CHPC Certified in Healthcare Privacy Compliance Practice Test PDF (Free Printable 2026)
🔎 Pass the CHPC Certified in Healthcare Privacy exam with confidence. Practice questions with detailed explanations and instant feedback on every answer.
Free CHPC Practice Test PDF Download
The CHPC (Certified in Healthcare Privacy Compliance) credential is awarded jointly by the Health Care Compliance Association (HCCA) and the Society of Corporate Compliance and Ethics (SCCE). It validates mastery of HIPAA Privacy, Security, and Breach Notification rules, state privacy laws, 42 CFR Part 2, healthcare fraud statutes, and privacy program development. Our free printable PDF gives you a curated set of exam-style questions you can study anywhere — no internet required.
Print the PDF, work through every question, then check your answers on the last page. Pair it with the online CHPC practice test for timed simulation and instant scoring.
What the CHPC Exam Covers
HIPAA Privacy Rule
Questions test covered entities, business associates, and the PHI definition. You must know the minimum necessary standard, permitted uses and disclosures for treatment/payment/operations versus those requiring written authorization, and patient rights including access, amendment, accounting of disclosures, and restriction requests.
HIPAA Security Rule
The exam addresses all three safeguard categories. Administrative safeguards include risk analysis, workforce training, and access management. Physical safeguards cover facility access controls and workstation security. Technical safeguards encompass access controls, audit controls, and encryption standards.
Breach Notification Rule
Know the legal definition of a breach, the three exceptions (inadvertent access, good-faith belief, redisclosure), and the notification timelines: 60 days to affected individuals, annual reporting to HHS for small breaches, and prompt reporting for large breaches affecting 500 or more individuals.
State Privacy Laws and 42 CFR Part 2
State laws that are more stringent than HIPAA preempt the federal standard. The CHPC exam references California CMIA, mental health records, and HIV records as examples. Substance use disorder records under 42 CFR Part 2 require specific patient consent for each disclosure — a stricter standard than HIPAA.
Healthcare Fraud Laws
The False Claims Act includes qui tam provisions that allow whistleblowers to sue on behalf of the government. The Anti-Kickback Statute has defined safe harbors. The Stark Law prohibits physician self-referral for designated health services unless an exception applies.
Privacy Program Development
Expect questions on the privacy officer role, building training programs, drafting policies and procedures, conducting privacy risk assessments, and designing incident response procedures. The exam also covers HIPAA authorization requirements for research, IRB oversight, and the two de-identification standards: Safe Harbor and Expert Determination.
- ✓Memorize PHI definition and the 18 HIPAA identifiers
- ✓Know permitted uses/disclosures for TPO vs. those requiring authorization
- ✓Review all six patient rights under the HIPAA Privacy Rule
- ✓Study the three categories of HIPAA Security Rule safeguards and their specifications
- ✓Understand breach definition, the three exceptions, and all notification timelines
- ✓Compare state privacy laws (CA CMIA, mental health, HIV) against HIPAA floor
- ✓Master 42 CFR Part 2 consent requirements for substance use disorder records
- ✓Review False Claims Act qui tam provisions and whistleblower protections
- ✓Know Anti-Kickback Statute safe harbors and Stark Law self-referral exceptions
- ✓Study de-identification: Safe Harbor (18 identifiers removed) vs. Expert Determination method
Free CHPC Practice Tests Online
The PDF is ideal for offline review, but timed online testing builds the exam stamina you need on test day. Use the CHPC practice test to simulate real exam conditions, review answer explanations, and identify the topics that need the most attention before your scheduled exam date.
- +Industry-recognized credential boosts your resume
- +Higher earning potential (10-20% salary increase on average)
- +Demonstrates commitment to professional development
- +Opens doors to advanced career opportunities
- −Exam preparation requires significant time investment (4-8 weeks)
- −Certification fees can be $100-$400+
- −May require continuing education to maintain
- −Some employers may not require certification
Sample CHPC - Certified in Healthcare Privacy Compliance Practice Questions
Try these questions from our free CHPC - Certified in Healthcare Privacy Compliance practice tests. The correct answer and an explanation follow each question.
If a covered entity denies a patient's amendment request, what must the entity provide?
- A. Written denial with the basis and information about filing a statement of disagreement
- B. Only a verbal explanation to the patient
- C. An immediate second review by a supervisor
- D. Nothing, as denials need no documentation
Answer: A. Written denial with the basis and information about filing a statement of disagreement
When denying an amendment, the covered entity must provide a written denial that includes the basis for denial and the patient's right to submit a statement of disagreement.
What distinguishes a limited data set from fully de-identified data under HIPAA?
- A. A limited data set retains more direct identifiers than de-identified data
- B. A limited data set may retain indirect identifiers such as dates and city-level geographic data
- C. A limited data set requires stricter physical safeguards than fully identified PHI
- D. A limited data set can only be used for treatment, not research or operations
Answer: B. A limited data set may retain indirect identifiers such as dates and city-level geographic data
Unlike fully de-identified data, a limited data set may retain indirect identifiers like dates, ages, and geographic data at the city, state, or ZIP code level, while all direct identifiers must be removed.
Which right allows patients to receive a list of disclosures of their PHI made by a covered entity in the past six years?
- A. Right of accounting of disclosures
- B. Right of access
- C. Right to restrict
- D. Right to amend
Answer: A. Right of accounting of disclosures
The HIPAA right of accounting of disclosures allows individuals to request a log of certain PHI disclosures made without their authorization.
A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?
- A. The name of the specific workforce member who caused the breach.
- B. A brief description of the steps individuals should take to protect themselves from potential harm.
- C. A formal apology from the organization's CEO.
- D. An offer of at least one year of complimentary credit monitoring services.
Answer: B. A brief description of the steps individuals should take to protect themselves from potential harm.
The HIPAA Breach Notification Rule at 45 CFR § 164.404(c) specifies the required content for individual notifications. This includes a brief description of the breach, a description of the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of what the covered entity is doing to investigate and mitigate harm, and contact procedures. While offering credit monitoring is a common best practice, it is not explicitly mandated by the rule itself.
Take the full CHPC - Certified in Healthcare Privacy Compliance practice test
Join the Discussion
Connect with other students preparing for this exam. Share tips, ask questions, and get advice from people who have been there.
View discussion (8 replies)