Certified in Healthcare Privacy and Security (CHPS) — Questions and Answers

Question 1: A covered entity discovers that a workforce member has been snooping on celebrity patient records over the past year. How many breaches does this represent?

A single breach because it involves one workforce member
No breach if the workforce member did not disclose the information to anyone
One breach per patient record impermissibly accessed (Correct answer)
One breach per year

Correct answer: One breach per patient record impermissibly accessed

Each patient's record that was impermissibly accessed represents a separate potential breach requiring individual analysis under the four-factor risk assessment.

Question 2: A healthcare organization discovers that an employee's workstation has been accessed by an unauthorized user. According to the HIPAA Security Rule, this should be documented under which process?

Information Access Management
Workforce Clearance Procedure
Contingency Plan
Security Incident Procedures (Correct answer)

Correct answer: Security Incident Procedures

Security Incident Procedures require covered entities to document and respond to suspected or known security incidents, including unauthorized access events.

Question 3: A healthcare organization is evaluating a mobile health (mHealth) app that will access patient ePHI. Under HIPAA, which consideration is MOST critical before deployment?

Whether the app has at least 4 stars in the app store
Whether the app vendor has signed a BAA and the app uses appropriate encryption and access controls (Correct answer)
Whether the app has been approved by the FDA
Whether the app is available on both iOS and Android platforms

Correct answer: Whether the app vendor has signed a BAA and the app uses appropriate encryption and access controls

Before deploying any mHealth app that accesses ePHI, the vendor must execute a BAA and the app must implement appropriate safeguards including encryption and access controls.

Question 4: Which of the following best describes the concept of 'integrity' in the context of the HIPAA Security Rule?

Ensuring ePHI is accessible to authorized users when needed
Protecting ePHI from improper alteration or destruction (Correct answer)
Encrypting ePHI during transmission over open networks
Restricting ePHI access to only authorized workforce members

Correct answer: Protecting ePHI from improper alteration or destruction

Integrity under HIPAA Security Rule means that ePHI has not been altered or destroyed in an unauthorized manner, preserving its accuracy and completeness.

Question 5: Under the HIPAA Security Rule, what is the purpose of the 'Assigned Security Responsibility' standard?

Determining which workforce members require security awareness training
Designating a person responsible for developing and implementing security policies and procedures (Correct answer)
Classifying ePHI data by sensitivity level for access control
Assigning unique IDs to all workforce members accessing ePHI

Correct answer: Designating a person responsible for developing and implementing security policies and procedures

The Assigned Security Responsibility standard (45 CFR §164.308(a)(2)) requires covered entities to identify a Security Officer responsible for security policies and procedures.

Question 6: A new business partner was employed by a covered organization. The business associate asked the covered entity to sign the contract provided by the vendor during the assessment of the business associates agreement. Is this a proper procedure?

Access establishment and modifications
All electronic systems
Yes, the covered entity must review the documentation in the business associate agreement and agree to it (Correct answer)
Device controls

Correct answer: Yes, the covered entity must review the documentation in the business associate agreement and agree to it

Yes — the covered entity is responsible for reviewing the terms of a Business Associate Agreement and agreeing to them before signing, so reviewing the vendor-provided contract is proper procedure. The other options reference Security Rule administrative controls, not the BAA review process.

Question 7: Under HIPAA's right to request restrictions, when is a covered entity REQUIRED to agree to a patient's restriction request?

When the restriction involves disclosures to a family member
Covered entities are never required to agree to restriction requests
When the treating physician supports the restriction
When the patient requests restriction on disclosure to a health plan for services the patient paid out-of-pocket in full (Correct answer)

Correct answer: When the patient requests restriction on disclosure to a health plan for services the patient paid out-of-pocket in full

Under the HITECH-amended HIPAA rules, covered entities must honor restrictions when the patient has paid out-of-pocket in full and requests the restriction to a health plan.

Question 8: When a business associate discovers a breach of PHI, within what timeframe must it notify the covered entity?

Without unreasonable delay and within 60 days of discovery (Correct answer)
Within 30 days of discovery
Immediately, with no delay
Within 24 hours of discovery

Correct answer: Without unreasonable delay and within 60 days of discovery

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days following discovery.

Question 9: A healthcare organization uses a cloud-based EHR. Under HIPAA, which type of agreement must be in place with the cloud provider?

Data Governance Agreement (DGA)
Business Associate Agreement (BAA) (Correct answer)
Service Level Agreement (SLA)
Non-Disclosure Agreement (NDA)

Correct answer: Business Associate Agreement (BAA)

Cloud providers that create, receive, maintain, or transmit ePHI on behalf of a covered entity are business associates and must have a BAA in place.

Question 10: What does the Evaluation standard under the HIPAA Security Rule's Administrative Safeguards require a covered entity to perform?

An annual third-party audit of all ePHI systems
A formal penetration test of all network-connected devices
A review of all workforce access logs on a quarterly basis
Periodic technical and non-technical evaluations of the security policies and procedures in response to environmental or operational changes (Correct answer)

Correct answer: Periodic technical and non-technical evaluations of the security policies and procedures in response to environmental or operational changes

The Evaluation standard requires covered entities to periodically assess how well their security policies and procedures meet the Security Rule requirements, particularly after operational or environmental changes.

Question 11: Under the HIPAA Security Rule, what distinguishes a 'required' implementation specification from an 'addressable' one?

Required specifications must be implemented as stated; addressable ones must be implemented, modified, or documented as not applicable with justification (Correct answer)
Required specifications must be audited annually; addressable ones are optional
Required specifications are technical controls; addressable ones are administrative controls
Required specifications apply only to hospitals; addressable ones apply to all covered entities

Correct answer: Required specifications must be implemented as stated; addressable ones must be implemented, modified, or documented as not applicable with justification

Required specifications must be implemented exactly as described, while addressable specifications allow covered entities to assess whether the standard is reasonable and appropriate, implement an equivalent alternative, or document why it is not applicable.

Question 12: Which of the following is a key component of an effective healthcare privacy training program?

Training is only required for workforce members who handle paper records
Training should be role-based, addressing the specific PHI access and risks for each job function (Correct answer)
All workforce members should receive identical training content regardless of their role
Training should occur only at onboarding and need not be repeated

Correct answer: Training should be role-based, addressing the specific PHI access and risks for each job function

Effective privacy training is role-based, tailoring content to the specific privacy risks and PHI handling responsibilities of each workforce role.

Question 13: Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules?

Office of the National Coordinator for Health Information Technology (ONC)
Centers for Medicare & Medicaid Services (CMS)
HHS Office for Civil Rights (OCR) (Correct answer)
Federal Trade Commission (FTC)

Correct answer: HHS Office for Civil Rights (OCR)

The HHS Office for Civil Rights (OCR) is the primary federal agency responsible for enforcing the HIPAA Privacy, Security, and Breach Notification Rules.

Question 14: A covered company has been asked in writing to postpone notifying the public of a data breach because it would complicate an investigation. How long may the covered entity delay sending the notice?

By the amount time specified in the request. (Correct answer)
Implement based on organizational assessment
Designated record set
Who is accessing information for business needs within the organization

Correct answer: By the amount time specified in the request.

Under the HIPAA Breach Notification Rule, if law enforcement provides a written statement that notification would impede an investigation, the covered entity must delay only for the specific time period stated in that request. The other options describe access-control or record-set concepts unrelated to a notification delay.

Question 15: Under the HIPAA Breach Notification Rule, what is the presumption when an impermissible use or disclosure of PHI occurs?

The event is presumed to be a security incident requiring criminal referral
The event is presumed to be a breach unless the covered entity demonstrates low probability of PHI compromise (Correct answer)
The event requires immediate notification to all affected individuals
The event is presumed harmless unless the patient files a complaint

Correct answer: The event is presumed to be a breach unless the covered entity demonstrates low probability of PHI compromise

Under the 2013 Omnibus Rule, an impermissible use or disclosure is presumed to be a breach unless a covered entity can demonstrate through a four-factor risk assessment that there is a low probability the PHI was compromised.

Question 16: A risk analysis under the HIPAA Security Rule must identify threats to the confidentiality, integrity, and availability of ePHI. Which document type formally captures this assessment?

Workforce Training Record
Risk Assessment Report (Correct answer)
Notice of Privacy Practices
Business Associate Agreement

Correct answer: Risk Assessment Report

The Risk Assessment Report documents identified threats, vulnerabilities, likelihood, and impact, fulfilling the Security Rule's requirement for a formal, documented risk analysis.

Question 17: How frequently must a covered entity review and update its security policies and procedures under the HIPAA Security Rule?

Periodically, and in response to environmental or operational changes that affect ePHI security (Correct answer)
Annually on a fixed calendar schedule
Every three years as part of a formal certification cycle
Only when a breach or security incident occurs

Correct answer: Periodically, and in response to environmental or operational changes that affect ePHI security

The Security Rule requires covered entities to review and update policies periodically and whenever environmental or operational changes affect the security of ePHI, rather than on a fixed schedule.

Question 18: A covered entity would save a copy of the letter used for notification, a list of all the people informed, and the notification date in the event that a data breach happened. As an illustration of

Burden of proof (Correct answer)
Limited data set
Civil action
Certiorari power

Correct answer: Burden of proof

The retention of a copy of a breach notification letter, a list of individuals notified, and the date of notification is an example of documentation related to breach notification requirements.

Question 19: What is the primary purpose of a healthcare organization's sanctions policy under HIPAA?

To document procedures for reporting breaches to HHS
To create a framework for denying patient access requests
To establish financial penalties for patients who misuse the patient portal
To define consequences for workforce members who violate privacy and security policies (Correct answer)

Correct answer: To define consequences for workforce members who violate privacy and security policies

The sanctions policy (required by 45 CFR §164.530(e)) defines appropriate disciplinary actions for workforce members who fail to comply with privacy and security policies.

Question 20: A healthcare organization's security team detects unusual after-hours access to the EHR from a nurse's account. Which NIST Incident Response phase should they initiate FIRST?

Containment (Correct answer)
Recovery
Detection and Analysis
Eradication

Correct answer: Containment

Upon detecting a potential incident, the immediate priority is Containment to prevent further unauthorized access while the team assesses the scope of the incident.

Question 21: Under HIPAA, which of the following PHI disposal methods is considered a safe harbor that renders a breach not reportable?

Moving PHI to a secure internal archive
Deleting files from a computer hard drive
Proper destruction (shredding, degaussing) rendering PHI unreadable or indecipherable (Correct answer)
Applying password protection to PHI files

Correct answer: Proper destruction (shredding, degaussing) rendering PHI unreadable or indecipherable

PHI that has been rendered unreadable, indecipherable, or destroyed through proper methods (shredding paper, degaussing/purging media) is excluded from breach notification requirements.

Question 22: What is the primary purpose of a risk analysis under the HIPAA Security Rule?

To validate encryption key management procedures
To identify and assess threats, vulnerabilities, and risks to ePHI confidentiality, integrity, and availability (Correct answer)
To create an audit trail for all ePHI access events
To document all workforce members with access to ePHI

Correct answer: To identify and assess threats, vulnerabilities, and risks to ePHI confidentiality, integrity, and availability

A risk analysis identifies and assesses potential threats and vulnerabilities to ePHI to determine the likelihood and impact of security incidents.

Question 23: A hospital's EHR system sends a patient summary to a referring physician via unsecured email. Under the HIPAA Security Rule, which standard is most directly violated?

Audit Controls
Integrity Controls
Transmission Security (Correct answer)
Access Control

Correct answer: Transmission Security

Transmission Security (45 CFR §164.312(e)) requires covered entities to guard against unauthorized access to ePHI transmitted over electronic communications networks.

Question 24: Which HIPAA Security Rule standard requires covered entities to implement policies to prevent, detect, contain, and correct security violations?

Security Incident Procedures
Evaluation
Security Management Process (Correct answer)
Workforce Training and Awareness

Correct answer: Security Management Process

The Security Management Process standard (45 CFR §164.308(a)(1)) is the overarching standard requiring risk analysis, risk management, sanction policy, and activity review.

Question 25: A hospital's Security Officer discovers that a workforce member accessed patient records without a valid treatment, payment, or operations reason. This is BEST described as:

A business associate agreement breach
A security incident requiring breach notification
A required disclosure under HIPAA
A workforce sanction policy violation (Correct answer)

Correct answer: A workforce sanction policy violation

Inappropriate access by workforce members without authorization violates the workforce sanction policy, which covered entities must have in place under the HIPAA Security Rule.

Question 26: Under the HIPAA Security Rule, what must a covered entity do when it terminates a workforce member's employment?

Only notify the Privacy Officer of the termination
Archive the employee's ePHI access logs for 6 years
Implement a termination procedure that includes removal of system access (Correct answer)
Submit a workforce change notification to HHS

Correct answer: Implement a termination procedure that includes removal of system access

Workforce Security standards require covered entities to implement termination procedures including removing system access to prevent unauthorized use of ePHI post-employment.

Question 27: In healthcare privacy program management, what is the purpose of conducting periodic privacy audits?

To generate reports for public disclosure on the organization's website
To satisfy state licensing requirements for hospital accreditation
To verify ongoing compliance with privacy policies, identify gaps, and drive continuous improvement (Correct answer)
To replace the annual privacy training requirement

Correct answer: To verify ongoing compliance with privacy policies, identify gaps, and drive continuous improvement

Privacy audits verify that policies are being followed, identify compliance gaps and risks, and provide data to drive program improvement over time.

Question 28: What is the maximum civil monetary penalty under HIPAA for violations due to willful neglect that are not corrected?

$250,000 per violation with no annual cap
$50,000 per violation up to $1.5 million per year (Correct answer)
$10,000 per violation up to $250,000 per year
$100,000 per violation up to $1.5 million per year

Correct answer: $50,000 per violation up to $1.5 million per year

Willful neglect violations not corrected carry penalties of $50,000 per violation up to a maximum of $1.5 million per calendar year for identical violations.

Question 29: Which framework is most widely used by healthcare organizations to build a comprehensive privacy program structure?

Generally Accepted Privacy Principles (GAPP) (Correct answer)
COBIT 5 for Information Security
NIST Cybersecurity Framework (CSF)
ISO/IEC 27001

Correct answer: Generally Accepted Privacy Principles (GAPP)

GAPP, developed by the AICPA and CICA, provides 10 privacy principles widely used as a framework for building privacy programs in healthcare and other sectors.

Question 30: Which of the following best describes a 'zero trust' security model in the context of healthcare IT?

Trusting only clinicians and denying access to administrative staff
Trusting all internal network traffic since it is inside the firewall perimeter
Removing all user access to clinical systems as the default state
Requiring continuous verification of every user, device, and connection regardless of network location (Correct answer)

Correct answer: Requiring continuous verification of every user, device, and connection regardless of network location

Zero trust operates on the principle of 'never trust, always verify' — every access request is authenticated and authorized regardless of network origin.

Certified in Healthcare Privacy and Security (CHPS)

The CHPS credential, awarded by AHIMA, validates expertise in healthcare privacy and security program management, HIPAA compliance, information technology safeguards, and regulatory enforcement across healthcare organizations.

150

Questions

210 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

ahima.org — Test delivery, fees, exam format, passing score, test dates, score validity, score release · verified Oct 2026