The Certified HIPAA Professional (CHP) credential is the leading certification for healthcare compliance officers, privacy officers, IT security staff, and anyone responsible for implementing or auditing HIPAA compliance at a covered entity or business associate. Awarded by the American Academy of HIPAA Compliance (AAHC), the CHP demonstrates comprehensive knowledge of the HIPAA Privacy Rule, Security Rule, Breach Notification Rule, Business Associate Agreements, HITECH Act enforcement, and the operational steps required to build and maintain a compliant organization.
This CHP practice test PDF provides targeted exam preparation across all major HIPAA domains. The questions are written at the difficulty level of the actual CHP exam — testing not just rule citations but applied judgment: how to respond to a breach, when a Business Associate Agreement is required, which technical safeguards address a specific threat, and how to document a risk analysis. Studying these questions offline before taking an interactive timed practice test gives you dual-mode preparation that reinforces retention and exam pacing simultaneously.
The HIPAA Privacy Rule establishes national standards for the protection of Protected Health Information (PHI) — any individually identifiable health information held or transmitted by a covered entity or its business associates. PHI includes name, address, dates (other than year), phone numbers, Social Security numbers, account numbers, and 15 other identifiers when linked to health, treatment, or payment information. De-identification removes all 18 identifiers, after which information is no longer subject to the Privacy Rule.
The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI access to the information actually needed for a particular purpose. Workforce members should access only the PHI required for their job function. Treatment providers are exempt from the minimum necessary standard when sharing PHI for treatment purposes — a physician can share a complete medical record with a consulting specialist without applying minimum necessary analysis. This exemption is tested frequently because it is counterintuitive given how strictly the standard applies in other contexts.
Patient rights under the Privacy Rule include the right to access and receive copies of their PHI within 30 days (extendable by 30 days with notice), the right to request amendment of inaccurate records, the right to an accounting of disclosures for purposes other than treatment, payment, or operations (TPO), and the right to request restrictions on certain uses or disclosures. The 2013 Omnibus Rule updated access rights to include electronic copies of electronic PHI and to require covered entities to honor requests that PHI not be disclosed to health plans for self-pay services that were paid out of pocket in full.
The Security Rule applies exclusively to Electronic Protected Health Information (ePHI) — PHI that is created, received, maintained, or transmitted in electronic form. It requires covered entities and business associates to implement three categories of safeguards. Administrative safeguards include the security management process (the foundational requirement), workforce training, information access management, security incident procedures, and contingency planning. The risk analysis is the cornerstone: organizations must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability.
Physical safeguards address the physical access to systems containing ePHI. Required implementations include facility access controls (locks, key cards, visitor logs), workstation use policies (clear screen, automatic logoff), workstation security (cable locks, positioning to prevent shoulder surfing), and device and media controls (policies for disposing of hardware and media containing ePHI — including hard drives, USB drives, and printed output that was scanned). Many organizations use NIST 800-88 standards for media sanitization as a defensible method for meeting this requirement.
Technical safeguards require access controls (unique user IDs, automatic logoff, encryption for remote access), audit controls (hardware and software activity logs for systems containing ePHI), integrity controls (mechanisms to confirm ePHI has not been altered or destroyed improperly), and transmission security (encrypting ePHI in transit over open networks). Encryption is an addressable implementation specification — not technically required if the organization documents an equivalent alternative — but in practice, encryption of data at rest and in transit is the overwhelming industry standard. The distinction between required and addressable specifications is a high-frequency CHP exam topic.
The Breach Notification Rule requires covered entities to notify affected individuals, the HHS Secretary, and (in some cases) prominent media outlets when unsecured PHI is breached. Individual notification must occur within 60 days of discovery. HHS notification is submitted via the HHS breach portal — breaches affecting 500 or more individuals in a state must be reported to both HHS and local media within 60 days; breaches affecting fewer than 500 individuals may be logged annually and submitted by March 1 of the following year. Business associates must notify covered entities within 60 days of discovery, after which the covered entity's 60-day clock begins.
The four-factor risk assessment determines whether an incident constitutes a reportable breach: the nature and extent of PHI involved, the identity of the person who used or received the PHI, whether PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. If a low probability of compromise is demonstrated across all four factors, the incident may be classified as not a breach — but this analysis must be documented. Improper documentation of the four-factor assessment is itself an enforcement finding.
Business Associate Agreements (BAAs) are required before a covered entity shares PHI with any vendor or contractor that creates, receives, maintains, or transmits PHI on its behalf. The BAA must specify the permitted and required uses and disclosures of PHI, require the business associate to implement appropriate safeguards, require reporting of breaches and security incidents, and ensure the business associate's subcontractors sign equivalent agreements. Under HITECH, business associates are directly liable for compliance with the Security Rule and the applicable portions of the Privacy Rule — BAAs are not merely contractual formalities but legally enforceable obligations.
The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted in 2009, dramatically increased HIPAA enforcement. Civil monetary penalties are now tiered by culpability: unknowing violations carry $100–$50,000 per violation (up to $1.5M per violation category per year); reasonable cause violations carry $1,000–$50,000; willful neglect corrected within 30 days carries $10,000–$50,000; willful neglect not corrected carries a mandatory $50,000 per violation. HHS Office for Civil Rights (OCR) investigates complaints, conducts compliance reviews, and has collected over $135 million in settlements since HITECH strengthened enforcement authority.
Building a compliant HIPAA program requires seven core elements: a designated Privacy Officer and Security Officer, documented policies and procedures for each Rule, workforce training at hire and regularly thereafter, a completed and documented risk analysis with a risk management plan to address identified gaps, a sanction policy for workforce members who violate HIPAA, ongoing monitoring and auditing of access logs and safeguards, and a documented process for receiving and responding to complaints. The CHP exam tests whether candidates can identify which program element addresses a specific compliance failure — for example, recognizing that repeated workforce access violations indicate a gap in the sanction policy or training program rather than a technical safeguard failure.
After working through this PDF, reinforce your preparation with the CHP practice test on PracticeTestGeeks. The online exam delivers the same core question bank in a timed, scored format that replicates the actual CHP testing experience — giving you both the conceptual depth from offline study and the pacing confidence from timed practice. Together, these two preparation formats cover every high-frequency domain on the Certified HIPAA Professional exam.