Healthcare Administration & Management · Independent exam preparation
CHPS Privacy and Security Decision Guide Study Guide
Practise disclosure decisions, patient rights, security controls, and breach assessment with 60 CHPS concepts, realistic questions, and focused recall cards.
By CertMedbry · Updated 3 November 2026
Practise deciding whether information may be disclosed, which patient rights apply, how safeguards address specific risks, and when an incident requires notification. This selective guide develops those decisions through 60 concepts, 20 original questions, and 20 flashcards. AHIMA's complete CHPS content outline defines the full examination scope. Legal examples address U.S. HIPAA requirements; additional applicable confidentiality laws must be evaluated when present.
Try 20 free practice questionsWhat is the exam format?
Check the question types, timing and outline before planning your revision.
Which credential and professional level does this guide address?
This guide addresses AHIMA's Certified in Healthcare Privacy and Security (CHPS), a professional credential for comprehensive healthcare privacy and security program management. It is not a nursing examination or clinical practice license. AHIMA's page and the outline's shortened title, Certified Healthcare Privacy Security, identify the same credential rather than separate examinations.
Certified in Healthcare Privacy and Security (CHPS) | AHIMA · CHPS Content Outline, effective September 1, 2022
Do different eligibility routes lead to different CHPS examinations?
AHIMA lists alternative eligibility combinations involving education, specified credentials, and healthcare privacy or security experience. These routes lead to the same CHPS credential and examination. This guide therefore follows one coherent CHPS outline rather than treating eligibility routes as separate examination variants.
How many questions are scored, and how much examination time is allowed?
AHIMA lists 150 total items: 125 scored items and 25 pretest items. Pretest items are randomly distributed and do not contribute to the score. The allowed examination time is three and a half hours. Candidates should give every item their best response because the published specifications do not identify pretest items for candidates.
How is the examination delivered, and is it adaptive?
AHIMA lists computer-based delivery at Pearson VUE testing centers and OnVUE remote proctoring. Its current page specifically describes the remote option for candidates located in the United States. Candidates may move between items after selecting an answer, flag items, and review before submission as time permits. The supplied specifications do not establish adaptive testing, so no adaptive format is assumed here.
Which item styles are verified, and how should these practice questions be used?
AHIMA describes a variety of questions or item types requiring candidates to select the best answer using knowledge, skills, or experience. The supplied specifications do not enumerate every item style. This guide's 20 questions are independent, four-option, single-best-answer learning drills. Their results identify study needs and do not predict an examination pass.
Which blueprint applies, and how is this guide distributed?
The linked outline is effective September 1, 2022, carries a 2023 copyright, and has an October 18, 2023 filename date. AHIMA still linked that outline in the supplied November 3, 2026 evidence; the filename date is not a new effective date. The four domain ranges are 10–18%, 30–40%, 24–35%, and 19–24%. Concepts allocate 9, 21, 18, and 12 entries; questions and flashcards each allocate 3, 7, 6, and 4 entries. These selections fall within the ranges but do not replace the full outline.
CHPS Content Outline, effective September 1, 2022 · Certified in Healthcare Privacy and Security (CHPS) | AHIMA
What passing score and examination resources does AHIMA specify?
AHIMA lists a passing score of 300, which should not be interpreted as a percentage correct. The certification page states that no books or other resources are required for examination day. Use AHIMA's current candidate instructions for appointment requirements and permitted materials.
Which version of the HIPAA Security Rule is taught?
Security concepts follow the rule currently in effect in the cited HHS summary and regulations. HHS separately identifies proposed Security Rule modifications. A proposal should not be treated as an operative requirement merely because it appears alongside current guidance.
CHPS recognizes professional expertise in managing healthcare privacy and security programs. These independently authored CertMedbry learning materials are not official AHIMA questions or endorsed preparation materials. The official outline establishes examination scope; the cited regulations and HHS guidance support the legal mechanisms taught here.
Outline used: AHIMA CHPS Content Outline, effective September 1, 2022, © 2023, filename dated October 18, 2023; linked from AHIMA's current CHPS certification page on October 19, 2026. The certification page uses Certified in Healthcare Privacy and Security; the outline abbreviates the same credential's name as Certified Healthcare Privacy Security.
60 key concepts: understand, apply and avoid the traps
Work through the questions by exam domain. Explain the answer in your own words, try the example, then check the common pitfall.
Ethical, Legal, and Regulatory Issues/Environmental Assessment10–18%
1.How do privacy and security officer responsibilities differ?
The privacy official develops and implements the covered entity's privacy policies and procedures. The security official holds corresponding responsibility for Security Rule policies and procedures. Their work overlaps when an event involves both inappropriate disclosure and compromised electronic safeguards. Assign responsibility by the obligation involved, then coordinate investigation, policy changes, and operational implementation. Naming an officer establishes accountability; it does not remove responsibilities from managers and workforce members who carry out the procedures.
Apply it
A clinic discovers employees sharing passwords and discussing patient information in public areas. The security official addresses account controls, while the privacy official addresses disclosure practices. Together they assign corrective actions and verify implementation by department managers.
Common pitfall: Treating every confidentiality problem as an IT issue overlooks spoken and paper disclosures. Designating an officer also does not transfer all operational duties to that person.
45 CFR 164.530 — Administrative requirements · 45 CFR 164.308 — Administrative safeguards
2.Which information falls under Privacy Rule and Security Rule protection?
The Privacy Rule protects individually identifiable health information held or transmitted by covered entities and business associates, subject to its definitions and exclusions, across electronic, paper, and oral forms. The Security Rule specifically protects electronic PHI. Determine both the organization's regulated role and the information involved before selecting obligations. A paper chart can present a privacy violation even though technical Security Rule controls do not directly govern the paper itself.
Apply it
An employee leaves a printed appointment list in a public elevator and stores its electronic original on a shared drive. Evaluate the paper disclosure under privacy requirements and the electronic file's access safeguards under security requirements.
Common pitfall: Assuming HIPAA protects only electronic records misses oral and paper PHI. Conversely, health-related information is not automatically HIPAA PHI in every holder's hands.
Summary of the HIPAA Privacy Rule · Summary of the HIPAA Security Rule
3.How should an officer translate a legal requirement into an operational policy?
Begin by identifying the regulated actor, affected information, triggering activity, and whether the provision requires, permits, or conditions an action. Convert those elements into a procedure with an owner, necessary evidence, decision criteria, and documentation. Distinguish legal requirements from accreditation expectations and organizational choices. For example, HIPAA permission to disclose information does not itself create a universal duty to disclose. A usable policy preserves the conditions attached to the underlying permission.
Apply it
A department proposes a policy stating that any request from another hospital must be fulfilled. The officer replaces that blanket instruction with steps identifying the disclosure purpose, recipient authority, applicable legal permission, and necessary supporting documentation.
Common pitfall: Copying a legal heading into a policy leaves staff without decision criteria. Organizational preference also cannot convert a conditional permission into an unconditional legal obligation.
CHPS Content Outline, effective September 1, 2022 · Summary of the HIPAA Privacy Rule
4.When does a more stringent state privacy law prevail?
Compare the actual state and HIPAA provisions rather than assuming federal law always displaces state law. A state provision can be more stringent when it provides greater privacy protection or greater individual rights, such as faster access. If provisions are compatible, comply with both. If a more stringent state privacy provision is contrary to HIPAA, the Privacy Rule's preemption exception can preserve it. The analysis concerns the particular requirement, not an entire statute.
Apply it
A hypothetical state law requires access sooner than HIPAA's applicable deadline. The organization's access procedure must satisfy the shorter state period while preserving other HIPAA protections. Staff should not use the federal deadline to justify the delay.
Common pitfall: Choosing whichever law is easier reverses the analysis. A stronger state access right can be more stringent even though it expands disclosure to the individual.
How do I know if a state law is more stringent than the HIPAA Privacy Rule?
5.How does disclosure purpose govern health information exchange access?
An exchange is a mechanism for sharing information, not an independent permission to access every participating patient's record. Identify the user's role and the purpose of each use or disclosure. HIPAA generally permits provider treatment disclosures without authorization, and its minimum necessary standard does not apply to disclosures to or requests by providers for treatment. Other applicable restrictions still require evaluation. Technical connectivity therefore must be paired with purpose-based authorization and appropriate safeguards.
Apply it
An exchange participant requests a patient's records for active treatment, while a researcher seeks the same records for a study. Evaluate the treatment request under treatment permissions and require a separate applicable research pathway for the study.
Common pitfall: Exchange membership does not establish a treatment relationship or research permission. The treatment minimum necessary exception also does not authorize curiosity access by participating staff.
Summary of the HIPAA Privacy Rule · CHPS Content Outline, effective September 1, 2022
6.Which governance questions matter before joining an information exchange?
Evaluate what information flows through the exchange, who operates it, whose functions it performs, and which participants receive information for their own purposes. These facts determine business associate relationships and appropriate agreements. Governance should also define access approval, audit responsibilities, incident reporting, and termination handling. A participation agreement can coordinate responsibilities, but its existence alone does not establish every required HIPAA safeguard or make an otherwise impermissible disclosure lawful.
Apply it
A hospital joins a regional exchange operated by a vendor on participants' behalf. It maps the vendor's functions, evaluates the business associate relationship, and assigns responsibility for access reviews and incident escalation before enabling production connections.
Common pitfall: Treating every exchange participant as the hospital's business associate ignores independent treatment relationships. Contract labels cannot replace analysis of the services and information involved.
Business Associate Contracts · CHPS Content Outline, effective September 1, 2022
7.How long must required Security Rule documentation be retained?
Required Security Rule documentation must be retained for six years from creation or the date it last was in effect, whichever is later. Written electronic records are acceptable. Documentation must remain available to those implementing the procedures and be updated as environmental or operational conditions change. This requirement concerns compliance documentation; it does not establish a universal medical record retention period. Additional applicable retention obligations must be evaluated for their own record categories.
Apply it
A security policy created in 2025 remains effective until replacement in 2029. Its HIPAA documentation retention period runs from its last effective date, making 2035 the relevant six-year endpoint, subject to any longer applicable requirement.
Common pitfall: Counting only from creation can destroy a long-used policy too early. Applying the six-year documentation rule to every patient record confuses different retention obligations.
8.When may PHI be disclosed to a public health authority?
HIPAA permits disclosures without individual authorization to public health authorities legally authorized to collect or receive information for preventing or controlling disease, injury, or disability. Verify the recipient's role and the purpose and authority supporting the request. Apply minimum necessary requirements when applicable; reasonable reliance on a public official's representation may help establish the necessary scope. Permission to support public health does not create equivalent permission to release identifiable information to the public.
Apply it
During an outbreak, a verified public health department requests specified patient information for an authorized investigation. The officer documents the authority and scope, then sends the appropriate information through the organization's approved protected communication process.
Common pitfall: An urgent request does not establish public health authority by itself. A reporter seeking outbreak details is not equivalent to an authorized public health investigator.
HIPAA Privacy in Emergency Situations · 45 CFR 164.514 — Other requirements relating to uses and disclosures
9.Why do privacy safeguards continue during an emergency?
An emergency does not automatically suspend the Privacy Rule. Existing permissions can support treatment, public health activities, and certain other emergency disclosures, while reasonable safeguards continue. Any actual waiver has defined legal conditions and scope; staff should not infer one from a disaster declaration alone. The practical decision is to identify the applicable disclosure pathway and preserve feasible protections, rather than choosing between refusing all information sharing and releasing information without limits.
Apply it
A hospital activates disaster operations and moves registration to a temporary area. Staff continue treatment-related sharing while shielding lists from public view and checking disclosure purposes. They do not announce unrestricted access to all patient information.
Common pitfall: Treating disaster activation as a blanket waiver removes protections that remain operative. Refusing all emergency sharing also overlooks permissions already built into HIPAA.
Privacy and Security Program Management and Administration30–40%
10.How should a direct treatment provider deliver its privacy notice?
A covered provider with a direct treatment relationship generally must provide its Notice of Privacy Practices no later than the first service delivery. For nonemergency encounters, it must make a good faith effort to obtain written acknowledgment of receipt. If acknowledgment is not obtained, document the effort and why acknowledgment was not obtained. When emergency treatment delays notice, provide the notice as soon as reasonably practicable after the emergency treatment situation. In that emergency circumstance, no good faith effort to obtain written acknowledgment is required. Maintain required notice availability and posting, including applicable website posting. Acknowledgment confirms receipt; it is not authorization for disclosures.
Apply it
At a nonemergency first visit, a patient accepts the notice but refuses to sign. Registration documents its acknowledgment request and the refusal; the clinic continues care. Separately, a hospital provides emergency treatment before delivering its notice. It delivers the notice as soon as reasonably practicable after the emergency treatment situation, without requiring staff to seek written acknowledgment or document an unsuccessful acknowledgment effort for that emergency-delayed notice.
Common pitfall: Do not carry the nonemergency acknowledgment-effort requirement into an emergency situation that delayed notice. The exception removes the required acknowledgment effort, while the obligation to deliver the notice afterward remains. Do not condition treatment on signing an acknowledgment or assume that posting alone satisfies the first-service notice delivery obligation.
11.Which records belong in a designated record set?
A designated record set includes covered providers' medical and billing records and other qualifying records used, in whole or in part, to make decisions about individuals. Health plans have additional specified record categories. Determine scope by the records' function and applicable definition rather than their location or department name. This mapping supports access and amendment workflows. A record maintained by a service provider on the organization's behalf does not become irrelevant simply because it is stored externally.
Apply it
A hospital keeps clinical notes in its EHR and billing records with a contractor. When defining its designated record set, it maps both repositories and establishes a coordinated process for responding to the patient's qualifying records request.
Common pitfall: Equating the designated record set with the EHR misses billing and other decision records. Conversely, every operational document is not automatically part of that set.
12.How do unpaid treatment charges affect patient access?
A covered provider cannot deny an individual's record copy because treatment charges remain unpaid. Medical and billing records generally fall within the access right, subject to applicable exceptions. Distinguish outstanding care charges from any permitted copying fee. HHS allows reasonable copying and mailing costs under the applicable access rules and excludes search or retrieval charges. The key decision is whether a lawful access limitation applies, rather than whether the account is financially settled.
Apply it
A patient with an overdue treatment balance requests copies of medical and billing records. The access team processes the request under its established access procedure and does not make payment of the treatment debt a prerequisite.
Common pitfall: Using records as debt-collection leverage violates the access principle. Permitted copying costs do not create authority to demand payment of unrelated treatment charges.
13.When may an amendment request be denied?
A covered entity may deny amendment when the information is accurate and complete, outside the designated record set, unavailable for inspection under the access rule, or created elsewhere unless the originator is no longer available to act. Act within 60 days, with one qualifying extension of up to 30 days. A denial must explain the basis and disagreement rights. Accepted amendments are linked or appended to affected records rather than silently erasing the record history.
Apply it
A patient challenges an accurate entry that the provider declines to amend. The provider issues a timely written denial explaining the basis and permits a statement of disagreement, linking the required materials to the disputed record.
Common pitfall: A denial does not end the patient's procedural rights. Automatically rejecting outside-origin records also overlooks the exception when the originator is unavailable to act.
14.When must a provider honor a paid-in-full disclosure restriction?
A covered entity must agree to restrict disclosure to a health plan when the information pertains solely to an item or service paid in full by the individual or someone other than the plan, and the disclosure is for payment or healthcare operations and is not required by law. This mandatory situation differs from other restriction requests that generally need not be accepted. Implement the restriction in billing and disclosure workflows so an automated claim does not defeat it.
Apply it
A patient pays the clinic in full for a service and requests that information solely about that service not be sent to the health plan for payment. No law requires disclosure. The clinic accepts and operationalizes the restriction.
Common pitfall: The rule does not require every requested restriction to be accepted. It also does not prohibit all disclosures of the information for every possible purpose.
15.How do confidential communication rights differ for providers and plans?
Covered providers must accommodate reasonable requests for communications by alternative means or at alternative locations without demanding an explanation. Health plans must accommodate reasonable requests when the individual clearly states that disclosure could endanger them, and plans may require that statement. An organization may request an alternative contact method and appropriate payment arrangements. This right changes how information reaches the individual; it is distinct from restricting disclosure to another party.
Apply it
A patient asks a clinic to send correspondence to a different address and supplies workable contact details. The clinic evaluates and accommodates the reasonable request without requiring a narrative explaining the patient's private circumstances or safety concerns.
Common pitfall: Importing the plan's endangerment condition into a provider's process imposes an improper barrier. Confidential communications also do not automatically erase permissible disclosures to others.
16.Which service relationships create business associate obligations?
A business associate is generally a person or entity outside the workforce performing covered functions or specified services on behalf of a covered entity involving PHI. The relationship follows the actual function and information handling, not the vendor's preferred label. Subcontractors performing such work for another business associate can also qualify. By contrast, a provider receiving information to treat a patient is not made a business associate merely by receiving that treatment disclosure.
Apply it
A clinic hires a company to process claims using patient information. The company performs a function on the clinic's behalf, so the clinic evaluates and establishes the required business associate agreement before the service begins handling PHI.
Common pitfall: A vendor's statement that it is only a contractor does not resolve its status. Receiving PHI also does not automatically make every recipient a business associate.
17.What makes a business associate agreement operationally sufficient?
A required business associate agreement must establish permitted uses and disclosures, safeguards, reporting obligations, support for applicable individual rights, HHS access to relevant compliance records, subcontractor protections, and termination provisions. Review whether the agreement actually covers the service's information flows. Service commitments such as availability or response times can supplement these protections, but they do not substitute for required terms. A signed agreement also does not replace implementation and monitoring of the promised safeguards.
Apply it
A billing vendor offers a contract promising confidentiality and uptime but omits incident reporting and support for patient rights. The clinic requires the missing business associate provisions and assigns internal owners to monitor the resulting obligations.
Common pitfall: A confidentiality clause or service-level agreement alone may omit required terms. Contract execution also does not demonstrate that the vendor's safeguards operate effectively.
18.How should subcontracting and contract termination protect PHI?
A business associate must obtain appropriate assurances from subcontractors that create, receive, maintain, or transmit PHI on its behalf, extending applicable restrictions through the service chain. At termination, required contract terms address return or destruction when feasible. If infeasible, protections continue and further uses and disclosures must be limited to the purposes making return or destruction infeasible. Evaluate subcontractor handling and exit arrangements before dependence on the service makes transition difficult.
Apply it
A records vendor uses a subcontractor and later ends its hospital contract. The hospital verifies the vendor's subcontractor obligations and exit plan. Any retained PHI that cannot feasibly be returned or destroyed remains protected under the required continuing restrictions.
Common pitfall: The hospital need not directly contract with every downstream subcontractor. Ending the main service agreement also does not automatically authorize unrestricted retention or reuse.
19.How should workforce education respond to policy changes?
Privacy training must be appropriate to workforce functions, provided to new members within a reasonable period, and updated for affected staff after material policy changes become effective within a reasonable period. Document its delivery. Security awareness applies across the workforce, including management. Evaluate learning through relevant decisions or observed behavior so completion records have operational meaning. A generic presentation can introduce principles, but role-specific practice reveals whether staff can apply a changed workflow.
Apply it
A clinic changes its process for confidential communication requests. It trains registration and billing staff on the revised routing and tests realistic requests, then documents delivery and addresses errors revealed by the exercises before reviewing actual workflow performance.
Common pitfall: An annual attendance record does not prove that affected staff learned a material change. Limiting security awareness to IT personnel also misses workforce obligations.
45 CFR 164.530 — Administrative requirements · 45 CFR 164.308 — Administrative safeguards
20.Which incident information helps leadership make a defensible decision?
Communicate what happened, which information and systems are involved, what remains uncertain, current containment, potential operational effects, and decisions requiring leadership action. Separate verified facts from assumptions and distinguish security risk management from the specific breach notification assessment. Include business associate incidents when relevant. A useful report connects each significant risk with an owner, proposed response, and evidence needed for closure, enabling leadership to allocate resources without mistaking preliminary conclusions for established facts.
Apply it
A vendor reports suspicious access but has not confirmed data acquisition. The privacy officer briefs leadership on confirmed access facts, missing evidence, containment status, contractual escalation, and resources needed for investigation while preserving the separate breach assessment decision.
Common pitfall: Reporting only that an incident is serious gives leaders no actionable basis. Calling every security event a confirmed reportable breach can also distort the response.
CHPS Content Outline, effective September 1, 2022 · 45 CFR 164.402 — Definitions
21.How should a requester’s identity and authority be verified?
When identity or authority is unknown, applicable HIPAA verification requirements generally call for establishing both before disclosure, subject to specified exceptions. Identity establishes who is asking; authority establishes why that person may receive the information. Obtain required supporting documentation or representations for the particular disclosure pathway. Reasonable reliance on qualifying official credentials or legal-authority statements can be appropriate. Verification should fit the circumstances rather than relying solely on familiarity, an email signature, or claimed urgency.
Apply it
An unfamiliar caller claims to represent a public agency and requests identifiable records. Staff verify the caller through an established channel, establish the relevant legal authority, and obtain the representations required for the proposed disclosure before releasing information.
Common pitfall: Confirming employment does not establish authority for every record requested. A convincing title or urgent tone is not a substitute for the applicable verification process.
45 CFR 164.514 — Other requirements relating to uses and disclosures
22.When does the minimum necessary standard change a disclosure decision?
When applicable, minimum necessary requires reasonable efforts to limit PHI to what accomplishes the intended purpose. Define routine disclosures and workforce access by role, purpose, and needed information; assess nonroutine requests using established criteria. Important exceptions include disclosures to or requests by providers for treatment, disclosures to the individual, and disclosures pursuant to authorization. Identify an exception before applying the limitation, while remembering that an exception does not independently establish permission to disclose.
Apply it
A payment analyst requests an entire patient chart to investigate one charge. Because this payment use is subject to minimum necessary, the organization supplies the relevant billing and supporting information rather than routinely granting access to unrelated clinical details.
Common pitfall: Applying minimum necessary to provider treatment requests as a universal limitation misses an exception. Calling a disclosure minimum necessary cannot make an otherwise impermissible disclosure lawful.
Summary of the HIPAA Privacy Rule · 45 CFR 164.514 — Other requirements relating to uses and disclosures
23.Which criteria support a research authorization waiver?
An IRB or Privacy Board may approve an authorization waiver when privacy risk is no more than minimal, the research cannot practicably proceed without the waiver, and it cannot practicably proceed without the PHI. Privacy protections include plans for identifiers, appropriate destruction, and limits on reuse or disclosure. The covered entity needs qualifying documentation identifying approval, necessary PHI, findings, review procedure, and an authorized signature. General research approval alone does not establish the HIPAA waiver.
Apply it
A researcher submits an IRB approval letter for a records study but no authorization-waiver documentation. The privacy office requests the required waiver findings and documentation before relying on that pathway to release identifiable information for the proposed study.
Common pitfall: Scientific importance or ordinary IRB approval alone does not satisfy waiver criteria. Minimal privacy risk also does not remove the two separate practicability requirements.
24.When may researchers review PHI to prepare a protocol?
The preparatory-to-research pathway requires researcher representations that access is solely for protocol preparation or similar preparatory purposes, the PHI is necessary for that purpose, and no PHI will be removed from the covered entity. It supports feasibility work without becoming general permission to conduct the eventual study. Evaluate the actual proposed activity and information movement. If the researcher wants to export identifiable data, this pathway alone does not satisfy that request.
Apply it
An investigator wants to inspect records to estimate whether a study is feasible. The organization obtains the required preparatory representations and permits appropriate review, but does not allow an identifiable patient spreadsheet to leave under that permission.
Common pitfall: Calling an activity preliminary does not authorize exporting PHI. Preparatory review also does not automatically authorize later study recruitment or full research data collection.
25.How does Safe Harbor de-identification handle dates and ages?
Safe Harbor requires removal of the specified identifiers and no actual knowledge that the remaining information could identify an individual, alone or combined with other information. For dates directly related to an individual, all elements except year must generally be removed. Ages over 89 and all date elements, including years, indicating those ages must be removed unless aggregated into a single category of age 90 or older. Retaining that category is optional; removing the information entirely is permissible. These requirements apply to structured fields and narrative text.
Apply it
A dataset retains full admission dates, an age of 96, and a birth year revealing that age. The analyst removes admission month and day and removes the exact older age and identifying birth year. The analyst may retain an optional age 90-or-older category instead of omitting older-age information entirely. Before claiming Safe Harbor, the analyst also checks every other specified identifier category and the actual-knowledge condition.
Common pitfall: The general permission to retain years does not permit retaining a year that indicates an age over 89. Likewise, replacing an exact age with a 90-or-older category does not cure identifying dates left elsewhere in the record. Aggregation is an available option, not a mandatory substitute for deletion.
45 CFR 164.514 — Other requirements relating to uses and disclosures
26.How does expert determination establish de-identification?
Expert determination uses a person with appropriate knowledge and experience applying accepted statistical and scientific principles to assess identification risk. The expert must determine that risk is very small for an anticipated recipient using the information alone or with reasonably available information, and document methods and results. This route can accommodate useful data differently from Safe Harbor, but requires an actual supported analysis. A confidentiality promise or an analyst's intuition does not constitute the determination.
Apply it
A project needs information that cannot meet Safe Harbor while retaining its analytic value. The organization engages a qualified expert to evaluate recipient-specific identification risk, apply appropriate transformations, and document the methods and resulting determination before release.
Common pitfall: Replacing names with random codes does not itself establish expert determination. Expertise must support a documented risk conclusion about the resulting information and anticipated recipients.
45 CFR 164.514 — Other requirements relating to uses and disclosures
27.What distinguishes a limited data set from de-identified information?
A limited data set remains PHI but excludes specified direct identifiers. It may retain information such as dates and city, state, and ZIP code, making it different from Safe Harbor de-identification. Its permitted purposes are research, public health, and healthcare operations, with a qualifying data use agreement. That agreement restricts uses, requires safeguards and reporting, and prohibits identifying or contacting individuals. A data use agreement does not cure a dataset that retains prohibited identifiers.
Apply it
A hospital proposes sharing service dates and city information for an operations analysis. It removes the required direct identifiers, confirms the permitted purpose, and executes a compliant data use agreement instead of labeling the information fully de-identified.
Common pitfall: Limited does not mean outside HIPAA. A data use agreement cannot authorize any purpose the recipient prefers or permit re-identification and contact with patients.
45 CFR 164.514 — Other requirements relating to uses and disclosures
28.What qualifies as psychotherapy notes, and when is authorization required?
Psychotherapy notes are notes recorded in any medium by a mental health professional documenting or analyzing counseling conversations during private, group, joint, or family counseling sessions, maintained separately from the remainder of the individual's medical record. Both the content and separate maintenance matter. The definition excludes medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results, and summaries of diagnosis, functional status, treatment plans, symptoms, prognosis, and progress. Qualifying notes generally require authorization for use or disclosure, subject to specific exceptions, including the originator's use for treatment. Ordinary permission to disclose PHI for treatment does not automatically authorize disclosure of psychotherapy notes to another treating provider.
Apply it
A therapist maintains a separate narrative analyzing a patient's counseling conversations. That narrative meets the definition of psychotherapy notes. A separately stored medication-monitoring sheet listing doses and adverse effects does not qualify merely because it is separate. When another clinician requests both documents for treatment, apply the psychotherapy-note authorization rule to the narrative and the applicable ordinary treatment-disclosure rules to the medication information.
Common pitfall: Neither a mental health diagnosis nor separate storage alone establishes the classification. Evaluate what the record documents and whether it is maintained separately. Conversely, calling a counseling-analysis narrative a progress note does not remove special protection if its actual content and maintenance meet the definition.
Federal Register :: Request Access · 45 CFR 164.508 — Uses and disclosures requiring authorization · Your Medical Records
29.How do purpose and financial arrangements determine whether a communication is marketing?
HIPAA generally defines marketing as a communication about a product or service that encourages recipients to purchase or use it. Relevant exclusions include treatment communications, such as treatment alternatives and care coordination, and certain communications describing the covered entity's health-related products, services, or plan benefits. These exclusions generally cease to apply when the covered entity receives financial remuneration in exchange for making the communication from or on behalf of the third party whose product or service is described. Financial remuneration means direct or indirect payment; it excludes payment for treating an individual. A separate exception covers refill reminders or communications about a currently prescribed drug or biologic when any remuneration is reasonably related to communication costs. PHI-based marketing generally requires authorization, except for face-to-face communications by the covered entity or promotional gifts of nominal value. If marketing involves third-party financial remuneration to the covered entity, the authorization must state that remuneration is involved.
Apply it
A clinic uses PHI to send patients treatment recommendations about another provider's therapy without receiving payment for the letters. The treatment exclusion can apply. If that provider instead pays the clinic per letter to promote the same therapy, the financial arrangement makes the communication marketing requiring authorization. Reimbursement limited to communication costs does not create a general exception for such therapy promotions; the specified cost-based exception concerns currently prescribed drug or biologic communications.
Common pitfall: A clinical topic or healthcare sender does not establish an exclusion. Identify the encouragement to purchase or use, the applicable exclusion, who pays whom, and what the payment purchases. A paid advertisement for a drug the patient is not currently prescribed cannot qualify merely by being labeled a refill reminder.
Federal Register :: Request Access · 45 CFR 164.508 — Uses and disclosures requiring authorization
30.How must fundraising communications preserve patient choice?
HIPAA permits specified PHI to be used, or disclosed to a business associate or institutionally related foundation, for the covered entity's own fundraising when required conditions are met. The notice must contain the required statement, and each communication must offer a clear, conspicuous opt-out without undue burden or more than nominal cost. Honor the election and do not condition treatment or payment on participation. This pathway permits specified information rather than unrestricted access to patient charts.
Apply it
A hospital foundation prepares a fundraising mailing using permitted information. The hospital checks its notice language and includes a simple opt-out. When a recipient declines future communications, the election is applied to subsequent fundraising lists without affecting care.
Common pitfall: A prior donation does not cancel a later opt-out. The fundraising permission also does not authorize sending the foundation every clinical detail in a patient's chart.
45 CFR 164.514 — Other requirements relating to uses and disclosures
Information Technology/Physical and Technical Safeguards24–35%
31.How do confidentiality, integrity, and availability guide security planning?
Confidentiality protects ePHI from unauthorized access or disclosure; integrity protects against improper alteration or destruction; availability ensures authorized access when needed. Security planning must address all three across reasonably anticipated threats. Select controls based on the organization's capabilities, infrastructure, costs, and the probability and criticality of risks. A control can strengthen one objective while creating another risk, so evaluate its operational effects rather than treating any security product as comprehensive protection.
Apply it
A hospital proposes disconnecting a critical record system to prevent unauthorized access. The security team evaluates the confidentiality benefit alongside treatment availability, then selects protective access and network measures that preserve necessary authorized use during clinical operations.
Common pitfall: Equating security solely with secrecy overlooks corrupted or unavailable information. A technically restrictive measure can be poorly chosen if it unnecessarily prevents essential authorized access.
32.Why does an ePHI inventory need data flows as well as devices?
An inventory supports risk analysis by identifying software, hardware, data, locations, and movement of ePHI. Device counts alone do not show which systems receive information, where copies persist, or which external services maintain it. Link assets to responsible owners and relevant information flows so changes can be assessed. The discriminating question is where ePHI is created, received, maintained, or transmitted, including less visible exports and portable media, rather than simply which equipment the IT department purchased.
Apply it
A department exports patient data from an approved system to a local analysis folder. The security team adds the copy, storage location, data owner, and transfer path to its inventory and evaluates safeguards for that newly identified information flow.
Common pitfall: A hardware purchase list can miss cloud services and local exports. An inventory also needs maintenance when workflows change, rather than only during initial implementation.
CHPS Content Outline, effective September 1, 2022 · Guidance on Risk Analysis
33.What makes an ePHI risk analysis organization-wide?
Risk analysis must address potential risks and vulnerabilities to all ePHI the regulated organization creates, receives, maintains, or transmits, regardless of location or electronic medium. Identify threats, vulnerabilities, existing controls, likelihood, and potential impact. Include departments, portable media, external services, and interfaces as applicable. A technical vulnerability scan can inform the work but does not independently establish the complete analysis because it may omit human, physical, environmental, and workflow-related risks.
Apply it
A hospital's assessment examines its main EHR but excludes billing exports and remote storage. The security official expands the analysis to those ePHI locations and evaluates their threats, vulnerabilities, safeguards, likelihood, and consequences alongside the main system.
Common pitfall: An EHR vendor's assessment does not automatically cover the customer's entire environment. A clean vulnerability scan also cannot establish that every relevant risk has been assessed.
34.How should risk analysis drive security treatment and system selection?
Risk analysis identifies and evaluates exposure; risk management implements measures that reduce identified risks to a reasonable and appropriate level. Prioritize using likelihood and impact, then assign actions, resources, and evidence of completion. Assess proposed systems before deployment and reassess existing systems when relevant conditions change. Product selection should respond to a demonstrated control need and operational context. Purchasing a tool without connecting it to identified risks can leave significant vulnerabilities untreated.
Apply it
A clinic evaluates a new remote-access service before launch. It identifies unauthorized-access and downtime risks, compares proposed safeguards, assigns required changes, and verifies implementation. After a major workflow change, it reassesses the service rather than relying permanently on approval.
Common pitfall: Listing risks without implementing responses stops at analysis. Buying the newest security product also does not demonstrate that the organization's most consequential exposures were addressed.
45 CFR 164.308 — Administrative safeguards · 45 CFR 164.306 — Security standards: General rules
35.How must an addressable implementation specification be evaluated?
Addressable means the entity must assess whether the implementation specification is reasonable and appropriate in its environment. Implement it when it is. If it is not, document why and implement an equivalent alternative when that alternative is reasonable and appropriate. The alternative is therefore conditional, not automatically mandatory in every case. The underlying standard remains applicable. Decisions should connect the safeguard's likely protective contribution with the actual risks and environment rather than treating the label as permission to ignore it.
Apply it
A facility evaluates an addressable safeguard for a particular system. Its documented assessment concludes the specification is unsuitable but an equivalent alternative is reasonable and appropriate. The facility implements that alternative and records how it supports the applicable standard.
Common pitfall: Addressable does not mean optional without assessment. It also does not mean an alternative must always be implemented when no alternative is reasonable and appropriate.
36.How should facility safeguards control physical access?
Physical access controls protect facilities and equipment against unauthorized entry, theft, and tampering while allowing appropriate operational access. Evaluate access by role or function, visitor procedures, security-related maintenance, and emergency restoration needs. A facility security plan should connect these measures with the locations and equipment at risk. Physical protection involves how access is granted and monitored in practice; possession of an employee badge does not establish a need to enter every protected area.
Apply it
A contractor needs access to a room containing servers. The organization verifies the work authorization, limits entry to the approved purpose, applies visitor controls, and records relevant security maintenance rather than granting unrestricted access based on contractor status.
Common pitfall: A locked exterior door does not control every sensitive interior location. Employee or contractor status alone also does not justify unrestricted access to equipment areas.
37.How do workstation safeguards reduce incidental disclosure?
Workstation use policies specify proper functions, how those functions are performed, and the physical surroundings of workstations accessing ePHI. Workstation security restricts access to authorized users. Screen placement, controlled locations, and appropriate session handling can reduce exposure. Under the Privacy Rule, an incidental disclosure can be permissible when it follows an otherwise permitted activity and reasonable safeguards and applicable minimum necessary requirements are satisfied. An avoidable exposure is not excused merely by calling it incidental.
Apply it
Visitors can read a registration monitor from a waiting area. The clinic changes screen placement and workstation practices, then checks visibility from public seating. It preserves necessary registration work while reducing exposure of patient information to people awaiting service.
Common pitfall: Labeling an exposure incidental does not establish that safeguards were reasonable. Conversely, privacy protection does not require eliminating every possible incidental observation regardless of context.
45 CFR 164.310 — Physical safeguards · Summary of the HIPAA Privacy Rule
38.Why are unique user identities necessary for accountability?
Unique user identification assigns a distinct name or number for identifying and tracking user identity. It enables access decisions and activity records to be associated with a particular user. Shared credentials weaken attribution because a recorded account no longer reliably identifies who performed an action. The required control concerns identifiable users, while supporting authentication and access-management processes determine how identities are verified and what each user may do. A detailed log cannot repair deliberately shared identity.
Apply it
Several registration staff use one account to save time. The organization issues individual identities and configures appropriate access, allowing later investigation of who opened or changed a record while preserving an efficient registration workflow for each authorized worker.
Common pitfall: An account named after a department does not identify individual users. Logging every shared-account action still leaves uncertainty about which person actually performed it.
39.How do authentication and authorization answer different access questions?
Authentication verifies that the person or entity seeking access is the one claimed. Authorization determines which information and functions that authenticated identity may access. Both are necessary: successful identity verification does not establish a work-related need for every record. Match privileges to approved duties, and review changes through access-management procedures. A strong login method can reduce impersonation risk while leaving excessive privileges untouched, so assess the two control functions separately.
Apply it
An employee passes the organization's login checks but can open records unrelated to assigned duties. The security team investigates access authorization and role configuration rather than assuming successful authentication proves that every available record is appropriate for that employee.
Common pitfall: Stronger authentication does not automatically correct excessive privileges. A valid employee identity also does not make every use of accessible patient information permissible.
45 CFR 164.312 — Technical safeguards · 45 CFR 164.308 — Administrative safeguards
40.How should emergency access preserve availability and accountability?
The Security Rule requires procedures for obtaining necessary ePHI during an emergency. Design a workable route that supports urgent authorized use when ordinary access is insufficient, while preserving identity tracking and appropriate review. Emergency access should specify who may activate it, its scope, and how activity is examined. The emergency-access requirement does not cancel other applicable safeguards or make every request urgent. An unusable emergency procedure can itself undermine availability when essential information is needed.
Apply it
An authorized clinician needs records during an emergency but the ordinary role lacks the required access. The approved emergency procedure provides necessary access with identifiable activity records, followed by review of whether the emergency use matched its stated purpose.
Common pitfall: A shared emergency password undermines accountability. Conversely, refusing to establish any exceptional access route can leave necessary ePHI unavailable when normal permissions are insufficient.
41.How do audit controls and abnormal-event triggers work together?
Audit controls record and support examination of activity in systems containing or using ePHI. Event triggers identify conditions needing attention, such as unusual login failures or suspicious access patterns. Configure records and alerts around meaningful events, then assign review and response responsibilities. An alert signals a need to investigate rather than proving misconduct. Recording alone also falls short when nobody examines the information or acts on patterns suggesting a security incident.
Apply it
A system records repeated failed logins but sends no alerts to a monitored destination. The organization defines a meaningful trigger, assigns response responsibility, and checks that reviewers can investigate associated successful access and account activity when the trigger fires.
Common pitfall: More alerts do not necessarily mean better detection if nobody can review them. A triggered rule also does not establish that an unauthorized disclosure occurred.
45 CFR 164.312 — Technical safeguards · 45 CFR 164.308 — Administrative safeguards
42.Which controls detect improper alteration of ePHI?
Integrity safeguards protect ePHI against improper alteration or destruction. Mechanisms that corroborate information has not been changed without authorization support that objective; version histories, validated change records, or suitable integrity checks can provide relevant evidence depending on the system. Distinguish authenticating the information from authenticating the person accessing it. A valid login may identify a user without demonstrating that a transferred file remains intact or that a particular modification was authorized.
Apply it
A receiving system must detect whether an electronic record changed during transfer. The organization evaluates an integrity verification mechanism and tests altered and unaltered files, while separately maintaining user authentication and permissions for people sending or receiving the records.
Common pitfall: Confidentiality protection alone does not necessarily demonstrate integrity. Verifying a user's identity also does not prove that the electronic information remained unaltered during handling.
43.How should transmission security protect external information exchange?
Transmission security protects ePHI against unauthorized access while it travels across an electronic communications network. Evaluate the route, endpoints, recipient validation, and risks of interception or improper modification. The current rule includes addressable transmission encryption and integrity specifications, requiring the applicable assessment rather than automatic dismissal. Protecting the channel does not establish the recipient's authority to receive the information. Effective exchange therefore combines lawful disclosure, correct addressing, and safeguards appropriate to the transmission risks.
Apply it
A hospital introduces a connection to an external service. It evaluates network exposure and appropriate encryption and integrity controls, verifies the intended endpoint, and confirms the underlying disclosure relationship before transmitting production patient information through the new connection.
Common pitfall: An encrypted message sent to an unauthorized recipient can still be an impermissible disclosure. A lawful disclosure purpose also does not eliminate transmission security obligations.
45 CFR 164.312 — Technical safeguards · 45 CFR 164.306 — Security standards: General rules
44.How do backup and disaster recovery plans serve different purposes?
A data backup plan creates and maintains retrievable exact copies of ePHI. A disaster recovery plan establishes how lost data will be restored. Both are required contingency components, and neither is demonstrated merely by a successful backup job notification. Verify that the copies are usable and that restoration procedures address the systems and dependencies needed for recovery. The discriminating cue is whether the question asks about preserving copies or recovering information after loss.
Apply it
A facility's backups complete successfully, but staff cannot restore records because a required dependency is missing. The organization corrects the recovery procedure and verifies restoration, recognizing that creating copies alone did not establish a workable disaster recovery process.
Common pitfall: A backup success message does not prove recoverability. A recovery document also cannot restore information that was never preserved in a usable, retrievable form.
45.How does emergency mode planning sustain critical operations?
Emergency mode operations maintain critical business processes that protect ePHI during an emergency, while disaster recovery addresses restoration of lost data. Analyze application and data criticality to determine which processes need priority support. Testing and revision help reveal dependencies and practical failures before an actual disruption. Planned downtime can use the same continuity reasoning, although its trigger differs from an emergency. A complete approach addresses the period before restoration as well as the eventual return to normal systems.
Apply it
A record system will be unavailable during an outage. The hospital identifies essential workflows, provides controlled downtime procedures, and plans reconciliation after restoration. It tests the sequence so critical information remains appropriately available and protected while ordinary systems are offline.
Common pitfall: A plan focused only on restarting servers can overlook operations during the outage. Restoring every application simultaneously also ignores differences in criticality and dependencies.
46.What must happen before electronic media are reused?
The Security Rule requires procedures for removing ePHI from electronic media before the media are made available for reuse. Select a method appropriate to the medium and verify that it achieves the intended removal. Ordinary file deletion may leave recoverable information, so assess the actual result rather than the user's interface action. Reuse within the same organization still requires control; changing the device's department or owner does not itself remove its stored patient information.
Apply it
A clinic transfers a workstation from billing to a training room. Before release, staff apply the approved media-clearing procedure and verify removal of ePHI, including relevant local storage, rather than merely deleting visible files or changing the assigned user.
Common pitfall: Moving a device internally does not eliminate reuse obligations. A cleared desktop or empty recycle bin does not demonstrate removal of recoverable ePHI from media.
47.How should disposal and movement controls protect retired equipment?
Device and media controls govern receipt, removal, and movement of hardware and electronic media containing ePHI. Disposal procedures must address the final disposition of the information or its media. Track the relevant assets and responsibility through storage, transfer, and approved disposal so a gap in custody does not become an unrecognized exposure. A disposal vendor's involvement can assist the process, but the organization still needs evidence that its chosen handling and disposal procedures were followed.
Apply it
A hospital replaces equipment containing patient data. It identifies the affected media, restricts access while awaiting disposal, records the transfer, and obtains appropriate evidence of the approved final disposition rather than leaving untracked devices in a general loading area.
Common pitfall: Retired equipment can still contain ePHI. A vendor pickup receipt establishes transfer but may not establish that the required information destruction or disposal actually occurred.
48.When should access privileges be modified or removed?
Access-management procedures should establish, document, review, and modify user access according to authorized duties. Workforce changes can require adjustment before employment ends, such as a transfer that removes a prior need for records. Termination procedures address access when a relationship ends. Review the complete access path, including external services and exceptional privileges, rather than only the primary application. Authentication can remain valid while authorization becomes inappropriate because the user's role has changed.
Apply it
An employee moves from clinical support to a finance role. The organization reassesses privileges, removes access no longer needed, and grants approved finance access. It checks related systems instead of waiting until the employee eventually leaves the organization.
Common pitfall: Adding a new role without removing obsolete privileges creates accumulated access. Disabling the main application alone may leave active access through other systems or services.
Investigation, Compliance, and Enforcement19–24%
49.How should staff report and contain a suspected incident?
An incident process should make reporting straightforward, identify response responsibilities, and address suspected as well as known security incidents. Respond, mitigate harmful effects to the extent practicable, and document outcomes. Staff should report observable facts promptly rather than deciding alone whether a legal breach occurred. Containment should preserve information needed for investigation whenever feasible. Early reporting enables the organization to stop continuing exposure and evaluate its obligations before uncertainty becomes an excuse for inaction.
Apply it
A worker realizes a patient attachment went to an unintended recipient. The worker promptly reports the recipient, information involved, and timing through the established channel. The response team seeks containment and preserves relevant evidence while beginning its disclosure assessment.
Common pitfall: Waiting for proof of harm can prolong exposure. Deleting all traces before reporting may also destroy evidence needed to assess the event and response.
45 CFR 164.308 — Administrative safeguards · CHPS Content Outline, effective September 1, 2022
50.How should an investigation establish facts and support external responses?
Build a documented timeline linking reported events, access records, communications, affected information, and containment actions. Preserve originals where appropriate and distinguish evidence from interpretation. Coordinate external inquiries through designated personnel so responses are accurate, consistent, and delivered within the applicable request deadline. A defensible investigation explains how conclusions follow from evidence, including unresolved gaps. The absence of a particular log entry is meaningful only when the system reliably records the activity in question.
Apply it
A regulator requests records about suspected access. The organization preserves relevant logs, reconciles system times, reviews the employee's assigned duties, and prepares a coordinated response. It identifies missing evidence explicitly instead of presenting an unsupported conclusion as established fact.
Common pitfall: Assuming no log entry proves no access ignores logging limitations. An uncoordinated response can also omit relevant facts or contradict other documented investigation findings.
CHPS Content Outline, effective September 1, 2022 · 45 CFR 164.308 — Administrative safeguards
51.When should compliance evaluations change organizational practice?
Security evaluation includes periodic technical and nontechnical assessment and reevaluation in response to environmental or operational changes affecting ePHI security. Review whether policies and procedures satisfy requirements and whether actual practice follows them. Monitoring legal and regulatory changes can identify further policy or training updates. A finding should produce a responsible owner, corrective action, and verification rather than merely a revised document. No universal annual evaluation interval should be inferred from a requirement expressed as periodic.
Apply it
A clinic introduces remote workflows after its last security evaluation. It reassesses the changed environment, identifies access and training gaps, updates the relevant procedures, and verifies operation of the changes rather than waiting for its next routine review date.
Common pitfall: An unchanged policy manual does not establish continuing compliance after operations change. A calendar review also cannot substitute for evaluating significant changes when they occur.
45 CFR 164.308 — Administrative safeguards · CHPS Content Outline, effective September 1, 2022
52.How can access audits distinguish unusual activity from inappropriate use?
Access audits compare recorded activity with the user's duties, treatment or operational context, and applicable permissions. Unusual patterns can identify records needing examination, but patterns alone do not establish wrongdoing. Review the reason for access and corroborating workflow evidence. Conversely, technical ability to open a record is not proof of a legitimate purpose. Effective auditing combines useful system records, assigned review responsibilities, investigation criteria, and documented resolution of exceptions requiring further attention.
Apply it
An audit flags an employee opening a colleague's record. The reviewer checks assignments and the documented reason for access rather than assuming either misconduct or legitimacy. If no permitted work purpose exists, the finding enters the incident and sanction process.
Common pitfall: An unusual relationship is an investigation cue rather than a final conclusion. Successful system access also does not prove that the employee's purpose was permitted.
45 CFR 164.308 — Administrative safeguards · CHPS Content Outline, effective September 1, 2022
53.How should sanctions coexist with protected complaint reporting?
Covered entities must apply appropriate sanctions for workforce noncompliance and document the required actions. They must also provide a complaint process and avoid prohibited retaliation for exercising protected rights or participating in specified compliance activities. Evaluate the underlying conduct separately from the act of reporting. A person who reports an error may still require fair review of that error, but reporting itself should not become the basis for punishment. Consistent, evidence-based enforcement supports both accountability and early disclosure.
Apply it
A worker reports a colleague's inappropriate access. Management investigates the access under its sanction policy and protects the reporter from retaliatory scheduling changes. It documents findings and actions rather than treating the complaint as disloyalty to the department.
Common pitfall: Punishing a complaint discourages reporting and can violate nonretaliation requirements. Nonretaliation does not mean independently established underlying misconduct must always escape appropriate review.
54.How does the breach presumption structure a notification assessment?
An impermissible acquisition, access, use, or disclosure is presumed a breach unless an applicable exception applies or the regulated entity demonstrates a low probability that PHI was compromised through the required risk assessment. Evaluate at least the information's nature and extent, the unauthorized recipient, actual acquisition or viewing, and mitigation. This is a probability-of-compromise analysis, not merely a search for proven financial harm. The organization may instead provide required notifications without performing that assessment.
Apply it
A clinic sends identifiable information to an unauthorized recipient. The investigator evaluates all four factors and any applicable exception, documenting the evidence and conclusion. The clinic does not close the matter solely because no patient has yet reported harm.
Common pitfall: No known harm is not the governing test. A favorable mitigation fact also cannot replace consideration of the information, recipient, and actual acquisition or viewing.
55.Which accidental disclosures may meet a breach-definition exception?
Specified exceptions include good-faith, unintentional workforce acquisition, access, or use within authority; certain inadvertent disclosures between authorized persons within the permitted organizational relationships; and a good-faith belief that an unauthorized recipient could not retain the information. The first two require no further impermissible use or disclosure. Match every condition to evidence rather than treating all accidents alike. An exception to breach notification does not eliminate the need to investigate the event and correct deficient practices.
Apply it
An authorized employee inadvertently sends information to another authorized employee within the same covered entity. The organization verifies the required conditions, including no further impermissible use or disclosure, before documenting whether the specific breach-definition exception applies to the event.
Common pitfall: An accidental disclosure to any employee does not automatically qualify. Recipient authorization, organizational relationship, and the absence of further impermissible handling are material conditions.
56.When does encryption of a stolen device affect HIPAA breach notification duties?
HIPAA breach notification applies to breaches of unsecured PHI. For stored electronic PHI, the HHS protection guidance identifies encryption consistent with NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices. The encryption must render the information unusable, unreadable, or indecipherable to unauthorized persons, and the confidential decryption process or key must remain unbreached. Verify the actual encryption configuration and its operation when the device was lost, rather than relying on a product label. If these conditions protect the affected PHI, its loss does not trigger HIPAA notification as a breach of unsecured PHI. The technical criteria appear in the [HHS protection guidance](https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html).
Apply it
A powered-off laptop is stolen. Configuration records establish that its PHI was protected by active storage encryption consistent with NIST SP 800-111, and the investigation establishes that the decryption key and process remained uncompromised. Document the basis for concluding that the affected PHI was secured. By comparison, a laptop protected only by an operating-system password, with readable unencrypted storage, does not meet this encryption criterion; assess that loss under the breach rules.
Common pitfall: Password protection alone does not establish qualifying encryption. Encryption also does not resolve an incident if an exposed key or accessible plaintext defeats the protection. Even when qualifying encryption removes the HIPAA breach-notification obligation for the affected information, investigate the theft, document findings, and correct security weaknesses.
57.What must individual breach notification accomplish?
Individual notice must be provided without unreasonable delay and no later than 60 days after discovery, absent an applicable lawful delay. It explains the event, involved information types, protective steps, response actions, and contact information to the extent possible. First-class mail is the ordinary method, with email available when the individual has agreed. Substitute-notice requirements address inadequate contact information. Notification planning should begin promptly rather than waiting for every investigative detail to become certain.
Apply it
A covered entity confirms a reportable breach affecting a small patient group. It prepares clear individual notices using available facts, explains protective and response steps, and sends them promptly rather than treating the outer deadline as its standard mailing date.
Common pitfall: Sixty days is an outside limit, not permission for avoidable delay. A website announcement alone does not ordinarily replace the required individual notification method.
58.How do HHS and media notification thresholds differ?
A breach affecting 500 or more individuals requires notice to HHS without unreasonable delay and within the applicable 60-day period. Breaches affecting fewer than 500 can be reported annually, no later than 60 days after the discovery year's end. Media notice applies when more than 500 residents of a state or jurisdiction are affected. The number comparison and geographic grouping differ. Individual notification remains a separate obligation even when annual HHS reporting is available.
Apply it
A reportable breach affects exactly 500 people, all in one state. The entity uses the 500-or-more HHS reporting route and provides individual notice. The media threshold of more than 500 residents is not met on those facts.
Common pitfall: Using one 500-person rule for every recipient misses the distinction. Annual HHS reporting for smaller breaches also does not postpone notices owed to affected individuals.
59.How should a business associate report a discovered breach?
A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. It should provide affected individuals' identities and other available information needed for notices to the extent possible. Contracts can require faster communication to support coordinated response. The covered entity remains responsible for ensuring individual notice, although performance may be delegated. An unfinished investigation does not automatically authorize postponing communication until every detail is known.
Apply it
A billing associate discovers a breach and has partial patient information. It promptly informs the covered entity under the applicable reporting terms, supplies known facts, and supplements the information as the investigation proceeds instead of awaiting a final forensic report.
Common pitfall: The outer federal deadline does not override a shorter contractual reporting requirement. Delegating notice preparation also does not remove the covered entity's responsibility to ensure notification.
60.Which documentation supports closure of a breach investigation?
The regulated entity bears the burden of demonstrating that required notifications were provided or that an impermissible event did not require notification. Preserve the supporting assessment or exception analysis, relevant facts, notices, timing evidence, and response decisions. Closure should also address the cause and verify assigned corrective actions. A defensible file connects evidence to the conclusion and demonstrates follow-through. Merely stating that an incident was resolved does not establish compliance or show whether the same exposure remains possible.
Apply it
A hospital concludes that an event meets a documented breach exception. It retains evidence supporting each condition, records the decision and responsible reviewer, and verifies the corrective workflow change rather than closing the record with only a no-notification label.
Common pitfall: A conclusory no-breach checkbox cannot demonstrate the basis for a decision. Sending notices also does not by itself establish that underlying control failures were corrected.
Breach Notification Rule · CHPS Content Outline, effective September 1, 2022
What to focus on during revision
The following are CertMedbry study suggestions. Use the official outline to check the full scope of your examination.
- Translate legal conditions into action: identify the actor, information, purpose, recipient authority, required evidence, and applicable exception before deciding.
- Distinguish patient access, amendment, restrictions, and confidential communications; each right has different criteria and operational consequences.
- Separate business associate agreements, research authorization waivers, and limited-data-set agreements by the function each performs.
- Connect security controls to confidentiality, integrity, and availability, including emergency operations, media handling, and privilege changes.
- Practise the complete addressable-specification decision, including the conditional requirement for an equivalent alternative.
- Separate incident containment, breach-definition exceptions, probability-of-compromise assessment, and notification duties.
- Memorize notification recipient distinctions: individuals, HHS, media, and covered entities receiving business associate reports.
A practical preparation plan
1. Map the complete outline
Read AHIMA's official tasks and mark topics beyond this selective guide. Use the published domain ranges to distribute study time, giving program management and technical safeguards substantial attention without neglecting legal interpretation or investigation.
2. Build disclosure decision tables
For treatment, public health, research, marketing, and fundraising, record the permission or requirement, conditions, necessary documentation, minimum necessary treatment, and important boundaries. Add state-law facts explicitly when practising preemption.
3. Practise patient-rights workflows
Work through access, amendment, paid-in-full restrictions, and confidential communications from receipt through documented disposition. Explain the decisive criterion before selecting an action.
4. Trace ePHI through an organization
Sketch a sample flow from collection through storage, external transfer, backup, and disposal. At each stage identify risks, appropriate controls, accountable owners, and evidence that the controls work.
5. Run an incident tabletop
Starting with a misdirected disclosure, practise reporting, containment, evidence preservation, exception analysis, the four breach-assessment factors, and recipient-specific notification. Repeat with exactly 500 affected individuals and then with more than 500 residents in one jurisdiction.
6. Review reasoning after every drill
Complete the 20 questions before reading explanations. For each error, state why the chosen option failed and identify the fact that would make it appropriate. Use the flashcards to retrieve criteria aloud, then revisit the underlying primary reference when the boundary remains unclear.
Use your sample score as a starting point
The free set contains 20 original practice questions. It is a small learning sample, not an official examination or a validated pass prediction. Review each explanation and its source before moving to another topic.
Start the free sampleOfficial sources and updates
- Certified in Healthcare Privacy and Security (CHPS) | AHIMA
- CHPS Content Outline, effective September 1, 2022
- How do I know if a state law is more stringent than the HIPAA Privacy Rule?
- HIPAA Privacy in Emergency Situations
- Summary of the HIPAA Privacy Rule
- Summary of the HIPAA Security Rule
- Business Associate Contracts
- Your Medical Records
- 45 CFR 164.526 — Amendment of protected health information
- 45 CFR 164.514 — Other requirements relating to uses and disclosures
- HIPAA and Research
- 45 CFR 164.520 — Notice of privacy practices
- Guidance on Risk Analysis
- 45 CFR 164.310 — Physical safeguards
- 45 CFR 164.308 — Administrative safeguards
- 45 CFR 164.312 — Technical safeguards
- 45 CFR 164.316 — Policies, procedures, and documentation
- 45 CFR 164.530 — Administrative requirements
- 45 CFR 164.522 — Rights to request privacy protection
- 45 CFR 164.508 — Uses and disclosures requiring authorization
- 45 CFR 164.402 — Definitions
- Breach Notification Rule
- 45 CFR 164.306 — Security standards: General rules
- Federal Register :: Request Access
- Message Authentication Codes | CSRC
Confirm current eligibility, fees, scheduling and policies directly with the examination provider. CertMedbry is independent and is not endorsed by these organisations. How we handle content and corrections.