Certified in Healthcare Privacy Compliance (CHPC) — Questions and Answers

Question 1: Under the HIPAA Safe Harbor method, full 5-digit ZIP codes must generally be removed. Under what specific condition may the first three digits of a ZIP code be retained?

When the data is being used solely for internal quality improvement
When the covered entity has obtained a waiver from HHS
When the geographic unit formed by the first three digits contains more than 20,000 people (Correct answer)
When the ZIP code belongs to a rural county with fewer than 1,000 residents

Correct answer: When the geographic unit formed by the first three digits contains more than 20,000 people

Safe Harbor permits retaining the first three digits of a ZIP code only if the corresponding geographic unit contains more than 20,000 people; otherwise, the digits must be replaced with '000'.

Question 2: A hospital's IT department detects unusual network traffic on June 1st. They begin an investigation and on June 10th, they confirm that an unauthorized third party accessed a server containing ePHI. The Privacy Officer is informed on June 11th. For the purposes of the HIPAA Breach Notification Rule, what is the date of "discovery" of the breach?

June 1st, the date the first indication of a potential breach was detected. (Correct answer)
The date the first affected patient is successfully notified.
June 11th, the date the Privacy Officer was officially informed.
June 10th, the date unauthorized access was confirmed.

Correct answer: June 1st, the date the first indication of a potential breach was detected.

The date of discovery is defined as the first day on which a breach is known to the covered entity, or, by exercising reasonable diligence, would have been known to the covered entity. This includes knowledge held by any member of the workforce or agent. Therefore, the discovery date is June 1st, when the IT department first detected the anomaly. The 60-day notification clock starts from this date.

Question 3: Which of the following is a best practice when conducting internal investigations into compliance complaints?

Documenting all steps, findings, and conclusions of the investigation (Correct answer)
Allowing the subject of the investigation to review all evidence in real time
Informing external regulators before the investigation is completed
Interviewing only the complainant to maintain confidentiality

Correct answer: Documenting all steps, findings, and conclusions of the investigation

Thorough documentation is a best practice for internal investigations because it provides a clear, defensible record of the entire process. This includes documenting the complaint, investigation steps, evidence collected, interviews conducted, findings, and conclusions. Such documentation is vital for demonstrating due diligence, supporting corrective actions, and responding to potential regulatory inquiries.

Question 4: Under the Expert Determination method of de-identification, what must the qualified expert certify?

That the risk of identifying any individual is very small using generally accepted statistical principles (Correct answer)
That the data has been encrypted using FIPS 140-2 compliant algorithms
That all 18 Safe Harbor identifiers have been removed
That the dataset contains fewer than 100 records

Correct answer: That the risk of identifying any individual is very small using generally accepted statistical principles

Under Expert Determination, a person with statistical or scientific knowledge must apply generally accepted principles and document that the probability of identifying an individual is very small.

Question 5: A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025. The clinic provides timely notification to the affected individuals. What is the latest date the clinic must notify the Secretary of HHS?

Within 60 days of the end of the 2025 calendar year. (Correct answer)
Within 60 days of discovering the breach.
Immediately, but no later than 30 business days from discovery.
Notification to HHS is not required for breaches affecting fewer than 500 individuals.

Correct answer: Within 60 days of the end of the 2025 calendar year.

For breaches affecting fewer than 500 individuals, a covered entity must notify the Secretary of HHS of such breaches annually. These reports are due no later than 60 days after the end of the calendar year in which the breaches were discovered.

Question 6: A Privacy Officer is developing a policy based on the 'Minimum Necessary' standard. Which of the following scenarios best demonstrates the correct application of this HIPAA principle?

Providing a health insurance company with a patient's complete medical history to process a claim for a single office visit.
Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims. (Correct answer)
Releasing a patient's name and general condition to a reporter without the patient's authorization.
Allowing the entire nursing staff to have full access to all patient electronic health records to ensure efficient care.

Correct answer: Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims.

The 'Minimum Necessary' standard, a key principle of the HIPAA Privacy Rule, requires covered entities to take reasonable steps to limit the use or disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose. Granting a billing clerk access only to the specific data elements required for their job function is a perfect example of this role-based access control. The other options represent overly broad disclosures of PHI.

Question 7: A hospital discovers that a former employee accessed the medical records of a celebrity patient without a valid reason after their employment was terminated. According to the HIPAA Breach Notification Rule, what is the hospital's primary obligation after containing the incident and performing a risk assessment?

Notify the affected individual, the Secretary of HHS, and potentially the media without unreasonable delay. (Correct answer)
Only notify the hospital's legal counsel to prepare for a potential lawsuit.
Wait for the celebrity patient to contact the hospital with a complaint.
Terminate the employee's supervisor for lack of oversight.

Correct answer: Notify the affected individual, the Secretary of HHS, and potentially the media without unreasonable delay.

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay, and in no case later than 60 days, following the discovery of a breach of unsecured PHI. If the breach affects 500 or more individuals, the Secretary of HHS must be notified concurrently, and prominent media outlets serving the area must also be notified. Waiting for a complaint or only notifying legal counsel would violate these federal requirements.

Question 8: Which document formally authorizes a business associate to use PHI for a purpose not specified in the original BAA?

A BAA amendment or addendum signed by both parties (Correct answer)
An internal policy change by the business associate
A verbal agreement between the privacy officers
A notification to HHS OCR

Correct answer: A BAA amendment or addendum signed by both parties

Any new permitted use or disclosure of PHI outside the original BAA scope requires a written amendment or addendum executed by both the covered entity and the business associate.

Question 9: A patient's right to access their PHI under HIPAA applies to which of the following?

Only billing records
Any document mentioning the patient anywhere in the facility
Only physician-authored notes
A designated record set maintained by the covered entity (Correct answer)

Correct answer: A designated record set maintained by the covered entity

The right of access applies specifically to PHI contained in a designated record set, which includes medical records and billing records used for decisions about the individual.

Question 10: A hospital's privacy officer is reviewing contracts with a new telehealth platform vendor. The vendor claims it is a 'conduit' and does not need a BAA. The privacy officer should:

File a complaint with HHS before proceeding
Require only a confidentiality agreement instead of a BAA
Evaluate whether the vendor stores or accesses PHI content beyond mere transmission before accepting the conduit claim (Correct answer)
Accept the vendor's claim and proceed without a BAA

Correct answer: Evaluate whether the vendor stores or accesses PHI content beyond mere transmission before accepting the conduit claim

The conduit exception is narrow and applies only to entities that transport PHI without accessing its content; a telehealth platform that processes or stores PHI does not qualify.

Question 11: A research institution wants to use a dataset containing PHI for a study. To comply with HIPAA, they must de-identify the data. Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?

The Minimum Necessary Standard
The Safe Harbor Method
The Expert Determination Method (Correct answer)
The Data Use Agreement Method

Correct answer: The Expert Determination Method

The HIPAA Privacy Rule provides two methods for de-identification. The Expert Determination Method involves a qualified expert applying statistical or scientific principles to determine that the risk is 'very small' that the information could be used to identify an individual. The Safe Harbor method involves removing 18 specific identifiers.

Question 12: Which format must a covered entity use when a patient requests an electronic copy of PHI maintained in an electronic health record (EHR)?

The entity's preferred internal format
Plain text only
Only PDF format regardless of request
The format requested by the patient, if readily producible (Correct answer)

Correct answer: The format requested by the patient, if readily producible

Covered entities must provide the electronic copy in the format requested by the patient if it is readily producible; otherwise, they must offer an agreed-upon alternative.

Question 13: Which of the following activities would be considered part of an effective compliance training program?

Providing role-specific compliance training for employees (Correct answer)
Offering training in multiple formats (e.g., in-person, online modules) (Correct answer)
Annual training on HIPAA and other applicable regulations (Correct answer)
Making attendance optional for senior leadership

Correct answer: Providing role-specific compliance training for employees

An effective compliance training program mandates regular, comprehensive training for all employees on relevant laws and regulations, such as HIPAA. Annual training ensures ongoing awareness and understanding of compliance obligations, keeping staff informed about current requirements and organizational policies. This consistent education is foundational to fostering a culture of compliance.

Question 14: Which of the following scenarios would NOT be considered a HIPAA violation?

A billing clerk accesses a patient’s record without a legitimate need
A nurse discusses a patient’s condition with a friend without authorization
A doctor shares PHI with a business associate under a signed Business Associate Agreement (BAA) (Correct answer)
A receptionist leaves a list of patient names and phone numbers in a public area

Correct answer: A doctor shares PHI with a business associate under a signed Business Associate Agreement (BAA)

A doctor sharing PHI with a business associate under a signed Business Associate Agreement (BAA) is not considered a HIPAA violation. A BAA is a legally required contract that ensures the business associate will appropriately safeguard the PHI they receive or create on behalf of the covered entity. This agreement allows for necessary data sharing while maintaining HIPAA compliance.

Question 15: A deceased patient's executor requests access to the decedent's medical records. HIPAA allows covered entities to disclose this PHI to:

A personal representative of the decedent, such as an executor (Correct answer)
No one; all PHI expires at death
Only the decedent's physician
Law enforcement only

Correct answer: A personal representative of the decedent, such as an executor

HIPAA permits disclosure of a decedent's PHI to their personal representative, such as an executor or administrator of the estate.

Question 16: What is the main purpose of the HIPAA Privacy Rule?

To establish national standards for protecting individuals’ medical records and PHI (Correct answer)
To prevent fraud and abuse in healthcare
To create standardized electronic health record (EHR) systems
To ensure healthcare organizations have strong cybersecurity controls

Correct answer: To establish national standards for protecting individuals’ medical records and PHI

The main purpose of the HIPAA Privacy Rule is to establish national standards for protecting individuals' medical records and other Protected Health Information (PHI). It grants patients rights over their health information, including the right to access and amend their records, and sets limits on who can access and use PHI. This rule ensures the confidentiality and security of sensitive patient data across the healthcare industry.

Question 17: Under HIPAA, psychotherapy notes receive special protection. Which statement best describes this?

They are treated identically to other medical records
They may be accessed freely for treatment purposes without any restriction
They are excluded from HIPAA coverage entirely
They require a separate, specific authorization from the patient for most disclosures (Correct answer)

Correct answer: They require a separate, specific authorization from the patient for most disclosures

Psychotherapy notes are separately defined and require a specific patient authorization for most disclosures, beyond the general authorization used for other PHI.

Question 18: Under the Expert Determination method, what documentation must the expert maintain to support the de-identification determination?

An audit log of all workforce members who accessed the dataset
A Business Associate Agreement with the covered entity
A signed authorization from every patient whose data is included
Documentation of the methods and results supporting the very small risk determination (Correct answer)

Correct answer: Documentation of the methods and results supporting the very small risk determination

HIPAA requires that the expert document the methods applied and results obtained so the de-identification determination can be reviewed and substantiated if later questioned.

Question 19: A health insurance company discovers a server misconfiguration that exposed the PHI of 600 members, all of whom reside in the state of Texas. The company has already planned for individual notifications and notification to HHS. What additional notification responsibility does the company have?

Notify prominent media outlets serving the state of Texas. (Correct answer)
Notify the Federal Trade Commission (FTC) due to the number of individuals affected.
Publish a notice on the homepage of its website for at least 90 days.
Notify the state's governor's office and attorney general via certified mail.

Correct answer: Notify prominent media outlets serving the state of Texas.

Under the HIPAA Breach Notification Rule, if a breach of unsecured PHI affects more than 500 residents of a single state or jurisdiction, the covered entity must provide notice to prominent media outlets serving that state or jurisdiction. This notification must be provided without unreasonable delay and no later than 60 days after discovery. Website posting is an alternative for insufficient contact information, not a primary requirement in this case.

Question 20: A business associate discovers a breach of unsecured PHI that it maintains on behalf of a covered entity. What is the business associate's primary notification responsibility under the HITECH Act?

Notify the affected individuals directly within 60 days.
Report the breach to the HHS Secretary on behalf of the covered entity.
Wait for the covered entity to discover the breach independently through an audit.
Notify the covered entity without unreasonable delay and in no case later than 60 days of discovery. (Correct answer)

Correct answer: Notify the covered entity without unreasonable delay and in no case later than 60 days of discovery.

Under the HITECH Act and the HIPAA Final Omnibus Rule, a business associate must notify the covered entity of a breach of unsecured PHI. This notification allows the covered entity to fulfill its own breach notification duties to individuals, HHS, and potentially the media. The contract (Business Associate Agreement) between the two parties will often specify a shorter timeframe for this internal notification, but the outer limit aligns with the 60-day rule.

Question 21: Under the HIPAA Safe Harbor method, how many specific categories of identifiers must be removed to achieve de-identification?

18 (Correct answer)
21
15
12

Correct answer: 18

The Safe Harbor method requires removal of exactly 18 categories of identifiers, including names, geographic data smaller than a state, dates, phone numbers, Social Security numbers, and biometric identifiers.

Question 22: A patient submits a written request to restrict how their PHI is used for treatment purposes. The covered entity may:

Deny the restriction for treatment uses
Never deny a restriction request
Grant the restriction only for payment uses
Grant or deny the restriction at its discretion (except the mandatory out-of-pocket rule) (Correct answer)

Correct answer: Grant or deny the restriction at its discretion (except the mandatory out-of-pocket rule)

For most restriction requests, covered entities have discretion to agree or disagree, with the exception of the mandatory restriction when a patient pays fully out of pocket.

Question 23: What happens to a BAA if the underlying covered entity–business associate relationship ends?

The BA may retain PHI indefinitely for its own business records
The BAA automatically extends for one additional year
No action is required as long as the BA keeps PHI secure
The BA must return or destroy all PHI and confirm compliance to the covered entity (Correct answer)

Correct answer: The BA must return or destroy all PHI and confirm compliance to the covered entity

Upon termination of the relationship, the business associate must return or destroy all PHI and certify that no copies have been retained, unless retention is legally required.

Question 24: Which of the following is a critical, non-technical component of an effective privacy training and awareness program within a healthcare organization?

Establishing a sanction policy for workforce members who fail to comply with privacy policies. (Correct answer)
Conducting annual penetration testing of the organization's network.
Implementing multi-factor authentication for all systems containing ePHI.
Deploying an intrusion detection system to monitor for malicious activity.

Correct answer: Establishing a sanction policy for workforce members who fail to comply with privacy policies.

While technical safeguards are vital, an effective privacy program must also include administrative components. A sanction policy is a required administrative safeguard under HIPAA that establishes consequences for non-compliance, reinforcing the importance of training and adherence to privacy policies among the workforce.

Question 25: A covered entity is drafting a Business Associate Agreement (BAA) with a new cloud storage vendor. According to HIPAA, which of the following is a mandatory provision that the BAA must contain regarding the business associate's duties?

The business associate must implement appropriate administrative, physical, and technical safeguards. (Correct answer)
The business associate must ensure all its employees complete the covered entity's specific HIPAA training module.
The business associate must use the same brand of firewall and antivirus software as the covered entity.
The business associate must conduct a penetration test annually and provide the full report to the covered entity.

Correct answer: The business associate must implement appropriate administrative, physical, and technical safeguards.

A compliant Business Associate Agreement must state that the business associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by the contract. This explicitly includes implementing the requirements of the HIPAA Security Rule (administrative, physical, and technical safeguards) for any ePHI it handles.

Question 26: Which of the following entities is considered a business associate under HIPAA?

An individual providing incidental services with no PHI access
A cloud service provider that stores PHI for a covered entity (Correct answer)
A covered entity's own workforce members
A healthcare clearinghouse transmitting claims on behalf of itself

Correct answer: A cloud service provider that stores PHI for a covered entity

Cloud service providers that store or process PHI on behalf of covered entities are business associates and require a BAA.

Question 27: Which of the following is NOT required to be included in a Business Associate Agreement?

Obligation to return or destroy PHI upon termination
Permitted uses and disclosures of PHI by the business associate
Requirements to report breaches to the covered entity
The business associate's liability insurance coverage amount (Correct answer)

Correct answer: The business associate's liability insurance coverage amount

HIPAA mandates specific BAA provisions about permitted uses, safeguards, breach reporting, and PHI disposition, but does not require disclosure of the BA's insurance coverage.

Question 28: If an internal investigation uncovers a significant compliance violation, which of the following steps should occur?

Close the investigation and ensure no documentation is kept for confidentiality
Implement corrective actions to address the violation (Correct answer)
Report the violation to the appropriate regulatory authority, if required (Correct answer)
Conduct staff retraining to prevent future occurrences (Correct answer)

Correct answer: Implement corrective actions to address the violation

When a significant compliance violation is uncovered, the most critical immediate step is to implement corrective actions. These actions directly address the identified violation, aiming to stop the non-compliant behavior, remediate any harm, and prevent its recurrence. This demonstrates the organization's commitment to resolving issues and maintaining compliance, forming the foundation for further steps like reporting or retraining.

Question 29: Which of the following is a primary objective of conducting a periodic privacy risk assessment within a healthcare organization?

To identify potential vulnerabilities and threats to the privacy of PHI. (Correct answer)
To eliminate all potential threats to protected health information (PHI).
To assign blame for past privacy incidents and breaches.
To satisfy the requirements for marketing and fundraising activities.

Correct answer: To identify potential vulnerabilities and threats to the privacy of PHI.

The main purpose of a privacy risk assessment is to proactively identify, analyze, and evaluate potential risks and vulnerabilities to the confidentiality, integrity, and availability of PHI. This process allows an organization to prioritize risks and implement reasonable and appropriate controls to mitigate them. It is not possible to eliminate all risks, and the focus is on identification and mitigation, not assigning blame for past events.

Question 30: Which of the following is a key element of an effective healthcare compliance program?

Using encrypted emails for internal communication
Implementing cybersecurity software
Ensuring all staff sign confidentiality agreements annually
Designating a Compliance Officer and Compliance Committee (Correct answer)

Correct answer: Designating a Compliance Officer and Compliance Committee

A key element of an effective healthcare compliance program, as outlined by the OIG, is the designation of a Compliance Officer and a Compliance Committee. These roles are crucial for overseeing the program, ensuring its implementation, and providing leadership and guidance on compliance matters within the organization. They establish accountability and structure for the program's success.

Question 31: A hospital's janitorial staff discards unshredded patient documents containing names, diagnoses, and account numbers into a publicly accessible dumpster. This event constitutes a breach. Which specific safeguard failure is MOST directly responsible for this type of incident?

Failure of the organization's disaster recovery plan.
Failure to implement proper policies for the final disposition of PHI. (Correct answer)
Failure to obtain patient authorization for research purposes.
Failure of technical access controls on the electronic health record system.

Correct answer: Failure to implement proper policies for the final disposition of PHI.

Both the HIPAA Privacy and Security Rules require covered entities to implement reasonable safeguards for PHI in any form. This includes having and implementing policies and procedures for the final disposition of PHI, such as shredding or otherwise destroying documents to render them unreadable and unreconstructible before they are discarded.

Certified in Healthcare Privacy Compliance (CHPC)

The CHPC certification validates expertise in healthcare privacy regulations, policies, and compliance programs, covering HIPAA Privacy Rule, HITECH Act, breach notification, vendor management, training programs, and privacy investigations. It is administered by the Compliance Certification Board (CCB) through HCCA.

120

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds