and the assessed threats to ePHI. A documented risk register is therefore a starting point rather than completion. Track responsible owners, practical measures and whether implemented controls actually address the identified exposure.
Apply it
An assessment identifies excessive access to exported patient files. Assign responsibility, restrict permissions and verify the change. Recording the issue as high risk without implementing a response does not accomplish the risk-management objective.
Common pitfall: Purchasing a security product without connecting it to identified risk may miss the problem. Documenting acceptance alone does not establish that remaining risk is reasonable and appropriate.
46.How should an addressable implementation specification be evaluated?
Addressable does not mean optional. The organization assesses whether the specification is reasonable and appropriate in its environment, considering its contribution to protecting ePHI. If appropriate, implement it. If not, document why and implement an equivalent alternative when reasonable and appropriate. The decision must still satisfy the applicable standard. Required specifications must be implemented; addressable specifications require a reasoned implementation decision rather than automatic adoption or automatic omission without analysis.
Apply it
A clinic considers omitting an addressable control because of its size. Assess the actual risk and feasible protection, document the conclusion, and implement the specification or an appropriate equivalent rather than recording only that the clinic is small.
Common pitfall: Treating addressable as elective skips the assessment and documentation. Treating every specification as universally required also ignores the rule’s structured flexibility for reasonable alternative measures.
HHS — Addressable and Required Implementation Specifications
47.How should workforce access change with roles and departures?
Workforce security and information-access management address who may access ePHI and under what authority. Appropriate authorization, supervision and role-based access help prevent access unrelated to assigned duties. Termination procedures address ending access when employment or another workforce arrangement ends, subject to the applicable addressable specification. Follow the entire access lifecycle: approval, role changes and departure. A person’s continuing technical ability to sign in does not establish continuing authorization to use patient information.
Apply it
An employee transfers from billing to facilities but retains broad claim-system privileges. Review the new role and remove unnecessary access instead of waiting for employment termination; role changes can invalidate previously appropriate permissions as well.
Common pitfall: Reviewing access only when someone leaves misses internal transfers. Calling termination procedures addressable does not justify leaving former workers’ access active without a documented, reasonable decision.
48.Why must security awareness extend beyond initial orientation?
The Security Rule requires a security awareness and training program for the workforce, including management. Relevant implementation specifications address security reminders, malicious software, login monitoring and password management. Effective training connects personnel behavior to the organization’s actual risks and procedures. A single orientation presentation cannot establish that staff understand later threats or changed workflows. Distinguish workforce education from technical controls: training supports protection but does not replace appropriate system safeguards or access management.
Apply it
After changing its remote-access process, a practice gives affected staff targeted instructions and reminders about suspicious sign-in requests. Management participates because its access and authority create security exposure alongside that of other workforce members.
Common pitfall: Training only clinical staff overlooks managers and other ePHI users. Relying on awareness alone also leaves technical weaknesses unresolved when staff make foreseeable mistakes or encounter attacks.
49.How does incident response differ from breach notification?
Security incident procedures identify and respond to suspected or known incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes. A security incident does not automatically establish a reportable breach, and uncertainty about breach status should not delay necessary containment. Investigate what happened, preserve useful evidence and evaluate affected information. The separate Breach Notification Rule determines whether notification is required after applying its definitions, exceptions and risk-assessment framework.
Apply it
Unusual account activity suggests unauthorized access to a patient system. Disable the compromised access and investigate promptly while separately assessing whether PHI was compromised. Do not wait for a final notification decision before containing the incident.
Common pitfall: Treating every alert as a confirmed breach overstates the evidence. Treating an unconfirmed breach as no incident at all delays response, mitigation and documentation obligations.
45 CFR 164.308 — Administrative safeguards · 45 CFR 164.402 — Breach definitions
50.Which contingency measures protect availability during disruption?
Contingency planning includes required data backup, disaster recovery and emergency-mode operation planning. These address preserving retrievable copies, restoring lost data and maintaining critical protection during emergency operations. Testing and revision procedures and application/data criticality analysis are addressable specifications requiring appropriate assessment. A backup’s existence does not prove that restoration will work or that essential workflows can continue. Evaluate recovery capability and operational needs rather than equating storage replication with a complete contingency plan.
Apply it
A ransomware exercise shows that backups exist but staff cannot restore the scheduling system or operate essential workflows safely. Improve recovery and emergency-mode arrangements rather than reporting contingency readiness solely from successful nightly backup jobs.
Common pitfall: Backing up data without verifying usable recovery leaves availability uncertain. Treating testing as optional without assessment misunderstands the addressable designation and the organization’s contingency-planning responsibilities.
51.When should technical and nontechnical security evaluations occur?
The Security Rule requires periodic technical and nontechnical evaluation of compliance with its requirements, initially based on implemented standards and later in response to environmental or operational changes affecting ePHI security. Evaluation asks whether policies and safeguards remain effective and aligned with requirements. It is related to, but not identical with, risk analysis. A major system migration or workflow change can justify reevaluation even if a calendar-based review was recently completed.
Apply it
A medical group moves its records to a cloud platform shortly after its annual review. Evaluate the new controls, responsibilities and workflows rather than waiting another year because the previous assessment still appears current by date.
Common pitfall: Equating evaluation with a penetration test omits nontechnical requirements. Treating a completed annual review as sufficient after major change overlooks the change-responsive component of evaluation.
52.How do facility and workstation safeguards reduce exposure?
Physical safeguards address access to facilities, equipment and workstations where ePHI is used or maintained. Facility access controls protect systems while allowing properly authorized access, including appropriate contingency arrangements. Workstation-use and workstation-security policies address acceptable functions, surroundings and physical access. Assess the actual environment: a secure application can still expose patient information when a public-facing screen, unattended workstation or uncontrolled equipment room permits inappropriate observation or use by others.
Apply it
A registration workstation faces a crowded waiting area and remains accessible when staff leave briefly. Reconsider screen placement, physical access and workstation procedures rather than assuming application passwords alone resolve the environmental exposure to patients’ information.
Common pitfall: Focusing exclusively on server rooms overlooks everyday workstations. Physically locking a room also does not establish that people inside it have appropriate electronic access permissions.
53.What must happen before electronic media are reused?
Device and media controls govern hardware and electronic media containing ePHI as they enter, leave or move within an organization. The media-reuse specification requires procedures to remove ePHI before media are made available for reuse. Disposal is a separate required specification. Deleting a visible file or reassigning a device does not necessarily remove recoverable information. Select and verify a removal process appropriate to the media and intended reuse or disposition.
Apply it
A clinic plans to give retired laptops to another department. Follow and verify the established ePHI-removal procedure before reassignment instead of merely deleting patient folders and assuming the next user cannot recover their contents.
Common pitfall: Confusing file deletion with verified removal can leave recoverable PHI. Treating media reuse as merely addressable also overlooks its required implementation-specification status under the Security Rule.
54.How do access controls support authorized use and emergency access?
Technical access controls allow only authorized persons or software programs to access ePHI. Unique user identification supports attribution, while emergency-access procedures provide necessary access during emergencies. Other implementation specifications, including automatic logoff and encryption/decryption, require their applicable addressable analysis. Match controls to both ordinary workflows and exceptional situations. A system that blocks all emergency access may undermine availability, while a permanently shared unrestricted account weakens accountability and access limitation.
Apply it
A hospital designs emergency chart access for urgent situations. Provide an authorized emergency workflow with attributable use instead of distributing a universal password that remains available for routine browsing by everyone in the department.
Common pitfall: Emergency access does not justify anonymous routine access. Automatically omitting addressable access controls without assessment also ignores the need to satisfy the underlying access-control standard.
55.How do audit controls and integrity safeguards serve different purposes?
Audit controls record and support examination of activity in systems containing or using ePHI. Integrity safeguards protect ePHI against improper alteration or destruction. Logs can help investigate a change, but logging alone does not prevent or detect every integrity failure. Identify whether the problem concerns visibility into activity, reliability of the information, or both. Pair appropriate monitoring with controls that address unauthorized changes and evaluate whether recorded events are actually usable.
Apply it
A practice can see who opened a chart but cannot determine whether an imported result was altered incorrectly. Assess integrity protections as well as audit capability; an access log alone does not verify the result’s reliability.
Common pitfall: Equating stored logs with complete security overlooks review and other safeguards. Equating accurate data with authorized access also confuses integrity with confidentiality and access-control objectives.
56.How do authentication and transmission safeguards protect different boundaries?
Person or entity authentication verifies that someone seeking ePHI access is who they claim to be. Transmission security protects ePHI against unauthorized access while it travels over electronic communications networks, with integrity and encryption specifications evaluated under their applicable status. Successful authentication does not make an insecure transmission safe, and encryption does not establish the recipient’s identity. Identify whether the control verifies identity, protects data movement, or contributes to both functions.
Apply it
A clinic confirms a recipient’s identity but sends records through an inadequately assessed channel. Evaluate transmission protection separately. Conversely, a strongly encrypted channel still requires assurance that the intended, authorized recipient controls the receiving account.
Common pitfall: Treating a password as proof that data are protected in transit mixes separate controls. Treating encryption as automatic recipient authorization makes the opposite mistake in security analysis.
57.How long must security documentation remain usable and current?
Required Security Rule documentation must be retained for six years from creation or the date it was last in effect, whichever is later. It must be available to those responsible for implementation and reviewed periodically, with updates reflecting relevant environmental or operational changes. Retention is therefore more than keeping an old file. Distinguish this documentation requirement from medical-record retention obligations, which are not established by the Security Rule’s six-year documentation period.
Apply it
A remote-access policy created eight years ago remained effective until last month. Calculate retention from when it was last in effect, and ensure staff can access the replacement policy rather than relying on the original creation date.
Common pitfall: Applying six years automatically to patient-record retention confuses different obligations. Keeping a policy that implementers cannot access also fails the documentation availability requirement despite long retention.
Other Security Requirements5%
58.What do the six NIST CSF 2.0 functions organize?
NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes through Govern, Identify, Protect, Detect, Respond and Recover. The functions describe complementary areas of risk management rather than a rigid sequence completed once. Governance informs how an organization directs the other functions, while identification, protection, detection and response/recovery capabilities address different needs. Use the functions to locate capability gaps; a strong preventive control does not establish readiness to detect incidents or restore disrupted services.
Apply it
A practice funds access protection but has little incident monitoring or restoration capability. Map these gaps to Detect and Recover so leadership sees why expanding preventive tools alone does not address the entire cybersecurity program.
Common pitfall: Treating the functions as one-time project phases overlooks continuous activity. Treating the framework as a HIPAA compliance certificate also overstates what its outcomes establish by themselves.
59.Why does the NIST Govern function change leadership discussions?
The Govern function emphasizes establishing, communicating and monitoring cybersecurity risk-management strategy, expectations and policy. It places cybersecurity within organizational decision-making rather than confining it to technical operations. Leadership needs visibility into responsibilities, priorities and risk context to direct the other functions effectively. A control can operate technically while accountability remains unclear. The discriminating cue is whether the decision concerns organizational direction and oversight rather than execution of a particular protective or detective activity.
Apply it
Department leaders disagree about who accepts residual risk in a shared patient platform. Address responsibilities and decision authority through governance instead of asking the technical team to resolve the organizational question by purchasing another security tool.
Common pitfall: Delegating all cybersecurity decisions to technicians leaves leadership responsibilities unresolved. Calling every technical control governance also obscures the difference between organizational direction and operational execution of safeguards.
NIST — Release of Cybersecurity Framework 2.0 · NIST CSWP 29 — The NIST Cybersecurity Framework 2.0
60.How do Current and Target Profiles support improvement and audit evidence?
A NIST CSF Organizational Profile describes cybersecurity posture using selected framework outcomes. Under section 3.1, a Current Profile documents outcomes an organization is achieving or attempting to achieve and characterizes how or to what extent each is achieved. It therefore records actual implementation status, including partial progress and remaining limitations. A Target Profile describes desired outcomes based on organizational objectives and risk context. Comparing the Profiles identifies gaps and informs prioritized action plans. Connect current-state claims to evidence: recording an attempted or partially implemented outcome does not establish completed implementation.
Apply it
A clinic’s Target Profile includes tested recovery capability. Its Current Profile records an implemented backup process, a drafted restoration procedure and the absence of successful restoration evidence. Record that partial progress and remaining gap, assign improvement work, and update the implementation status when testing supplies evidence.
Common pitfall: Excluding attempted outcomes hides useful current-state information. Reporting a partial implementation as complete overstates capability. A Target Profile’s desired outcome is not evidence that the outcome has been achieved.
What to focus on during revision
The following are CertMedbry study suggestions. Use the official outline to check the full scope of your examination.
- Classify the actor, information, purpose and applicable rule before deciding whether HIPAA permits an activity.
- Distinguish covered-provider criteria, business-associate functions, treatment relationships, persistent cloud storage and downstream subcontractors.
- Master individual-rights contrasts: access versus amendment, mandatory paid-in-full restrictions, confidential communications and accounting.
- Separate disclosure permission, minimum necessary, authorization requirements and reasonable safeguards.
- Work through breach exceptions, the four compromise-assessment factors and the different individual, Secretary, media and business-associate notification rules.
- Connect enterprise-wide ePHI risk analysis to implemented safeguards, including documented addressable-specification decisions.
- Identify transactions by purpose, separate code sets from transaction formats, and distinguish current identifiers from historical HPID terminology.
- Use NIST functions and Profiles to explain cybersecurity gaps, while consulting the complete issuer outline for additional enforcement and framework topics.
A practical preparation plan
1. Establish the examination scope
Read the six-area distribution and the complete 2026 CHP brochure. Map these 60 selected concepts to the official outline, then identify additional named topics requiring study, including collective actions, False Claims Act accountability, CMMC, HITRUST and HISAA discussion.
2. Build a rule-and-actor map
For each scenario, identify the organization’s role, whether the information is PHI or ePHI, the purpose of the activity and the applicable rule. Practise distinctions involving employment records, treatment providers, cloud storage and subcontractors.
3. Compare individual rights side by side
Create a compact comparison of access, amendment, restrictions, confidential communications and accounting. Include each right’s scope, denial or accommodation criteria, applicable deadlines and any permitted fees. Explain why a similar-looking right would lead to a different response.
4. Practise disclosure and breach decisions
Work through authorization, minimum necessary, public-health requests, judicial process and research waivers. For potential breaches, assess exceptions and all four compromise factors before selecting notification recipients and timelines.
5. Translate risks into operational controls
Trace ePHI through systems and vendors, identify threats and vulnerabilities, and justify safeguards. Explain required versus addressable specifications, recovery capability, incident response, media reuse and usable documentation.
6. Use the drills for explanation-based review
Answer the 20 questions before reading explanations, then explain why each alternative is less appropriate. Use the flashcards for active recall and revisit the relevant primary source when your reasoning misses a condition, exception or discriminating cue.
Use your sample score as a starting point
The free set contains 20 original practice questions. It is a small learning sample, not an official examination or a validated pass prediction. Review each explanation and its source before moving to another topic.
Start the free sampleOfficial sources and updates
- ecfirst — CHP Certification Online
- ecfirst — Virtual Certified HIPAA Professional
- ecfirst — CHP Certification, 26A brochure
- HHS — Covered Entities and Business Associates
- HHS — Summary of the HIPAA Privacy Rule
- HHS — Guidance on HIPAA and Cloud Computing
- 42 U.S.C. 17941 — Recognition of security practices
- 45 CFR 160.316 — Refraining from intimidation or retaliation
- 45 CFR 160.306 — Complaints to the Secretary
- HHS — Minimum Necessary Requirement
- 45 CFR 164.524 — Access of individuals to protected health information
- 45 CFR 164.526 — Amendment of protected health information
- 45 CFR 164.522 — Rights to request privacy protection
- 45 CFR 164.402 — Breach definitions
- HHS — Breach Notification Rule
- CMS — Adopted Standards and Operating Rules
- CMS — National Provider Identifier Standard
- HHS — Guidance on Risk Analysis
- HHS — Addressable and Required Implementation Specifications
- HHS — Summary of the HIPAA Security Rule
- 45 CFR 164.308 — Administrative safeguards
- 45 CFR 164.310 — Physical safeguards
- NIST — Release of Cybersecurity Framework 2.0
- HHS — Direct Liability of Business Associates
- HHS — Business Associates
- 45 CFR 160.404 — Amount of a civil money penalty
- HHS — State Attorneys General
- 45 CFR 164.520 — Notice of privacy practices
- 45 CFR 164.514 — Other requirements relating to uses and disclosures
- 45 CFR 164.528 — Accounting of disclosures
- 45 CFR 164.508 — Uses and disclosures requiring authorization
- CMS — HPID
- 45 CFR 164.316 — Policies, procedures and documentation
- NIST CSWP 29 — The NIST Cybersecurity Framework 2.0
- 45 CFR 160.203 — General rule and exceptions
- 45 CFR 164.530 — Administrative requirements
- 45 CFR 164.512 — Specified uses and disclosures without authorization
- 45 CFR 164.410 — Notification by a business associate
- HealthIT.gov — Information Blocking
- CHP%20FAQ.pdf
- Federal Register :: Request Access
- 0556282.pdf
- NPI Files
- Federal Register :: Request Access
Confirm current eligibility, fees, scheduling and policies directly with the examination provider. CertMedbry is independent and is not endorsed by these organisations. How we handle content and corrections.