CHPC Exam at a Glance

Facts verified Oct 20, 2026 against Compliance Certification Board (CCB), the credentialing body of HCCA (Health Care Compliance Association) and SCCE. Dates that have passed are removed automatically.

Free CHPC - Certified in Healthcare Privacy Compliance Study Tools

Interactive CHPC - Certified in Healthcare Privacy Compliance resources on PracticeTestGeeks, free to start:

• CHPC De-identification of Protected Health Information 1 — 7 questions with answer explanations
• CHPC - Certified in Healthcare Privacy Compliance flashcards — review key terms and concepts card by card
• CHPC - Certified in Healthcare Privacy Compliance study guide — topic-by-topic overview of what the exam covers
• CHPC - Certified in Healthcare Privacy Compliance cheat sheet — one-page printable summary for last-minute review

What the CHPC is and how it works

According to Compliance Certification Board (CCB), the credentialing body of HCCA (Health Care Compliance Association) and SCCE, “Your score is based on 100 of the 120 questions on the exam. The remaining 20 questions are unscored pretest items used to gather data and ensure future questions are fair and valid.”^[1]

The CHPC exam checks that you can apply healthcare privacy rules in day-to-day compliance work. The Compliance Certification Board (CCB), the credentialing body of HCCA and SCCE, runs it.

Delivery. When you apply, you choose a format: a computer-based test at a PSI test center, an online remotely proctored exam, or a paper and pencil exam after an SCCE or HCCA event.

Format and scoring. The exam has 120 questions and you get 2 hours. Your score comes from 100 of them. The other 20 are unscored pretest items. The result is pass or fail. The cut score is set with the Angoff method, so there is no fixed published percentage to aim for.

Fees. In 2026 the initial fee is $350 for members and $450 for non-members. From Jan 1, 2027 it rises to $375 and $475. A re-exam costs $75 if you take it within your eligibility period.

Retakes and results. You can apply to retake right away. If you fail 2 attempts within 180 days, you must wait 180 days from your latest exam date. Remote and US test center results come within 24 hours. Paper results take 6-8 weeks.

Validity. The certification lasts 2 years. Eligibility and renewal details are in the CCB CHPC candidate handbook. Check it and the HCCA site before you apply, because fees and policies can change.

Worked examples: how to reason through CHPC questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: Which of the following is a permitted use of PHI by a business associate WITHOUT requiring additional patient authorization?

1. Using PHI for the specific services described in the BAA with the covered entity
2. Selling PHI to a marketing firm for research purposes
3. Using PHI to create a new commercial database product
4. Disclosing PHI to another covered entity for their treatment purposes

Answer: A. Using PHI for the specific services described in the BAA with the covered entity

Explanation:

A is correct. A business associate gets PHI only to do work for a covered entity. It may use or disclose that PHI only as its business associate agreement (BAA) allows, or as the law requires. Doing the services described in the BAA is exactly what the agreement permits.

B is wrong. Selling PHI to a marketing firm is a sale of PHI. That needs patient authorization, and a BAA cannot grant it. C is wrong. Building a commercial product from PHI is a use for the business associate's own benefit, not a service for the covered entity. D is wrong. Covered entities may share PHI with each other for treatment, but a business associate cannot make that disclosure unless its BAA allows it.

Rule to remember: the BAA sets the outer limit of what a business associate may do with PHI.

Example 2

Question: A Privacy Officer is developing a policy based on the 'Minimum Necessary' standard. Which of the following scenarios best demonstrates the correct application of this HIPAA principle?

1. Allowing the entire nursing staff to have full access to all patient electronic health records to ensure efficient care.
2. Providing a health insurance company with a patient's complete medical history to process a claim for a single office visit.
3. Releasing a patient's name and general condition to a reporter without the patient's authorization.
4. Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims.

Answer: D. Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims.

Explanation:

D is correct. Under the minimum necessary standard, a covered entity must take reasonable steps to limit uses, disclosures and requests of PHI to what the task needs. A billing clerk who sees only demographic and insurance data is role-based access built around that standard.

A is wrong. Treatment disclosures between providers are exempt from the standard, but internal access still has to be set by role. Giving every nurse full access to every record goes too far. B is wrong. A claim for a single office visit does not need the patient's whole medical history. C is wrong. Giving a reporter a patient's name and condition without authorization is not a permitted disclosure. Minimum necessary does not apply because the disclosure should not happen at all.

Rule to remember: first ask whether the use or disclosure is permitted. Then ask how little PHI will do the job.

Example 3

Question: A privacy officer wants to catch workforce members viewing records without a work-related reason. Which monitoring activity is MOST effective?

1. Asking staff to confirm once a year that they have never snooped
2. Reviewing the Notice of Privacy Practices every year
3. Proactive EHR access-log reviews, such as same-last-name, VIP and coworker record checks
4. Raising the minimum password length

Answer: C. Proactive EHR access-log reviews, such as same-last-name, VIP and coworker record checks

Explanation:

C is correct. To catch snooping you have to look at what people actually did. Proactive reviews of EHR access logs can flag patterns such as a user opening records of patients with the same last name, coworkers or VIPs. These patterns often point to access with no work-related reason, and you can investigate them.

A is wrong. A yearly self-attestation relies on honesty and finds nothing that has already happened. B is wrong. The Notice of Privacy Practices tells patients how their information is used. Reviewing it does not monitor workforce behavior. D is wrong. Stronger passwords keep out unauthorized users. They do nothing about authorized users opening records they have no reason to see.

Rule to remember: preventive controls such as passwords and training stop some problems. Detective controls such as access audits find the ones that get through.

How to use these practice tests

Start with the official material. Read the CCB CHPC candidate handbook and the HCCA exam information page so you know the rules, delivery options and what exam day involves.

Take a baseline. Do a broad set first, such as HIPAA and Healthcare Privacy Standards or Healthcare Privacy Regulations. Note which topics cost you the most points.

Work topic by topic. Spend most of your time on your weak areas. Common ones are business associate agreements, de-identification, investigations and breach notification and patient rights and access. Read every explanation, including for questions you got right, and write down the rule behind each one.

Cover program work. Many questions are about running a privacy program, not just reciting a rule. Use Privacy Program Management, Privacy Risk Management and Training and Awareness Programs.

Practise the pace. The real exam is 120 questions in 2 hours. Before test day, do a long mixed session under that time limit. Then go back to the regulation text for any topic you still guess on.