HealthCare Information Security and Privacy Practitioner (HCISPP) Study Guide

Apply it

A hospital sends encounter information to an insurer and a hosted billing service. Map the hospital's care function, the insurer's payment function and the service's processing role before assigning access permissions or deciding which agreements govern each exchange.

Apply it

A billing interface changes a service identifier during export, producing repeated claim rejections. Compare the documented service, export transformation and submitted claim. Correct the mapping under change control and validate sample claims before restoring the routine workflow.

Apply it

A service receives several clinics' proprietary billing files and converts them into standard transactions for health plans. Identify the conversion as a clearinghouse function, then examine the service's relationship with each clinic and the safeguards covering those files.

Apply it

Two departments record different phrases for the same clinical concept. A terminology team evaluates whether both phrases should reference the same SNOMED CT concept, preserving the original documentation while improving consistent interpretation across the organization's records.

Apply it

A hospital receives similar record requests from a public health authority investigating an outbreak and a university researcher. Verify that the authority is legally authorized to collect the requested information for that investigation. For the university study, verify participants' research authorizations or documented IRB or Privacy Board waiver approval; if a qualifying limited data set meets the study's needs, remove its required identifiers and obtain a data use agreement before release.

Apply it

A clinic buys an imaging device and archive that both claim DICOM conformance. Before accepting the installation, test the required image exchange workflow and compare supported capabilities, rather than accepting the two product labels as proof of integration.

Apply it

A patient's access request reaches a hospital whose legal record policy excludes a billing application. Assess whether billing records fall within the HIPAA designated record set, rather than limiting the response solely to the organization's legal medical record definition.

Apply it

Security and research leaders disagree about a proposed data release. Use the governance charter to identify the authorized decision body, present the privacy and operational implications, and document its decision with assigned implementation and review responsibilities.

Apply it

A policy requires controlled access to patient information, a standard requires individual accounts, and a procedure instructs night staff to share a login. Revise the procedure and provide workable account provisioning so routine practice satisfies the approved requirement.

Apply it

A manager asks an analyst to certify that supplier recovery controls passed, although only a written policy was reviewed. The analyst reports the actual review performed, identifies the missing operational evidence and requests a suitable recovery assessment.

Apply it

A clinic adds remote maintenance to a previously isolated system. Identify the external connection, permitted administrative actions and affected information, then require controlled access and monitoring before allowing the maintenance pathway into routine use.

Apply it

A partner application can request patient resources from a new FHIR service. Before production use, verify protected transport, client authentication and authorization for the intended records and operations, including attempts to request information outside the approved scope.

Apply it

An analyst exports appointment data into a spreadsheet for scheduling analysis. Because the export still identifies patients and their visits, assign appropriate handling controls before storage or sharing instead of treating the spreadsheet as an ordinary office document.

Apply it

A hospital controls decryption keys while its provider stores encrypted backups. Document the provider's storage and availability safeguards and the hospital's key and account responsibilities, and establish the appropriate business associate agreement before transferring the backups.

Apply it

A laboratory needs to send results to a hospital but requests broad internal network access. Define the required endpoint and exchange operations, restrict the connection accordingly, and document ownership, monitoring and disconnection responsibilities in the connection agreement.

Apply it

A transferred result differs from its source, and the patient also alleges inappropriate access. Examine transformation history for the content discrepancy and access records for the privacy concern, correlating identities and times without assuming either record answers both questions.

Apply it

A hospital replaces an old records platform but must retain selected records. Test that the archive preserves readable content, associated context and authorized access before shutting down the original application and removing the staff accounts used to operate it.

Apply it

For a copier's magnetic disk staying within the same controlled environment, policy may permit verified clearing. For sensitive patient documents on an SSD leaving organizational control, select a supported purge method that addresses the device's storage behavior, or authorized destruction if an adequate purge cannot be established. After retention and disposal approval, record the device identity, method, tool, operator and outcome. Verification must establish that the selected operation covered the intended media and completed successfully, with method-appropriate checks and resolution of errors. Cryptographic erasure additionally requires evidence that the target data were adequately encrypted and all relevant decryption-key copies were sanitized.

Apply it

An individual independently chooses an application and directs a hospital to send it records for the individual's own use. Assuming the application meets no independent covered-entity criterion, receiving those records does not by itself make it the hospital's business associate. If the hospital instead engages the application operator to process or maintain patient records on the hospital's behalf, outside its workforce, that qualifying PHI service establishes a business-associate relationship. Separately, a provider whose billing company submits covered electronic claims on its behalf cannot avoid covered-entity status merely because the provider does not submit the claims itself.

Apply it

A hospital holds a worker's treatment chart and a separate personnel file documenting sick leave. Evaluate the treatment record as patient information and the personnel record in the hospital's employer capacity, then apply the appropriate protections to each.

Apply it

A workforce member leaves printed patient information in a public waiting area. Assess the unauthorized exposure under privacy requirements and organizational safeguards, without dismissing the event because the Security Rule specifically addresses information maintained or transmitted electronically.

Apply it

A practice proposes omitting an addressable safeguard because its systems are small. Require an assessment of whether the safeguard is reasonable and appropriate, documentation of any justified alternative, and evidence that the applicable standard is still satisfied.

Apply it

A patient list reaches an unintended external recipient. Preserve evidence about the file, recipient access and deletion assurances, evaluate each required compromise factor, and document the resulting breach decision rather than closing the event solely because nobody has complained.

Apply it

A confirmed breach affects exactly 500 people across several states, with no state having more than 500 affected residents. Provide individual notices and notify HHS without unreasonable delay and within 60 days after discovery; the stated counts do not trigger media notice. If a separate breach affects 120 individuals and is discovered during a calendar year, individual notices still follow the 60-day discovery limit, while annual HHS reporting is due within 60 days after that discovery year ends.

Apply it

An EU clinic designs an appointment reminder process requiring contact details and appointment times. Exclude unrelated diagnostic histories from the reminder dataset when they do not support its defined purpose, even if the storage platform offers strong encryption.

Apply it

An EU research team replaces patient names with codes and stores the linking table separately. Treat the coded health records as pseudonymised personal data, protect the linking table and verify the applicable lawful basis and special-category processing condition.

Apply it

A hospital adopts a cybersecurity framework and claims that patient access obligations are therefore satisfied. Map those obligations explicitly, identify the responsible process and examine request-handling evidence instead of inferring compliance from the framework adoption decision.

Apply it

A hospital wants to disclose an identifiable patient story to a commercial publisher, with no other HIPAA permission supporting the disclosure. A signed admission consent for treatment, payment and operations does not authorize that release. Obtain a valid authorization covering the story, recipient and purpose, check its expiration and any revocation, and disclose only within its terms. A written revocation stops future reliance except to the extent the hospital has already acted in reliance on the authorization.

Apply it

An interface imports a laboratory result into the wrong patient record. Restrict the affected workflow, investigate identifiers and transformation logic, and correct records through the approved amendment process while preserving evidence of the original error and its correction.

Apply it

A clinic's records application remains operational, but a failed identity service prevents staff login. Include identity availability and an approved contingency access process in service planning, then exercise the complete workflow instead of checking server uptime alone.

Apply it

A scheduling employee signs in correctly but can export complete clinical records. Keep individual authentication in place and correct the role's permissions, then verify that authorized scheduling work remains possible while the excessive export capability is removed.

Apply it

A payer requests information for a payment review while a treating specialist requests records for treatment. Apply the appropriate minimum necessary analysis to the payment request, recognize the treatment disclosure exception and maintain secure, verified access for both exchanges.

Apply it

An administrator can grant privileged accounts and erase the logs showing those grants. Assign independent control over audit evidence and review, restrict the administrator's logging permissions and test whether the combined privileges still allow concealed account creation.

Apply it

A stolen laptop contains encrypted records and an unprotected file holding the decryption key. Assess exposure considering both items together, then correct key storage and access practices instead of relying on the encryption status displayed by the device.

Apply it

A patient signs acknowledgment of a clinic's notice and later asks for billing records and a restriction on an insurer disclosure. Route the access request through the designated-record-set process and evaluate the restriction under its own criteria. The signature does not waive these rights or authorize an unrelated release. Train reception staff to recognize both requests and escalate them through the stated privacy contact rather than dismissing them because the notice was signed.

Apply it

A review identifies an employee accessing many unrelated patient records after hours. Preserve the relevant logs, compare activity with assigned duties and investigate through the approved process instead of either ignoring the pattern or immediately declaring intentional misuse.

Apply it

A critical application has an exposed flaw, but its update needs compatibility testing. Restrict the vulnerable pathway where feasible, prioritize testing and deployment, assign an owner and deadline, and verify the final correction rather than leaving a permanent temporary exception.

Apply it

A workstation begins sending unusual outbound traffic while staff are using it. Follow the approved containment process, preserve relevant evidence and provide a safe operational alternative, then investigate affected information and assess any notification duties using the established facts.

Apply it

A clinic requires restoration within four hours and recovery to within thirty minutes before disruption. A two-hour restore from the previous night's backup meets the restoration-time target but fails the data-recovery target, requiring a more current recoverable copy. If an exercise instead reveals unavailable decryption credentials, correct key recovery arrangements and repeat the affected restoration steps. Validate restored information and the supported workflow before declaring recovery successful.

Apply it

A patient pays a provider the full charge for a service and asks that information solely about that service be withheld from the health plan. No law requires the proposed disclosure, which would be for payment or operations. Accept the restriction, flag the affected service and prevent claim submissions or other plan disclosures from including the restricted PHI. By contrast, a request to withhold all future records from every treating provider generally does not require acceptance under this paid-in-full rule; evaluate and communicate that separate request through the restriction process.

Apply it

A proposed export removes names but retains full admission dates, age 94, a city and identifying narrative details. For Safe Harbor, reduce admission dates to year, aggregate the age as 90 or older without retaining dates revealing the exact older age, remove the city and narrative identifiers, and apply the population test before retaining three-digit ZIP codes. Check every identifier category and the actual-knowledge condition before approval.

Apply it

Researchers needing full service dates can receive a qualifying limited data set under a data use agreement, while it remains PHI. If they instead seek de-identified information with details unsuitable for Safe Harbor, a qualified expert must assess the proposed data, anticipated recipients and available linking information and document a very-small-risk determination. Choose the pathway by its criteria and intended use.

Apply it

A modestly priced interface supports result delivery for several departments. Rank it using the consequences of delayed or incorrect information and its dependent workflows, instead of placing it below expensive equipment solely because its replacement cost is low.

Apply it

An assessment identifies a stolen account, excessive permissions and possible record export. Describe the unauthorized actor or event separately from the excessive-permission weakness, then assess how access restrictions and monitoring would change the resulting disclosure scenario.

Apply it

Two systems have the same software flaw, but one is externally reachable and the other has tested isolation. Assess the different exposure and control conditions before assigning likelihood, while checking whether the assumed isolation actually blocks the relevant attack path.

Apply it

An outage could interrupt several departments' access to essential records. Assess affected workflows, expected duration and tested alternatives with service owners, documenting the operational consequences instead of estimating impact solely from the number of records that might be exposed.

Apply it

Before assessing a proposed hosted records service, define whether the decision concerns initial adoption, a specific interface or continuing operation. Include relevant data flows and supplier dependencies, select evidence sources and agree how findings will inform the decision.

Apply it

A committee multiplies likelihood category 4 by impact category 5 and calls the result a financial loss estimate. Explain that the result is a ranking score under its chosen model, then obtain monetary and frequency estimates if financial analysis is needed.

Apply it

A supplier presents a policy requiring terminated accounts to be disabled. To assess operation, examine a suitable sample of terminations, compare disablement records with required timing and investigate exceptions instead of treating the policy approval date as proof of effectiveness.

Apply it

A legacy system remains partly exposed after network restrictions are installed. Reassess the remaining scenario and present it to the authorized owner with alternatives and review triggers, instead of letting the engineer's completed change ticket serve as risk acceptance.

Apply it

A hospital buys coverage for certain incident costs and also restricts an exposed service. Classify the insurance as transfer of covered financial consequences and the restriction as mitigation, then assess remaining operational and privacy consequences requiring further decisions.

Apply it

A supplier begins using a new hosting arrangement after its annual assessment. Review the changed dependencies and information flows promptly, update the relevant risk scenarios and determine whether previous control evidence still supports continued approval.

Apply it

Procurement lists a remote maintenance company as an equipment expense but omits it from security review. Add its administrative access, affected systems, internal owner and service dependency to the supplier inventory, then assign assessment priority based on those exposures.

Apply it

A transcription supplier advertises a single service but sends recordings to an external processing platform. Add that onward flow, relevant storage and access arrangements to the assessment scope before deciding whether existing restrictions and safeguards cover the complete processing chain.

Apply it

A hosted records provider supplies an assurance report covering its corporate office but excluding the production service. Identify the scope gap and obtain relevant production control evidence before approving the provider to maintain patient information.

Apply it

A scheduling supplier requests permission to add diagnostic information to its existing dataset. Reassess the expanded purpose, sensitivity, access and contractual restrictions before permitting the change, even though the supplier's routine review is several months away.

Apply it

A billing business associate hires a subcontractor to host claim records. Verify that the downstream arrangement carries the applicable PHI restrictions, safeguards and reporting obligations, rather than relying solely on the hospital's original contract with the billing company.

Apply it

A supplier promises to remove former staff access within a month. Track the commitment, require interim safeguards and examine disablement evidence at completion, including whether the revised process works for subsequent departures before closing the finding.

Apply it

A supplier reports unauthorized access but cannot yet identify affected records. Activate agreed contacts, preserve relevant evidence, request scope and containment updates, and begin organizational assessment without waiting for the supplier's final report to coordinate necessary actions.

Apply it

A departing business associate demonstrates that specified retained backup information cannot feasibly be returned or destroyed. Document the affected information and basis, extend contractual protections and restrict further use to the purpose causing infeasibility while revoking unnecessary operational access.